an effective anti-spam with milter - milter manager

% sudo add-apt-repository "deb http://archive.ubuntu.com/ubuntu $(lsb_release -cs)-backports main universe"

PPA (Personal Package Archive)

The milter manager APT repository for Ubuntu uses PPA (Personal Package Archive) on Launchpad . You can install milter manager by APT from the PPA.

Here are supported Ubuntu versions:

Add the ppa:milter-manager/ppa PPA to your system:

% sudo apt -y install software-properties-common
% sudo add-apt-repository -y ppa:milter-manager/ppa
% sudo apt update

Install

Install milter manager:

% sudo apt -y install milter-manager

We use Postfix as MTA:

% sudo apt -V -y install postfix

We use spamass-milter, clamav-milter and milter-greylist as milters:

% sudo apt -V -y install spamass-milter clamav-milter milter-greylist

Configure spamass-milter

At first, we configure spamd.

We add the following configuration to /etc/spamassassin/local.cf. This configuration is for adding headers only if spam detected.

report_safe 0

remove_header ham Status
remove_header ham Level

We change /etc/default/spamassassin like the following to enable spamd:

Before:

ENABLED=0

After:

ENABLED=1

spamd should be started:

% sudo /etc/init.d/spamassassin start

There are no changes for spamass-milter's configuration.

Configure clamav-milter

We don't need to change the default clamav-milter's configuration.

Configure milter-greylist

We change /etc/milter-greylist/greylist.conf for the following configurations:

Before:

racl whitelist default

After:

subnetmatch /24
greylist 10m
autowhite 1w
racl greylist default

We change /etc/default/milter-greylist to enable milter-greylist. milter-greylist uses IPv4 socket because milter-gresylist's run script doesn't support changing socket's group permission:

Before:

ENABLED=0

After:

ENABLED=1
SOCKET="inet:11125@[127.0.0.1]"

milter-greylist should be started:

% sudo /etc/init.d/milter-greylist start

Configure milter-manager

milter-manager detects milters that installed in system. We can confirm spamass-milter, clamav-milter and milter-greylist are detected:

% sudo /usr/sbin/milter-manager -u milter-manager --show-config

The following output shows milters are detected:

...
define_milter("milter-greylist") do |milter|
  milter.connection_spec = "inet:11125@[127.0.0.1]"
  ...
  milter.enabled = true
  ...
end
..
define_milter("clamav-milter") do |milter|
  milter.connection_spec = "unix:/var/run/clamav/clamav-milter.ctl"
  ...
  milter.enabled = true
  ...
end
..
define_milter("spamass-milter") do |milter|
  milter.connection_spec = "unix:/var/spool/postfix/spamass/spamass.sock"
  ...
  milter.enabled = true
  ...
end
..

We should confirm that milter's name, socket path and 'enabled = true'. If the values are unexpected, we need to change /etc/milter-manager/milter-manager.conf. See Configuration for details of milter-manager.conf.

But if we can, we want to use milter manager without editing miter-manager.conf. If you report your environment to the milter manager project, the milter manager project may improve detect method.

We change /etc/default/milter-manager to work with Postfix:

Before:

# For postfix, you might want these settings:
# SOCKET_GROUP=postfix
# CONNECTION_SPEC=unix:/var/spool/postfix/milter-manager/milter-manager.sock

After:

# For postfix, you might want these settings:
SOCKET_GROUP=postfix
CONNECTION_SPEC=unix:/var/spool/postfix/milter-manager/milter-manager.sock

We create a directory for milter-manager's socket:

% sudo mkdir -p /var/spool/postfix/milter-manager/

We add milter-manager user to postfix group:

% sudo adduser milter-manager postfix

milter-manager's configuration is completed. We start milter-manager:

% sudo /etc/init.d/milter-manager restart

/usr/bin/milter-test-server is usuful to confirm milter-manager was ran:

% sudo -u postfix milter-test-server -s unix:/var/spool/postfix/milter-manager/milter-manager.sock

Here is a sample success output:

status: accept
elapsed-time: 0.128 seconds

If milter-manager fails to run, the following message will be shown:

Failed to connect to unix:/var/spool/postfix/milter-manager/milter-manager.sock: No such file or directory

In this case, we can use log to solve the problem. milter-manager is verbosily if --verbose option is specified. milter-manager outputs logs to standard output if milter-manager isn't daemon process.

We can add the following configuration to /etc/default/milter-manager to output verbose log to standard output:

OPTION_ARGS="--verbose --no-daemon"

We start milter-manager again:

% sudo /etc/init.d/milter-manager restart

Some logs are output if there is a problem. Running milter-manager can be exitted by Ctrl+c.

OPTION_ARGS configuration in /etc/default/milter-manager should be commented out after the problem is solved to run milter-manager as daemon process. And we should restart milter-manager.

Configure Postfix

We add the following milter configuration to /etc/postfix/main.cf.

milter_default_action = accept
milter_protocol = 6
milter_mail_macros = {auth_author} {auth_type} {auth_authen}

Here are descriptions of the configuration.

We need to register milter-manager to Postfix. It's important that spamass-milter, clamav-milter, milter-greylist aren't needed to be registered because they are used via milter-manager.

We need to add the following configuration to /etc/postfix/main.cf. Note that Postfix chrooted to /var/spool/postfix/.

smtpd_milters = unix:/milter-manager/milter-manager.sock

We reload Postfix configuration:

% sudo /etc/init.d/postfix reload

Postfix's milter configuration is completed.

milter-manager logs to syslog. If milter-manager works well, some logs can be showen in /var/log/mail.info. We need to sent a test mail for confirming.