Panix Help System -- About SpamAssassin

Contents

• If you're already familiar with SpamAssassin
• What it is and how it works
• Whitelisting and blacklisting
• Setting up SpamAssassin in webmail
• How to see if you're running SpamAssassin from Procmail
• Using SpamAssassin with procmail
• Filtering mail by language with Spamassassin under procmail

What it is and how it works

Panix makes SpamAssassin available and supports it for filtering spam as it is delivered to your account.

Rather than using specific addresses, SpamAssassin uses a series of tests to look for "key phrases" and other indicators of spam in an email message. Each of these tests has a point value, and the message gets a score that is the total of the points for all the tests it matches. If the score is above a given threshold, the message is treated as spam. You can adjust the point value for any of the tests, and/or you can change the threshold setting. You can also control what happens to mail that scores in the Spam range: You can trash it without looking at it, put it into a special folder of your own choosing, or put it into your inbox with a special header to distinguish it from the rest of your email.

For full details, please see the SpamAssassin web page at http://www.spamassassin.org/.

Because SpamAssassin is third-party software, upgrades may result in changes in the point value of any of the rules. (We make occasional local changes, but they are rare.) We advise users to whitelist addresses they wish to protect.

Panix users can enable Spamassassin either from the webmail interface or via procmail. It is not a good idea to use both. (Not only does it waste system resources, it complicates the process of determining what might have happened to a given piece of mail.)

Whitelisting and blacklisting

You might think that SpamAssassin would also be good for blacklisting spammers' addresses, but this is not the case. First, spammers tend to use one-time addresses, or forge legitimate addresses. Blacklisting these accomplishes nothing and might cause mail from legitimate senders to be trashed. Also, the file that contains these addresses becomes bloated. Once the file becomes too large (over 1024 non-blank lines), SpamAssassin stops working entirely. Blacklisting is fine for dealing with small numbers of specific known addresses-- former friends whose email is no longer welcome, say.

Setting up SpamAssassin in Webmail

It's quick and easy to set up SpamAssassin from webmail. Start by logging into Web mail at https://mail.panix.com/.

Make sure your browser accepts cookies. The Web mail interface is more than just a mail reader. It includes a full-featured Options page where you can adjust the preferences of your Panix email account, without having to log into the shell. To activate SpamAssassin, just:

1. Log into Web mail and click "Options",
2. Click the link for "SpamAssassin - Marks Probable Spam",
3. Look in the "General Settings" section for the "Use Filtering" setting.
   • If "Current" says "Yes", then SpamAssassin is already enabled on your account. (Note that if "Current" says "No" it means that you don't have SpamAssassin turned on in webmail. You might be running it from procmail, so check first.
   • If "Current" says "No", then check "Yes" under "New Value" and click "Change Default Settings".
4. Suspected spam will now be sent to your Trash folder, and kept there for up to a week before auto-deletion.
5. If you're expecting a piece of mail that hasn't arrived, check your Trash folder; SpamAssassin can occasionally misdiagnose real mail as spam. (Especially if the mail has some commercial or advertising content)
6. If you're feeling brave and are willing to discard suspected spam unread, you can select Delete (PERM!) from the pull-down menu. If you want to save your suspected spam to a folder other than Trash, you can do that, too-- but it won't be emptied automatically except from Trash.

Under "Allowable Locales," you'll find a list of languages with checkboxes. Should you not wish to receive any mail in one of these languages (such as Russian or Chinese), simply uncheck the box. This feature relies on the rules "CHARSET_FARAWAY", "CHARSET_FARAWAY_HEADER", and "CHARSET_FARAWAY_BODY". You might need to increase the scoring of these rules under the "Manage Spam Rules" table, possibly as high as your "Required Hits" level.

For more information about Squirrelmail preferences and tweaking SpamAssassin settings in Squirrelmail, see http://www.panix.com/help/mail.newmail.intro.html.

How to see if you're running SpamAssassin from Procmail

1. Login to webmail.
2. Go to Options->Mail Forwarding Options and see what, if any, forwarding instructions you have in place.

   If your instructions do not include the word "procmail" you are not running procmail at all, so you aren't running Spamassassin from procmail.

   If your instructions do include the word "procmail" you are probably (but not necessarily) running procmail, and you may be running Spamassassin from procmail. In this case you will need to log into your shell account and look at your procmail setup files or ask staff to check for you.

• If you are already running procmail, you can turn on SpamAssassin by placing the following line in your .procmailrc:

  INCLUDERC=/net/local/filters/rc.spamassassin
  This uses spamc, a version of SpamAssassin that works as a client with a daemon running on the server. Please do not use /usr/local/bin/spamassassin with procmail.

• If you are not yet running procmail, and switching to New Mail or using Squirrelmail's interface is not possible or preferable, you can activate Procmail for your account by typing the following command at a UNIX shell prompt:

  install-procmail

  The Procmail installer will ask you if you'd like to use SpamAssassin, among other things. Say yes. :)

• It's advisable to check the procmail help pages for complete information.

Your spam box and the $TRASH variable

If you want to use a spambox, just set TRASH equal to the place where you want your spambox. For example, if you use Pine and you want your spambox to be a plain Pine folder called "spam", you'd add (or change) the $TRASH line in your .procmailrc to:

TRASH=$HOME/mail/spam

TRASH=$HOME/.maildir/.Trash/

Important: If you are adding or moving the $TRASH line, make sure you put it before any of the INCLUDERC lines that need that setting.

(In case you're wondering why it's sometimes "TRASH" and sometimes "$TRASH": using the $ means "figure out the value of this variable and use that", and without the $ it's just the name of the variable.)

Tweaking your SpamAssassin user_prefs

The quick way:
1. Log into the shell, and go to your home directory.
2. If you use the menu interface, type ! to get to a standard command line.
3. Enter the command whitelist at the command line.
4. You will see these messages:

   Created directory /net/u/17/f/fff/.spamassassin.
   Created file /net/u/17/f/fff/.spamassassin/user_prefs.

   and nothing further will happen.
5. Enter ^C (hold the control key while typing c).
6. If you use the menu interface, type exit to return to the menu.
7. That's it.

If you want to build it from scratch:
1. Log into the shell, and go to your home directory.
2. Type the following command to create a .spamassassin directory:
   mkdir .spamassassin
3. "cd" to your new .spamassassin directory.
4. Make a copy of the Panix user_prefs template:
   cp /usr/local/share/spamassassin/user_prefs.template ./user_prefs
5. This sample user_prefs file contains some settings to get you started, and some good pointers to more info on tweaking SpamAssassin.

Next, you'll need to define only the languages you want to receive mail in. Using the locale codes, add the following line to user_prefs:

ok_locales [$locale codes]

If, for example, you only wanted to receive mail in English, French, and Spanish, the line would read as follows:

ok_locales en fr es

Mail composed with any of the other character sets would be filtered as spam.

Checking your Procmail installation

1. Your mail forwarding entry

From the shell prompt, type forward -l to "look" at your mail forwarding record. The last line of this record should look like:

|IFS=' ';exec /usr/local/bin/procmail||exit 75

It might also have a number sign and your username at the end; that's okay. But if it doesn't include this line, then you probably need to run "install-procmail" again.

2. Your .procmailrc

If you have doubts about your .procmailrc file, here is a simple .procmailrc that will call spamassassin and put the suspected spam in a standard Pine folder called "spam". It also puts logfiles in your .procmail directory, so make sure that directory exists.

    VERBOSE=no    #Set VERBOSE to yes for advanced debugging
    PMDIR=$HOME/.procmail
    MAILDIR=$HOME/mail
    LOGFILE=$PMDIR/log
    TRASH=$MAILDIR/spam
    INCLUDERC=/net/local/filters/rc.spamassassin 
  

You can also change the TRASH line to TRASH=/dev/null if you'd rather have SpamAssassin delete all suspected spam as soon as it's received.

Whitelisting from webmail
It's easy and straightforward, from the SpamAssassin page in webmail:

Login into Web mail and click "Options"

Click the link for "SpamAssassin - Marks Probable Spam"

In the Manage White List box, enter the address you wish to protect into the text box.

Click the "Add New" button.

Whitelisting from the "old" mail system
You don't have to construct special procmail rules; you can whitelist directly from SpamAssassin.

[If you use the Panix text menu, type "!" to get to a full shell.]

From the shell, enter
whitelist <address>
where <address> is the address you want to protect.

[If you use the menu, type exit to return to it.]

Whitelisting from Procmail
Whitelisting from procmail gives you more flexibility than whitelisting from SpamAssassin. You can create rules that look for any characteristic of a message, not just the address, and save it to your inbox or any other folder.

Construct a procmail rule to match the characteristic you're looking for. This rule
:0:
*^Subject:.*mortgage rates
$DEFAULT
will match any item with a subject line containing "mortgage rates" and save it to your regular mailbox.

Make sure that the rule is invoked before SpamAssassin is called.

Other SpamAssassin Resources:

• The master list of SpamAssassin tests and their default values:
  http://www.spamassassin.org/tests.html
  Panix uses the "net" numbers, so if a particular test has four different default numbers on the list, Panix uses the second number on the list.
• The SpamAssassin manpages:
  spamassassin(1), spamc(1), and Mail::SpamAssassin::Conf(3) (user_prefs config)
• The spamassassin.org README file offers additional documentation (some of it relevant and some not).