book

SpamAssassin

Name: SpamAssassin
Author: Alan Schwartz
ISBN: 9780596007072

by Alan Schwartz

July 2004

Intermediate to advanced

224 pages

6h 13m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Copyright
Preface
Scope of This BookVersions Covered in This BookConventions Used in This BookUsing Code ExamplesComments and QuestionsAcknowledgments
1. Introducing SpamAssassin
1.1. How SpamAssassin Works1.2. Organization of SpamAssassin1.3. Mailers and SpamAssassin1.3.1. Scanning at the MTA1.3.2. Scanning at the MDA1.3.3. Scanning with a POP Proxy1.3.4. Scanning at Multiple Places1.4. The Politics of Scanning
2. SpamAssassin Basics
2.1. Prerequisites2.2. Building SpamAssassin2.2.1. What Gets Installed2.2.2. Basic Configuration2.2.3. Testing SpamAssassin2.2.4. SpamAssassin Options2.2.4.1. Locating configuration files2.2.4.2. Scripting and testing options2.2.4.3. Untagging2.2.4.4. Reporting2.3. Invoking SpamAssassin with procmail2.4. Using spamc/spamd2.4.1. Setting up spamd2.4.1.1. Connection type2.4.1.2. Running as a non-root user2.4.1.3. Other security features2.4.1.4. Locating configuration files2.4.2. Testing spamc2.4.3. spamc Options2.4.3.1. Connection type2.4.3.2. Handling problems2.4.4. Invoking spamc with procmail2.4.5. Changing SpamAssassin Configuration Files2.5. Invoking SpamAssassin in a Perl Script2.6. SpamAssassin and the End User2.6.1. True Negatives (ham)2.6.2. True Positives (spam)2.6.3. False Positives2.6.4. False Negatives
3. SpamAssassin Rules
3.1. The Anatomy of a Test3.2. Modifying the Score of a Test3.2.1. Modifying Scores Systemwide3.2.2. Modifying Scores on a Per-User Basis3.2.3. Storing Scores in an SQL Database3.2.4. Storing Scores in an LDAP Database3.3. Writing Your Own Tests3.3.1. Header Tests3.3.1.1. Configurable header tests (SpamAssassin 3.0)3.3.1.2. check_rbl( )3.3.1.3. check_rbl_txt( )3.3.1.4. check_rbl_sub( )3.3.2. Body Tests3.3.3. URI Tests3.3.4. Meta Tests3.4. The Built-in Tests3.4.1. 10_misc.cf3.4.2. 20_fake_helo_tests.cf3.4.3. 20_body_tests.cf3.5. Whitelists and Blacklists3.5.1. Systemwide Whitelists3.5.1.1. Whitelisting senders3.5.1.2. Whitelisting senders by relay3.5.1.3. Whitelisting recipients3.5.2. Systemwide Blacklists3.5.3. Per-User Whitelists and Blacklists
4. SpamAssassin as a Learning System
4.1. Autowhitelisting4.1.1. Principles4.1.2. Configuration4.1.2.1. Configuring per-user autowhitelists4.1.2.2. Configuring a system-wide autowhitelist4.1.3. Using an Autowhitelist4.2. Bayesian Filtering4.2.1. Principles4.2.2. Configuration4.2.3. Training4.2.4. Daily Use4.2.4.1. Ongoing training4.2.4.2. Expiration and importing4.2.5. Storing Bayesian Data in SQL4.2.6. A Sitewide Bayesian Classifier
5. Integrating SpamAssassin with sendmail
5.1. Spam-Checking at Delivery5.2. Spam-Checking During SMTP5.2.1. The Milter Interface5.2.2. MIMEDefang5.2.2.1. Installing MIMEDefang5.2.2.2. Starting the MIMEDefang multiplexor5.2.2.3. Checking multiplexor status5.2.2.4. Starting the MIMEDefang milter5.2.2.5. Verifying the MIMEDefang processes5.2.2.6. Customizing MIMEDefang5.2.3. SpamAssassin Integration5.2.3.1. Adding sitewide Bayesian filtering5.2.3.2. Adding sitewide autowhitelisting5.2.3.3. Adding per-domain or per-user streaming5.3. Building a Spam-Checking Gateway5.3.1. sendmail Configuration5.3.2. SpamAssassin Configuration5.3.3. MIMEDefang Configuration5.3.4. Routing Email5.3.5. Internal Server Configuration5.3.6. Testing
6. Integrating SpamAssassinwith Postfix
6.1. Postfix Architecture6.2. Spam-Checking During Local Delivery6.3. Spam-Checking All Incoming Mail6.3.1. Using a Program as a Content Filter6.3.2. Using a Daemon as a Content Filter6.3.3. Filtering Before Address-Rewriting6.4. Building a Spam-Checking Gateway6.4.1. Installing amavisd-new6.4.2. Configuring amavisd-new6.4.2.1. Essential options6.4.2.2. MTA options6.4.2.3. Daemon process options6.4.2.4. Distinguishing local domains6.4.2.5. Postfix-specific options6.4.2.6. Logging options6.4.2.7. Spam-handling options6.4.2.8. Recipient whitelists6.4.2.9. Sender whitelists and blacklists6.4.2.10. SpamAssassin settings6.4.2.11. Storing recipient preferences in external databases6.4.3. Basic Operations6.4.4. Adding Sitewide Bayesian Filtering6.4.5. Adding Sitewide Autowhitelisting6.4.6. Routing Email Through the Gateway6.4.6.1. Postfix changes6.4.6.2. Routing changes6.4.6.3. Internal server configuration
7. Integrating SpamAssassin with qmail
7.1. qmail Architecture7.2. Spam-Checking During Local Delivery7.3. Spam-Checking All Incoming Mail7.4. Building a Spam-Checking Gateway7.4.1. Installation7.4.2. Initialization7.4.3. Basic Operations7.4.4. Per-User Spam Preferences7.4.5. Sitewide Bayesian Filtering7.4.6. Sitewide Autowhitelisting7.4.7. Routing Email Through the Gateway7.4.7.1. qmail changes7.4.7.2. Routing changes7.4.7.3. Internal server configuration
8. Integrating SpamAssassin with Exim
8.1. Spam-Checking via procmail8.2. Spam-Checking All Incoming Mail8.3. Using Routers and Transports8.3.1. Configuring the Transport8.3.2. Configuring the Router8.3.3. Using Per-User Spam-Checking Preferences8.4. Using exiscan8.4.1. Installing exiscan8.4.2. Writing acl_smtp_data8.4.3. Using Per-User Preferences8.5. Using sa-exim8.5.1. Buiding sa-exim for Static Integration8.5.2. Building sa-exim for Dynamic Integration8.5.3. Configuring SpamAssassin for sa-exim8.5.4. Configuring sa-exim8.5.4.1. Choosing messages on which to run SpamAssassin8.5.4.2. Choosing messages on which to take antispam actions8.5.4.3. Limiting how much of the message is fed to SpamAssassin8.5.4.4. Allowing SpamAssassin to rewrite message bodies8.5.4.5. Archiving messages when actions are taken8.5.4.6. Passing SMTP senders and recipients to SpamAssassin8.5.4.7. Setting a timeout on spamc8.5.4.8. Handling messages that cause sa-exim errors8.5.4.9. Teergrubing8.5.4.10. Accepting and discarding spam8.5.4.11. Rejecting spam8.5.4.12. Temporarily failing spam8.5.4.13. Archiving accepted spam8.5.4.14. Archiving non-spam messages8.5.4.15. Debugging sa-exim8.5.5. Using Per-User Preferences8.6. Building a Spam-Checking Gateway8.6.1. Routing Email Through the Gateway8.6.1.1. Exim domain lists8.6.1.2. Routing changes8.6.1.3. Internal server configuration8.6.2. Adding Sitewide Bayesian Filtering8.6.3. Adding Sitewide Autowhitelisting

9. Using SpamAssassin as a Proxy
9.1. Using Pop3proxy9.1.1. Installing Pop3proxy9.1.2. Starting Pop3proxy9.1.3. Configuring the POP Client9.2. Using SAproxy Pro9.2.1. Installing SAproxy Pro9.2.2. Starting SAproxy Pro9.2.3. Configuring the POP Client9.2.4. Configuring SAproxy Pro
A. Resources
A.1. General Spam ResourcesA.2. Spam-FilteringA.3. SpamAssassinA.4. Mail Transport AgentsA.4.1. SendmailA.4.2. PostfixA.4.3. qmailA.4.4. EximA.5. Related Mail ToolsA.5.1. procmailA.5.2. MIMEDefangA.5.3. amavisd-newA.5.4. sa-eximA.5.5. exiscan-aclA.5.6. qmail-scanner
About the Author
Colophon
Copyright

Content preview from SpamAssassin

Chapter 3. SpamAssassin Rules

SpamAssassin performs its spam-checking by applying a series of tests to an email message. Most tests examine the message headers or body for patterns that are suggestive of spam; others perform Internet lookups against network-based blacklists of IP addresses or checksums of spam messages. Each positive test yields a score, and the sum of the scores is the total spam score of the message.

This chapter describes the SpamAssassin pattern-based and network-based tests: how they are written and scored, and how you can modify the score of a built-in test or write your own custom tests. This chapter also covers whitelist and blacklist rules, which can override SpamAssassin’s usual determination of whether or not a message is spam.

The tests described in this chapter are all static tests—they don’t change over time as SpamAssassin analyzes messages. Chapter 4 explains learning tests, which use information from messages seen in the past to improve decisions in the future.

The Anatomy of a Test

Most SpamAssassin tests consist of the same basic components:

A test name, consisting of up to 22 uppercase letters, numbers, or underscores. Names that begin T_ refer to rules in testing.
A more verbose description of the test, which is used in the reports generated by SpamAssassin. Typically, descriptions are up to 50 characters long.
An indication of where to look. Tests can be applied to the message headers only, the message body only, uniform resource identifiers ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 0596007078Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

SpamAssassin

by Alan Schwartz

Chapter 3. SpamAssassin Rules

The Anatomy of a Test

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.