Dkim key under RSPAMD

Discussion in 'ISPConfig 3 Priority Support' started by misterm, Oct 5, 2019.

  1. misterm

    misterm Member

    Hello

    In the management of email domains, there is a tab generate dkim, knowing that I use RSPAMD, the key it puts it or?

    Mz
     
  2. Croydon

    Croydon ISPConfig Developer ISPConfig Developer

    Have you tested? If not, do it.
     
  3. misterm

    misterm Member

    I use it in production mode, it works well, and you use it too?
    Do you have tutorials?
    Yours
    Mz
     
  4. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    I do not understand the question, so just offer recent experience. With Amavis the DKIM key generated by ISPConfig is added to amavis configuration by ISPConfig. I assume the same goes if RSPAMD is used instead of Amavis.
    I have set up a testing ISPConfig setup, where I can experiment with stuff. They are virtual machines, so I can easily take snapshot of servers before experiments and go back in time if stuff breaks badly.
     
    Croydon likes this.
  5. misterm

    misterm Member

    Translation on bing
    Hello
    As you understand, I don't speak English, so translation.
    What I ask, when you generate the dkim key, or the key that puts or it create.
    Yes I use RSPAMD.
    Mz
     
  6. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    I am just guessing you may be asking where the generated key is put so applications use it? In the amavis case, I looked in amavis configuration files, there I can see in directory /etc/amavis/conf.d files 50-user that enables DKIM and 60-dkim that contains
    Code:
    dkim_key('mydomain.tld', 'default', '/var/lib/amavis/dkim/mydomain.tld.private');
     
  7. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Examining what files rspamd installs, I would guess these:
    Code:
    /etc/rspamd/modules.d/dkim.conf
    /etc/rspamd/modules.d/dkim_signing.conf
    I really do not like your attitude. I wrote at the very start I do not use rspamd.
    So coco yourself.
     
    Croydon likes this.
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    The keys are included in Rspamd config automatically and they are stored in the same place that amavis uses: /var/lib/amavis/dkim/
    You can see all keys that were included in the file /etc/rspamd/local.d/dkim_domains.map

    @misterm: Please do not insult other users. I removed one of your posts above as your wording violated our forum rules.
     
  9. misterm

    misterm Member

    Okay, I apologize to @Taleman
    He was right, but except on one thing, the message send is not signing.
    Before you accused someone and knowing that I know the administrative under ISPConfig, there would be not a bug in the development that you have to perform for the integration of RSPAMD?
    Mz , Till
     
    Taleman likes this.
  10. misterm

    misterm Member

    There are some that they will tell me that I'm wrong, if you look at this tutorial (which I test, and the, my message is signed) they miss some things development of Till , sorry, I'm in production at the moment Till, is the errors , I can't create them, you understand Till

    https://cloudpro.zone/index.php/2018/07/06/smtp-dkim-postfix-rspamd/
     
  11. till

    till Super Moderator Staff Member ISPConfig Developer

    You mix up configuration problems of your server with development issues here. I just tested dkim signing in Rspamd in ISPConfig and was able to confirm that it works fine. Example mail has been sent from test.tld to test.int where test.tld has dkim enabled in ISPConfig using Rspamd on Debian 10:

    Code:
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from _ (localhost [127.0.0.1])
            (Authenticated sender: [email protected])
            by server1.example.com (Postfix) with ESMTPA id EC7D08132D
            for <[email protected]>; Sun, 06 Oct 2019 16:35:43 +0200 (CEST)
    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=test.tld; s=default;
            t=1569810284;
            h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
             to:to:cc:mime-version:mime-version:content-type:content-type:
             content-transfer-encoding:content-transfer-encoding;
            bh=cpNknYTSUVSKmgZp5UaNRAwqZN9aiXQ8O1evzzw2tzc=;
            b=YT4aGGeKJjgGvQzsPdO21/eFn/Yrgeo2bJIbVOUI+7lks2EDcdg73lXH3lkpXoFNO0HTDj
            Fbzz8/xSELB3GIYFUl5ObUr0EvBft4sw4D4KTteA/tqEP4CB9fn6Pm/86XousdVQCCRTlC
            3TYhKotfy5VA20DUGcemBpRonArXrMc=
    MIME-Version: 1.0
    Content-Type: text/plain; charset=US-ASCII;
     format=flowed
    Content-Transfer-Encoding: 7bit
    Date: Sun, 06 Oct 2019 16:35:43 +0200
    From: [email protected]
    To: [email protected]
    
    The steps that need to be taken to use Rspamd and sign Dkim messages is that Rspamd on ISPConfig must be installed and enabled as shown here:

    https://www.howtoforge.com/replacing-amavisd-with-rspamd-in-ispconfig/

    The dkim signing configuration is then written by ISPConfig like this:

    The file /etc/rspamd/local.d/dkim_signing.conf must contain this, the config from the link you posted will cause dkim in ISPConfig to fail, so don't use that config.

    Code:
    try_fallback = false;
    path_map = "/etc/rspamd/local.d/dkim_domains.map";
    selector_map = "/etc/rspamd/local.d/dkim_selectors.map";
    The file /etc/rspamd/local.d/dkim_domains.map contains this:

    Code:
    test.tld /var/lib/amavis/dkim/test.tld.private
    one line for each domain that has dkim enabled, the first parameter is the domain name and the second one is the path to the Dkim key. The file /etc/rspamd/local.d/dkim_selectors.map contains this:

    Code:
    test.tld default
    one line for each domain, the word 'default' is the name of the selector.
     
    misterm likes this.
  12. misterm

    misterm Member

    Till, thank you
     
  13. misterm

    misterm Member

    Till, I talk too fast, this does not work is this not sign the message with the tutorial you show me ...
     
  14. till

    till Super Moderator Staff Member ISPConfig Developer

    The tutorial is fine, it has been used on hundreds of servers successfully. Rerun an ispconfig update with reconfigure services = yes. if this still does not fix it, check the rspamd logs for dkim related errors. And check that the _rspamd Linux user is a member of the amavis group.
     
  15. misterm

    misterm Member

    You're talking about this directory that's must be in _rspamd:_rspamd :
    Mz
     
  16. till

    till Super Moderator Staff Member ISPConfig Developer

    No, I do not talk about a directory and this directory is and shall not be owned by _rspamd, so do not change any directory permissions! I talk about Linux user groups: have a look into the /etc/group file, it should contain a line like this on Debian and Ubuntu:

    amavis:x:121:clamav,_rspamd

    which means that the users clamav and _rspamd are members of the amavis group.
     
  17. till

    till Super Moderator Staff Member ISPConfig Developer

    The directory /var/lib/amavis/dkim/ must be owned by the user and group 'amavis':

    Code:
    drwxr-x--- 2 amavis amavis 4096 Sep 30 03:09 .
     
  18. misterm

    misterm Member

    Logic that files on as permissions root:root is not amavis:amavis ?
    Mz
     
  19. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes, that's correct.
     
  20. misterm

    misterm Member

    I just changed this:
    I know if something should be restarted, but it does not sign.
    Mz:mad::mad:
     

Share This Page