Re: Trying to do antispam with Sieve

Tue, 13 Nov 2018 21:09:49 -0800

For the archives: after reading https://www.dovecot.org/list/dovecot/2017-February/107039.html I found & fixed the issue, it appears I *must* use the inbox prefix, hence the configuration should be: 

plugin {
  sieve_plugins = sieve_imapsieve sieve_extprograms
  imapsieve_mailbox1_name = INBOX.Spam
  imapsieve_mailbox1_causes = COPY
imapsieve_mailbox1_before = file:/usr/lib64/dovecot/sieve/report-spam.sieve 
  imapsieve_mailbox2_name = *
  imapsieve_mailbox2_from = INBOX.Spam
  imapsieve_mailbox2_causes = COPY
imapsieve_mailbox2_before = file:/usr/lib64/dovecot/sieve/report-ham.sieve 
  sieve_pipe_bin_dir = /usr/lib64/dovecot/sieve
  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
}
Perhaps worth adding a note to https://wiki.dovecot.org/HowTo/AntispamWithSieve for this case? 

--
Adi Pircalabu

On 2018-11-14 15:08, Adi Pircalabu wrote:

On 2018-11-14 14:25, Adi Pircalabu wrote:

On 2018-11-14 13:51, Adi Pircalabu wrote:

On 2018-11-14 13:11, Adi Pircalabu wrote:

Hi,

Using https://wiki.dovecot.org/HowTo/AntispamWithSieve I'm trying to
execute scripts when moving to/from Spam folder, however nothing's
happening. The actions are:
1. Move to Spam: redirect :copy "spamcop_spam@domain.local";
2. Move from Spam: redirect :copy "spamcop_ham@domain.local";

[...]

/usr/lib64/dovecot/sieve/report-spam.sieve contains:
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; 
redirect :copy "spamcop_spam@domain.local";
/usr/lib64/dovecot/sieve/report-ham.sieve contains:
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; 
redirect :copy "spamcop_ham@domain.local";


More information after enabling mail_debug, in maillog I see:
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: Module loaded:
/usr/libexec/dovecot/modules/lib95_imap_sieve_plugin.so
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: imapsieve: Mail set keywords
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: imapsieve: mailbox INBOX.Spam: FLAG event (changed
flags: Junk)
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: sieve: Pigeonhole version 0.4.16 (fed8554)
initializing
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: sieve: include: sieve_global is not set; it is
currently not possible to include `:global' scripts.
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: sieve: Sieve imapsieve plugin for Pigeonhole version
0.4.16 (fed8554) loaded
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: sieve: Sieve Extprograms plugin for Pigeonhole
version 0.4.16 (fed8554) loaded
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: imapsieve: Static mailbox rule [1]: mailbox=`Spam'
from=`*' causes=(COPY) =>
before=`file:/usr/lib64/dovecot/sieve/report-spam.sieve' after=(none)
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: imapsieve: Static mailbox rule [2]: mailbox=`*'
from=`Spam' causes=(COPY) =>
before=`file:/usr/lib64/dovecot/sieve/report-ham.sieve' after=(none)
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: Module loaded:
/usr/libexec/dovecot/modules/lib95_imap_sieve_plugin.so
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: imapsieve: mailbox INBOX: MOVE event
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: sieve: Pigeonhole version 0.4.16 (fed8554)
initializing
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: sieve: include: sieve_global is not set; it is
currently not possible to include `:global' scripts.
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: sieve: Sieve imapsieve plugin for Pigeonhole version
0.4.16 (fed8554) loaded
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: sieve: Sieve Extprograms plugin for Pigeonhole
version 0.4.16 (fed8554) loaded
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: imapsieve: Static mailbox rule [1]: mailbox=`Spam'
from=`*' causes=(COPY) =>
before=`file:/usr/lib64/dovecot/sieve/report-spam.sieve' after=(none)
Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1@adit1.local,
ip=[::1]. Debug: imapsieve: Static mailbox rule [2]: mailbox=`*'
from=`Spam' causes=(COPY) =>
before=`file:/usr/lib64/dovecot/sieve/report-ham.sieve' after=(none)

So imapsieve "sees" the configuration, then I went and enabled
debugging in the 2 sieve scripts which now read:
1. /usr/lib64/dovecot/sieve/report-spam.sieve
require ["vnd.dovecot.pipe", "copy", "imapsieve", "vnd.dovecot.debug"]; 
debug_log "/var/tmp/report-spam.sieve.debug";
redirect :copy "spamcop_spam@domain.local";
2. /usr/lib64/dovecot/sieve/report-ham.sieve
require ["vnd.dovecot.pipe", "copy", "imapsieve", "vnd.dovecot.debug"]; 
debug_log "/var/tmp/report-ham.sieve.debug";
redirect :copy "spamcop_ham@domain.local";

Should I expect to see debugging in /var/tmp/report-ham.sieve.debug
and /var/tmp/report-spam.sieve.debug, respectively? The 2 files aren't 
created, nothing in that directory.
BTW, getenforce=Disabled.


Tried with another set of ham/spam scripts that are supposed to log to
syslog. Now using:
1. log-ham.sieve which contains:
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; 

if environment :matches "imap.mailbox" "*" {
  set "mailbox" "${1}";
}

if string "${mailbox}" "Trash" {
  stop;
}

if environment :matches "imap.user" "*" {
  set "username" "${1}";
}

pipe :copy "sa-learn-ham.sh" [ "${username}" ];

2. log-spam.sieve which contains:
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; 

if environment :matches "imap.user" "*" {
  set "username" "${1}";
}

pipe :copy "sa-learn-spam.sh" [ "${username}" ];

And the 2 sa-learn scripts:
1. sa-learn-ham.sh contains:
#!/bin/bash

exec /usr/bin/logger `basename $0` Called for mailbox $1

2. sa-learn-spam.sh contains:
#!/bin/bash

exec /usr/bin/logger `basename $0` Called for mailbox $1

After compiling log-ham.sieve and log-spam.sieve, making
sa-learn-spam.sh and sa-learn-ham.sh executable and reloading dovecot
I should see syslog entries like this:
Nov 14 14:19:08 plesk12 root: sa-learn-spam.sh Called for mailbox t...@test.com 

But I see nothing. Needless to say the sa-learn scripts are running
from command line. I'm a bit lost at the moment, any ideas?


After more digging I've ended up with this sieve spam script:
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment",
"variables", "vnd.dovecot.debug"];

---CUT HERE---
if environment :matches "imap.user" "*" {
  set "username" "${1}";
}

debug_log "In log-spam.sieve, username = ${username}";

pipe :copy "sa-learn-spam.sh" [ "${username}" ];
---CUT HERE---
Can't see anything in maillog. Where can I read more about debugging imapsieve?

Reply via email to