SpamAssassin

What is SpamAssassin ?

SpamAssassin checks mail for spam using syntactic rules in perl and optional external modules. SpamAssassin integration with MTAs requires glue code such as external daemons (amasvid-new) or MIMEDefang with the sendmail Milter interface.

Installing Perl modules

Perl modules can be installed interactively using the CPAN module "# perl -MCPAN -e shell". On first use, CPAN asks questions most of which can be answered by <enter>. Choose to automatically install the missing modules when detected by CPAN. In theory, this would insure that all the missing modules are installed. In practise, SpamAssassin did not work properly (no spam detected) after installing in this way, so we'd recommend to install the perl modules instead in the order described below, which worked for us.

The modules are distributed in sub-directories of /usr/local/lib64/perl5 and /usr/local/share/perl5. It is still unclear if modules can be removed or not and how. Any module failing installation can alternatively be downloaded from the CPAN site and installed in this way :

# tar -C /usr/local -xvf module-x.y.z
# cd /usr/local
# chown -R root:root module-x.y.z
# cd module-x.y.z
# perl Makefile.PL
# make
# make install

Modules required by SpamAssassin

The modules below must be installed prior to installing SpamAssassin :

# perl -MCPAN -e shell
. . .
cpan> install CPAN
cpan> install YAML
cpan> install Digest::SHA1
cpan> install HTML::Parser
cpan> install Net::DNS
cpan> install LWP::UserAgent
cpan> install HTTP::Date
cpan> install IO::Zlib
cpan> install Archive::Tar
cpan> install MIME::Base64
cpan> install DB_File
cpan> install Net::SMTP
cpan> install Mail::SPF
cpan> install IP::Country::Fast
cpan> install Compress::Zlib
cpan> install Time::HiRes
cpan> install Mail::DKIM
cpan> install Mail::DomainKeys
cpan> install DBI
cpan> install DBD
cpan> install Encode::Detect
cpan> install Mail::SPF::Query
cpan> install Net::Ident
cpan> install IO::Socket::SSL
cpan> install Bundle::CPAN
cpan> install IO::Stringy
cpan> install Mail::Audit
cpan> install Unix::Syslog
cpan> quit

Installing SpamAssassin

Download and untar and install as below then test using the spamassassin command and check the files generated to make sure everything was OK. The -D flag affords getting an extended trace on the system output :

# tar -tvf Mail-SpamAssassin-x.y.z.tar.gz
# tar -C /usr/local -xvf Mail-SpamAssassin-x.y.z.tar.gz
# cd /usr/local/Mail-SpamAssassin-x.y.z
# perl Makefile.PL
# make
# make install
# sa-update --updatedir /usr/local/share/spamassassin
# spamassassin -t -D < sample-nonspam.txt > nonspam.out
# spamassassin -t -D < sample-spam.txt > spam.out

In practice, the basic syntactic tests in SpamAssassin are not very efficient. External modules can be used to extend, but are somewhat CPU or time-consuming. Below are a few modules that really work.

Installing SPF

Sender Policy Framework is a protocol to make sure senders send from legitimate domains. Install as below :

# perl -MCPAN -e shell
. . .
cpan> install Mail::SPF
cpan> install Mail::SPF::Query

Installing DCC

The Distributed Checksum Clearinghouse uses checksums of known spam to score the incoming mails. Download then install as below :

# tar -C /usr/local -xvzf dcc.tar.Z
# cd /usr/local/dcc-x.y.z
# ./configure
# make
# make install
# make clean
# cd /var
# mkdir dcc
# groupadd milter
# useradd -g milter -s /bin/bash milter
# chown -R milter:milter dcc

To use dcc, uncomment the dcc line in /etc/mail/spamassassin/v310.pre. Also authorize udp connections to port 6277 from your client ports and back. Provided you already accept outgoing protocols, accept port 6277 udp packets modifying /etc/rc.d/rc.firewall as below :

# vi /etc/rc.d/rc.firewall
. . .
iptables -A INPUT -p udp -j ACCEPT --dport 1024:65535 --sport 6277
:x
# /etc/rc.d/rc.firewall restart

Installing Razor

Razor uses checksums of known spam to score the incoming mails. It requires outbound access to tcp ports 7 and 2703. It requires perl modules Time::HiRes and Getopt::Long plus download razor-agents-x.y.tar.gz and install as below :

# perl -MCPAN -e shell
. . .
cpan> install Time::HiRes
cpan> install Getopt::Long
quit
# tar -C /usr/local -xvf razor-agents-x.y.tar.gz
# cd razor-agents-x.y
# perl Makefile.PL && make && make install && make clean
# cd
# razor-admin -create
# razor-admin -discover
# razor-admin -register

Installing Pyzor

Pyzor is a free database and software Hash Sharing System. It requires outbound access to udp and tcp port 24441 (from the mailing lists on the Pyzor site it seems that the Pyzor service is sometimes down). Download the tarball then install as below :

# tar -C /usr/local -xvf pyzor-x.y.z.tar.bz2
# chown -R milter:milter /usr/local/pyzor-x.y.z
# wget https://bootstrap.pypa.io/ez_setup.py -O - | python
# su milter
$ cd /usr/local/pyzor-x.y.z
$ python setup.py build
$ python setup.py install
$ pyzor discover
$ <ctrl>d
# mv /usr/bin/pyzor /usr/local/bin
# mv /usr/bin/pyzord /usr/local/bin

Language and locale check

Uncomment the TextCat language guesser in v310.pre and add the following lines to local.cf :

# Mail using languages used in these country codes will not be marked
# as being possibly spam in a foreign language.
# - english french italian russian
ok_languages en fr it ru

# Mail using locales used in these country codes will not be marked
# as being possibly spam in a foreign language.
# - english french italian russian
ok_locales en fr it ru

Another possible option to create local.cf is to use the Spam Assassin configuration generator.

The Bayes module

The SpamAssassin Bayes module uses databases of previously registered hams and spams to compare with incoming mails and assign probabilities. The module requires at least 200 hams and 200 spams in order to be used (enforced at run-time), but 3000 hams and 3000 spams to be fully efficient. You must provide the training mails. sa-learn affords analyzing them and initializing the databases using mbox or mbx mail folders. However, when using cyrus-imap, none of these formats is available. It is alternatively possible to use fetchmail to dump the messages from the existing cyrus-imap mailboxes. In the example below LearnSpam and LearnHam are shared imap folders that can be created using cyradm :

# cyradm --user postmaster --auth plain localhost
Password: 
localhost> cm LearnHam
localhost> sq LearnHam 307200
localhost> sam LearnHam myUser lrswipcda
localhost> cm LearnSpam
localhost> sq LearnSpam 307200
localhost> sam LearnSpam myUser lrswipcda
localhost> quit

Once the shared imap folders are created ham and spam mails can be manually copied using for example Thunderbird (not shown here). The Bayes database is created in the ~/.spamassassin directory using :

# sa-learn --clear
# sa-learn --sync
# sa-learn --dump magic

Before invoking fetchmail create a .fetchmailrc configuration file with permissions 700 :

# vi ~/.fetchmailrc
. . .
poll inner.studioware.com proto imap service 993 user "myUser" pass "myPass" ssl keep
<esc>

Fetchmail can now be invoked passing the mails to learn to sa-learn :

# fetchmail --folder 'LearnSpam' -m 'sa-learn --spam'
# fetchmail --folder 'LearnHam' -m 'sa-learn --ham'

Running SpamAssassin

SpamAssassin is not ran as such but used from the perl in MIMEDefang, itself being launched by the sendmail milter interface. So there is no daemon to put in place and nothing to launch !

Cyrus-IMAP

Main Page

ClamAV