Whitelist Amavis

[Anathorn-fr]

Hello,

How can I configure Amavis to allow one email address with bad header ?

"amavis[465]: (00465-03) Blocked BAD-HEADER-0 {BouncedOpenRelay,Quarantined}"

Thank you

[polarathene]

Could you try with Rspamd instead of Amavis? Check our docs for guidance.

[polarathene]

We do seem to have config support where you can add a /tmp/docker-mailserver/amavis.cf file which will allow you to override amavisd.conf.

With that config you can then try following examples for your issue covered here: https://www.habibza.in/amavisd-whitelist-or-allowed-mail-from-blocked-bad-header/

[Anathorn-fr]

Hello,

Thank you for your answer.
I tried the different solutions of your link.

• The first one is not working.
• The second one disable the header check for all mails. Not desirable ^^
• The third solution (policy bank) imply the redirection to the 10026 port, but in the debug logs, it seems that postfix still redirect the mail to 10024.
  And when I remove the line "content_filter = smtp-amavis:[127.0.0.1]:10024", it's working, but all mails are redirected to 10026, so, no more header check for all mails

[Anathorn-fr]

The lines in the logs

amavis[482]: (00482-01) local delivery: <[email protected]> -> bad-header-quarantine, mbx=/var/lib/amavis/virusmails/V/badh-VpecH-yIm4xr
...
amavis[482]: (00482-01) Blocked BAD-HEADER-0 {BouncedOpenRelay,Quarantined}, ...

[polarathene]

UPDATE: Skip to the bottom for a solution that should work for you 😎

---

The first one is not working.

Verified:

services:
  dms:
    image: ghcr.io/docker-mailserver/docker-mailserver:edge # will become `:15.0`
    hostname: mail.example.test
    configs:
      - source: dms-accounts
        target: /tmp/docker-mailserver/postfix-accounts.cf
      - source: amavis-allow-sender
        target: /tmp/docker-mailserver/amavis.cf
      - source: amavis-addresses
        target: /etc/amavisd/badheader
      - source: swaks-data-template
        target: /tmp/swaks.tmpl

configs:
  dms-accounts:
    content: |
      [email protected]|{SHA512-CRYPT}$$6$$sbgFRCmQ.KWS5ryb$$EsWrlYosiadgdUOxCBHY0DQ3qFbeudDhNMqHs6jZt.8gmxUwiLVy738knqkHD4zj4amkb296HFqQ3yDq4UXt8.

  # The `use strict;` and `1;` lines in this config file were added
  # as all other Amavis configs at `/etc/amavis/conf.d/` seem to have it (makes no difference?)
  amavis-allow-sender:
    content: |
      use strict;

      # Two different ways to configure, actual cause of difference in behaviour
      # is the first one wraps values in `[ ... ]` while the `read_hash` does not.
      # All senders bounce due to header check, even when jane.doe is the sender:
      #@bypass_header_checks_maps = ( [qw( [email protected] )] );
      # Equivalent, qw is used for convenience as described in Amavis docs:
      # 
      #@bypass_header_checks_maps = ( [ '[email protected]' ] );
      # All senders pass regardless of listed headers:
      @bypass_header_checks_maps = ( read_hash("/etc/amavisd/badheader") );

      #------------ Do not modify anything below this line -------------
      1;  # ensure a defined return

  amavis-addresses:
    content: |
      [email protected]
      [email protected]

  # Missing Date header will trigger Amavis "BAD-HEADER-0" rule:
  swaks-data-template:
    content: |
      From: %FROM_ADDRESS%
      To: %TO_ADDRESS%
      Subject: test
      %NEW_HEADERS%
      %BODY%

You can then run the container:

# Start the container and shell into it,
# wait a little bit before sending with swaks until Amavis is ready (logs appear in `/var/log/mail.log`)
docker compose up -d --force-recreate
docker compose exec -it dms bash

# Connect directly to the Amavis service on port 10024 to test, skipping Postfix:
# Uses custom mail template to trigger Amavis "BAD-HEADER-0"
swaks --data @/tmp/swaks.tmpl --server localhost --port 10024 --to '[email protected]' --from '[email protected]'

Regardless of the --from sender address used, the feature does not work as intended. Why that is I'm not sure, there could be a potential config issue on our end somewhere, or it could be a bug in Amavis 🤷‍♂️

---

The second one disable the header check for all mails. Not desirable

Fair 👍

---

The third solution (policy bank) imply the redirection to the 10026 port, but in the debug logs, it seems that postfix still redirect the mail to 10024.
And when I remove the line "content_filter = smtp-amavis:[127.0.0.1]:10024", it's working, but all mails are redirected to 10026, so, no more header check for all mails

Just to double check, is Amavis opening another port 10026? That's not one DMS would configure, also we may configure some of the Postfix setting already (smtpd_sender_restrictions for check_sender_access) with the assumption they're not modified 🤔 So I wouldn't be surprised if that's broken.

Our setup email restrict command creates /tmp/docker-mailserver/postfix-send-access.cf to use with check_sender_access, but for the changes in that Amavis guide you'd need to edit that config file manually and it'll be loaded into DMS without removing any existing DMS configurations for smtpd_sender_restrictions.

UPDATE: Here's a compose.yaml to show it working:

services:
  # Required to test sending the mail due to Amavis otherwise
  # trusting mail sent to Postfix within the same container
  dms-sender:
    image: ghcr.io/docker-mailserver/docker-mailserver:edge # will become `:15.0`
    hostname: mail.somewhere.test
    # Network alias added for example (adds another DNS A record entry to this container)
    networks:
      default:
        aliases:
          - somewhere.test
    configs:
      - source: dms-accounts-somewhere
        target: /tmp/docker-mailserver/postfix-accounts.cf
      - source: swaks-data-template
        target: /tmp/swaks.tmpl

  dms-receiver:
    image: ghcr.io/docker-mailserver/docker-mailserver:edge
    hostname: mail.example.test
    networks:
      default:
        aliases:
          - example.test
    configs:
      - source: dms-accounts-example
        target: /tmp/docker-mailserver/postfix-accounts.cf
      - source: swaks-data-template
        target: /tmp/swaks.tmpl
      # Configure Amavis to run another listener with a relaxed security policy to bypass checks
      - source: amavis-policy
        target: /tmp/docker-mailserver/amavis.cf
      # The trusted sender addresses that qualify for the bypass policy:
      - source: amavis-bypass
        target: /tmp/docker-mailserver/postfix-send-access.cf

configs:
  dms-accounts-example:
    content: |
      [email protected]|{SHA512-CRYPT}$$6$$sbgFRCmQ.KWS5ryb$$EsWrlYosiadgdUOxCBHY0DQ3qFbeudDhNMqHs6jZt.8gmxUwiLVy738knqkHD4zj4amkb296HFqQ3yDq4UXt8.

  # Optional: Not actually needed, but prevents `dms-sender` shutting down after 2 minutes with no accounts.
  # Additionally should receive any bounce mail.
  dms-accounts-somewhere:
    content: |
      [email protected]|{SHA512-CRYPT}$$6$$sbgFRCmQ.KWS5ryb$$EsWrlYosiadgdUOxCBHY0DQ3qFbeudDhNMqHs6jZt.8gmxUwiLVy738knqkHD4zj4amkb296HFqQ3yDq4UXt8.
      [email protected]|{SHA512-CRYPT}$$6$$sbgFRCmQ.KWS5ryb$$EsWrlYosiadgdUOxCBHY0DQ3qFbeudDhNMqHs6jZt.8gmxUwiLVy738knqkHD4zj4amkb296HFqQ3yDq4UXt8.

  # NOTE: `compose.yaml` inline configs need to treat `$` as `$$` to avoid interpolation
  amavis-policy:
    content: |
      $$inet_socket_port = [10024,10026];
      $$interface_policy{'10026'} = 'SENDERBYPASS';

      $$policy_bank{'SENDERBYPASS'} = {
        bypass_spam_checks_maps   => [1],
        bypass_banned_checks_maps => [1],
        bypass_header_checks_maps => [1],
      };

  # Mail from these sender addresses will be sent to the
  # alternative Amavis interface `SENDERBYPASS` on port 10026
  # NOTE: Presumably uses the `smtp-amavis` configured service in `/etc/postfix/master.cf`
  amavis-bypass:
    content: |
      [email protected] FILTER smtp-amavis:[127.0.0.1]:10026
      [email protected] FILTER smtp-amavis:[127.0.0.1]:10026

  # Missing Date header will trigger Amavis "BAD-HEADER-0" rule:
  swaks-data-template:
    content: |
      From: %FROM_ADDRESS%
      To: %TO_ADDRESS%
      Subject: test
      %NEW_HEADERS%
      %BODY%

We can verify directly against Amavis ports to see the Amavis config is working, but if you try with --port 25 while the routing to Amavis works correctly when observing /var/log/mail.log, the john.doe to port 10024 (implicit) doesn't get flagged for bouncing like when sent to Amavis directly..

# Start the container and shell into it,
# wait a little bit before sending with swaks until Amavis is ready (logs appear in `/var/log/mail.log`)
docker compose up -d --force-recreate
docker compose exec -it dms-receiver bash

# Connect directly to the Amavis service on port 10024 to test, skipping Postfix:
# Uses custom mail template to trigger Amavis "BAD-HEADER-0"
swaks --data @/tmp/swaks.tmpl --server localhost --port 10024 --to '[email protected]' --from '[email protected]'

# This one will pass as we send it to the Amavis port with relaxed policy:
swaks --data @/tmp/swaks.tmpl --server localhost --port 10026 --to '[email protected]' --from '[email protected]'

# Expectation is to trigger `BAD-HEADER-0` amavis log in `/var/log/mail.log`,
# Yet it it's not flagged. Some part of the DMS configuration is treating localhost through Postfix differently.
swaks --data @/tmp/swaks.tmpl --server localhost --port 25 --to '[email protected]' --from '[email protected]'

# Exit the container, switch shell to the `dms-sender` container:
exit
docker compose exec -it dms-sender bash

# Send to `dms-receiver` account, default port will be 25 (_you won't be able to connect directly to Amavis ports_)
# NOTE: This will send to the DMS instance successfully,
# but the `dms-receiver` logs will show it was bounced due to `BAD-HEADER-0`
swaks --data @/tmp/swaks.tmpl --helo mail.somewhere.test --server mail.example.test --to '[email protected]' --from '[email protected]'

# This will reveal in `dms-receiver` logs that it was routed to Amavis port 10026 and valid:
swaks --data @/tmp/swaks.tmpl --helo mail.somewhere.test --server mail.example.test --to '[email protected]' --from '[email protected]'

So there we go, you've probably only got to mount the Postfix related config to /tmp/docker-mailserver/postfix-send-access.cf instead and not touch smtpd_sender_restrictions, let DMS handle that 😅