Instantly share code, notes, and snippets.

Embed
What would you like to do?
Howto create local whitelists and blacklists for Rspamd

Local whitelists and blacklists for Rspamd

  • cd /etc/rspamd
  • create rspamd.conf.local
  • create lists:
touch local_bl_from.map.inc local_bl_ip.map.inc local_bl_rcpt.map.inc \
local_wl_from.map.inc local_wl_ip.map.inc local_wl_rcpt.map.inc
  • change permissions:
chmod o+w local_bl_from.map.inc local_bl_ip.map.inc local_bl_rcpt.map.inc \
local_wl_from.map.inc local_wl_ip.map.inc local_wl_rcpt.map.inc

Thanks to @mnik247 in #118

multimap {
# ip - matches source IP of message (radix map)
# from - matches envelope from (or header From if envelope from is absent)
# rcpt - matches any of envelope rcpt or header To if envelope info is missing
# header - matches any header specified (must have header = "Header-Name" configuration attribute)
# dnsbl - matches source IP against some DNS blacklist (consider using RBL module for this)
local_bl_ip { type = "ip"; map = "$CONFDIR/local_bl_ip.map.inc"; symbol = "LOCAL_BL_IP"; description = "Local ip blacklist";}
local_bl_from { type = "from"; map = "$CONFDIR/local_bl_from.map.inc"; symbol = "LOCAL_BL_FROM"; description = "Local from blacklist";}
local_bl_rcpt { type = "rcpt"; map = "$CONFDIR/local_bl_rcpt.map.inc"; symbol = "LOCAL_BL_RCPT"; description = "Local rcpt blacklist";}
local_wl_ip { type = "ip"; map = "$CONFDIR/local_wl_ip.map.inc"; symbol = "LOCAL_WL_IP"; description = "Local ip whitelist";}
local_wl_from { type = "from"; map = "$CONFDIR/local_wl_from.map.inc"; symbol = "LOCAL_WL_FROM"; description = "Local from whitelist";}
local_wl_rcpt { type = "rcpt"; map = "$CONFDIR/local_wl_rcpt.map.inc"; symbol = "LOCAL_WL_RCPT"; description = "Local rcpt whitelist";}
}
metric {
name = "default";
group {
name = "local";
symbol {
weight = 3;
description = "Sender ip listed in local ip blacklist";
name = "LOCAL_BL_IP";
}
symbol {
weight = 3;
description = "Sender from listed in local from blacklist";
name = "LOCAL_BL_FROM";
}
symbol {
weight = 3;
description = "Recipient listed in local rcpt blacklist";
name = "LOCAL_BL_RCPT";
}
symbol {
weight = -5;
description = "Sender ip listed in local ip whitelist";
name = "LOCAL_WL_IP";
}
symbol {
weight = -5;
description = "Sender from listed in local from whitelist";
name = "LOCAL_WL_FROM";
}
symbol {
weight = -5;
description = "Recipient listed in local rcpt whitelist";
name = "LOCAL_WL_RCPT";
}
}
}
@meifi

This comment has been minimized.

meifi commented Aug 10, 2017

Hi, how can we make this lists in the webgui editable under configuration --> lists?

@ghost

This comment has been minimized.

ghost commented Oct 5, 2017

Hi,

just put them into $CONFDIR/local.d/...

@layer3

This comment has been minimized.

layer3 commented Nov 16, 2017

Hi,

after touch edit files, because files cant be empty or you will get cant retrieve map data error in webgui

@leoberto89

This comment has been minimized.

leoberto89 commented Feb 10, 2018

Hi, I have the same error like layer3:

2018-02-10 17:08:18 #4264(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_bl_rcpt.map.inc: No such file or directory
2018-02-10 17:08:18 #4264(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_from.map.inc
2018-02-10 17:08:18 #4264(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_from.map.inc
2018-02-10 17:08:18 #4264(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_from.map.inc: No such file or directory
2018-02-10 17:08:18 #4264(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_rcpt.map.inc
2018-02-10 17:08:18 #4264(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_rcpt.map.inc
2018-02-10 17:08:18 #4264(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_rcpt.map.inc: No such file or directory
2018-02-10 17:08:18 #4264(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_ip.map.inc
2018-02-10 17:08:18 #4264(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_ip.map.inc
2018-02-10 17:08:18 #4264(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_ip.map.inc: No such file or directory
2018-02-10 17:08:18 #4264(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_bl_from.map.inc
2018-02-10 17:08:18 #4264(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_bl_from.map.inc
2018-02-10 17:08:18 #4264(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_bl_from.map.inc: No such file or directory
2018-02-10 17:08:18 #4262(normal) <49ef81>; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_bl_ip.map.inc
2018-02-10 17:08:18 #4262(normal) <49ef81>; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_bl_ip.map.inc
2018-02-10 17:08:18 #4262(normal) <49ef81>; map; read_map_file: can't open map /etc/rspamd/local.d/local_bl_ip.map.inc: No such file or directory
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_bl_rcpt.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_bl_rcpt.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_bl_rcpt.map.inc: No such file or directory
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_from.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_from.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_from.map.inc: No such file or directory
2018-02-10 17:08:18 #4263(normal) <49ef81>; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_bl_ip.map.inc
2018-02-10 17:08:18 #4263(normal) <49ef81>; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_bl_ip.map.inc
2018-02-10 17:08:18 #4263(normal) <49ef81>; map; read_map_file: can't open map /etc/rspamd/local.d/local_bl_ip.map.inc: No such file or directory
2018-02-10 17:08:18 #4263(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_bl_rcpt.map.inc
2018-02-10 17:08:18 #4263(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_bl_rcpt.map.inc
2018-02-10 17:08:18 #4263(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_bl_rcpt.map.inc: No such file or directory
2018-02-10 17:08:18 #4263(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_from.map.inc
2018-02-10 17:08:18 #4263(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_from.map.inc
2018-02-10 17:08:18 #4263(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_from.map.inc: No such file or directory
2018-02-10 17:08:18 #4263(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_ip.map.inc
2018-02-10 17:08:18 #4263(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_ip.map.inc
2018-02-10 17:08:18 #4263(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_ip.map.inc: No such file or directory
2018-02-10 17:08:18 #4263(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_bl_from.map.inc
2018-02-10 17:08:18 #4263(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_bl_from.map.inc
2018-02-10 17:08:18 #4263(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_bl_from.map.inc: No such file or directory
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_rcpt.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_rcpt.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_rcpt.map.inc: No such file or directory
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_ip.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_ip.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_ip.map.inc: No such file or directory
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_bl_from.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_bl_from.map.inc
2018-02-10 17:08:18 #4262(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_bl_from.map.inc: No such file or directory
2018-02-10 17:08:21 #4263(normal) ; map; rspamd_map_file_check_callback: old mtime is -1, new mtime is 1518289626 for map file /etc/rspamd/local.d/local_wl_rcpt.map.inc
2018-02-10 17:08:21 #4263(normal) ; map; rspamd_map_file_read_callback: rereading map file /etc/rspamd/local.d/local_wl_rcpt.map.inc
2018-02-10 17:08:21 #4263(normal) ; map; read_map_file: can't open map /etc/rspamd/local.d/local_wl_rcpt.map.inc: No such file or directory

@xmacan

This comment has been minimized.

xmacan commented May 4, 2018

If file has 0 bytes size, you will see No such file or directory. If size > 0 (new line is enough), the message " can't open map ... No such file of directory" will not in log and map is loaded (and you can edit it via web gui). I guess that this behavior is strange.

@vstakhov

This comment has been minimized.

vstakhov commented Oct 16, 2018

I have added this to the documentation (adopted for the general Rspamd configuration guidelines):

rspamd/rspamd.com@75fd771

@vstakhov

This comment has been minimized.

vstakhov commented Oct 16, 2018

0 size maps should also be fixed in WebUI case.

@mspenkov

This comment has been minimized.

mspenkov commented Oct 22, 2018

Hi,
Sorry for my stupidity, but how can I add a field with any subdomain?
Example: we receive mail from address nobody@mx3.domain.ru and from address nobody@mx4.domain.ru. How to make the rule "*.domain.ru"?

@Flole998

This comment has been minimized.

Flole998 commented Oct 26, 2018

I'm having the same question as @mspenkov has.

@pclemot

This comment has been minimized.

pclemot commented Nov 14, 2018

Maybe with Regexp maps?

@mspenkov

This comment has been minimized.

mspenkov commented Dec 11, 2018

I'm having the same question as @mspenkov has.

email:domain:tld - parse header value as email address and extract effective second level domain from it (Somebody user@foo.example.com -> example.com)

local_bl_from_domain { type = "from"; filter = "email:domain:tld"; map = "$CONFDIR/maps/local_bl_from_second_domain.map.inc"; symbol = "LOCAL_BL_FROM_DOMAIN"; description = "Local from domain blacklist";}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment