Hi all,

I am running a RH 8.0 server with sendmail, DNS, samba, dhcp, etc. I have successfully set up all of this myself over the past months (with help from all of you, of course!). Now, I get a ridiculous (don't we all...) and I would like to use spamassassin to filter it. Now, I know NOTHING about spamassassin. So, I guess what I am looking for is someone to gimme a hand learning it and configuring it. Here's what I have from "rpm -qa | grep sendmail" and rpm -qa | grep spamassassin":

sendmail-8.12.5-7
spamassassin-2.31-16

I don't recall ever installing spamassassin, so it either got installed with the initial RH install, or it was installed with sendmail. I don't know which. As far as I can tell, there is no spamassassin service running, but it's obviously (well, presumably) installed. I thought that in the /etc/mail directory there was a spamassassin subdir, but there is not. Ok, so...

How do I install spamassassin if it is NOT installed already and integrate it with sendmail?

How do I configure it? Does it run with sendmail or seperately?

How do I make it most effective?

How does it work, anyway?!

I guess I am looking for someone to work with me, and give me sort of a tutorial. Anyone willing to help me out? Thanks a million!

Chris

1. Make sure that you have these pieces of the puzzle: sendmail (you do!), spamd (the daemon portion of spamassassin), spamc (the client portion), and procmail (undoubtedly you do, but make sure).

2. Check that sendmail has a line similar to this one in the /etc/mail/sendmail.mc file:

FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl

3. Locate your main spamassassin directory. In RH9 it is in /etc/mail, but in RH8 it maybe in /usr/share/spamassassin. You are looking for a file called

user_prefs.template

4. Create a .spamassassin directory in your home directory and copy user_prefs.template into it, and rename it user_prefs

5. Create a file called .procmailrc in your home directory.

The .procmailrc file should contain these lines:

SHELL = /bin/bash

:0fw: spamassassin.lock
| /usr/bin/spamc

:0:
* ^X-Spam-Status: Yes
spam

6. Create an empty file in your home directory and name the file spam (at the commandline a "touch spam" will do).

If spamd and sendmail are running, restart them both.

From time to time, read through the spam file you created to see that it contains only spam. It may have a few non-spam items and you can add an entry to your user_prefs files to white_list those.

From time to time empty the spam file like so:

cat /dev/null > spam

Read through the other files in the spamassassin directory to tweak it. Read the Docs, too!

Hope that gets you started.

Cheers--
Charles

THANKS!!!

I will get to work on this tomorrow, and will post back here to let you know what's going on. Please check back tomorrow! Again, THANKS A MILLION!!!

Chris

Remember, spamassassin doesn't kill spam, it just marks it as spam. It is procmail that sends the "marked as spam" mail to the file called spam.

If you get stuck, just shout.

It is possible, too, if you are providing e-mail to many folk to do all this spamassassin stuff for them, but most users learn to use the user_prefs file pretty quick.

Cheers--
Charles

I have sendmail (obviously).
I have spamd and spamc. Both are in /usr/bin.
I have procmail.

I do have that line in the sendmail.mc file.

Found the file, it is in /usr/share/spamassassin.



All of that has been done.

Ah, ok. Here's where I am a little stuck, Charles. Sendmail is running (of course), but "spamd" is not, nor has it ever. Is spamd a service in RH so that I can simply type "service spamd start"? Or do I need to start it manually from /usr/bin? How can I put "spamd" in init so that it starts when the computer is booted (I think I can do this, but some reinforcement would help!)? Also, which needs to start first, sendmail or spamd, does it matter? Further help with those matters would be greatly appreciated! Again, thanks a million!

Chris

PS. How does Spamassassin work "out-of-the-box"? Without any configuration at all, what will it do? Nothing, or does it have some built-in capability at all? I'm sure I can figure out how to further configure it, but I'd like to know what it will do by default. Thanks!

Yes, you should be able to start spamd like so (at least on RH9 it works the way )

service spamd start

There may be command line switches you have to add, so read the docs, or maybe (just maybe) there is a /etc/spamd.conf file --I am not at my linux box, can you tell?

In the spamassassin directory, you will find all of the files that direct spamassassin "out of the box" so to speak. There is, for example, a spamssassin executable (as opposed to spamd spamc). It takes mail from a socket (25 I think) and hads it back to that socket and simply rewrites the subject line adding [SPAM] at the beginning of the line, and adding X-Spam-Status: Yes to the header (which is what procmail is looking for in the .procmailrc file). Spamassassin also adds an explanation to the beginning of the mail so you can see why it labeled any e-mail as spam. There is a file that sets this threshold score. Moreover, there is a set of files (whose names all begin with numbers) that contain the tests used for the scoring. The files are accessed in numerical order.

So, another program calls spamassassin, or you have to have spamc call spamd (it amounts to the same thing except spamc has a much smaller footprint than spamassassin does).

So, here is what happens: senmail gets the mail; it checks to see to whom it is to be delivered, and hands it off to procmail to do the actual delivery. Procmail checks to see if there is a .procmailrc file in the home directory of the person who gets the mail. If there is, it "runs" the script. In that script, you are sending *all* the mail for that user through spamc, which calls spamd, which returns the mail back to procmail, which thens tests to see if there is a line in the header "X-Spam-Status: Yes". If there is it then appends that mail to a file called "spam", but you can change the name of the file by just changing its name in the last line of the promail script you have.

HTH a little.

Cheers--
Charles

AFAIK, it doesn't matter, but as a matter of course I would always start spamd first, since promail will want to see it, and you can't be sure that as soon as sendmail is started it won't immediately receive mail.

Just tinker along, you will have it working before you know it. There is tons of information on the net about spamassassin. Be sure and snoop through the configuration files, like user.prefs and the other where user.prefs.template are stored. There you will find a number fo "tweaks."

Are we having fun yet!

Cheers--
Charles

YES!!!!

Haha. This is highly cool. So far, it has been much easier than I thought it would be. I like it, I like it a lot... lol. Thanks for all your help, bro! I'll continue to post back and let you know how the battle goes...

Chris

Hit a snag!

The command to start has proven to be: "service spamassassin start". When I run that, I get the following error:

Starting spamd: bind: Address already in use at /usr/bin/spamd line 135.
[FAILED]

Looking at that very file, I see that line 135 is this:

bind(Server, sockaddr_in($port, $addr)) || die "bind: $!";

Eh??!! lol, I have little idea what this means... Obviously, it has something to do with BIND, but what that is, I don't know. I'll look into it, but can you be of any help with this? Thanks!

Chris

Well, not being at my linux box, I am no help. When I get home later tonight I'll see. It may be that the service has to start in a given order, i.e. before bind (otherwise known as "named"). I would google for that exact error message and see what the net returns. I haven't had this error, so there maybe a configuration parameter for spamd so it uses a port that does not conflict. I would start there.

Cheers--
Charles

I have searched google, alltheweb, and every other search engine I can think of. I have also tried the spamassassin website, ISC, and a host of others. Nothing! Weird, indeed... I appreciate you looking into it when you get home. I am running out of ideas.

Chris

Well, it has nothing to do with the service called "bind" or "named." Rather, the question is who were you when you started the service? Root, or yourself as a regular user?

Cheers--
Charles

I was the root user. Always am when doing stuff like this. Did you find something?

Chris

Ok...

I stopped the named service and the sendmail service and started everything in the following order:

spamd
named
sendmail

Now, everything started fine, including spamd! I guess it was picky and being started before DNS. Now, I will look over the next few days about how well it filters spam before I even get to tweaking it. One thing that is troubling me, though. After doing all this, my internet access has slowed down to a crawl. I suppose that my ISP could simultaneously be wiggin out on me, but that seems awfully coincidental. Does spamassassin slow down the server heavily? Waddya think?

Chris

PS. Thank you VERY much for all of your help so far!!!

One other thing while I am thinking about it... Now, when I check my e-mail on my Outlook client, it goes a lot slower now than it ever did before. Is spamassassin responsible for that,too? Thanks!

Chris