Filtering spam into a folder on Slackware/Sendmail using SpamAssassinPosted by: Andrew Smith
Poster contact info: asmith16 at littlesvr ca
Author: same as 'Posted by'
Software: Slackware 12.2
For years I've been manually filtering spam, and for years I wanted to set up some kind of spam filter on my mail server (I run my own Sendmail). Unfortunately if you've never done it the setup is really complicated and until now I never had the time to figure it out.
Now that I know how to do it I can probably do it again in less than 3 hours, most of which would be spent pressing enter in response to useless prompts.
My setup is:
- Slackware 12.2 (it has a huge uptime and I don't have a need to upgrade it)
- Sendmail from the distro, upgraded at some point via a Slackware security update
- Sendmail set up properly not to forward spam around, outgoing mail through my ISP, optionally accessed via SSL
- imapd for reading the email
In other words - nothing special really.
The short of it is this: you need to filter all the incoming mail through SpamAssassin, which will flag all mail with spam likelihood scores. Then you have to configure procmail (the default MDA used by Sendmail on Slack) to move the likely spam messages to a different folder.
Note: almost all the commands below need to be run as root. The one possible exception is creating the .procmailrc files.
Unless you're a hardcore Perl dude - you have to use CPAN to install it. Even so it will take several steps.
Step1: figure out what the dependencies are. To do this run
Step2: install all the dependencies. For me the command was
cpan HTML::Parser Net::DNS NetAddr::IP Digest::SHA1 \ Mail::SPF IP::Country Razor2 Net::Ident IO::Socket::INET6 IO::Socket::SSL \ Mail::DKIM LWP::UserAgent HTTP::Date Encode::DetectBut it might be different for you if you don't have the same version of Slackware as me.
This is a long process, and unfortunately it's not unattended. Even after the initial CPAN setup is done (which will happen if you never ran it before) it will keep coming up with prompts about extra dependencies and some other things. Basically you just have to press enter for any prompt that comes up.
You can expect this to take a couple of hours, though it depends on the speed of your network and your machine.
Step3: install SpamAssassin. Run the same command as you did in step 1:
There are plenty of warnings printed during the cpan runs above, you can ignore all of them.
The defaults (which I've tested now for a couple of days) are very good so actually you don't need to configure much at all. In the default
# rewrite_header Subject *****SPAM***** # report_safe 1 # trusted_networks 212.17.35. # lock_method flock #required_score 2.0 # use_bayes 1 # bayes_auto_learn 1 # bayes_ignore_header X-Bogosity # bayes_ignore_header X-Spam-Flag # bayes_ignore_header X-Spam-Status bayes_path /etc/mail/spamassassin/bayesThe
If in the future I will make more useful tweaks to the config - I will post them in a reply here.
Get the rules
Just run sa-update.
I figured this is a low-volume mail server and I don't care much about performance but I underestimated just how long a bunch of perl modules can take to load. If you're curious you can try to run this and see how long it takes:
time spamassassin --test-mode ~/.cpan/build/Mail-SpamAssassin-3.3.2-XDoMpI/sample-spam.txtThe exact directory name will be slightly different on your system. You can use your own sample email too of course.
On my system this took over 22 seconds (no kidding), which is completely unacceptable. So I tried using spamd/spamc instead. The improvement was massive.
Setup is a piece of cake: simply run
echo -n "Starting spamassassin daemon: " /usr/bin/spamd --daemonize --pidfile /var/run/spamd.pid echo "done."After the daemon is running try
The difference was shocking on my system. Instead of 22+ seconds this ran in 3+ seconds! All the loading time was spent just once, when starting the daemon.
Plugging it into Sendmail
By default Sendmail (the MTA) will use procmail as an MDA. But you might want to confirm that for your existing setup. If you still remember which .mc file you used to configure Sendmail, there should be a line like this in it:
MAILER(procmail)dnlIf there isn't - well, in that case you'll have to figure some things out yourself. It should be there.
Now we will tell procmail to send all mail less than 300k in size to SpamAssassin. Create the file
DROPPRIVS=yes PATH=/bin:/usr/bin:/usr/local/bin SHELL=/bin/sh # Spamassassin :0fw * <300000 |/usr/bin/spamcNo need to restart anything after changing this file, it gets reread for every message.
Now go send yourself an email and have a look at the headers. There should be several X-Spam-* headers in it. If there are - you're almost done! If not - stop now and figure out what step you missed.
Move spam automatically to a folder
I use a folder named "Spam" for all the garbage I receive. Unfortunately it looks like I had to create a per-user .procmailrc file to instruct procmail to do the move automatically. Basically for each user who you want to enble this for create a
:0 * ^X-Spam-Flag: YES SpamAnd if your spam folder is called something else - just use that instead. This folder wasn't there automatically, I created it manually years ago after I started receiving spam.
I'm not sure this part is required but I did it anyway, and it certainly didn't hurt. The idea is to show SpamAssassin lots of examples of messages you know to be spam and lots you know are not spam. This will only work of course if you kept all the spam you received to date in a separate folder:
sa-learn --showdots --mbox --spam ~andrew/Spam sa-learn --showdots --mbox --ham ~andrew/TrashThis took me about 30 minutes per 3500 messages, so be ready to wait after running it.
Now if you wait till you receive some spam and some real email - everything shold work. I was quite impressed with how good SpamAssassin is at identifying spam.