How to build antispam SMTP gateway for Exchange on Ubuntu 8.04

32 Responses to How to build antispam SMTP gateway for Exchange on Ubuntu 8.04

1. Amar Kulo says:

   2009/12/03 at 20:53

   Tnx

   Reply
2. Rob says:

   2010/08/05 at 16:34

   First off great How To! I was able to build this on Ubuntu 10.04. I havn’t put it into production but the machine is ready to go. I just have one question. How do you view/release emails that are quarantined as spam but are legit?

   Reply
   • Amar Kulo says:

     2010/08/05 at 23:29

     Tnx for comment. The easiest way to do this is to view it manually with vi or some other editor and see if it is legit mail. Then you can execute command sa-learn –ham /path_to_message_file. With this command you can learn spam assassin to treat messages like that as ham, or if you have got some messages as legit and they are spam save whole message with headers and content in a file and call sa-learn –spam message_file.

     Reply
3. realpeace says:

   2010/09/13 at 19:00

   Its good on last version of Ubuntu. tanck you, Very Good How To!

   Reply
   • Amar Kulo says:

     2010/09/13 at 19:38

     You are welcome

     Reply
4. NELSON says:

   2011/01/28 at 20:26

   este tutorial funciona en ubuntu 10.10?
   la version nornal no la server

   Reply
   • amar says:

     2011/01/28 at 20:28

     I think config is the same, maybe packets are updated with newer versions.

     Reply
5. Nelson says:

   2011/03/25 at 18:46

   I have a Server Winserver R2 with Exchange 2010, but i can´t configure spamassassin. im thinking is a configuration of the main.cf
   you can help me with a example.
   And sorry my english

   Reply
   • amar says:

     2011/03/25 at 19:11

     What errors or problems do you have?

     Reply
6. Nelson says:

   2011/03/25 at 18:48

   y have a UBUNTU server 10.10

   Reply
7. Chris Houghton says:

   2011/06/05 at 21:45

   I’m not very proficient in Linux so I installed Ubuntu 11.04 and followed your instructions. I got Postfix and Mail Scanner from the UBuntu software centre and these included SpamAssassin and ClamAV. I found that some of the files in your instructions were missing (no /etc/postfix/transport file, no /opt/MailScanner/bin/check_mailscanner or /etc/postfix/header_checks files.)

   I never did the bit to download the latest mailscanner as I thought my download through the software centre would be the latest.

   Any help would be appreciated. My aim is to run this server as a SMTP gateway in the DMZ that scans all messages before passing the mails on to my Exchange 2010 server.

   Reply
   • amar says:

     2011/06/05 at 21:51

     You don’t have them because they doesn’t exist by default, you need to create them first.

     So create both of them and then when you enter content in them create hashes for use with postfix, restart postfix and that’s it.

     Open /etc/postfix/transport and add your forwarding domains in it. For multiple domains add new row by same principle.

     sp.local smtp:[192.168.1.5]
     domain2.com smtp:[192.168.1.5]

     This ip 192.168.1.5 is IP of my Exchange server, not of my Linux machine and sp.local is the name of my domain, replace IP and domain name with yours. After this editing we need to create hash of the transport file and to restart Postfix.

     postmap /etc/postfix/transport
     /etc/init.d/postfix restart

     Reply
     • Rob Mazoros says:

       2011/06/30 at 23:40

       Hey, thanks for the great tutorial.
       Just trying to wrap up here but I am stuck on the
       /opt/MailScanner/bin/check_mailscanner
       command. I do not have a /opt/Mailscanner directory. There is nothing in the /opt folder.
       I am on Ubuntu 9 and I first followed the instructions to set up Mailscanner before I tried your tutorial.
       here were the instructions.
       I think everything is good up to this point but I seem to be missing some files.

       Any Ideas? I may try to unpack the tar install file and see if I can get them. I used the most recent stable .deb package.

       Thanks!
       Rob

       Reply
       • amar says:

         2011/07/01 at 07:03

         Tnx for the comment Rob.

         Paths are changed a bit because in tutorial I have installed it via tar and you have installed it as a package.

         You can try to find the file with the command find * / |grep mailscanner to see where it’s been installed.

         Regards.
         Amar

         Reply
8. Arek says:

   2011/10/31 at 17:27

   Hi guys,
   I have some issues i guess on Exchange side, i have ubuntu box with Mailscanner + spamassassin + clam + postfix and it works as a Gateway for exchange, but unfortunately when it relay email exchange 2010 bounce relayed email, and i cant figure out why is so.
   if you could help me solve this issue i would appreciate.

   to=, relay=192.168.105.31[192.168.105.31]:25, delay=11, delays=5.9/0/0/5, dsn=5.7.1, status=bounced (host 192.168.105.31[192.168.105.31] said: 530 5.7.1 Client was not authenticated (in reply to MAIL FROM command)
   why is so ?

   Reply
   • amar says:

     2011/11/01 at 07:33

     Hi Arek,

     You have enabled client authentication for relaying somewhere. You need to add internal ip addresses to config as permitted ones which are not requiring client authentication.

     Reply
9. Adam says:

   2011/12/05 at 23:04

   Thanks Amar for this How-To,
   Is there any configuration we need to do on the Exchange Server ?

   I am asking this question because I am getting these logs:

   Dec 5 17:41:19 smtp1 postfix/smtpd[4234]: connect from test-host[192.168.1.10]
   Dec 5 17:41:19 smtp1 postfix/smtpd[4234]: 8316424600C7: client=test-host[192.168.1.10]
   Dec 5 17:41:19 smtp1 postfix/cleanup[4238]: 8316424600C7: hold: header Received: from monitor-test.office.com (test-host [192.168.1.10])??by smtp1.office.com (Postfix) with ESMTPS id 8316424600C7??for ; Mon, 5 Dec from test-host[192.168.1.10]; from= to= proto=ESMTP helo=
   Dec 5 17:41:19 smtp1 postfix/cleanup[4238]: 8316424600C7: message-id=
   Dec 5 17:41:19 smtp1 postfix/smtpd[4234]: disconnect from test-host[192.168.1.10]
   Dec 5 17:41:39 smtp1 postfix/qmgr[3725]: 34D0B24600A2: from=, size=908, nrcpt=1 (queue active)
   Dec 5 17:41:39 smtp1 postfix/qmgr[3725]: warning: connect to transport private/smtp [192.168.2.20]: No such file or directory
   Dec 5 17:41:39 smtp1 postfix/qmgr[3725]: 4BBBB24600A8: from=, size=908, nrcpt=1 (queue active)
   Dec 5 17:41:39 smtp1 postfix/error[4240]: 34D0B24600A2: to=, relay=none, delay=8826, delays=8826/0/0/0, dsn=4.3.0, status=deferred (mail transport unavailable)
   Dec 5 17:41:39 smtp1 postfix/error[4241]: 4BBBB24600A8: to=, relay=none, delay=8798, delays=8798/0.01/0/0, dsn=4.3.0, status=deferred (mail transport unavailable)
   Dec 5 17:42:01 smtp1 update.virus.scanners: Found clamav installed
   Dec 5 17:42:01 smtp1 update.virus.scanners: Running autoupdate for clamav
   Dec 5 17:42:01 smtp1 ClamAV-autoupdate[4305]: ClamAV updater /usr/local/bin/freshclam cannot be run
   Dec 5 17:42:01 smtp1 update.virus.scanners: Found generic installed
   Dec 5 17:42:01 smtp1 update.virus.scanners: Running autoupdate for generic

   Client sending email is 192.168.1.10 (root@monitor-test.office.com) and destination email address is test-user@office.com and exchange server is 192.168.2.20

   Thanks for your help.

   Reply
   • amar says:

     2011/12/06 at 06:37

     Hello Adam,

     Actually there isn’t any configuration for exchange, because linux is acting as a gateway so it intercepts mail and deliver it to next hop, which is exchange.

     Check which ip addresses you have for test domain, and it’s mx records, it could be a dns problem, because as I can see it from your logs postfix is not sending it further, it’s stopping them because it’s not able to reach domain.

     Reply
10. Adam says:

    2011/12/07 at 22:23

    Amar, just to understand, we are trying to configure a MTA (SMTP relay) for Exchange.
    For my part: MX record is set up on the DNS, relayhost is empty (relayhost = )
    my main.cf look like this:
    myhostname = smtp1.office.com
    mydomain = office.com
    myorgin = $mydomain
    inet_interfaces = all
    mydestination = $myhostname, localhost.$mydomain $mydomain
    mynetwork_style = host
    relay_domains = office.com
    transport_maps = hash:/etc/postfix/transport
    append_at_myorigin = no
    local_recipient_maps =
    header_checks = regexp:/etc/postfix/header_checks
    alias_maps = hash:/etc/aliases
    alias_database = hash:/etc/aliases
    relayhost =
    mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
    mailbox_size_limit = 0
    recipient_delimiter = +

    Kindly, could you review it please.
    Thanks.

    Reply
    • amar says:

      2011/12/12 at 14:57

      Hello Adam,

      This configuration seems ok, but I would say that you have problem with transport file or master.cf so check them if they are correct.

      Master.cf can be pain in the ass, spaces and dashes matters there.

      Reply
11. Adam says:

    2011/12/12 at 16:43

    I got working, there was two things:
    1- The first problem was on master.cf I had to uncomment one line.
    2- I copy/paste your main.cf and there was a mistype in: myorigin = $mydomain
    (it was: myorgin = $mydomain).

    Thanks a lot man.

    I want to use it on production, so can we harden it for more spams filtering ?
    I tried to send using aaaa@aaaa.com and it works, and don’t want it to work for this kind of emails.
    Can you help on this please.

    Thanks again.

    Reply
    • amar says:

      2011/12/12 at 16:53

      You can set list of domains that are accepted for relaying and it will allow sending only for them.

      http://www.postfix.org/SMTPD_ACCESS_README.html

      Tnx for highlighting type error, I will fix it in the post.

      Reply
12. Juan says:

    2011/12/14 at 19:29

    Hi,

    All very good first scenario is the tutorial.mi the firewall nat all that comes to port 25 to an X port you configure in the postfix (Intal from your tutorial), he analyzes the mail and forwards it to me to exchange 2010 up here ok.Mi question is this: first I get mail sent by the cron (attached) and the other is how to update and how do I verify the basis of MailScanner, ClamAV and SpamAssassin?

    Attached:
    from:From: Cron Daemon
    To:
    Subject: Cron /opt/MailScanner/bin/check_mailscanner
    Message:MailScanner running with pid 1261 1262 1431 1432 1433 1434
    Message:Failed to retrieve valid current details Reading status from /var/spool/MailScanner/quarantine/phishingupdate/status
    Checking that /var/spool/MailScanner/quarantine/phishingupdate/cache/2011-493 exists… ok Checking that /var/spool/MailScanner/quarantine/phishingupdate/cache/2011-493.32 exists… ok

    Reply
    • amar says:

      2011/12/14 at 20:40

      Yes you are correct, you nat or forward port 25 to postfix which filters it and then forward further.

      Now regarding cron you have set it to update itself from cron, so you can edit crontab and add >/dev/null 2>&1 at the end of the mailscanner line so it won’t send you e-mail and it will update itself.

      Answer to the second question is pretty simple, try to send yourself copy of some spam mail, or mail that contains .exe file, spamassasing should put it to quarantine and you would receive mail that attachment has been removed.

      Also when you check mail headers you should see spamasassin score in the header.

      Reply
13. Juan says:

    2011/12/15 at 13:59

    thank amar,

    I commented that add the line “> / dev / null 2​​> & 1″ at the end of the crontab file and mail Mailscanner.conf and I keep coming, but in the case of modification of MailScanner gives me an error when I restart the service :

    root@PMCSpam:~# root@xxx:~# service mailscanner restart
    * Restarting mail spam/virus scanner MailScanner
    Syntax error(s) in configuration file: at /opt/MailScanner/lib/MailScanner/Config.pm line 2213
    Unrecognised keyword “optmailscannerbin” at line 3132 at /opt/MailScanner/lib/MailScanner/Config.pm line 2216
    Warning: syntax errors in /opt/MailScanner/etc/MailScanner.conf. at /opt/MailScanner/lib/MailScanner/Config.pm line 2221

    So I had to undo the last change to service MailScanner start.
    Finally the last question I want to add the following, where seconfigura mail notifications to the administrator’s mail in quarantine or are bounced by spam or where you can view these log (would need the commands) Thanks again and sorry for my bad English

    Reply
14. Juan says:

    2011/12/15 at 15:40

    thank amar,

    I commented that add the line “> / dev / null 2​​> & 1″ at the end of the crontab file and mail Mailscanner.conf and I keep coming, but in the case of modification of MailScanner gives me an error when I restart the service :

    root@xxxx:~# root@xxx:~# service mailscanner restart
    * Restarting mail spam/virus scanner MailScanner
    Syntax error(s) in configuration file: at /opt/MailScanner/lib/MailScanner/Config.pm line 2213
    Unrecognised keyword “optmailscannerbin” at line 3132 at /opt/MailScanner/lib/MailScanner/Config.pm line 2216
    Warning: syntax errors in /opt/MailScanner/etc/MailScanner.conf. at /opt/MailScanner/lib/MailScanner/Config.pm line 2221

    So I had to undo the last change to service MailScanner start.
    Finally the last question I want to add the following, where seconfigura mail notifications to the administrator’s mail in quarantine or are bounced by spam or where you can view these log (would need the commands) Thanks again and sorry for my bad English

    Reply
    • amar says:

      2011/12/15 at 15:49

      Hmm I don’t understand why crontab part is not working, you maybe did something wrong because you should add it to crontab line with crontab -e command, not to any config file so it shouldn’t interfere with those files and create errors that you get. Check those 2 lines 2216 and 2221 for errors.

      Logs should be available in /opt/Mailscanner and eventual bounce messages should return to senders.

      Reply
15. Juan says:

    2011/12/15 at 17:18

    The line> / dev / null 2​​> & 1 copy it and paste it in the crontab file, it may be that here is the error, now remove that line and ran this command: root @ xxxx: ~ # crontab-e> / dev / null 2​​> & 1, did not return to # the peer’m thinking (I ran the command correctly?). This command resolves that does not reach either of the 2 mail?. I am attaching the lines / opt / MailScanner / lib / MailScanner / Config.pm .El file is by default I did not do any modification

    line 2213–MailScanner::Log::WarnLog(“Syntax error(s) in configuration file:”);
    #print STDERR “Syntax error(s) in configuration file:\n”;
    foreach $leftover (sort @leftovers) {
    MailScanner::Log::WarnLog(“Unrecognised keyword \”%s\” at line %d”,
    ItoE($leftover), $LineNos{$leftover});
    #print STDERR “Unrecognised keyword \”" . ItoE($leftover) .
    # “\” at line ” . $LineNos{$leftover} . “\n”;
    }
    MailScanner::Log::WarnLog(“Warning: syntax errors in %s.”,
    line 2222 $filename);
    line 3132 #print STDERR “Config: $keyword has a ruleset $isrules\n”;
    if (!$RulesAllowed) {
    MailScanner::Log::WarnLog(“Value of %s cannot be a ruleset, only a ” .
    “simple value”, $keyword);
    line 3136 }

    Thanks for your time and sorry for my lack of knowledge of the subject and errors to the problem as well talk to you about my bad ingles.

    Reply
16. Juan says:

    2011/12/27 at 13:52

    Hi amar,

    I was able to solve the above problems, but now I have the following:
    1) I want to send copies of the emails in quarantine and also a notice of rejection (at least who is the sender and the receiver?) To an admin account or log to check.
    2) I want to limit the size of attachments, but can not find in mailscanner.conf or rules for editing. Thanks

    Regards

    Reply
    • amar says:

      2011/12/27 at 14:00

      Hi Juan,

      1. I think this is default behavior with notifying sender, but sending the whole content to admin I don’t know how to do it, try with activating notifications and chech this link http://www.mailscanner.info/man/MailScanner.conf.5.html#Notifications%20back%20to%20the%20senders%20of%20blocked%20messages

      2. If you check http://www.mailscanner.info/man/MailScanner.conf.5.html you will find that you have 2 possible settings, Maximum Message Size and Maximum Attachment Size where you can specify size in bytes to limit message

      Reply
17. Juan says:

    2011/12/28 at 14:11

    Hi Amar,
    thanks for the help earlier, and fix those 2 problems.Ahora me I have the following are all queued mail (some are reliable and some not). I attached the result of tail-f /var/log/syslog

    Dec 28 11:00:29 XXX postfix/pickup[21244]: 8DF748D8B6: uid=103 from= orig_id=076D48D885
    Dec 28 11:00:29 XXX postfix/cleanup[21305]: 8DF748D8B6: message-id=
    Dec 28 11:00:29 XXX postfix/qmgr[21245]: 8DF748D8B6: from=, size=1576, nrcpt=1 (queue active)

    I have created in the directory /etc/postfix file “header_checks” with the single line: /^Received: / HOLD
    if the comment before I left with # the mail in the queue, the problem you grow doubtful or spam mail.Thanks again

    Reply
18. Juan says:

    2011/12/28 at 15:05

    amar,

    I am attaching the tail-f capture. Because the /^Received:/ HOLD sends them to the queue, but as the spamassassins and MailScanner takes to scan and there are accumulating mail in the queue of postfix and not forwarded to the exchange.

    Dec 28 12:00:38 xxx MailScanner[22438]: Enabling SpamAssassin auto-whitelist functionality…
    Dec 28 12:00:39 xxx MailScanner[22438]: Connected to Processing Attempts Database
    Dec 28 12:00:39 xxx MailScanner[22438]: Found 108 messages in the Processing Attempts Database
    Dec 28 12:00:39 xxx MailScanner[22438]: Using locktype = flock
    Dec 28 12:00:39 xxx MailScanner[22438]: Warning: skipping message 83DBA8D460.AF3C0 as it has been attempted too many times
    Dec 28 12:00:39 xxx MailScanner[22438]: Quarantined message 83DBA8D460.AF3C0 as it caused MailScanner to crash several times
    Dec 28 12:00:43 xxx MailScanner[22439]: MailScanner E-Mail Virus Scanner version 4.84.3 starting…
    Dec 28 12:00:43 xxx MailScanner[22439]: Reading configuration file /opt/MailScanner/etc/MailScanner.conf
    Dec 28 12:00:43 xxx MailScanner[22439]: Reading configuration file /opt/MailScanner/etc/conf.d/README
    Dec 28 12:00:43 xxx MailScanner[22439]: Read 869 hostnames from the phishing whitelist
    Dec 28 12:00:43 xxx MailScanner[22439]: Read 3544 hostnames from the phishing blacklists

    “83DBA8D460 mail is safe”

    Reply