This is specific to the migration from amber to the second system named bock.

SpamAssassin Installation and Configuration

Package Installation

Packages installed for SpamAssassin
Prerequisite packages
libcrypt-openssl-bignum-perlaccess OpenSSL multiprecision integer libraries
libcrypt-openssl-rsa-perl module for RSA encryption using OpenSSL
libmail-dkim-perl cryptographically identify the sender of email
libmail-spf-perl Perl implementation of SPF and Sender ID
libsys-hostname-long-perl Figure out the long (fully-qualified) hostname
Recommended or suggested not already installed
libbsd-resource-perl BSD process resource limit and priority funcs
libencode-detect-perl detects the encoding of data
geoip-database GeoIP library (country database)
geoip-database-extra GeoIP library (ASN/city database)
libgeoip1:amd64 non-DNS IP-to-country resolver library
libgeo-ip-perl Perl interface to GeoIP library
libnet-cidr-lite-perl for merging IPv4 or IPv6 CIDR address ranges
pyzor spam-catcher using a collaborative network
razor spam-catcher using a collaborative network
Base SpamAssassin
re2c tool for generating fast C-based recognizers
sa-compile Tools for compiling SpamAssassin rules into C
spamassassin Perl-based spam filter using text analysis
spamc Client for SpamAssassin spam filtering daemon

At the time of implementation, there were recommendations to use MaxMind GeoIP2, but this was not found in Debian repositories. And there were warnings that other DB editions "require you to purchase a license". So the legacy GeoIP was used. We have no need for city databases, only country and continent.

DCC

DCC code is not included with any Debian package. The plugin included with SpamAssassin relies on on a package that must be downloaded and installed from scratch. This is no mentioned in the Debian packaging, and not explicit in the SpamAssassin documentation.

Download via the URL in the SpamAssassin documentation.

tar zxf mail-spamassassin/packages/dcc-1.3.163.tar.Z
cd dcc-1.3.163
rm -rf /tmp/dcc_base
mkdir  /tmp/dcc_base

var_dir=/var/lib/dcc                    # For production
unset DCC_OWN DCC_GRP MANOWN MANGRP     # For production
dcc_user=dcc-daemon                     # For production
run_dir=/var/run/dcc                    # For production


make > ../dcc-make-log.txt 2>&1

addgroup --gid 6000 dcc-daemon
adduser --uid 6000 --gid 6000 --shell /bin/sh --disabled-password \
        --home /var/lib/dcc --no-create-home \
        --gecos "DCC Daemon" \
        dcc-daemon

make install > ../dcc-install-log.txt 2>&1

chmod go+rx /var/lib/dcc
chmod go+rx /var/lib/dcc/bin /var/lib/dcc/man /var/lib/dcc/log
Other

Deleted "spamd" user and group, and associated /home/spamd/ directory. The origin of these is unknown. Debian uses "debian-spamd" for the spamd user/group with uid/gid numbers in the "system" range.

Make sure the spamassassin.service is enabled and running.

Spamassassin Configuration

Custom rules were added in a separate config file force_score.cf to allow forcing increments or decrements to the score. This is trigger various actions on a score, such as rejection or changing the subject. This is by having the Subject: contain "Force Score " followed by numbers such as 02, 15, or -05. The score is incremented by the sum of those numbers on the subject line. Multiple numbers may be combined, but only once each. Unfortunately, this is a added to other test results, not an exact score. A subject using all the valid numbers would be:

Subject: Force Score by 02 04 10 15 -01 -03 -05 -08

Actions based on score:

Optional tests implemented
Misc configuration

A crontab entry runs script get_phishing_feeds.sh daily.

Not implemented

Postfix Integration

There are several tools for integration into the mail server. Considered and rejected include: mimedefang, amavisd, milter-manager, SAQ. In the past we used MailScanner, but changed to use a milter. This meant the headers added to mail are different.

spamass-milter

Ordering of clamav-milter and spamass-milter was for clam to be after SA, due to clam almost never rejecting any mail.

Logging to a specific log was implemented. This allows the SpamAssassin scores and test results to be reviewed in one compact location instead of being mixed with thousands of other log entries.