Level 1

140 points

Blocking 100% of SPAM

I am currently using SpamAssasin, along with the great tool spamtrainer on our OS X servers.

However I am now looking into even more powerful SPAM blocking that will guarantee 100% blocking, such as services like SpamArrest:

http://www.spamarrest.com/tryit/index.jsp?1153522346495

Does anyone know of anything similar or close to being able to block 100% of SPAM? I was hoping that something like this could be installed on OS X server, instead of having to pay for a service.

Any suggestions are very much welcomed. Thanks.

Power Mac G5, Dual 2.0, Mac OS X (10.4.2)

Posted on Jul 21, 2006 3:55 PM

29 replies

davidh

Level 4

1,896 points

Aug 1, 2006 4:24 PM in response to Paul Wharff

Glad I could help along with the others who posted here.

I'd hate for you to think you'd exhausted your options when it seems more like you haven't fully explored the ones in front of you 🙂

The information about minimum feeding for SpamAssassin is in the Apple docs for your server, always a good first place to start.
See page 51 of the Mail Service pdf
http://images.apple.com/server/pdfs/MailServicev10.4.pdf

You can find that along with the rest of the documentation on the install DVD
as well as here:
http://www.apple.com/server/documentation/

Good luck !

Paul Wharff Author

Level 1

140 points

Aug 2, 2006 1:47 PM in response to davidh

Is the below still an issue and will it greatly help my situation:

sudo serveradmin stop mail
cd /var/amavis/
sudo mv .spamassassin spamassassin.bak
sudo ln -s /var/clamav/.spamassassin /var/amavis/.spamassassin
serveradmin start mail

I've seen different variations of this hack. Which is the proper one?

UptimeJeff

Level 4

3,479 points

Aug 2, 2006 1:57 PM in response to Paul Wharff

You can remove either directory and link the removed to the existing..... doesn't matter which one is real and which is a link. The code you posted is fine.

Your data is split-up, you will lose whatever was in the database you delete. After you do the fix, feed the system a as much spam and ham as possible. Many people say a minimum of 200, I ask my clients for a minimum of 1000 of EACH.

You may also want to:

- Install RAZOR2
- Enable network tests
- Add extra SARE tests
- Make sure you have a GOOD training/correction routing. If you don't correct the system, it will continue to make mistakes.

Directions for these recommendations are all available in the forum.

Jeff

gunzee1

Level 1

20 points

Aug 2, 2006 2:57 PM in response to Paul Wharff

Razor is now free for commercial use. It helped a lot on my server.

See this page for general setup tips for SpamAssassin on OS X - http://wiki.apache.org/spamassassin/SpamAssassinon_Mac_OS_XServer

See this page to get Razor2 - http://razor.sourceforge.net/

pterobyte

Level 6

11,104 points

Aug 2, 2006 11:49 PM in response to gunzee1

While I agree that Razor can help reducing spam, from my experience, a well tuned spamassassin can do without. So I suggest you keep it simple: Training, rules, symlink. The use it for a month and see if you want to further improve.
Also make sure you are making all proper tests at the postfix level as well. RBLs and checking for non FQDN reduce a lot of spam already.

Paul Wharff Author

Level 1

140 points

Aug 3, 2006 12:31 PM in response to pterobyte

Thank you Alex, I'll try to do my best at the main points you made. Thank you very much for your involvement in this community!

Paul Wharff Author

Level 1

140 points

Aug 3, 2006 1:42 PM in response to davidh

David,

On a previous thread you posted which Rules you're using from:

http://www.rulesemporium.com/rules.htm

However I was only able to find about half of the ones you're using. Here are the ones I can no longer find on their website:

88 FVGTheaders.cf
88 FVGTsubject.cf
88 FVGTuri.cf
antidrug.cf
backhair.cf
chickenpox.cf
weeds.cf

Also, I wasn't able to find much regarding the installation/configuration of these rules except for this, which you had posted before:

"Anytime you change/update your configuration manually, you'll want to run:"
sudo su clamav -c "spamassassin -D --lint"

"They get installed into /etc/mail/spamassassin
be sure to pay attention to the file permissions,
-rw-r--r-- 1 root wheel 3880 Jun 21 2005 weeds.cf"

"the only exception being "learn junkmail" which should be executable. That's Apple's script that runs for training spamassassin."

I am taking down our Companies email server tonight to update it from 10.4.2 to 10.4.7.

Here is how I see I will perform all of these updates:

1) Run Software Update and update to 10.4.7
2) run mailbfr-0.4.6 to fix email
3) Fix Sym-link issue
4) Install Rules

You said:

"Anytime you change/update your configuration manually, you'll want to run:"
sudo su clamav -c "spamassassin -D --lint"

Would this include when I run spamtrainer and/or Software Updates or changes in SA?

Sorry for being so anal-retentive, but I just want to make sure that I understand all the "loose ends". Thanks again for your help and suggestions.

UptimeJeff

Level 4

3,479 points

Aug 3, 2006 2:02 PM in response to Paul Wharff

Paul,
Look in the Other Rules section:
http://www.rulesemporium.com/other-rules.htm

Jeff

Paul Wharff Author

Level 1

140 points

Aug 3, 2006 2:15 PM in response to UptimeJeff

Thanks Jeff, much appreciated. Any idea about my questions above regarding installation configuration of these rules into 10.4.7 server?

UptimeJeff

Level 4

3,479 points

Aug 3, 2006 6:56 PM in response to UptimeJeff

The installation is easier than you think.
Save the files into /etc/mail/spamassassin/
Remove the .txt from the end of each file (should end in .cf).
Make sure permissions are as set as listed in prev post (you probably need to issue: sudo chown root:wheel *.cf)
issue spamassassin --lint (as listed in prev post)
Stop/Start Mail service

If you are rebuilding tonight and get stuck, you can IM me at
jdj atmac.com
No sure if I'll be near the computer, but you are welcome to try.

Jeff

Paul Wharff Author

Level 1

140 points

Aug 3, 2006 9:04 PM in response to UptimeJeff

Thank you so very much Jeff. I'm actually right in the middle of upgrading and applying the Junk mail rules now. I'll IM you if I get stuck. Thanks again for your help.

pterobyte

Level 6

11,104 points

Aug 3, 2006 11:55 PM in response to Paul Wharff

Jeff already answered most of this. Just one remark:

"Anytime you change/update your configuration
manually, you'll want to run:"
sudo su clamav -c "spamassassin -D --lint"

This will most likely give you some errors due to local.cf
Luckily most are irrelevant, since on OS X spamassassin is driven by amavisd.
So look mainly for errors related to your rules.
More info: http://wiki.apache.org/spamassassin/SpamAssassinon_Mac_OS_XServer

2) run mailbfr-0.4.6 to fix email

Never run mailbfr -f just for the sake of it. I f you have a broken database do. If not, don't. Normally a system update will not cause harm to your mail database. Make sure you stop mail before applying any updates.

Alex

davidh

Level 4

1,896 points

Aug 4, 2006 4:09 AM in response to Paul Wharff

As noted elsewhere (by another poster), some of those "other" rules have now been incorporated into SpamAssassin, eg: backhair

see http://spamassassin.apache.org/tests3_0x.html

In order to avoid decreasing SpamAssassin performance, choose your additional rules carefully

Paul Wharff Author

Level 1

140 points

Aug 4, 2006 10:29 AM in response to pterobyte

I ran all the updates on both of our OS X servers last night. I did notice the errors due to local.cf and UptimeJeff was able to help me via IM (Thanks Jeff!). I did not have to run mailbfr, but thought I would have to since the last time I upgraded from 10.4.2 to 10.4.6, my email kept crashing. Fortunately this didn't happen this time. Everything went very smooth, especially thanks to everyone here and their info that helped me prepare for this! Now we shall see if the SPAM intake decreases?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Blocking 100% of SPAM