Recipe 21.10. Setting Up SpamAssassin Without Amavisd-new

21.10.1 Problem

You're not using Amavisd-new, so how can you use SpamAssassin with Postfix?

21.10.2 Solution

Use Courier-Maildrop to pass traffic between Postfix and SpamAssassin. After installing Courier-Maildrop, edit or create /etc/maildroprc, adding these lines:

if ( $SIZE < 26144 )

{

    exception {

       xfilter "/usr/bin/SpamAssassin"

    }

}

   

if (/^X-Spam-Flag: *YES/)

{

    exception {

        to "$HOME/Maildir/.junkmail/"

    }

}

else

{

    exception {

        to "$HOME/Maildir/"

    }

}

The .junkmail folder, or whatever you want to call it, must already exist. $SIZE < 26144 specifies a minimum message size to send to SpamAssassin; you can tweak this to suit your needs.

Then add this line to /etc/postfix/main.cf, to tell Postfix to use Maildrop for delivery to Linux system accounts:

mailbox_command = /usr/bin/maildrop -d ${USER}

Run postfix reload, and you're finished.

The default SpamAssassin configuration is a good starting point; run it for a while without changing anything. See the "Discussion" section of this recipe for a sample configuration and explanations of the options.

21.10.3 Discussion

If you're hosting virtual domains on your Postfix server, don't use the mailbox_command directive. Instead, add these lines to main.cf:

maildrop_destination_recipient_limit = 1

virtual_transport = maildrop

Then add the following lines to /etc/master.cf:

 maildrop  unix  -     n     n     -     -     pipe

  flags=DRhu user=vhosts argv=/usr/bin/maildrop -d ${recipient}

There's a tricky bit here, in user=vhosts. Maildrop must run as the same user that owns the virtual mailboxes, which should be a unique user created just for the job. It must not be the "nobody," "postfix," or root user. (See Recipe Recipe 20.15.)

Restart Postfix, and you're done.

Configuring SpamAssassin is pretty simple. The global configuration file is /etc/spamassassin/local.cf. Here is a sample configuration:

required_hits 8.0

rewrite_subject 1

use_terse_report 1

report_safe 0

skip_rbl_checks 0

use_bayes 1

auto_learn 1

Here's a rundown of what the above options mean:

required_hits 8.0

The higher the number, the fewer messages SpamAssassin will mark as spam. You can adjust this up or down as you get SpamAssassin trained.

rewrite_subject 1

Adds "*****SPAM*****" to the subject line.

use_terse_report 1

Use a shorter report format.

report_safe 0

Adds SpamAssassin reports to the message headers, without altering the rest of the message. Set this to 2 if you have any Windows clients. Level 2 converts the messages to an attachment or type text/plain, which adds a level of protection.

skip_rbl_checks 0

By default, SpamAssassin checks DNSRBLs; this setting turns them on. Set this to 1 to turn them off if you are doing DNSRBL checks somewhere else.

use_bayes 1

Use the built-in Bayes classifier. You definitely want this enabled; it is what makes SpamAssassin so smart.

auto_learn 1

Feed high-scoring mails to the Bayes classifier.

Complete options are spelled out in perldoc Mail::SpamAssassin::Conf. That's a command, if you're not familiar with Perldocs:

$ perldoc Mail::SpamAssassin::Conf

Perldocs are also available online and in man page format.

21.10.4 See Also

• Postfix's MAILDROP_README

• Mail::SpamAssassin::Conf(3)

• maildrop(1)