Much more Spam after Update from 7.7 to 7.9

Support
, , ,
1

NethServer Version: 7.9.2009

Hello,
we have major problems with spam since the update from 7.7 to 7.9. It seems that the rspamd is not working, but the logs say otherwise. We get up to 120 junk-mails per Day.

In the last few days I have tested whether the rspamd works at all. That’s how I have it
Spam threshold set to 1 - without success, no change of the situation,
the graylist set to 1 - without success, no change of the situation.

If I go to rspamd and scan the source code of one of this mails, I get a spam level of 27 (= reject), but the mail is still delivered. The mail seems to be recognized as spam, but is still delivered.
See LOG: from: heinrichshzrtdzvolker@alexussro.com, (default: T (reject): [27.16 / 20.00]
Can someone help? Thank you.

2

Hi @TK_KSH,

Can you tell a little bit about your setup ?

As an example:
Has the nethserver a red interface and is the mail received on that interface?

3

Hi,

I pick up the mails via getmail (pop3-connector). The neth-box is not a direct MX. My settings:

Mark as spam ist set to : 4.5
Reject is set to : 20
Greylist is set to: 4

I’ve searched rspamd’s logs, but can’t find anything that helps. Do you need somthing more? Thanks for help.

4

Do not use getmail myself, however difference found between 7.7 and 7.9 seems to be on 7.9 the mail-filter for getmail is disabled by default.

Is it enabled in the getmail settings ? (AFAIK this can be done in the server-manager)

SOURCE:

5

Sorry stupid question; obviously yes otherwise it would not be scanned at all.

I thingk to have a clue:

The mail form getmail is parsed to rspamd emulating the message was received from the specified ip address 127.0.0.1. Which is a (trusted) local address and respected since my commit correcting the syntax of local_addrs.

cc/ @stephdl

6

We need the full email transaction of a supposed spam from maillog, from the hello to the end of the transaction.

7

Hello,
damn it was that simple. :grinning: Mark, you’re right.

Of course the filters were still switched on in version 7.7 and now in version 7.9 they were all switched off. It never occurred to me to look again in the basic settings.

Thanks for the quick help!!!

2 Likes
8

@TK_KSH Glad you are sorted out!

@stephdl we can discus my doubt regarding -i 127.0.0.1 later.
(feel responsible for possible side effects the commit correcting local_addrs can have)

9

It is feature that when the email is on localhost we skip some checks, not all checks

The mantra is the same, do never use getmail

1 Like