16 Sep
2009
16 Sep
'09
10:44 a.m.
Hello,
Spam to my e-mail address has recently exceeded my tollerance level and
I am now looking in to implementing spam checking, I am however having
some trouble configuring exim4 to use the BitFolk shared SpamAssassin
service.
Currently I have done the following in attempting to configure my mail
server to use SpamAssassin, per the documentation at [1]:
- Replace exim4-daemon-light with exim4-daemon-heavy
- Add "spamd_address = 212.13.194.5 783" to
/etc/exim4/exim4.conf.template.
- `update-exim4.conf -v` (this indicates /etc/exim4/exim4.conf.template
is used).
- `/etc/init.d/exim4 restart`
I then send a test message via a foreign mailserver I have access to,
however no spam checks are made. I checked /var/log/exim4/maillog and
it does not show any references to attempting to contact a spamd
server.
Does anyone have any pointers regarding how I can troubleshoot this, or
anything I am doing wrong?
Thank you,
[1] http://www.exim.org/exim-html-4.68/doc/html/spec_html/ch41.html#SECTscanspa…
--
Robert Leverington
http://rhl.me.uk/
16 Sep
16 Sep
11:21 a.m.
On Wednesday 16 September 2009 11:44:19 Robert Leverington wrote:
Currently I have done the following in attempting to
configure my mail
server to use SpamAssassin, per the documentation at [1]:
- Replace exim4-daemon-light with exim4-daemon-heavy
- Add "spamd_address = 212.13.194.5 783" to
/etc/exim4/exim4.conf.template.
You're missing adding the call to SpamAssassin in your DATA ACL - see the next
section in the Exim documentation that you linked to. There's a commented
out example in the acl_check_data ACL in the template file, or
acl/40_exim4-config_check_data in the split config.
I also exclude authenticated users from the scan, which neatly avoids scanning
outbound mail in most cases with the extra condition line:
warn
!authenticated = *
spam = Debian-exim:true
message = X-Spam_score: $spam_score\n\
X-Spam_score_int: $spam_score_int\n\
X-Spam_bar: $spam_bar\n\
X-Spam_report: $spam_report
Cheers,
--
Dominic Cleal
dominic(a)computerkb.co.uk
11:50 a.m.
Dominic Cleal (dominic(a)computerkb.co.uk) wrote:
On Wednesday 16 September 2009 11:44:19 Robert
Leverington wrote:
Its worth noting that this method leaves the user's client to filter
mail based on headers, and it will always add the headers even if its
not spam (:true bit).
I like the authenticated bit though, hadn't thought of that myself :)
I had gone down the same path originally on my new server, but found I
liked the way it used to work on my old machine where the email gets
tagged as SPAM in the subject and also encloses the spam in the email
report as an attachment. If you want to go down that route I would
suggest sa-exim - was very easy to install and configure, and quite a
few resources out there explaining it.
Andy.
Currently I have done the following in attempting
to configure my mail
server to use SpamAssassin, per the documentation at [1]:
- Replace exim4-daemon-light with exim4-daemon-heavy
- Add "spamd_address = 212.13.194.5 783" to
/etc/exim4/exim4.conf.template.
You're missing adding the call to SpamAssassin in your DATA ACL - see the next
section in the Exim documentation that you linked to. There's a commented
out example in the acl_check_data ACL in the template file, or
acl/40_exim4-config_check_data in the split config.
I also exclude authenticated users from the scan, which neatly avoids scanning
outbound mail in most cases with the extra condition line:
warn
!authenticated = *
spam = Debian-exim:true
message = X-Spam_score: $spam_score\n\
X-Spam_score_int: $spam_score_int\n\
X-Spam_bar: $spam_bar\n\
X-Spam_report: $spam_report 
12:13 p.m.
Andy wrote:
Its worth noting that this method leaves the user's client to filter
mail based on headers, and it will always add the headers even if its
not spam (:true bit).
I like the authenticated bit though, hadn't thought of that myself :)
I had gone down the same path originally on my new server, but found I
liked the way it used to work on my old machine where the email gets
tagged as SPAM in the subject and also encloses the spam in the email
report as an attachment. If you want to go down that route I would
suggest sa-exim - was very easy to install and configure, and quite a
few resources out there explaining it.
Here's my 0.02p
I also simply get spamd to add headers, then use Seive rules to filter
all mail.
Depending on how anal I set the seive rules some legitimate mail still
gets filtered out, and when I retrieve it from my spam bucket I like ti
to be in the state it was sent without any indication that it has been
futzed with by the system.
Horses for courses.
n
12:13 p.m.
Andy wrote:
Its worth noting that this method leaves the user's client to filter
mail based on headers, and it will always add the headers even if its
not spam (:true bit).
I like the authenticated bit though, hadn't thought of that myself :)
I had gone down the same path originally on my new server, but found I
liked the way it used to work on my old machine where the email gets
tagged as SPAM in the subject and also encloses the spam in the email
report as an attachment. If you want to go down that route I would
suggest sa-exim - was very easy to install and configure, and quite a
few resources out there explaining it.
Here's my 0.02p
I also simply get spamd to add headers, then use Seive rules to filter
all mail.
Depending on how anal I set the seive rules some legitimate mail still
gets filtered out, and when I retrieve it from my spam bucket I like ti
to be in the state it was sent without any indication that it has been
futzed with by the system.
Horses for courses.
n
4:20 p.m.
On Wed, Sep 16, 2009 at 10:44:19AM +0000, Robert Leverington wrote:
Currently I have done the following in attempting to
configure my mail
server to use SpamAssassin, per the documentation at [1]:
[...]
Does anyone have any pointers regarding how I can
troubleshoot this, or
anything I am doing wrong?
Others have pointed you at how to do this. Other things I like
doing (roughly in order):
- Rejecting clients that give a malformed HELO/EHLO command, or that
try to HELO with my host name.
- Greylisting connections from hosts with no reverse DNS.
- Selecting a very small number of good quality DNSBLs and rejecting
connections from hosts contained therein.
- Greylisting hosts that are in a range of other, less trusted
DNSBLs. This allows use of a number of the rfc-ignorant DNSBLs
and RHSBLs which by themselves only demonstrate poor behaviour,
not outright spamminess.
I don't like to greylist everything, but it is an option which
some people are comfortable with.
- Pass data to SpamAssassin (resource-intensive), reject if scores
more than say 10, greylist connection if it scores >5.
- Pass data to clamav.
Personally I do these things in the RCPT ACL because by then I know
if the mail is to (root|postmaster|abuse)@*. I will tend to be more
lenient with these emails as it's more important they get through.
If anyone has hooked dspam or crm114 up to Exim in a nice way then
I'd be interested in hearing how it's working out..
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
"I remember the first time I made love. Perhaps it was not love exactly but I
made it and it still works." -- The League Against Tedium
5333
days inactive
5333
days old
5 comments
5 participants
participants (5)
-
Andy -
Andy Smith -
Dominic Cleal -
Nigel Rantor -
Robert Leverington