[TriLUG] SpamAssassin is wonderful...
Sun, 2 Jun 2002 01:15:48 -0400
I grabbed this off the Mandrake Forum a couple of weeks ago, and I've been
using SpamAssassin ever since. I have to say that it is quite awesome. I
still get a kick out of how well it ferrets out Spam! It tags well over
80% of my spam with absolutely no false positives (so far).
To install SpamAssassin, enter the MCPAN shell and execute the following
perl -MCPAN -e shell
o conf prerequisites_policy ask
(optional, used to check the RBL, RSS, DUL etc. and perform MX checks)
SpamAssassin can act as a Procmail filter and can be added to an individual
by editing (or creating) their .procmailrc file and adding the following
| spamassassin -P
We run the application on Mercury.srvr.haht.com (our corporate mailserver)
It runs as a subprocess of procmail which in turn is a subprocess of
Sendmail runs on Mercury and accepts an incoming mail from the outside
- Sendmail takes delivery of the message and discovers that the message
is for a local user (employee of HAHT)
- Sendmail invokes Procmail for the local delivery of the message.
- Procmail takes delivery of the message and searches the local
users home directory (/home/users/<username>/) for a configuration
file called .procmailrc. Note: Procmail also uses a global
configuration file (/etc/procmailrc)
- Procmail sees that the local configuration file for the user is
invoking a external mail filter called "spamassassin"
- Spamassassin starts up as a subprocess and performs 224 tests
on the message. Each positive test results in a number being
added to a running sum. No one single test can condemn an
email as being tagged as Spam. Normally a message must have
three or more elements associated with spam before it is
Currently the running value to tag a message as spam is set to "5". The
value is only adjustable by the root user of Mercury. This value is
adjustable on an individual basis, but "5" is the current system wide value
and is defined in the local configuration file:
Global changes can be made by editing this file.
Local or individual changes can be made by editing the users configuration
Individual user preferences over-ride the global settings, so an individual
can make themselves less sensitive to spam by raising the value for tagging
a message as Spam from "5" to some higher number.
Below is a sample Spam email that was processed by Spamassassin...
Subject: *****SPAM***** Lose weight SAFELY, guaranteed!
Date: Thu, 30 May 2002 22:04:58 -0400 (EDT)
From: email@example.com ()
SPAM: ------------------ Start SpamAssassin results --------------------
SPAM: This mail is probably spam. The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM: Content analysis details: (16.7 hits, 5 required)
SPAM: Hit! (-0.0 points) To: contains similar domains at least 10 times
SPAM: Hit! (2.7 points) Subject contains lots of white space
SPAM: Hit! (2.4 points) To: contains similar usernames at least 10 times
SPAM: Hit! (1.0 point) From: ends in numbers
SPAM: Hit! (0.5 points) Subject has an exclamation mark
SPAM: Hit! (4.1 points) BODY: Broken CGI script message
SPAM: Hit! (2.7 points) BODY: Claims you can be removed from the list
SPAM: Hit! (1.5 points) BODY: Asks you to click below
SPAM: Hit! (0.2 points) URI: Uses a username in a URL
SPAM: Hit! (-0.4 points) BODY: Contains a line >=199 characters long
SPAM: Hit! (2.0 points) Subject contains a unique ID number
SPAM: ------------------ End of SpamAssassin results -------------------
### <snip - actual spam email not included in this document> ###
I hope this is useful to folks looking to cut down on the amount of spam
they have to process. Take care,