Mail app: optional SpamAssassin plugins can't be enabled with their stock rules, and `sa-update` never runs
-
There's too much AI text here to investigate but sa-update is now run periodically. I fixed this recently.
Also, the plan is not to expose spamassassin and it's features/plugins. We will simply integrate the use cases and never implementation details. Currently, the custom SA config is allowed in the UI but this was a mistake on our side.
-
sorry @girish it was indeed written by Claude Code Opus 5. But realise that in this AI world I noticed on my 3 Cloudron-servers a huge increase of attacks, spam and phishing (and the last one was once "successful" for one user with nasty results).
As far as I can see the default "anti-spam / anti-phishing" in Cloudron is absolutely not sufficient, @d19dotca was "the pioneer" here on the forum with custom SA rules and I fight "attackers with AI" with my own "AI"
.The only thing I ask you devs is to increase attention for "attacks, spam and phishing" and tell me what I can do if you don't/can't.
-
@imc67 no worries. But yeah fighting spam has become overly complicated and products don't exist yet to tackle this kind of scale.
Currently, our gitlab is under attack. Almost 40k unique IPs. I took the IPs from our access.log and not some random blocklist. In fact, I blocked gitlab for everyone now and just put the company in a whitelist for the moment. I understand this is impractical for Email (our email too is under constant attack).
-
@imc67 no worries. But yeah fighting spam has become overly complicated and products don't exist yet to tackle this kind of scale.
Currently, our gitlab is under attack. Almost 40k unique IPs. I took the IPs from our access.log and not some random blocklist. In fact, I blocked gitlab for everyone now and just put the company in a whitelist for the moment. I understand this is impractical for Email (our email too is under constant attack).
@girish indeed I noticed git.cloudron.io gave a 403.
As you might remember I created my own "security monitor" for centrally monitoring and managing 3 Cloudron servers, it's growing with hundreds a day, the list below are lines, the unique IP's are 641.451.742 separate IPv4-adressess:
-
@girish indeed I noticed git.cloudron.io gave a 403.
As you might remember I created my own "security monitor" for centrally monitoring and managing 3 Cloudron servers, it's growing with hundreds a day, the list below are lines, the unique IP's are 641.451.742 separate IPv4-adressess:
-
haha (sorry) now you experience the same as I do, every hour the newly to be blocked IP's are pushed via API and it takes 4-6 minutes to be processed. That's why I suggested previously in a post to maken it "insert/update/delete" per IP or CIDR.
Good luck!
-
@imc67 no worries. But yeah fighting spam has become overly complicated and products don't exist yet to tackle this kind of scale.
Currently, our gitlab is under attack. Almost 40k unique IPs. I took the IPs from our access.log and not some random blocklist. In fact, I blocked gitlab for everyone now and just put the company in a whitelist for the moment. I understand this is impractical for Email (our email too is under constant attack).
-
There's too much AI text here to investigate but sa-update is now run periodically. I fixed this recently.
Also, the plan is not to expose spamassassin and it's features/plugins. We will simply integrate the use cases and never implementation details. Currently, the custom SA config is allowed in the UI but this was a mistake on our side.
Also, the plan is not to expose spamassassin and it's features/plugins. We will simply integrate the use cases and never implementation details. Currently, the custom SA config is allowed in the UI but this was a mistake on our side.
Hmm, I am not sure if I agree with that view. Why do you think that was a mistake? If it wasn't customizable, many of us would be getting many more times the spam we already do because the default SpamAssassin rules are pretty awful these days with the aggressive spam nature as a result of so many more bots and more sophisticated spam attacks.
Please don't remove that. If anything, I am in agreement with @imc67 that we need more controls. Cloudron is maturing, and with the help of AI many people are getting more advanced in their skillsets, and hiding things away from technical admins only increase friction with using Cloudron. I do hope that this will be reconsidered, and that more controls can be exposed for us.
On a separate note about the SpamAssassin sa-update and sa-learn stuff that Cloudron has a script for, I was recently looking into that myself and comparing it with a script I wrote myself for running some SpamAssassin scans for learning ham and spam (BAYES training). Here is an AI summary of this for reference:
The bundled /app/code/spamassassin-config/learn-from-user-mail.sh, scheduled daily at 22:00 UTC by /app/code/service.js, only identifies paths under .Spam as spam. Its ham search excludes exact .Drafts, .Spam, and .Trash paths, but it does not correctly handle: - .Junk or nested Junk folders, which are learned as ham - .Deleted Messages, which is learned as ham - nested Trash folders such as .Trash.CANCELLATIONS - Sent/Sent Messages, with no option for administrators to exclude them - folder and message paths containing spaces, because results from find are processed through whitespace-splitting shell variables - messages above the default spamc 512 KB limit The script also applies head -n 200 to unsorted find output, so the selected messages are not necessarily the newest 200. Could the learner use Dovecot special-use metadata (\Junk, \Trash, \Sent, and \Drafts) or, at minimum, robust Maildir folder-name matching with NUL-delimited paths? It would also be helpful to make Sent-folder learning configurable and provide an administrator option to disable or customize the bundled automatic learner.--
Dustin Dauncey
www.d19.ca -
Also, the plan is not to expose spamassassin and it's features/plugins. We will simply integrate the use cases and never implementation details. Currently, the custom SA config is allowed in the UI but this was a mistake on our side.
Hmm, I am not sure if I agree with that view. Why do you think that was a mistake? If it wasn't customizable, many of us would be getting many more times the spam we already do because the default SpamAssassin rules are pretty awful these days with the aggressive spam nature as a result of so many more bots and more sophisticated spam attacks.
Please don't remove that. If anything, I am in agreement with @imc67 that we need more controls. Cloudron is maturing, and with the help of AI many people are getting more advanced in their skillsets, and hiding things away from technical admins only increase friction with using Cloudron. I do hope that this will be reconsidered, and that more controls can be exposed for us.
On a separate note about the SpamAssassin sa-update and sa-learn stuff that Cloudron has a script for, I was recently looking into that myself and comparing it with a script I wrote myself for running some SpamAssassin scans for learning ham and spam (BAYES training). Here is an AI summary of this for reference:
The bundled /app/code/spamassassin-config/learn-from-user-mail.sh, scheduled daily at 22:00 UTC by /app/code/service.js, only identifies paths under .Spam as spam. Its ham search excludes exact .Drafts, .Spam, and .Trash paths, but it does not correctly handle: - .Junk or nested Junk folders, which are learned as ham - .Deleted Messages, which is learned as ham - nested Trash folders such as .Trash.CANCELLATIONS - Sent/Sent Messages, with no option for administrators to exclude them - folder and message paths containing spaces, because results from find are processed through whitespace-splitting shell variables - messages above the default spamc 512 KB limit The script also applies head -n 200 to unsorted find output, so the selected messages are not necessarily the newest 200. Could the learner use Dovecot special-use metadata (\Junk, \Trash, \Sent, and \Drafts) or, at minimum, robust Maildir folder-name matching with NUL-delimited paths? It would also be helpful to make Sent-folder learning configurable and provide an administrator option to disable or customize the bundled automatic learner.@d19dotca both the statements are orthogonal. Cloudron can provide feature to tackle spam and make it more accessible for all users. At the same time, Cloudron can also not expose implementation details like SpamAssassin configs. In fact, there are newer solutions out there like say rspamd which even help with integrating email with LLM. But because Cloudron exposed SA we are now "stuck" and possibly have to break support at some point.
We have always taken this approach to our product, so it's not anything new. We don't expose docker configs, haraka configs, dovecot configs, nginx configs etc. It's not how we do things. The SpamAssasin config was done only because an immediate problem had to be fixed and was done in haste.
thing is in some of our servers even the hash list of the kernel is slow when adding so many IPs !Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login