Spam passed through: "Unknown lua" (score is 0.00)

DrMaxNix

Heyo! The last few days we are hit with a big wave of spam mails, at some points receiving the same mail on the same inbox multiple times a minute. For troubleshooting this issue, I have checked the rspamd UI to see, why they are not being catched by the filter. Turns out, the filter is not processing them for some reason and just passing them through with a score of 0.00? Affecte mails all show the “Pass-through module” as “Unknown lua”.
Reading docs and doing a bit of research, I was not even able to figure out, what “Unknown lua” even means. So here are my two questions:

What is “Pass-through module: Unknown lua”
How can I prevent rspamd from passing through these mails? Possibly this is related to the first question, as I’m quite sure they are being passed through due to the “Pass-through module” (duh).

Affected mails include these headers, the X-Rspamd-Pre-Result being unique to these kinds of messages:

X-Rspamd-Pre-Result: action=no action;
	module=Unknown lua;
	whitelisting postmaster smtp rcpt
X-Spamd-Result: default: False [0.00 / 15.00]

Above screenshot shows the first 3 mails being passed through and a fourth mail, which is not spam for reference, being handled by rspamd just fine.

Any input on this matter helps!
Thank you,
~ Kim (DrMaxNix)
Admin at tjdev.de

DrMaxNix

Well.. Answering my own question in case anyone else is wondering about this topic..

The hint in my original question is the last part of the X-Rspamd-Pre-Result header: whitelisting postmaster smtp rcpt. That’s basically the answer right there in plain sight and exactly what’s happening.

Some more digging in the mailcow code whows what conditions lead to the addition of this header: mailcow/mailcow-dockerizedblob/527f27d2490c8835e8fa395ec3139fabe7dc4e04/data/conf/rspamd/lua/rspamd.local.lua#L99-L110
TLDR: Mail to postmaster@ addresses are always accepted and not checked for spam. I confirmed that this indeed only happened to spam sent to postmaster addresses. Makes sense if you think about it.

Maybe though it would be a good idea (don’t know how hard it would be to implement) to also display the “whitelisting postmaster smtp rcpt” thingy as the module name in rspamd UI. If I have some time I may look into creating a PR for that!

heavygale

DrMaxNix creating a PR

There already is one for this change:
mailcow/mailcow-dockerized6630

I’m wondering what’s the best way to have an postmaster@ alias on all domains, redirecting the mails to my admin-postmaster-mailbox…. i don’t want to add this alias manually and remember to do say when i add a new domain.

DrMaxNix

heavygale Wow thanks! This PR does exactly what I would’ve liked to have!

Regarding postmaster aliases: I have not yet found a way to automate that sadly.. I am currently doing it using Recipient maps to prevent domain admins from overriding these aliases. Maybe it would be helpful to allow user wildcards in the Recipient maps section? Something like postmaster@* which will target all domains? Recipient maps is probably using some postfix feature under the hood which I’m pretty certain should support wildcards!

heavygale

Yes, i’ve looked into how the aliasses are used in postfix. There are sql-querys which should be easy to adopt for our use case, but I don’t have the time to play around with that currently. As a workaround i’ve added a globale pre filter sieve rule to redirect the mails to my mailbox, but that only works for domains with catch-all alias or with an explicit postmaster@ alias or mailbox.
Automating the creation of actual postmaster@ aliases would also be possible using the api… but i don’t want to have the aliases in the ui and opimally also prohibit users from creating postmaster@ mailboxes or aliasses.