The Random Ramblings of a Sysadmin

From the capable minds and hands of Solido Systems I got a license key for the spamfilter they make, and just had to try it on my OpenBSD 4.4 server. The filter is a java app with a spamasssassin plugin, and with java 1.7.0 included in the package list for 4.4, the time was right for testing - I'd previously had (and lost) quite a few fights with java from ports on 4.2 and 4.3. My usual setup relies on postfix, courier-imap and userdb for mail delivery and storage, and my intention was to minimize the amount of reconfiguration I had to do to get the spamfilter working. Here are the checks I had defined in postfix before installing the spamfilter:

/etc/postfix/main.cf header_checks = regexp:/etc/postfix/header_checks smtpd_client_restrictions = permit_mynetworks, reject_rbl_client zen.spamhaus.org smtpd_helo_required = yes smtpd_sender_restrictions = reject_unknown_sender_domain, reject_non_fqdn_sender smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_unknown_sender_domain, reject_unknown_recipient_domain

I disabled the header checks and the RBL lookup, as they were redundant after adding the spamfilter to the config. And then modified master.cf  to include spamassassin:

/etc/postfix/master.cf: smtp      inet  n       -       -       -       -       smtpd -o content_filter=spamassassin <...> spamassassin    unix    -       n       n       -       -       pipe flags=R user=_spamdaemon argv=/usr/local/bin/spamc -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

Before reloading postfix, I made sure that the Solido Systems spamfilter and Spamassassin were included in rc.local:

/etc/rc.local: # Solido Systems spamfilter if [ -x /usr/local/solido/spamfilter/bin/spamfilterctrl ]; then echo -n 'Solido spamfilter'; /usr/local/solido/spamfilter/bin/spamfilterctrl start fi # Spamassassin if [ -x /usr/local/bin/spamd ]; then echo -n 'spamd'; /usr/local/bin/spamd -d fi

And naturally both services were then configured and started. Spamassassin config was modified slightly, and the Solido Systems spamfilter plugin for Spamassassin was installed according to the documentation.

/etc/mail/spamassassin/local.cf: #   Save spam messages as a message/rfc822 MIME attachment instead of #   modifying the original message (0: off, 2: use text/plain instead) # report_safe 0 #   Use Bayesian classifier (default: 1) # use_bayes 0 # Disable RBL checks # skip_rbl_checks 1

The rest of that config file was left as it is by default on OpenBSD. The last step was to block port 25 in the firewall, reload postfix and test whether everything was ok. After testing for the obvious, I reopened port 25 and was rewarded with a nice mailflow through the system. So far I've had the expected 0 false positives and 0 false negatives, and the only thing left to do is to tweak the default spamassassin config to get rid of the RBL/RWL checks, as they're done by both Spamassassin and the Solido filter at the moment. As the Solido filter does all checks in parallel, and the Spamassassin filter does them serially, getting rid of them should speed up mail delivery by a few seconds or more. Update: Modified spamassassin a bit for a much faster scan, and no redundant checks, update has been included above.