Panix - Public Access Networks Corporation

Panix Help System -- About SpamAssassin

Contents

What it is and how it works

Panix makes SpamAssassin available and supports it for filtering spam as it is delivered to your account.

Rather than using specific addresses, SpamAssassin uses a series of tests to look for "key phrases" and other indicators of spam in an email message. Each of these tests has a point value, and the message gets a score that is the total of the points for all the tests it matches. If the score is above a given threshold, the message is treated as spam. You can adjust the point value for any of the tests, and/or you can change the threshold setting. You can also control what happens to mail that scores in the Spam range: You can trash it without looking at it, put it into a special folder of your own choosing, or put it into your inbox with a special header to distinguish it from the rest of your email.

For full details, please see the SpamAssassin web page at http://www.spamassassin.org/.

Because SpamAssassin is third-party software, upgrades may result in changes in the point value of any of the rules. (We make occasional local changes, but they are rare.) We advise users to whitelist addresses they wish to protect.

Panix users can enable Spamassassin either from the webmail interface or via procmail. It is not a good idea to use both. (Not only does it waste system resources, it complicates the process of determining what might have happened to a given piece of mail.)

Whitelisting and blacklisting

Whitelisting simply means adding a known good address to a list that will either bypass SpamAssassin entirely or will give messages from that address a very low (i.e. large negative number) score. SpamAssassin's built-in whitelisting function is easy to enable from the webmail interface. If you're using procmail to run SpamAssassin (spamc), you have an alternative, described below.

You might think that SpamAssassin would also be good for blacklisting spammers' addresses, but this is not the case. First, spammers tend to use one-time addresses, or forge legitimate addresses. Blacklisting these accomplishes nothing and might cause mail from legitimate senders to be trashed. Also, the file that contains these addresses becomes bloated. Once the file becomes too large (over 1024 non-blank lines), SpamAssassin stops working entirely. Blacklisting is fine for dealing with small numbers of specific known addresses-- former friends whose email is no longer welcome, say.

Setting up SpamAssassin in Webmail

It's quick and easy to set up SpamAssassin from webmail. Start by logging into Web mail at https://mail.panix.com/.

Make sure your browser accepts cookies. The Web mail interface is more than just a mail reader. It includes a full-featured Options page where you can adjust the preferences of your Panix email account, without having to log into the shell. To activate SpamAssassin, just:

  1. Log into Web mail and click "Options",
  2. Click the link for "SpamAssassin - Marks Probable Spam",
  3. Look in the "General Settings" section for the "Use Filtering" setting.
  4. Suspected spam will now be sent to your Trash folder, and kept there for up to a week before auto-deletion.
  5. If you're expecting a piece of mail that hasn't arrived, check your Trash folder; SpamAssassin can occasionally misdiagnose real mail as spam. (Especially if the mail has some commercial or advertising content)
  6. If you're feeling brave and are willing to discard suspected spam unread, you can select Delete (PERM!) from the pull-down menu. If you want to save your suspected spam to a folder other than Trash, you can do that, too-- but it won't be emptied automatically except from Trash.

For more information about Squirrelmail preferences and tweaking SpamAssassin settings in Squirrelmail, see http://www.panix.com/help/mail.newmail.intro.html.

How to see if you're running SpamAssassin from Procmail

  1. Login to webmail.
  2. Go to Options->Mail Forwarding Options and see what, if any, forwarding instructions you have in place.

    If your instructions do not include the word "procmail" you are not running procmail at all, so you aren't running Spamassassin from procmail.

    If your instructions do include the word "procmail" you are probably (but not necessarily) running procmail, and you may be running Spamassassin from procmail. In this case you will need to log into your shell account and look at your procmail setup files or ask staff to check for you.

Using SpamAssassin with Procmail

Procmail is a full-featured UNIX mail filtering system, based on "filter recipes" that you can write and call from a .procmailrc file in your home directory.

Your spam box and the $TRASH variable

When you call SpamAssassin from Procmail, it looks at the value of the TRASH variable. This is set by default to /dev/null (i.e. immediate discard). You can set it in your .procmailrc for the location of your spambox. If you unset the TRASH variable, your suspected spam will be marked as spam and handed off to the next procmail rule. In practice, this usually means that it's delivered to your inbox.

If you want to use a spambox, just set TRASH equal to the place where you want your spambox. For example, if you use Pine and you want your spambox to be a plain Pine folder called "spam", you'd add (or change) the $TRASH line in your .procmailrc to:

TRASH=$HOME/mail/spam
If you're using Procmail in conjunction with the New Mail system, you can set your TRASH equal to your New Mail "Trash" folder, thusly:
TRASH=$HOME/.maildir/.Trash/
(That ending slash tells Procmail that it's a New Mail folder, so don't forget it!)

Important: If you are adding or moving the $TRASH line, make sure you put it before any of the INCLUDERC lines that need that setting.

(In case you're wondering why it's sometimes "TRASH" and sometimes "$TRASH": using the $ means "figure out the value of this variable and use that", and without the $ it's just the name of the variable.)

Tweaking your SpamAssassin user_prefs

When you call SpamAssassin from Procmail, you can set up a "user_prefs" file to change the point-value threshold for spam, specify whitelists and blacklists, and assign custom values to particular "hit types". Here's how to get started:
    The quick way:
  1. Log into the shell, and go to your home directory.
  2. If you use the menu interface, type ! to get to a standard command line.
  3. Enter the command whitelist at the command line.
  4. You will see these messages: 
    Created directory /net/u/17/f/fff/.spamassassin.
Created file /net/u/17/f/fff/.spamassassin/user_prefs.
    and nothing further will happen.
  5. Enter ^C (hold the control key while typing c).
  6. If you use the menu interface, type exit to return to the menu.
  7. That's it.
    If you want to build it from scratch:
  1. Log into the shell, and go to your home directory.
  2. Type the following command to create a .spamassassin directory:
    mkdir .spamassassin
  3. "cd" to your new .spamassassin directory.
  4. Make a copy of the Panix user_prefs template:
    cp /usr/local/share/spamassassin/user_prefs.template ./user_prefs
  5. This sample user_prefs file contains some settings to get you started, and some good pointers to more info on tweaking SpamAssassin.
Have fun!

Checking your Procmail installation

If you're using Procmail but it doesn't seem to be filtering your mail properly, here's what you can do to check your Procmail setup.
1. Your mail forwarding entry
From the shell prompt, type forward -l to "look" at your mail forwarding record. The last line of this record should look like:

|IFS=' ';exec /usr/local/bin/procmail||exit 75

It might also have a number sign and your username at the end; that's okay. But if it doesn't include this line, then you probably need to run "install-procmail" again.

2. Your .procmailrc
If you have doubts about your .procmailrc file, here is a simple .procmailrc that will call spamassassin and put the suspected spam in a standard Pine folder called "spam". It also puts logfiles in your .procmail directory, so make sure that directory exists. 
    VERBOSE=no    #Set VERBOSE to yes for advanced debugging
    PMDIR=$HOME/.procmail
    MAILDIR=$HOME/mail
    LOGFILE=$PMDIR/log
    TRASH=$MAILDIR/spam
    INCLUDERC=/net/local/filters/rc.spamassassin
You can also change the TRASH line to TRASH=/dev/null if you'd rather have SpamAssassin delete all suspected spam as soon as it's received.

Whitelisting addresses

Whitelisting from webmail
It's easy and straightforward, from the SpamAssassin page in webmail:

Login into Web mail and click "Options"
Click the link for "SpamAssassin - Marks Probable Spam"
In the Manage White List box, enter the address you wish to protect into the text box.
Click the "Add New" button.

Whitelisting from the "old" mail system
You don't have to construct special procmail rules; you can whitelist directly from SpamAssassin.

[If you use the Panix text menu, type "!" to get to a full shell.]
From the shell, enter
whitelist <address>
where <address> is the address you want to protect.
[If you use the menu, type exit to return to it.]

Whitelisting from Procmail
Whitelisting from procmail gives you more flexibility than whitelisting from SpamAssassin. You can create rules that look for any characteristic of a message, not just the address, and save it to your inbox or any other folder.

Construct a procmail rule to match the characteristic you're looking for. This rule
:0:
*^Subject:.*mortgage rates
$DEFAULT
 will match any item with a subject line containing "mortgage rates" and save it to your regular mailbox.
Make sure that the rule is invoked before SpamAssassin is called.

Other SpamAssassin Resources:

webmaster@panix.com
© Copyright 2003, Public Access Networks Corporation
Last modified: Wednesday, 12-Oct-2005 17:22:43 EDT
[ Panix Home ] [ Panix Help System Index ] [ Top of This Page ]