Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 14 Dec 2007 15:19:08 -0600
From:      "Preston Hagar" <prestonh@gmail.com>
To:        "Sten Daniel Soersdal" <netslists@gmail.com>, freebsd-questions@freebsd.org
Subject:   Re: (postfix) SPAM filter?
Message-ID:  <8f5897560712141319r780ddafo3b64e855ad44d6d1@mail.gmail.com>
In-Reply-To: <4761A597.8060901@gmail.com>
References:  <476086E2.5030402@gmail.com> <a9f4a3860712122200uecdbc83x5b072be9800e7c62@mail.gmail.com> <4760CFC3.7060904@ibctech.ca> <4760D5C8.2010804@monkeybrains.net> <4761A597.8060901@gmail.com>

next in thread | previous in thread | raw e-mail | index | archive | help
> > I have found spam assassin with nightly updates of the helpful (there
> > are other people developing new regexs daily).
> >
> > 48 5 * * * /usr/local/bin/sa-update  --channel updates.spamassassin.org
> > && /usr/local/etc/rc.d/sa-spamd restart
> >
> > There are other channels you can subscribe to.
> >
> > Another super helpful bocker is to block all inbound connections from
> > IPs without reverse DNS. Don't forget to virus check your email while
> > you are at it -- there are several packages (clamav is one).  And
> > finally, a couple of RBLs added into the mix are helpful.
>
> Awesome, i didn't see the subscriptions on their website.
> This is exactly what i need.
>
> --
> Sten Daniel Soersdal
>

Something else I would recommend if you end up going the spamassassin
route is to look at rules emporium and rules du jour

http://www.rulesemporium.com/rules.htm

Rules Du Jour is a nice bash script that can automatically download
and update the latest rules emporium rules for several different
categories of spam.  You just choose which rule lists you want to use
(there are a lot of categories and then different levels of spam
caught vs false positives within rule sets) and then set rules du jour
as a nightly cron job to update your rule sets automatically.  As some
one else said, this lets you have other people keep your regexs up to
date.  I also added these lines to the top of the Rules Du Jour script
to download a couple of other nice clamAV spam signatures:

#update extra clam spam defs
if [[ -d /var/lib/clamav/ ]]; then
     cd /var/lib/clamav/ && wget --timestamping
http://download.mirror.msrbl.com/MSRBL-SPAM.ndb
     cd /var/lib/clamav/ && wget --timestamping
http://www.sanesecurity.co.uk/clamav/scamsigs/scam.ndb.gz
         gunzip -cdf scam.ndb.gz > scam.ndb
fi
#end update extra clam spam defs

I also use these smtpd restrictions in main.cf:

smtpd_helo_required = yes
smtpd_helo_restrictions =
    permit_mynetworks,
    check_helo_access
         hash:/etc/postfix/helo_access,
    reject_non_fqdn_hostname,
    reject_invalid_hostname,
    permit

smtpd_sender_restrictions =
   check_sender_access hash:/etc/postfix/client_restrictions,
   permit_sasl_authenticated,
   permit_mynetworks,
   reject_non_fqdn_sender,
   reject_unknown_sender_domain,
   permit

smtpd_recipient_restrictions =
   reject_unauth_pipelining,
   reject_non_fqdn_recipient,
   reject_unknown_recipient_domain,
   reject_unknown_sender_domain,
   check_sender_access hash:/etc/postfix/client_restrictions,
   permit_mynetworks,
   permit_sasl_authenticated,
   reject_unauth_destination,
   reject_rbl_client list.dsbl.org,
   reject_rbl_client zen.spamhaus.org,
   reject_rbl_client bl.spamcop.net,
   reject_rbl_client dnsbl.njabl.org,
   permit

Most of that came from here:
http://www.freesoftwaremagazine.com/articles/focus_spam_postfix/

Greylisting is great, and usually doesn't delay mail more than 5
minutes, but in some rare cases it can lead to mail delays of
sometimes up to 4 or 5 hours (which is within RFC specs for resending
after a 302 message).  For my personal server, that is no problem, so
I have implemented postgrey (with the stuff above) and get almost no
spam ever.  For a few businesses I run mail servers for, they expect
email to be instant (I know it doesn't have to be technically, but
that is what a lot of people expect now a days).  For them 20 extra
spam a day by not doing grey listing is an okay trade off so that one
contact from the new client shows up in time, instead of 3 hours too
late.


Anyway, I hope this helps.  I am always trying to find new great spam
solutions (using postfix), so I will continue watching this tread with
great interest.  Most of the companies I setup mail servers for would
rather have 30 spam delivered per user per day than have even 1 false
positive or 1 significantly delayed mail, so it is always a tricky
line to walk (at least for me) to block as much spam as I can, without
ever delaying or blocking a ham message, so I am always looking for
new ideas and solutions.

Preston



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?8f5897560712141319r780ddafo3b64e855ad44d6d1>