Trying to do antispam with Sieve

[Adi Pircalabu]

On 2018-11-14 13:51, Adi Pircalabu wrote:
> On 2018-11-14 13:11, Adi Pircalabu wrote:
>> Hi,
>> 
>> Using https://wiki.dovecot.org/HowTo/AntispamWithSieve I'm trying to
>> execute scripts when moving to/from Spam folder, however nothing's
>> happening. The actions are:
>> 1. Move to Spam: redirect :copy "spamcop_spam at domain.local";
>> 2. Move from Spam: redirect :copy "spamcop_ham at domain.local";
> [...]
>> /usr/lib64/dovecot/sieve/report-spam.sieve contains:
>> require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", 
>> "variables"];
>> redirect :copy "spamcop_spam at domain.local";
>> /usr/lib64/dovecot/sieve/report-ham.sieve contains:
>> require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", 
>> "variables"];
>> redirect :copy "spamcop_ham at domain.local";
> 
> More information after enabling mail_debug, in maillog I see:
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: Module loaded:
> /usr/libexec/dovecot/modules/lib95_imap_sieve_plugin.so
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: imapsieve: Mail set keywords
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: imapsieve: mailbox INBOX.Spam: FLAG event (changed
> flags: Junk)
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: sieve: Pigeonhole version 0.4.16 (fed8554)
> initializing
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: sieve: include: sieve_global is not set; it is
> currently not possible to include `:global' scripts.
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: sieve: Sieve imapsieve plugin for Pigeonhole version
> 0.4.16 (fed8554) loaded
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: sieve: Sieve Extprograms plugin for Pigeonhole
> version 0.4.16 (fed8554) loaded
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: imapsieve: Static mailbox rule [1]: mailbox=`Spam'
> from=`*' causes=(COPY) =>
> before=`file:/usr/lib64/dovecot/sieve/report-spam.sieve' after=(none)
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: imapsieve: Static mailbox rule [2]: mailbox=`*'
> from=`Spam' causes=(COPY) =>
> before=`file:/usr/lib64/dovecot/sieve/report-ham.sieve' after=(none)
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: Module loaded:
> /usr/libexec/dovecot/modules/lib95_imap_sieve_plugin.so
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: imapsieve: mailbox INBOX: MOVE event
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: sieve: Pigeonhole version 0.4.16 (fed8554)
> initializing
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: sieve: include: sieve_global is not set; it is
> currently not possible to include `:global' scripts.
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: sieve: Sieve imapsieve plugin for Pigeonhole version
> 0.4.16 (fed8554) loaded
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: sieve: Sieve Extprograms plugin for Pigeonhole
> version 0.4.16 (fed8554) loaded
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: imapsieve: Static mailbox rule [1]: mailbox=`Spam'
> from=`*' causes=(COPY) =>
> before=`file:/usr/lib64/dovecot/sieve/report-spam.sieve' after=(none)
> Nov 14 13:41:52 plesk12 dovecot: service=imap, user=adi1 at adit1.local,
> ip=[::1]. Debug: imapsieve: Static mailbox rule [2]: mailbox=`*'
> from=`Spam' causes=(COPY) =>
> before=`file:/usr/lib64/dovecot/sieve/report-ham.sieve' after=(none)
> 
> So imapsieve "sees" the configuration, then I went and enabled
> debugging in the 2 sieve scripts which now read:
> 1. /usr/lib64/dovecot/sieve/report-spam.sieve
> require ["vnd.dovecot.pipe", "copy", "imapsieve", "vnd.dovecot.debug"];
> debug_log "/var/tmp/report-spam.sieve.debug";
> redirect :copy "spamcop_spam at domain.local";
> 2. /usr/lib64/dovecot/sieve/report-ham.sieve
> require ["vnd.dovecot.pipe", "copy", "imapsieve", "vnd.dovecot.debug"];
> debug_log "/var/tmp/report-ham.sieve.debug";
> redirect :copy "spamcop_ham at domain.local";
> 
> Should I expect to see debugging in /var/tmp/report-ham.sieve.debug
> and /var/tmp/report-spam.sieve.debug, respectively? The 2 files aren't
> created, nothing in that directory.
> BTW, getenforce=Disabled.

Tried with another set of ham/spam scripts that are supposed to log to 
syslog. Now using:
1. log-ham.sieve which contains:
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", 
"variables"];

if environment :matches "imap.mailbox" "*" {
   set "mailbox" "${1}";
}

if string "${mailbox}" "Trash" {
   stop;
}

if environment :matches "imap.user" "*" {
   set "username" "${1}";
}

pipe :copy "sa-learn-ham.sh" [ "${username}" ];

2. log-spam.sieve which contains:
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", 
"variables"];

if environment :matches "imap.user" "*" {
   set "username" "${1}";
}

pipe :copy "sa-learn-spam.sh" [ "${username}" ];

And the 2 sa-learn scripts:
1. sa-learn-ham.sh contains:
#!/bin/bash

exec /usr/bin/logger `basename $0` Called for mailbox $1

2. sa-learn-spam.sh contains:
#!/bin/bash

exec /usr/bin/logger `basename $0` Called for mailbox $1

After compiling log-ham.sieve and log-spam.sieve, making 
sa-learn-spam.sh and sa-learn-ham.sh executable and reloading dovecot I 
should see syslog entries like this:
Nov 14 14:19:08 plesk12 root: sa-learn-spam.sh Called for mailbox 
test at test.com

But I see nothing. Needless to say the sa-learn scripts are running from 
command line. I'm a bit lost at the moment, any ideas?

---
Adi Pircalabu