358 Technique 47: Stopping Spam with SpamAssassin

• Figure 47-3: These are the packages that will be installed.

That’s it. Fedora (or SuSE) takes care of resolving the dependencies as it installs the spamassassin RPM package. Now, you need to start SpamAssassin, as described in the section, “Starting the service,” later in the technique.

Installing from RPM downloads

If you don’t have the Fedora or SuSE distribution media and don’t want to take the time right now to make a set, you can get SpamAssassin up and running with a quick visit to the SpamAssassin Web site. Follow these steps to download and install SpamAssassin:

1. Open your favorite browser and surf to

www.spamassassin.org/released/RPMs

2. Click the download links to retrieve the following RPMs:

perl-Mail-SpamAssassin-version.i386.rpm spamassassin-version.i386.rpm

Be sure to choose the most recent version and save the files to your Desktop.

3. Close the browser and open a terminal window.

Give yourself superuser privileges with the su command.

4. Move to your Desktop directory and install the packages with the following commands:

#cd ~/Desktop

#rpm -Uhv perl-Mail-SpamAssassin- 2.63-1.i386.rpm

#rpm -Uhv spamassassin-2.63-1.i386.rpm

That’s it — the perl-Mail-SpamAssassin package satisfies the dependencies of the spamassassin RPM package. You’re ready to start the service! See the next section for details.

Starting the service

You’ll get the best performance from SpamAssassin by running it as a client/server installation. Keeping the spamd daemon alert and on its toes saves startup time every time you get an e-mail message.

To start the SpamAssassin service, open a terminal window and give yourself superuser privileges with the su - command. Then enter the following command:

# service spamassassin start

The terminal echoes this message:

Starting spamd: [OK]

That’s it. You’re ready to configure SpamAssassin.

Fine-Tuning SpamAssassin to Separate the Ham from the Spam

You can fine-tune SpamAssassin to screen your e-mail more aggressively or less aggressively. If you screen more aggressively, you run the risk of missing a message that might be trapped by mistake; if you don’t

Fine-Tuning SpamAssassin to Separate the Ham from the Spam 359

screen aggressively enough, you’ll be greeted by spam in your e-mail client. It’s important to note that your e-mail client decides what to do with mail classified as spam, not SpamAssassin — SpamAssassin classifies each piece of e-mail; your e-mail client

can throw out spam messages or route it to a specific mailbox (we show you how to configure your e-mail client in the section, “Adding a New Filter to Evolution”).

The easy way to configure SpamAssassin is with the help of the SpamAssassin Configuration Generator. Open your favorite browser and surf to

www.yrex.com/spam/spamconfig.php

You’re taken to the SpamAssassin Configuration Generator, shown in Figure 47-4. The next two sections explain how to customize SpamAssassin and then save your configuration file.

• Figure 47-4: The SpamAssassin Configuration Generator.

If you’re using Webmin for administrative tasks, be sure to check out the Webmin interface for configuring the SpamAssassin Mail Filter. You find it in the Servers menu of your Webmin client. The SpamAssassin Configuration Generator at yrex.com is quick and easy, but Webmin gives you finer control over SpamAssassin. See Technique 17 for more information about Webmin.

Customizing settings

The Configuration Generator lists a series of settings that you can customize. Check the radio button next to the desired setting to add that value to the custom configuration file. The settings are described in the following list:

Score Threshold: The first setting in the Configuration Generator is for the Score Threshold. Each e-mail is assigned a score based on its content.

The higher the score, the more likely the e-mail is spam.

For example, if your threshold is set to 5, an e-mail with a spam score of 7 is considered spam, and an e-mail with a score of 3 is considered ham.

If you start out at 5, you’ll probably want to eventually lower the threshold. We’ve noticed that even at 3, we still get spam. Our suggestion is to start at 5, and watch what’s getting through before you set the threshold too low.

Rewrite Message Subjects: If you check the Rewrite Subjects box, the text string shown is written into the subject line before the e-mail is added to your inbox. This feature doesn’t work with the Evolution e-mail reader. If you’re using an e-mail client other than Evolution, a string such as “POSSIBLE SPAM - ” is a good choice that will make it easy to spot spam in your mailbox.

Encapsulate Spam in Attachments: If you accept the default, SpamAssassin encapsulates any message that scores above the spam threshold into a new message as a MIME attachment. This can help prevent accidental virus infection. For even more protection, select the Use Text-Only Attachments radio button. This feature doesn’t work with the Evolution e-mail client either.

Use Terse Reports: If enabled, SpamAssassin issues a shorter version of the spam report. If you get a lot of spam, you may want to go with a shorter report. This feature also does not work with Evolution (don’t worry; you don’t need it).

360 Technique 47: Stopping Spam with SpamAssassin

When used with Evolution, SpamAssassin acts as a filter. SpamAssassin classifies the e-mail as spam or ham, but it doesn’t make modifications to the e-mail. It does, however, put the e-mail into a separate folder so you can speed cruise it later.

Bayes Options: By enabling the Bayes Options, you allow SpamAssassin to learn what spam looks like from e-mails that score highly on the spam threshold. As each message arrives, SpamAssassin Bayesian filter searches it for words and phrases that appear often in spam messages. If a message contains many words and phrases that are commonly found in spam, SpamAssassin assumes that the new message is likely to be spam as well. SpamAssassin learns what spam looks like if you enable Bayes filtering.

Rather than shipping a set of rules to every user in the world, a custom set of rules is built for each user. For example, if a doctor actually wants all that e-mail about Viagra, he or she can tell the filter that.

Use Bayes System: Accept the default setting to use Bayesian analysis to identify spam.

Use Auto Learning: Accept the default setting to allow SpamAssassin to automatically train its Bayes database based on non-Bayesian classification rules.

Network Test Options: The Network Test Options uses information gleaned from the Internet to separate the spam from the ham.

The Network Test Options will slow down your e-mail traffic. The more e-mail you get, the slower your e-mail arrives because each piece needs to be verified against an Internet resource.

Enable RBL Checks: If you accept the default and enable RBL (Realtime Black List) checks, your incoming e-mail is compared to a blacklist. If the sender of the e-mail is on that list, the e-mail is considered spam.

Use Network Checksum Tests: Computed checksums on known spam are kept in several distributed databases. If you select this option and install the appropriate client software, your incoming e-mail messages are screened against the checksums maintained in the databases. Any matches are considered spam and are treated as such.

Language Options: You can set SpamAssassin filters to watch for the character sets or recognized language patterns in the body of the e-mail message. By default, all languages are accepted — check the boxes next to any languages you would consider to be spam.

Check the Use Language Testing box to read the body text of a message looking for recognized languages that can’t be distinguished by the character set alone. Hungarian and English use the same character set, so check this box to screen out excessive Hungarian spam.

Saving your settings

After you’ve customized your settings in the Configuration Generator (as described in the preceding section), follow these steps to save your configuration file:

1. Click the Generate the Configuration File button.

You’re taken to a new Web page, displaying the new configuration file (see Figure 47-5).

2. Click the Download This File button and save the file to disk.

You can either save the file in place or copy it into place later.

To save the configuration file into place for a single user, enter the following code in the File Name field of the Download Manager:

~/.spamassassin/user_prefs

To save the file into place for the entire system, copy the local.cf file into

# /etc/mail/spamassassin/local.cf