Guide: Upgrade Rspamd on Enhance & Unlock the Full WebUI Experience

kess

Love it, after a very long time finally something to tweak our mailservers !
Just one question: if/when enhance upgrades through apt are going to touch rspamd what happens ?
Are we going to face conflicts ?

cPFence

kess

The guide uses the native official apt method from Rspamd, as recommended here: https://rspamd.com/downloads.html

Once set up, running apt update and apt upgrade will automatically pull in the latest stable Rspamd version from the official repo going forward, so you'll always stay up to date, just like with any other package.

Steamon

cPFence

Very cool. Does this also works if I use smarthost with postfix for some domains?

https://documentation.n-able.com/spamexperts/userguide/Content/B_Admin%20Level/outgoing-filtering/postfix-sender-bsd-rout.htm this method. I use now. Not the Enhance UI one.

If users used spamexperts in this way in mailcow I needed to use global_smtp_from_whitelist.map and that use the e-mail on the mailcow itself without smarthost the global_mime_from_whitelist.map or domain filtering.

Then it acts like a double spam filter.

Overall its just a question maybe it works globally in both ways. As Enhance works differently I think.

If it behaves the same then its fine I guess with better filtering.

I have not tested autoshield yet + spamexpert incoming domains. Or can I configure autoshield per domain and should only use it on non spamexpert users to be safe?

Anyway nice development.

cPFence

Steamon

We haven’t tested it with your specific SpamExperts smarthost setup, so we can’t say for sure how it will behave in that scenario. Currently, Spam AutoShield works server-wide without per-domain configuration. That said, you can still manually customize Rspamd with additional rules and maps if you need more granular control alongside your existing setup.

cPFence

Steamon

I had a chance to look at the SpamExperts setup you linked, while we haven’t tested that specific configuration, it’ll likely work just fine.

pratik_asabe

deydod

Yes, both incoming and outgoing emails are still filtered through Rspamd. Spam AutoShield’s protections will apply server-wide. Incoming mail is always scanned before delivery, and outgoing mail is filtered before being handed off to the smart host, as long as "Outgoing spam filtering" is enabled in Enhance.

pratik_asabe

cPFence I was also wondering, we're using mail.baby as smarthost, will it be beneficial to us? I love this new addition in cpfence though!

Shaijee

pratik_asabe I was also wondering, we're using mail.baby as smarthost, will it be beneficial to us? I love this new addition in cpfence though!

Yes, it will optimize your incoming email filtering. I have been using the Rspamd WebUI for the past four months, actively training HAM and SPAM, and it has effectively eliminated spam.

That being said, I’d like to know more about the Mailbaby service you are using. Specifically, how do you limit user email sending, such as restrictions on Webmail and website usage? Since Mailbaby operates on a pay-per-use model, uncontrolled usage could lead to significant costs. Some of my users rely on IMAP and SMTP for their Outlook clients, and in those cases, limiting outbound email sending isn’t straightforward in Enhance. How do you handle this issue?

Additionally, how does the Enhance Panel DKIM integration work within the Mailbaby system? I would appreciate a detailed explanation.

deydod

Hi cPFence
Does this tool scans outgoing emails for spam too, or just incoming ones?
I have a client with very old wordpress 5.x that seems to be hacked or something. From time to to time he is sending out huge amount of emails. Is there a way to block him?

Steamon

cPFence

Thanks will test it soon on a test cluster as I have 2 enhance clusters 1 for live customers and 1 for testing this way I can ensure everything works 🙂

AdamM

@cPFence
Made the update and configured everything, through my fault there was a small problem but @cPFence team quickly helped me 🙂
Thank you! cPFence is the perfect complement to Enhance CP and bridges the gaps.

PS - maybe you can also give a guide to update Postfix to the latest stable version as is the case with rspamd?

cPFence

AdamM

Thanks Adam, you are welcome.

Regarding Postfix , we don’t recommend upgrading it manually, since Enhance uses the latest version available in the official Ubuntu repo:

~# apt-cache policy postfix
postfix:
  Installed: 3.8.6-1build2
  Candidate: 3.8.6-1build2

It’s better to stick with Ubuntu’s packaged version and wait for updates via apt, rather than adding custom repos.

As for Rspamd, we used the upstream repo because the Ubuntu version had some issues in our setup, and the newer release fixed them , so it was more of a practical workaround. That said, if you’re not facing any problems, it’s totally fine to stick with the Rspamd Ubuntu version and just enable the WebUI without updating.

adil

Is this only for v12 ?

cPFence

adil

The upgrade should still work, but we haven’t tested it on v11, so can’t say for sure.

If everything’s working fine for you, you can just stick with the WebUI as mentioned in the guide and continue using your current Rspamd version.

We only went for the upgrade path after running into rate-limiting issues on several servers.

cPFence

cPFence The guide also shows how to enable the WebUI

If you want direct access without using an SSH tunnel:

Edit the Rspamd config file:

nano /etc/rspamd/rspamd.conf

Replace localhost:11334 with 0.0.0.0:11334 in the controller section:

worker "controller" {
    bind_socket = "0.0.0.0:11334";

Then restart Rspamd:

systemctl restart rspamd

You can now access the Rspamd web UI directly at:
http://your-server-ip:11334

plat

Rspamd web UI does not open

cPFence

plat

If using the direct access method, open the port for the Rspamd GUI:

sudo ufw allow 11334/tcp
sudo ufw reload

plat

it's work