Rspamd installation and OpenSMTPD configuration on it on OpenBSD
Tags: rspamd, opensmtpd, openbsd, mailserver
Published: 2021-07-17 02:59:48

## Summary

Thanks to [poolpOrg](https://github.com/poolpOrg)'s [filter-rspamd](https://github.com/poolpOrg/filter-rspamd), [Rspamd](https://rspamd.com/) filter in [OpenSMTPD](https://www.opensmtpd.org/) is provided as [Ports](https://www.openbsd.org/faq/ports/ports.html) package whose name is 
`opensmtpd-filter-rspamd` in OpenSMTPD 6.6.0 or higher. It means it has not been necessary any longer to use [`rspamc`](https://rspamd.com/doc/quickstart.html#using-rspamc-console-routine#using-rspamc-console-routine) in [smtpd.conf](https://man.openbsd.org/smtpd.conf).

This post shows how to install Rspamd and configure it on [OpenBSD](https://www.openbsd.org/).

### Environment

- Server OS: OpenBSD [6.9](https://www.openbsd.org/69.html)
- MTA (Mail transfer agent): OpenSMTPD 6.9
- Spam filtering system: Rspamd 2.7
- Command line shell: [Fish](https://fishshell.com/) 3.2

## Tutorial

Here shows packages related to OpenSMTPD:

```console
$ doas pkg_info -Q opensmtpd
libopensmtpd-0.6
opensmtpd-extras-6.7.1v0
opensmtpd-extras-mysql-6.7.1p0v0
opensmtpd-extras-pgsql-6.7.1p0v0
opensmtpd-extras-python-6.7.1v0
opensmtpd-extras-redis-6.7.1v0
opensmtpd-filter-admdscrub-0.1
opensmtpd-filter-dkimsign-0.4
opensmtpd-filter-dnsbl-0.2
opensmtpd-filter-rspamd-0.1.7p0
opensmtpd-filter-senderscore-0.1.1p0
opensmtpd-filter-spamassassin-0.7p0
```

Several extras and also several filters :)

---

First, let's install Rspamd and also required packages, its OpenSMTPD filter and [Redis](https://redis.io/). Rspamd in OpenBSD is highly configured and ready to use Redis as database by default.

```console
$ doas pkg_add rspamd redis opensmtpd-filter-rspamd
quirks-3.633 signed on 2021-07-03T10:19:35Z
Ambiguous: choose package for rspamd
 	0: <None>
	1: rspamd-2.7p0
	2: rspamd-2.7p0-hyperscan
Your choice: 2
rspamd-2.7p0-hyperscan:luajit-2.0.5p2: ok
rspamd-2.7p0-hyperscan:gcc-libs-8.4.0p6: ok
rspamd-2.7p0-hyperscan:blas-3.8.0p0: ok
rspamd-2.7p0-hyperscan:cblas-1.0p7: ok
rspamd-2.7p0-hyperscan:hyperscan-5.4.0-ssse3: ok
useradd: Warning: home directory `/var/redis' doesn't exist, and -m was not specified
rspamd-2.7p0-hyperscan:redis-6.2.1p0: ok
rspamd-2.7p0-hyperscan: ok
opensmtpd-filter-rspamd-0.1.7p0: ok
The following new rcscripts were installed: /etc/rc.d/redis /etc/rc.d/rspamd
See rcctl(8) for details.
New and changed readme(s):
	/usr/local/share/doc/pkg-readmes/opensmtpd-filter-rspamd
	/usr/local/share/doc/pkg-readmes/rspamd
```

Besides, [hyperscan](https://github.com/intel/hyperscan) is used as an option of [local optimizations
](https://rspamd.com/performance.html#local-optimizations) on Rspamd performance, which is developed by [Intel](https://www.intel.com/).

Next, enable daemons.

```console
$ doas rcctl enable {redis, rspamd}
```

And run them.

```console
$ doas rcctl start {redis, rspamd}
redis(ok)
rspamd(ok)
```

---

If you want to add custom configuration to Rspamd, it's available with ".conf" files.
In my case, I edited actions.conf to mitigate rejection by the filter.

```console
$ cd /etc/rspamd/local.d

$ cat ../actions.conf
(...)
actions {
    reject = 15; # Reject when reaching this score
    add_header = 6; # Add header when reaching this score
    greylist = 4; # Apply greylisting when reaching this score (will emit `soft reject action`)
(...)
    .include(try=true; priority=1; duplicate=merge) "$LOCAL_CONFDIR/local.d/actions.conf"
    .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/actions.conf"
}

$ doas nvim actions.conf
```

My actions.conf in local.d is like this:

```config
reject = 27.0;
greylist = 19.0;
subject = "** Suspicious ** %s"
rewrite_subject = 12.0;
add_header = 7.0;
```

When changing Rspamd configuration, it is necessary to restart the daemon:

```console
$ doas rcctl restart rspamd
rspamd(ok)
rspamd(ok)
```

---

Then, modify smtpd.conf in /etc/mail to [execute (`proc-exec`) the filter](https://man.openbsd.org/smtpd.conf#opensmtpd-filter-rspamd).

```console
$ cd /etc/mail

$ # create a backup if necessary:
$ doas cp -p smtpd.conf smtpd.conf.bak

$ doas nvim smtpd.conf
```

Add these lines:

```diff
  (...)
+ filter "rspamd" \
+ 	proc-exec "filter-rspamd"
  (...)
  listen on egress \
  	tls \
  	pki (...) \
  	auth-optional \
+ 	filter { "rspamd" } \
  	tag MTA
  (...)
```

Just 3 lines :)
Well, here, I actually added more lines:

```diff
+ filter "check_dyndns" \
+ 	phase connect match rdns regex { '.*\.dyn\..*', '.*\.dsl\..*' } \
+ 	disconnect "550 no residential connections"
+ filter "check_rdns" \
+ 	phase connect match !rdns \
+ 	disconnect "550 no rDNS"
+ filter "check_fcrdns" \
+ 	phase connect match !fcrdns \
+ 	disconnect "550 no FCrDNS"
  filter "rspamd" \
  	proc-exec "filter-rspamd"
  (...)
- 	filter { "rspamd" } \
+ 	filter { "check_dyndns", "check_rdns", "check_fcrdns", "rspamd" } \
```

The 3 filters are builtin ones in OpenSMTPD.

Finally, restart the smtpd daemon:

```console
$ doas rcctl restart smtpd
smtpd(ok)
smtpd(ok)
```

Now OpenSMTPD calls Rspamd while transfering messages and the filter results are being stored in Redis.
Hope your trouble on spams and scams will get remarkably less.

## Acknowledgments

I appeciate the [Gilles](https://twitter.com/poolporg) (poolp) 's great article:

https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/

It enabled me to set up Rspamd working well with OpenSMTPD at last.