David and Katherine Goodwin

intro:
How to drop spam using Postfix, SpamAssassin and a perl script

subject:
postfix, spamassassin, perl, spam

content:
Background
Spam (either variety) really annoys me.
Unfortunately, until recently I've always had to deliver spam to a mail box somewhere, or use Procmail to delete it. This is acceptable in some situations, but if my machine is just acting as a virtual mail domain, rewriting mails which then get delivered onto someone else, I can easily end up forwarding a lot of spam (and needed a way of dropping it)

One way around this is to build upon the standard Postfix setup for dealing with spam, which is briefly summarised below, and changing it to what is also below.

Initial Postfix + Spam Assassin configuration

Edit /etc/postfix/master.cf and change the smtp definition to :

smtp inet n - - - - smtpd
-o content_filter=spam_filter:
(Previously it would have lacked the -o content_filter=spam_filter: part)

Now we need to define a "spam_filter" service, also in master.cf, like as follows :

spam_filter unix - n n - - pipe flags=Rq user=assassin
argv=/usr/local/sbin/postfixfilter -f ${sender} -- ${recipient}

Having set this up, all mail received over smtp (i.e. not locally sent) will pass through our filter script. This filter script is then responsible for resending the mail locally with any modifications made (e.g. addition of spam assassin headers etc).

The /usr/local/sbin/postfixfilter script can look as follows :

#!/bin/bash
#/usr/bin/spamc | /usr/sbin/sendmail -i "$@"
/usr/bin/spamc | /usr/local/sbin/spam_nuke.pl "$@"
exit $?

The original line is commented out - this will work, but spammy mail won't be dropped, it will continue to be delivered - so users will need to create filters to hide / delete it.

The other line using spam_nuke.pl undertakes a similar function to the first (commented out one), but checks the mail for a set header (e.g. X-Spam-Status: Y) and if it's found it exits, without sending it to sendmail. In this way the spam infected mail is silently dropped.

Here's the magic script (spam_nuke.pl)

#!/usr/bin/perl -w
#
# This reads in input on stdin, sees if it contains X-Spam-Status: Y,
# and if it does it prints out nothing, and exit(0)'s.
# Else it prints out the mail message (for local delivery
# through sendmail)

#debug ("Spam Check starting..");
undef $/; # change line seperator
$_ = <STDIN>; # read standard input (i.e. what's being piped in)

if ($_ =~ /^X-Spam-Status: Y/m ) {
# debug("spam detected, skipping ") ;
exit 0;
}

# debug("Mail ok : $_");
my $prog = "/usr/sbin/sendmail -i @ARGV";
# debug("Program set to : $prog");
open PROG, "|$prog" or die "Cannot spawn |$prog: $!";
print PROG $_;
close PROG;

Having achieved the above (with thanks to David Chan), I'm now quite happy :)

This filtering would be most useful on gateway servers, to stop spam reaching the "real" mail server. It obviously relies upon SpamAssassin being kept up to date, and modifications to it should be trivial if you wish to send a "sorry you're mail is spam" message to the sender (whose address will probably be forged anyway).

Technorati Tags: Documentation Linux