Table of Contents
SpamAssassin
SpamAssassin is one of the best-known Open Source spam filters. It is now an Apache Foundation project. The main advantage of SpamAssassin is that it integrates many different types of tests – each test adds to or subtracts from the message's "spaminess", and the message gets a final score that combines all the tests. The primary disadvantage of SpamAssassin is that it is relatively slow, because it is written in Perl and runs through a large number of tests. We believe that our boxes are plenty powerful enough to handle the load, especially with some of the Postfix spam-avoidance techniques (such as greylisting) that reduce the number of spam emails that make it into the system.
We're using MailScanner as an interface between Postfix and SpamAssassin. We chose it because it's quite easy to understand, as compared with configuring amavisd and others to interface with Postfix. It was also used on the old AIX systems, so we were able to re-use most of the existing configuration settings.
Installation
apt-get install -y spamassassin apt-get install -y mailscanner apt-get install -y razor pyzor dcc-client
Configuration
Run pyzor discover to update pyzor's server list:
pyzor discover
Create a location for MailScanner to put files for SpamAssassin to scan.
mkdir /var/spool/MailScanner/spamassassin chown -R postfix:postfix /var/spool/MailScanner chown -R postfix:postfix /var/lib/MailScanner chown -R postfix:postfix /var/run/MailScanner chown -R postfix:postfix /var/lock/subsys/MailScanner
Back up the original MailScanner config file.
cp -a /etc/MailScanner/MailScanner.conf /etc/MailScanner/MailScanner.conf.dist
Edit the file /etc/MailScanner/MailScanner.conf to change these lines:
%org-name% = SLUUG %org-long-name% = St. Louis UNIX Users Group %web-site% = www.sluug.org Max Children = 2 # Upped it from 1, to hopefully improve throughput. Run As User = postfix Run As Group = postfix Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = /var/spool/postfix/incoming MTA = postfix Sendmail2 = /usr/sbin/sendmail Virus Scanning = no Virus Scanners = none Dangerous Content Scanning = no Quarantine Infections = no Information Header = Always Include SpamAssassin Report = yes Mark Unscanned Messages = no Notify Senders = no # This is the default, but we want to be SURE on this setting! Virus Modify Subject = no Filename Modify Subject = no Content Modify Subject = no Size Modify Subject = no Disarmed Modify Subject = no Spam Modify Subject = no High Scoring Spam Modify Subject = no Send Notices = no Use SpamAssassin = yes # This is the default. Required SpamAssassin Score = 5 High SpamAssassin Score = 11 SpamAssassin Timeout = 120 High Scoring Spam Actions = delete Log Spam = yes Log Non Spam = yes
Edit /etc/MailScanner/spam.assassin.prefs.conf to add:
razor_config /etc/razor/razor-agent.conf
Edit /etc/razor/razor-agent.conf to add:
razorhome = /etc/razor/ logfile = sys-syslog
Create /etc/postfix/header_checks containing a single line, to have Postfix
send all incoming emails to the HOLD queue, where MailScanner will pick them up.
echo '/^Received:/ HOLD' > /etc/postfix/header_checks
Tell Postfix to put everything it receives into the HOLD queue.
postconf -e 'header_checks=regexp:/etc/postfix/header_checks'
Configure MailScanner to run when started.
echo 'run_mailscanner=1' >> /etc/default/mailscanner
Startup
Start the MailScanner daemon:
/etc/init.d/mailscanner start
Restart the Postfix daemon, to have it send incoming emails to the HOLD queue.
/etc/init.d/postfix restart
Testing
Check the logs for errors on startup, using tail -f /var/log/mail.log /var/log/syslog.
MailScanner logs to /var/log/syslog under the name check. (Not sure why it uses that name in the log files instead of its own.)
Notes
All SpamAssassin settings are global in nature and not settable on a per user basis. This is the reason that we set the delete threshold so high – some users may want a higher threshold than others. Those that want a lower threshold can do so using procmail filters (or whichever other delivery agent we choose). Those wanting special rules will also have to set them up as procmail filters.
TODO
We should really not use MailScanner's preferred method of picking up emails from the HOLD queue and injecting them back into the Postfix system via the INCOMING queue. Postfix documentation says that this method is not supported. Instead, there should be an SMTP-type listener added to /etc/postfix/master.cf, which will submit the scanned messages back into Postfix via another SMTP listener (also listed in master.cf) on another port. I believe amavisd supports this method. One main reason we went with MailScanner (at least at first) it that it's easier to configure than figuring out how to configure all the required services in master.cf.
Configure SpamAssassin more like Michelob/Dark. Their local.cf file looks like this:
# If this option is set to 0, incoming spam is only modified by adding # some `X-Spam-' headers and no changes will be made to the body. report_safe 0 ok_languages en # Trusted networks are assumed to not be originating spam. clear_trusted_networks trusted_networks 128.252.19.8 # michelob trusted_networks 128.252.19.9 # dark # Internal networks are other potential MXes for our domain. clear_internal_networks internal_networks 128.252.19.8 # michelob internal_networks 128.252.19.9 # dark internal_networks 206.196.99.162 # bud internal_networks 206.196.99.163 # budlight # Assume we always have DNS lookups available. dns_available yes # The score threshold below which a mail has to score, to be fed into # SpamAssassin's learning systems automatically as a non-spam message. bayes_auto_learn_threshold_nonspam -1.1 # The score threshold above which a mail has to score, to be fed into # SpamAssassin's learning systems automatically as a spam message. bayes_auto_learn_threshold_spam 11.0 # For feeding spam and and ham for saved messages, mailboxes # or directories: # Change X-YOURDOMAIN-COM to match your %org-name% as # set in MailScanner.conf bayes_ignore_header X-SLUUG-MailScanner bayes_ignore_header X-SLUUG-MailScanner-SpamCheck bayes_ignore_header X-SLUUG-MailScanner-SpamScore bayes_ignore_header X-SLUUG-MailScanner-Information # When using MailScanner, this is highly recommended. bayes_auto_expire 0 # What should be the maximum size of the Bayes tokens database? bayes_expiry_max_db_size 600000 lock_method flock use_auto_whitelist 0 # This should be explicitly set for MailScanner envelope_sender_header X-MailScanner-From # Reduce timeouts for RBSLs. rbl_timeout 20 razor_timeout 10 pyzor_timeout 10
Anti-virus
apt-get install clamav unrar lha arj unzoo
Edit /etc/MailScanner/MailScanner.conf:
Virus Scanning=yes Virus Scanners=clamav
and restart mailscanner.
For some reason, even though "Still Deliver Silent Viruses" is set to "no", the system is delivering messages stripped of infected attachments. This is contrary to the documentation in MailScanner.conf. Accordingly, virus scanning is now turned off.
Credits
Installed, configured, and documented by Craig Buchek.
Based on Mike Knight's MailScanner configuration on our AIX servers.
These articles helped me figure out how to configure Postfix and MailScanner to work together:
These articles helped me figure out why MailScanner was stopping without restarting,
due to razor putting its log file in /var/spool/postfix/hold:
Comments
