After having thought about it for at least half a year and having researched the topic thoroughly for a good weekend, I finally got to implementing anti-spam and anti-virus measures on my server. It turned out to be more complex than I had initially thought (as always), but it seems to be working now.

To give a bit more background, I am running Postfix with Courier-IMAP and PostgreSQL as database backend. E-mail accounts reside in a virtual folder and have no corresponding Unix accounts.

I decided to use maildrop (I discussed Postfix and procmail issues here) and followed this tutorial, with the following exceptions:

• I had to backport a few packages to sarge (wrote about it here).
• I found out by trial and error that two packages courier-maildrop and maildrop have the same program working differently (essentially, maildrop from the maildrop package works, the other one doesn’t!)

• I added a custom clamAV source to my sources.list files:

  deb http://ftp2.de.debian.org/debian-volatile sarge/volatile main
  

• I wrote my own /etc/maildroprc

The idea is to have e-mail moved automatically to a folder containing spam if (and only if) such a folder exists. What I came up with is the following

This is the folder into which spam messages are delivered

SPAMFOLDER="$DEFAULT/.caughtspam/"

run the message through SpamAssassin

exception {
    xfilter "/usr/bin/spamc -u $LOGNAME"
}

if the message is marked as spam AND SPAMFOLDER exists - deliver there

I have no idea how to check it other than executing [ -d ] in a shell

SPAMFOLDEROK=[ -d $SPAMFOLDER ]; echo $?
if ( /^X-Spam-Flag:.*YES/ && $SPAMFOLDEROK == 0 )
{
  exception {
          to $SPAMFOLDER
  }
}

What still needs to be done is:

• automatic training on users’ emails (to enable per-user training)
• inclusion of user-specific rules (still need to thnik about it a bit as it has serious security implications).

Useful links:

• http://www.courier-mta.org/maildrop/?maildropfilter.html – Maildrop filtering language
• http://spamassassin.apache.org/gtube/ SpamAssasin GTUBE test
• http://www.webmail.us/testvirus – Sending EICAR messages to test anti-virus

This entry was posted on Tuesday, February 7th, 2006 at 1:35 am and is filed under Linux, Personal, Tips&Tricks. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.