1 (edited by Dexus 2014-10-24 05:21:36)

Topic: ANTISPAM via Dovecot and Spamassassin

==== Required information ====
- iRedMail version: 0.8.7
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Linux/BSD distribution name and version: Debian 7
====

I have a user based AntiSpam made for Dovecot with Spamassassin.

1. Install via apt-get:

apt-get install dovecot-antispam

2. Mod, Add Dovecot Settings:

protocol imap {
  ...
  mail_plugins = $mail_plugins antispam
}

plugin {
  ...
  #antispam_debug_target = syslog
  #antispam_verbose_debug = 1

  antispam_backend = pipe
  antispam_trash = Trash
  antispam_spam = Junk
  antispam_pipe_program_spam_arg = --spam
  antispam_pipe_program_notspam_arg = --ham
  antispam_pipe_program = /usr/bin/sa-learn
  antispam_pipe_program_args = --username=%Lu
}

3. Edit the local.cf from spamassassin: (NOTICE: Write down the "Data you Setting for MYSQL connection")

use_bayes          1
bayes_auto_learn   1
bayes_auto_expire  1

# Store bayesian data in MySQL
bayes_store_module Mail::SpamAssassin::BayesStore::MySQL
bayes_sql_dsn      DBI:mysql:(db):(host):(port)

# Store bayesian data in MySQL
#bayes_store_module Mail::SpamAssassin::BayesStore::PgSQL
#bayes_sql_dsn      DBI:Pg:database:sql_server:sql_port
#
bayes_sql_username (user)
bayes_sql_password (password)
#
# Override the username used for storing
# data in the database. This could be used to group users together to
# share bayesian filter data. You can also use this config option to
# trick sa-learn to learn data as a specific user.
#
#bayes_sql_override_username vmail

Please change the Plaseholder in : (db), (host), (port), (user), (password)

4. create mysql user, db and scheme for spamassassin bayes

# cd /root/
# wget http://svn.apache.org/repos/asf/spamassassin/tags/spamassassin_release_3_3_2/sql/bayes_mysql.sql

### NOTICE /root/bayes_mysql.sql must be modded TYPE => ENGINE for correct mysql syntax.


### CREATE DB for SA_BAYES AND IMPORT SCHEME.

# mysql -uroot -p
mysql> CREATE DATABASE sa_bayes;
mysql> USE sa_bayes;
mysql> SOURCE /root/bayes_mysql.sql;

### CREATE USER AND GIVE ACCESS (USERDATA NEEDED IN LOCAL.CF for SETTING UP SPAMASSASSIN)
mysql> GRANT SELECT, INSERT, UPDATE, DELETE ON sa_bayes.* TO sa_user@localhost IDENTIFIED BY 'sa_user_password';
mysql> FLUSH PRIVILEGES;
mysql> EXIT;

5. RESTART DOVECOT, AMAVIS(-NEW)

# service dovecot restart
# service amavis restart

6. Its Done,
Now all emails that are push to spamfolder, via IMAP will now learned by SA if you get an mail in Spamfolder, that is not Spam, push it to an other Folder like Inbox and it will learned as -ham


I hope, it will help you!

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: ANTISPAM via Dovecot and Spamassassin

Useful tutorial. Thanks for sharing. I added (link of) your tutorial in our document page here:
http://www.iredmail.org/docs/ (search 'antispam' or your forum name 'Dexus')

3

Re: ANTISPAM via Dovecot and Spamassassin

I'm using this procedure to mark certain email as SPAM. But I can't seem to be able to move email to the Junk folder. What settings can I use to generate some log info so I can see where the failure occurs? I'm sorry I don't have any more info at this time but I don't seem to have the logging that indicates what the problem is in moving a message to the Junk folder.

4

Re: ANTISPAM via Dovecot and Spamassassin

It looks like it's more than likely a permissions problem. Any suggestions?

5

Re: ANTISPAM via Dovecot and Spamassassin

Zhang is it possible to add this to iredmail as default behavior?

6 (edited by SteveLuxe 2015-06-12 08:22:37)

Re: ANTISPAM via Dovecot and Spamassassin

One correction:

In step 2, it should be:

plugin {

not "plugins {"

And shouldn't the line in /etc/spamassassin/local.cf "#bayes_sql_override_username vmail" be uncommented?

And the file that's being edited in step 2 is /etc/dovecot/dovecot.conf (on Debian, anyway).

And one question: Is there a way to chown /etc/spamassassin/local.cf to the correct group so that only root and the group that needs to read the file have permission to local.cf with a database password in it? As it stands, on my system anyway, it's owned by root:root, and the permissions are 644 which is world-readable. The only reason I haven't changed it is because I'm not sure what user / group needs to have read permissions to the file.

7

Re: ANTISPAM via Dovecot and Spamassassin

SteveLuxe wrote:

One correction:

In step 2, it should be:

plugin {

not "plugins {"

I edited the first post, it's now correct.

SteveLuxe wrote:

And one question: Is there a way to chown /etc/spamassassin/local.cf to the correct group so that only root and the group that needs to read the file have permission to local.cf with a database password in it? As it stands, on my system anyway, it's owned by root:root, and the permissions are 644 which is world-readable. The only reason I haven't changed it is because I'm not sure what user / group needs to have read permissions to the file.

Good point. I didn't try to set a restrict permission before (no password in this file), you can try it and share it. smile

8 (edited by SteveLuxe 2015-06-12 08:29:51)

Re: ANTISPAM via Dovecot and Spamassassin

ZhangHuangbin wrote:

Good point. I didn't try to set a restrict permission before (no password in this file), you can try it and share it. smile

Zhang, I'm kinda asking which user, or group (if you happen to know off-hand) should be given permission to read this file? vmail? amavis?

And shouldn't the line in /etc/spamassassin/local.cf "#bayes_sql_override_username vmail" be uncommented? We want the bayes data to be run as the user "vmail" right?

9 (edited by neoark 2015-06-12 08:33:14)

Re: ANTISPAM via Dovecot and Spamassassin

Will this also work with sogo and exchange?

10

Re: ANTISPAM via Dovecot and Spamassassin

Yes neoark

11

Re: ANTISPAM via Dovecot and Spamassassin

Its seems that I am running into problems with roundcube. When i drag from inbox to spam folder gives error: Server Error: UID MOVE: failed to send mail .

However it seems to work for internal mail. But I can drag mail from Trash to Spam fine.

12 (edited by SteveLuxe 2015-06-14 03:42:45)

Re: ANTISPAM via Dovecot and Spamassassin

neoark wrote:

Its seems that I am running into problems with roundcube. When i drag from inbox to spam folder gives error: Server Error: UID MOVE: failed to send mail .

However it seems to work for internal mail. But I can drag mail from Trash to Spam fine.

I can confirm the same behavior as neoark in Roundcube. I'm experiencing the exact same behavior. I can't send mail to Junk, but I can send mail to the trash. However, I CAN drag the mail straight to Junk from the inbox. I'm running Apache, iRedMail 0.9.2, and Debian 8.1.

The access log for Apache says nothing unusual, except for this odd little snippet. The error.log says nothing out of the ordinary at all:

"GET /mail/?_task=mail&_refresh=1&_mbox=INBOX&_remote=1&_unlock=loading1434223820899&_action=list&_=1434223552310 HTTP/1.1" 200 3537

Post's attachments

fail.jpg
fail.jpg 15.41 kb, file has never been downloaded. 

You don't have the permssions to download the attachments of this post.

13

Re: ANTISPAM via Dovecot and Spamassassin

I have no idea if no related log in Dovecot. I suggest asking in Dovecot mailing list if you think it might be a antispam plugin issue, or asking in Roundcube mailing list if you think it's a webmail issue.

14

Re: ANTISPAM via Dovecot and Spamassassin

By the way, any related log after increase debug level?

plugin {
    antispam_verbose_debug = 1
    ...
}

15

Re: ANTISPAM via Dovecot and Spamassassin

ZhangHuangbin wrote:

By the way, any related log after increase debug level?

plugin {
    antispam_verbose_debug = 1
    ...
}

None it seems like antispam module is crashing.

16

Re: ANTISPAM via Dovecot and Spamassassin

This isn't a crash. its that sa-learn is not DIRECTLY compatible with Antispam, it needs a wrapper around it to route everything where it needs to be, google around to find example wrappers. It refuses to move the mail as that would result in a piece of Spam that would get past the net (of being taught to sa-learn)

17 (edited by lakano 2015-08-18 22:01:43)

Re: ANTISPAM via Dovecot and Spamassassin

Hello !

I'm trying to follow this tutorial to set the dovecot antispam plugin, but I have some problem.

1) I can't start amavisd easily to check if Bayes plugin is launched, because on my Ubuntu Server 14.04.1, the /etc/amavis/ doesn't contains amavisd.conf ( only a conf.d/ with mutliples files )

2) I would like to start sa-learn on a folder where I have a lot of spam, but I don't found it in my /var/vmail/vmail1/mydomain.com/t/e/s/test@mydomain.com/Maildir/ ( cur / new are empty )

3) So, I'm trying to move a spam directly from Thunderbird to /Junk/ folder, but I have an error "[SERVERBUG] failed to send mail".
If I move it firstly to /Trash, then move it after to /Junk, this works, it's same behavior as @neoark

4) Even after moved successfully my SPAM in /Junk, I don't see anything in my MySQL table bayes_token.

Any help will be appreciated smile

Regards

EDIT:
Finally the bayes_token table count increase (only 93 rows... for 250 spams files strange) but may be theses operations are delayed, this could explain why few minutes ago the table was empty.

But if someone have found a solution to move directly email to /Junk without the need to firstly move it to /Trash, this could be really usefull smile

thanks!

18

Re: ANTISPAM via Dovecot and Spamassassin

lakano wrote:

1) I can't start amavisd easily to check if Bayes plugin is launched, because on my Ubuntu Server 14.04.1, the /etc/amavis/ doesn't contains amavisd.conf ( only a conf.d/ with mutliples files )

Read this tutorial:
http://www.iredmail.com/docs/file.locat … ml#amavisd

lakano wrote:

2) I would like to start sa-learn on a folder where I have a lot of spam, but I don't found it in my /var/vmail/vmail1/mydomain.com/t/e/s/test@mydomain.com/Maildir/ ( cur / new are empty )

Use command 'ls -a' to list imap folders. they're hidden directories which have a dot '.' in directory names.

19

Re: ANTISPAM via Dovecot and Spamassassin

ZhangHuangbin wrote:
lakano wrote:

1) I can't start amavisd easily to check if Bayes plugin is launched, because on my Ubuntu Server 14.04.1, the /etc/amavis/ doesn't contains amavisd.conf ( only a conf.d/ with mutliples files )

Read this tutorial:
http://www.iredmail.com/docs/file.locat … ml#amavisd

Great!


ZhangHuangbin wrote:
lakano wrote:

2) I would like to start sa-learn on a folder where I have a lot of spam, but I don't found it in my /var/vmail/vmail1/mydomain.com/t/e/s/test@mydomain.com/Maildir/ ( cur / new are empty )

Use command 'ls -a' to list imap folders. they're hidden directories which have a dot '.' in directory names.

Ok I see, thanks a lots smile

So, now I only have the problem reported by @noark :

noark wrote:

ts seems that I am running into problems with roundcube. When i drag from inbox to spam folder gives error: Server Error: UID MOVE: failed to send mail .

However it seems to work for internal mail. But I can drag mail from Trash to Spam fine.

It's not only a problem in RoundCube ( I haven't tested the plugin MarkAsSpam because I'll not use RoundCube )
It's a problem in other mail tools, for example I'm using Thunderbird, and the error reported by Thunderbird is "[SERVERBUG] failed to send mail"

Any idea / suggestion to solve this problem will be really appreciated smile

Thanks a lots guys for this amazing works!

20

Re: ANTISPAM via Dovecot and Spamassassin

lakano wrote:

It's a problem in other mail tools, for example I'm using Thunderbird, and the error reported by Thunderbird is "[SERVERBUG] failed to send mail"

Did you try to turn on debug mode in Dovecot to see what happened?
Reference: http://www.iredmail.org/docs/debug.dovecot.html

21

Re: ANTISPAM via Dovecot and Spamassassin

ZhangHuangbin wrote:

Did you try to turn on debug mode in Dovecot to see what happened?
Reference: http://www.iredmail.org/docs/debug.dovecot.html

Good idea, but this not help.
I see a lots of new lines in the logs, but when I move the mail to /Junk for trigger the error, there is no new line in logs.

Aug 19 16:23:22 imap-login: Info: Login: user=<guillaume.XXXX@mydomain.com>, method=PLAIN, rip=80.215.245.72, lip=188.164.131.104, mpid=4647, TLS, session=<jqvgxqodiwBQ1/VI>
Aug 19 16:23:22 imap: Debug: Loading modules from directory: /usr/lib/dovecot/modules
Aug 19 16:23:22 imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so
Aug 19 16:23:22 imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so
Aug 19 16:23:22 imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so
Aug 19 16:23:22 imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so
Aug 19 16:23:22 imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib20_mailbox_alias_plugin.so
Aug 19 16:23:22 imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib90_antispam_plugin.so
Aug 19 16:23:22 imap: Debug: Added userdb setting: plugin/master_user=guillaume.XXXX@mydomain.com
Aug 19 16:23:22 imap: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Effective uid=2000, gid=2000, home=/var/vmail/vmail1/mydomain.com/g/u/i/guillaume.XXXX-2015.08.17.15.39.44/
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Quota root: name=user backend=dict args=:proxy::quotadict
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Quota rule: root=user mailbox=* bytes=0 messages=0
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Quota warning: bytes=0 (85%) messages=0 reverse=no command=quota-warning 85 guillaume.XXXX@mydomain.com
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Quota warning: bytes=0 (90%) messages=0 reverse=no command=quota-warning 90 guillaume.XXXX@mydomain.com
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Quota warning: bytes=0 (95%) messages=0 reverse=no command=quota-warning 95 guillaume.XXXX@mydomain.com
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Quota grace: root=user bytes=0 (10%)
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: dict quota: user=guillaume.XXXX@mydomain.com, uri=proxy::quotadict, noenforcing=0
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Namespace : type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/vmail/vmail1/mydomain.com/g/u/i/guillaume.XXXX-2015.08.17.15.39.44//Maildir/:INDEX=/var/vmail/vmail1/mydomain.com/g/u/i/guillaume.XXXX-2015.08.17.15.39.44//Maildir/
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: maildir++: root=/var/vmail/vmail1/mydomain.com/g/u/i/guillaume.XXXX-2015.08.17.15.39.44//Maildir, index=, indexpvt=, control=, inbox=/var/vmail/vmail1/mydomain.com/g/u/i/guillaume.XXXX-2015.08.17.15.39.44//Maildir, alt=
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl: initializing backend with data: vfile
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl: acl username = guillaume.XXXX@mydomain.com
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl: owner = 1
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl vfile: Global ACL directory: (none)
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=yes location=maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/Shared/%u
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt=
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl: initializing backend with data: vfile
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl: acl username = guillaume.XXXX@mydomain.com
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl: owner = 0
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl vfile: Global ACL directory: (none)
Aug 19 16:23:22 imap(guillaume.XXXX@mydomain.com): Debug: acl vfile: file /var/vmail/vmail1/mydomain.com/g/u/i/guillaume.XXXX-2015.08.17.15.39.44//Maildir/.Drafts/dovecot-acl not found

22

Re: ANTISPAM via Dovecot and Spamassassin

Did you try to turn on antispam debug level?

plugin {
  ...
  antispam_debug_target = syslog
  antispam_verbose_debug = 1
  ...
}

23

Re: ANTISPAM via Dovecot and Spamassassin

Yes, but just seen the logs was in syslog, so here the error:

Aug 20 11:18:47 mail imap: antispam: mailbox_is_unsure(Junk): 0
Aug 20 11:18:47 mail imap: antispam: mailbox_is_trash(INBOX): 0
Aug 20 11:18:47 mail imap: antispam: mailbox_is_trash(Junk): 0
Aug 20 11:18:47 mail imap: antispam: mail copy: from trash: 0, to trash: 0
Aug 20 11:18:47 mail imap: antispam: mailbox_is_spam(INBOX): 0
Aug 20 11:18:47 mail imap: antispam: mailbox_is_spam(Junk): 1
Aug 20 11:18:47 mail imap: antispam: mailbox_is_unsure(INBOX): 0
Aug 20 11:18:47 mail imap: antispam: mail copy: src spam: 0, dst spam: 1, src unsure: 0
Aug 20 11:18:47 mail imap: antispam: running mailtrain backend program /usr/bin/sa-learn
Aug 20 11:18:47 mail imap: antispam: running mailtrain backend program /usr/bin/sa-learn
Aug 20 11:18:47 mail imap: antispam: running mailtrain backend program parameter 1 --username=guillaume.XXXX@mydomain.com
Aug 20 11:18:47 mail imap: antispam: running mailtrain backend program parameter 2 --spam
Aug 20 11:18:50 mail imap: antispam: run program failed with exit code -1

But we haven't more logs, it's sa-learn which return -1... but why?
Where is set the "sa-learn" command/args ?
grep "sa-learn" not match in /etc/ of dovecot/amavis/postfix/spamassassin folders..

If we could add the parameter " -D " to add debug information, this could help to understood!

Regards,

24

Re: ANTISPAM via Dovecot and Spamassassin

*) Please show us full output of command 'dovecot -n'.
*) Any related log in /var/log/syslog or /var/log/mail.log?

25

Re: ANTISPAM via Dovecot and Spamassassin

Hello Zhang,

Here is the output of "dovecot -n":

# dovecot -n
# 2.2.9: /etc/dovecot/dovecot.conf
# OS: Linux 3.13.0-62-generic x86_64 Ubuntu 14.04.1 LTS
auth_master_user_separator = *
auth_mechanisms = PLAIN LOGIN
dict {
  acl = mysql:/etc/dovecot/dovecot-share-folder.conf
  quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf
}
first_valid_uid = 2000
last_valid_uid = 2000
listen = * [::]
log_path = /var/log/dovecot.log
mail_gid = 2000
mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/
mail_plugins = quota mailbox_alias acl
mail_uid = 2000
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
namespace {
  inbox = yes
  location =
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    auto = no
    special_use = \Sent
  }
  mailbox Spam {
    auto = no
    special_use = \Junk
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  prefix =
  separator = /
  type = private
}
namespace {
  list = children
  location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%u
  prefix = Shared/%%u/
  separator = /
  subscriptions = yes
  type = shared
}
passdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
}
passdb {
  args = /etc/dovecot/dovecot-master-users
  driver = passwd-file
  master = yes
}
plugin {
  acl = vfile
  acl_shared_dict = proxy::acl
  antispam_backend = pipe
  antispam_debug_target = syslog
  antispam_pipe_program = /usr/bin/sa-learn
  antispam_pipe_program_args = --username=%Lu
  antispam_pipe_program_notspam_arg = --ham
  antispam_pipe_program_spam_arg = --spam
  antispam_spam = Junk
  antispam_trash = Trash
  antispam_verbose_debug = 1
  auth_socket_path = /var/run/dovecot/auth-master
  mailbox_alias_new = Sent Messages
  mailbox_alias_new2 = Sent Items
  mailbox_alias_old = Sent
  mailbox_alias_old2 = Sent
  quota = dict:user::proxy::quotadict
  quota_rule = *:storage=1G
  quota_warning = storage=85%% quota-warning 85 %u
  quota_warning2 = storage=90%% quota-warning 90 %u
  quota_warning3 = storage=95%% quota-warning 95 %u
  sieve = %Lh/sieve/dovecot.sieve
  sieve_before = /var/vmail/sieve/dovecot.sieve
  sieve_dir = %Lh/sieve
  sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute
  sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter
  sieve_global_dir = /var/vmail/sieve
  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute
  sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe
  sieve_plugins = sieve_extprograms
}
protocols = pop3 imap sieve lmtp
service auth {
  unix_listener /var/spool/postfix/private/dovecot-auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-master {
    group = vmail
    mode = 0666
    user = vmail
  }
  unix_listener auth-userdb {
    group = vmail
    mode = 0660
    user = vmail
  }
}
service dict {
  unix_listener dict {
    group = vmail
    mode = 0660
    user = vmail
  }
}
service imap-login {
  process_limit = 500
  service_count = 1
}
service lmtp {
  executable = lmtp -L
  inet_listener lmtp {
    address = 127.0.0.1
    port = 24
  }
  process_min_avail = 5
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
  user = vmail
}
service managesieve-login {
  inet_listener sieve {
    address = 127.0.0.1
    port = 4190
  }
}
service pop3-login {
  service_count = 1
}
service quota-warning {
  executable = script /usr/local/bin/dovecot-quota-warning.sh
  unix_listener quota-warning {
    group = vmail
    mode = 0660
    user = vmail
  }
}
ssl = required
ssl_cert = </etc/ssl/certs/iRedMail.crt
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
ssl_dh_parameters_length = 2048
ssl_key = </etc/ssl/private/iRedMail.key
ssl_prefer_server_ciphers = yes
ssl_protocols = !SSLv2 !SSLv3
userdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
}
protocol lda {
  auth_socket_path = /var/run/dovecot/auth-master
  lda_mailbox_autocreate = yes
  lda_mailbox_autosubscribe = yes
  log_path = /var/log/dovecot-sieve.log
  mail_plugins = quota mailbox_alias acl sieve
  postmaster_address = root
}
protocol lmtp {
  info_log_path = /var/log/dovecot-lmtp.log
  lmtp_save_to_detail_mailbox = yes
  mail_plugins = quota sieve
  postmaster_address = postmaster
  recipient_delimiter = +
}
protocol imap {
  imap_client_workarounds = tb-extra-mailbox-sep
  mail_max_userip_connections = 20
  mail_plugins = quota mailbox_alias acl imap_quota imap_acl antispam
}
protocol pop3 {
  mail_max_userip_connections = 20
  mail_plugins = quota mailbox_alias acl
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
  pop3_uidl_format = %08Xu%08Xv
}

I just tried to add the argument "-D" to add debug details, but this doesn't add anything.
Nothing in /var/log/mail.log, nothing in /var/log/dovecot.log , so the only result are in syslog:

Aug 20 20:21:13 mail imap: antispam: plugin initialising (2.0-notgit)
Aug 20 20:21:13 mail imap: antispam: verbose debug enabled
Aug 20 20:21:13 mail imap: antispam: "Junk" is exact match spam folder
Aug 20 20:21:13 mail imap: antispam: no unsure folders
Aug 20 20:21:13 mail imap: antispam: "Trash" is exact match trash folder
Aug 20 20:21:13 mail imap: antispam: pipe backend spam argument = --spam
Aug 20 20:21:13 mail imap: antispam: pipe backend not-spam argument = --ham
Aug 20 20:21:13 mail imap: antispam: pipe backend program = /usr/bin/sa-learn
Aug 20 20:21:13 mail imap: antispam: pipe backend program arg[0] = -D --username=guillaume.XXXX@nydomain.com
Aug 20 20:21:13 mail imap: antispam: pipe backend tmpdir /tmp
Aug 20 20:21:14 mail imap: antispam: mailbox_is_unsure(Junk): 0
Aug 20 20:21:14 mail imap: antispam: mailbox_is_trash(INBOX): 0
Aug 20 20:21:14 mail imap: antispam: mailbox_is_trash(Junk): 0
Aug 20 20:21:14 mail imap: antispam: mail copy: from trash: 0, to trash: 0
Aug 20 20:21:14 mail imap: antispam: mailbox_is_spam(INBOX): 0
Aug 20 20:21:14 mail imap: antispam: mailbox_is_spam(Junk): 1
Aug 20 20:21:14 mail imap: antispam: mailbox_is_unsure(INBOX): 0
Aug 20 20:21:14 mail imap: antispam: mail copy: src spam: 0, dst spam: 1, src unsure: 0
Aug 20 20:21:14 mail imap: antispam: running mailtrain backend program /usr/bin/sa-learn
Aug 20 20:21:14 mail imap: antispam: running mailtrain backend program /usr/bin/sa-learn
Aug 20 20:21:14 mail imap: antispam: running mailtrain backend program parameter 1 -D --username=guillaume.XXXX@mydomain.com
Aug 20 20:21:14 mail imap: antispam: running mailtrain backend program parameter 2 --spam
Aug 20 20:21:16 mail imap: antispam: run program failed with exit code -1

Something bad happends in sa-learn and return a bad exit code, then the antispam return to not move the email.

Regards