THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
Integrated into Sendmail
With Sendmail, Spamassassin can be called for every user by editing /etc/procmailrc . More details at http://www.stearns.org/doc/spamassassin-setup.current.html#sitewide
An alternative is to use the smtp-vilter high-performance content filter using the sendmail milter API which has a backend for Spamassassins spamd. More details at http://www.etc.msys.ch/software/smtp-vilter/
Integrated into Postfix
This is just a summary of the following websites. Go there for more detailed information.
http://www.geocities.com/scottlhenderson/spamfilter.html
http://www.dambrosioauto.com/razor_config.html
http://www.ijs.si/software/amavisd/#faq-spam
This document describes the configuration for sitewide use of SpamAssassin with Amavis and Razor. The distribution used is SuSE Linux 9.0. If you use something else, some options may be different. For example Amavis may run as user amavis, not vscan and the path to the Amavis spool directory may be
/var/amavis not /var/spool/amavis
- Postfix Configuration*
/etc/postfix/master.cf:
Add these lines to the end of the file
smtp-amavis unix - - y - 2 smtp -o smtp_data_done_timeout=1200 -o disable_dns_lookups=yes 127.0.0.1:10025 inet n - y - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes
After that, the master.cf file should look like this
# ========================================================================== # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes) (never) (100) # ========================================================================== smtp inet n - y - - smtpd #628 inet n - n - - qmqpd pickup fifo n - y 60 1 pickup cleanup unix n - y - 0 cleanup qmgr fifo n - y 300 1 qmgr #qmgr fifo n - n 300 1 nqmgr rewrite unix - - y - - trivial-rewrite bounce unix - - y - 0 bounce defer unix - - y - 0 bounce flush unix n - y 1000? 0 flush proxymap unix - - n - - proxymap smtp unix - - y - - smtp relay unix - - y - - smtp # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 showq unix n - y - - showq error unix - - y - - error local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - y - - lmtp smtp-amavis unix - - y - 2 smtp -o smtp_data_done_timeout=1200 -o disable_dns_lookups=yes 127.0.0.1:10025 inet n - y - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes
/etc/postfix/main.cf:
- myorigin - domain mail from this machine appears to come from.
postconf -e "myorigin = domain1.com"
Replace domain1.com with your actual domain.
- myhostname - the fully-qualified domain name ("FQDN") of the machine running the Postfix system.
postconf -e "myhostname = spamfilter.domain1.com"
- mydestination - specifies for which domains this machine will accept mail
(from the outside, i.e., from the Internet). You want to list here ONLY
domains that you are responsible for which you are responsible for accepting mail.
Separate them with commas.
postconf -e "mydestination = domain1.com, domain2.com"
- mynetworks - the machines I trust, and will relay mail for, to any destination.
Generally, this is set to my LAN, or just one, or a few trusted internal mail servers.
This is an important one to get right, or else you can become an "open relay".
In other words, your box could accept and forward mail to domains for which it has
no business doing so. Being an "open relay" is a serious issue, and can cause you to get
"blacklisted" by various Internet anti-spam lists, among other problems.
postconf -e "mynetworks = x.x.x.x/32"
(where x.x.x.x is the IP address of a specific machine)
If you will be dealing with multiple internal mail servers, and/or want to allow several machines
and/or subnets to relay through this server (carefull!!), just add them to this parameter in CIDR format,
like this:
postconf -e "mynetworks = 172.20.32.5/32, 10.0.0.0/16, 172.20.16.0/8"
(the above will allow the machine 172.20.32.5, and any machines that have an IP address starting
with 10.0, or 172.20.16, to relay smtp mail through this box)
- biff - we won't use biff notifications
postconf -e "biff = no"
- smtpd_banner - what this server calls itself, when talking with other mail servers
postconf -e "smtpd_banner = mail.domain1.com"
- message_size_limit - maximum size email that postfix will let in the "front door"
postconf -e "message_size_limit = 1000000000"
(The above allows emails up to 1GB)
- local_transport - give an error message for local delivery attempts.
postconf -e "local_transport = no local mail delivery"
- local_recipient_maps - don't try to determine valid email recipients
In our situation, the postfix server will have no idea if we have a bob@domain1.com or a
jsmith@domain2.com, etc. It doesn't have any such lists to check against!
We could fix this, but it is far easier to just ignore this problem.
If mail comes in to a recipient that I don't have, postfix will process it and
transport it on to the internal mail server, which will promptly reject it and will
attempt to do the NDR (non-delivery report) to the stated sender email address.
There are other potential solutions here, but I will only cover this simple configuration,
which works fine. So we'll just set this value to nothing:
postconf -e "local_recipient_maps = "
/etc/postfix/transport
Postfix will check the transport file for redirection or relaying of mail addressed to particular domains. In our case, all inbound mail will be relayed on to other mail servers:
domain1.com smtp:[x.x.x.x]
domain2.com smtp:[y.y.y.y]
(DO include the brackets on these lines!)
*These lines tell postfix to transport any mail addressed to recipients in domain#.com to the mail servers at the IP address(es) specified (i.e. your internal mail server(s), using the smtp protocol. The format is exacting, get every symbol correct and leave some white space between the domains and the "smtp" part.
After that run the command:
postmap /etc/postfix/transport
- Amavis configuration*
Amavis is just used for spam detection, not virus protection. See the options below.
/etc/amavisd.conf
Change the following options:
- $mydomain = 'example.com'
Change 'example.com' to 'domain1.com'
- @bypass_virus_checks_acl . . . .
Change to @bypass_virus_checks_acl = qw( . );
We only want spam protection and no virus scanning, so this will disable virus scanning for all
your domains.
- $mailfrom_notify_spamadmin . . .
Change
"spam.police@$mydomain"; to "postmaster@domain1.com";
- #$spam_quarantine_to = 'spam-quarantine';
and insert a # symbol at the beginning of that line On the very next line, you'll see:
#$spam_quarantine_to = "spam-quarantine@$mydomain";
Here, remove the leading # symbol. (And make sure you have an emailbox for this address on a destination server -
This is where you will review quarantined emails, and will forward on any "false positives" to the proper recipient.)
*Alternative:* Instead of delivering the spam to an emailbox on the internal server, drop it into a folder right on the spamfilter. To do that, comment out the "spam_quarantine_to" line above that references the email address, and instead select and indicate a folder name for the value "spam_quarantine_to". (Read the comments in this area of amavisd.conf for more info.)
Go to the chapter # SpamAssassin settings When you run SpamAssassin with Amavis, you have to do most of the configuration in amavisd.conf.
See http://www.ijs.si/software/amavisd/#faq-spam for details.
- $sa_local_tests_only = 0;
If you want to use Razor, this has to be set to 0.
- $sa_tag_level_deflt = -999;
The number of hits needed to update the mail headers.
With a value of -999 all headers will be updatedt with X_Spam_Flag, X_Spam_Level and X_Spam_Status
- $sa_tag2_level_deflt = 5.0;
The number of hits required to set X_Spam_Flag to Yes.
- $sa_spam_subject_tag = '***SPAM*** ';
Remove the # if you want ***SPAM*** to be added to the subject of spam mails.
- SpamAssassin configuration*
Go to /etc/mail/spamassassin and edit local.cf. My file looks like this.
Be sure to doublecheck this options with amavisd.conf. If one of these options is in amavisd.conf, the one in local.cf will not be used.
# Add your own customisations to this file. See 'man Mail::SpamAssassin::Conf' # for details of what can be tweaked. # # How many hits before a message is considered spam. required_hits 5.0 # Whether to change the subject of suspected spam rewrite_subject 0 # Text to prepend to subject if rewrite_subject is used subject_tag *****SPAM***** # Encapsulate spam in an attachment report_safe 1 # Use terse version of the spam report use_terse_report 0 # Enable the Bayes system use_bayes 1 # Enable Bayes auto-learning auto_learn 1 # Enable or disable network checks skip_rbl_checks 0 use_razor2 1 use_dcc 0 use_pyzor 0 # Mail using languages used in these country codes will not be marked # as being possibly spam in a foreign language. ok_languages all # Mail using locales used in these country codes will not be marked # as being possibly spam in a foreign language. ok_locales all
Amavis expects to see spamassassin's user_prefs file in /var/spool/amavis/.spamassassin but that directory and that file do not exist. Spamassassin's Bayes data is also stored there.
cp -r /root/.spamassassin /var/spool/amavis
This will create it (and copy user_prefs to that directory at the same time).
chown -R vscan:vscan /var/spool/amavis/.spamassassin
Give amavis ownership
If you run spamassassin --lint -D from a command line you will notice that
spamassassin looks for config files in /root/.spamassassin and razor files in /root/.razor
This is misleading and confusing because
that is not where it looks when it runs under amavis.
You can create symbolic links to help make the command line debug look cleaner.
Also, it will not find any Bayes files in /root/.spamassassin so the
symbolic links will help there too.
cd /root/.spamassassin
rm user_prefs
ln -s /var/spool/amavis/.spamassassin/user_prefs user_prefs
ln -s /var/spool/amavis/.spamassassin/bayes_seen bayes_seen
ln -s /var/spool/amavis/.spamassassin/bayes_toks bayes_toks
- Razor configuration*
Open port 2703 in your firewall.
razor-client
This creates sym-links
razor-admin -d -create
Creates files in /root/.razor and shows debugging info.
razor-admin -register
Creates a random user name and password.
Necessary for data access to Razor2 servers.
razor-admin -discover
Refreshes the list of razor servers
Razor has to be patched to run under SpamAssassin.
Browse to http://www.ijs.si/software/amavisd/Razor2.patch-quinlan
use Save Page As and save in:
/usr/lib/perl5/vendor_perl/5.8.1/i586-linux-thread-multi/Razor2
cd /usr/lib/perl5/vendor_perl/5.8.1/i586-linux-thread-multi/Razor2
patch -p0 < Razor2.patch-quinlan
vi /root/.razor/razor-agent.conf
and insert
razorhome = /var/spool/amavis/.razor
Change the debuglevel from 3 to 0 or the log file will eventually
consume all disk space.
Save the file. We are going to copy Razor to it's new home in a moment.
Seems Amavis is not happy unless Razor is in that directory and it owns it.
cp -r /root/.razor /var/spool/amavis
This copies the stuff we need to where we need it.
razor-admin -d -create -home=/var/spool/amavis/.razor
This tries to force Razor to live there.
chown -R vscan:vscan /var/spool/amavis/.razor
Now amavis owns it.
vi /var/spool/amavis/.spamassassin/user_prefs
and insert
razor_config /var/spool/amavis/.razor/razor-agent.conf
This forces SpamAssassin to find the file here.
Integrated into Qmail
Can be integrated via qmail-scanner, an add-on to qmail. Info available at http://qmail-scanner.sourceforge.net/
This is actually quite easy. SA is auto-detected when you install qmail-scanner, and uses the spamd/spamc combo if available. Here is my configure line (sans private data):
$ ./configure --spooldir /var/lib/qmailscan --qmaildir /var/qmail --bindir /var/qmail/bin \ --qmail-queue-binary /var/qmail/bin/qmail-queue --admin postmaster@example.com --domain example.com \ --notify none --local-domains example1.com,example3.com,some.other.domain.net --silent-viruses auto \ --lang de_DE --debug 1 --unzip 0 --add-dscr-hdrs 0 --archive 1 --redundant no --log-details \ --fix-mime 1 --scanners "verbose_spamassassin" --install 1
Integrated into Exim
SpamAssassin can be integrated into [http://www.exim.org/ Exim] in three ways:
As an [http://duncanthrax.net/exiscan-acl/ Exiscan]-extended ACL condition stack, Exim can reject spam after reading the body, but before Exim acknowledges acceptance of the email. [http://www.debian.org/ Debian Linux]'s exim4-daemon-heavy comes with the exiscan patch built in. You can discover its presence in your distro's exim binary directly with the command
exim -bVorexim4 -bV; look for the phraseContains exiscan-acl patch.As an Exim 4.x loadable module or local_scan.c replacement. [http://marc.merlins.org/linux/exim/sa.html SA-Exim] also allows SpamAssassin to reject spam before its accepted by your MTA.
As an [http://dman13.dyndns.org/~dman/config_docs/exim-spamassassin/ Exim transport].