Gallery

Stop spam the expert way: Build an anti-spam email server

Posted on 23 May 2005 at 16:20

(press Return when you are asked a question)

make (if you have any errors here, check for missing Perl modules and download them using cpan. For example, if you are missing the Digest::SHA1 module, as we were, run 'cpan install Digest::SHA1')

make install

You will have to type a different directory name, depending on the version of SpamAssassin that's available when you try this. Since we are going to use the spamd daemon, we need to start it whenever the system boots up. As with most daemons, you should add a startup script to /etc/init.d. There are a few sample ones contained in the spamd directory, and you should move the one appropriate to your Linux distribution to /etc/init.d and run it by typing:

/etc/init.d/spamd start

If you use SuSE Linux like us, you will need to download the script from kmail.kde.org/unsupported/spamd, because it is not included with the SpamAssassin source code due to licensing reasons.

SpamAssassin is now running on your server, but it is not integrated with your email system yet. For that we need to use a bit of software to glue SpamAssassin and your mail server program together. That glue is called Procmail.

Enabling Procmail

Procmail is a mail processing program, or Mail Delivery Agent (MDA), and we will be using it to move spam messages to a separate file, leaving your mailbox unmolested and populated with real email. For Procmail to work, your email server needs to be able to invoke it when a message arrives. As the final stage in the mail delivery process, the mail server passes messages to Procmail, which takes over and does various things such as saving the file to a mail file called Spam, or saving it in the real mail inbox. With Postfix, you need to edit the main configuration file called /etc/postfix/main.cf and add the line:

mailbox_command = /usr/bin/procmail

Sendmail users will need to add FEATURE('local_procmail') to their configuration program.

A less efficient method, which is easier for Qmail administrators, is to place a special file in each local user's home directory. Create a file called .forward if you use Sendmail or Postfix, or .qmail if you use Qmail. This file needs to contain the path to the Procmail program, which in SuSE Linux's case is /usr/bin/procmail, although other distributions tend to use /usr/local/bin/procmail. It should be written with a pipe character in front:

| /usr/bin/procmail

At this stage, we can forget about specific mail servers and just deal with Procmail. We can configure Procmail by editing two files. The global configuration file is called /etc/procmailrc, but users can have their own customisable ones in their home directory called .procmailrc. These files contain Procmail 'recipes', which are detailed instructions on how to filter email.

For our purposes, we want Procmail to run mail through SpamAssassin, which will add some tags showing how spam-like the message is, and then have Procmail move any tagged messages to a Spam archive file. We will move mails that are almost certainly spam into a folder called almost-certainly-spam, and mail that's probably spam into a folder called probably-spam.

All of the following lines should be entered into either /etc/procmailrc or an individual user's ~/.procmailrc file. We have added comments to show what each recipe does.

# This is the procmailrc file, saved

# in the /etc directory

# The lines below are some standard

# set up parameters used by Procmail.