Re: Starting SA with Procmail

[Hans du Plooy <hansdp@sagacit.com>]

On Mon, 2005-07-04 at 07:20 -0500, John Fleming wrote:
> You shouldn't have to give up.  I suspect a lot of people use procmail just 
> as you have described you want to do.  It is the simplest implementation of 
> SpamAssassin, ClamAV, and Postfix, and works great.  You shouldn't be 
> limited as to whether you use it site-wide of user-specific.

I missed the original post, but I'll offer you my experiences.  I setup
mail servers all the time for antivirus and spam scanning.

Through procmail starting spamassassin is best done with spamc and
spamd, because it lightens load on the machine a lot.  Your procmail
recipy should look like this:

:0hbfw: spamassassin.lock
*<256000
|/usr/bin/spamc

This will chuck your mail through spamassassin and mark it (according to
the settings in $HOME/.spamassssin or /etc/spamassassin

Once that's done, you can use something like:

:0
*^X-Spam-Flag: YES
/home/hans/caughtspam/

or

:0
*^Subject:.*****SPAM*****
/home/hans/caughtspam/

BUT: Really the best and most elegant way to do virus and spam checking
(and loads easier to troubleshoot) is with amavisd-new

apt-get install amavisd-new spamassassin razor pyzor clamav

In your /etc/master.cf (assuming you use postfix, I don't know how the
others work), put:

smtp      inet  n       -       n       -       2       smtpd -o
content_filter=smtp:[127.0.0.1]:10024

localhost:10025 inet    n       -       n       -       -       smtpd -o
content_filter=

Read through /etc/amavisd.conf - it is fairly straight forward and easy
to set up.  Amavisd gives you a bit more control over what happens with
spam and you can handle border cases differently from spam.  With Clam
in the mix it will get rid of html phishing mails too.

There are some nice tools too that give you graphs of how much of what
was stopped, ect.

-- 
Kind regards
Hans du Plooy
SagacIT (Pty) Ltd
hansdp at sagacit dot com