Rspamd monitoring with OpenBSD relayd
Published: 2021-07-18 02:40:15

## Summary

I installed Rspamd on [OpenBSD](https://www.openbsd.org/) and configure it with [OpenSMTPD](https://www.opensmtpd.org/) the other day.

{% post nabbisen/rspamd-installation-and-opensmtpd-configuration-on-it-on-openbsd-1p6i %}

Well, [Rspamd](https://rspamd.com/) includes [web interface](https://rspamd.com/webui/) to monitor its performance.
I combined it with [relayd](https://man.openbsd.org/relayd.8).

This post shows how I built the environment.
It is possible to monitor Rspamd via a web browser only when relayd is running on the server.
The servers relation is:

``` 
* smtpd *
| .. Is MTA (Mail transfer agent)
|
* rspamd *
| .. Is filtering system
| .. Includes Web ui
|    .. Listens on 127.0.0.1 only (port 11334)
|    .. Confirms `password` when accessed not from `secure_ip`s
|
* relayd *
  .. Listens on 0.0.0.0, any outbound TCP traffic (port 11334 or any)
  .. Uses TLS connection with self-signed certificate
```

## Tutorial

First, [set up the web ui](https://rspamd.com/doc/quickstart.html#setting-up-the-webui) of Rspamd.

```console
$ cd /etc/rspamd

$ # create a backup if necessary
$ doas cp -p worker-controller.inc worker-controller.inc.bak

$ doas nvim worker-controller.inc
```

It is officially strongly recommended to change the `password`. Besides, connection from `secure_ip` is not required password authorization by web ui.

```diff
- password = "**";
+ password = "<your-password>";
  secure_ip = "127.0.0.1"; 
  secure_ip = "::1";
```

The web ui protects your configuration and email information with the `password`:

![password protection](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d5a6546dctqebxuewpe9.png)

The reason why "Not secure" in address bar is shown is that self-signed certificate is used by relayd as shown below.
This is how to create a self-signed certificate with ` openssl` utility provided by [LibreSSL](https://www.libressl.org/):

```console
$ cd /etc/ssl

$ set -x MYDOMAIN "rspamd-relayd"
$ doas openssl req -newkey rsa:2048 -new -nodes -x509 -days 36500 -keyout private/$MYDOMAIN.key -out $MYDOMAIN.crt \
    -subj "/C=<your.company>/ST=<your.state>/L=/O=<your.org>/OU=/CN=$MYDOMAIN"
$ doas chmod 400 private/$MYDOMAIN.key
```

Here we have:

```console
$ ls -l /etc/ssl/rspamd-relayd.crt
-rw-r--r--  1 root  wheel  1135 Jul 14 21:09 /etc/ssl/rspamd-relayd.crt
$ doas ls -l /etc/ssl/private/rspamd-relayd.key
-r--------  1 root  wheel  1704 Jul 14 21:09 /etc/ssl/private/rspamd-relayd.key
```

Next, configure OpenBSD relayd.

```console
$ doas nvim /etc/relayd.conf
```

Add the lines below to [relayd.conf](https://man.openbsd.org/relayd.conf.5):

```config
protocol rspamd {
        tls keypair "rspamd-relayd"
}

relay rspamd {
        # Run as a SSL/TLS accelerator
        listen on 0.0.0.0 port 11334 tls
        protocol rspamd

        # Forward to hosts in the webhosts table using a src/dst hash
        forward to 127.0.0.1 port 11334
}
```

relayd listens on 0.0.0.0:11334 with using TLS connection based on the self-signed certificate. When relayd accepts the requests, they will be forwarded to Rspamd web ui.

Configuration is done now.
Let's start relayd, which is disabled by default and therefore `-f` (force) option is required:

```console
$ doas rcctl -f start relayd
relayd(OK)
```

Of course, alternatively, you can do `rcctl enable relayd` (and `rcctl start relayd`).

## Conclusion

Now the Rspamd web ui is public in the web world. Access to https://\<fqdn\>:11334.

![rspamd web ui status](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zndcpx9wtngh8rj66bmx.png)

![rspamd web ui history](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d1gj217k78bbrzy5zv6l.png)

Really useful information :)

Finally, stop the relayd:

```console
$ doas rcctl stop relayd
relayd(OK)
```