Install and configure SpamAssassin on Fedora/RHEL

I run my own mail server, for myself and my family. Setting up spamassassin correctly took a bit of work on Google, but in the end was pretty easy, so I thought I'd write it down here in case it can benefit other sysadmins.

General setup

The goal here is to setup spamassassin to examine every incoming mail message to the system.

The pieces that are needed:

sendmail
spamassassin
procmail

These are all shipped with Fedora or RHEL, so it's just a matter of using yum or up2date to make sure that they are on your system.

Start the services

This is a pretty obvious step. The sendmail service is probably already on, but you'll want to turn the spamassassin service on so that it starts up automatically on boot.

chkconfig sendmail on
chkconfig spamassassin on

Edit a couple of config files

/etc/mail/spamassassin/local.cf

required_score                  3.5
rewrite_header subject          ***SPAM***
report_safe                     2
use_bayes                       1
bayes_auto_learn                1
skip_rbl_checks                 0
ok_locales                      en

All of this is configurable. This is what I'm using right now, based on the results of various other Google searches, etc.

/etc/procmailrc

DROPPRIVS=yes

:0fw
| /usr/bin/spamc

All this does is run every incoming mail message through spamassassin.

Restart services

service spamassassin restart
service sendmail restart

And that's it. Now as messages arrive via sendmail, the global procmailrc will run them through spamassassin, and they will be delivered to the user's mailspool with the rewritten ***SPAM*** subject header if applicable.

From there, the individual users can filter in their own email clients or via $HOME/.procmailrc. In addition, users can extend the rules placed in /etc/mail/spamassassin/local.cf by editing ~/.spamassassin/user_prefs as they see fit.

Example ~/.spamassassin/user_prefs

whitelist_from                  *@redhat.com
whitelist_from                  *@fedoraproject.org

So for this particular user, any mail from redhat.com or fedoraproject.org will never be marked spam.

Training

Once you accumulate several mailboxes full of good messages ("ham") and bad messages ("spam"), it's useful to train SpamAssassin to recognize these. This can be done as the non-root user.

sa-learn --ham -C $HOME/.spamassassin/ --showdots --mbox /path/to/ham
sa-learn --spam -C $HOME/.spamassassin/ --showdots --mbox /path/to/spam

Forwarding mail while using SpamAssassin

A related (but separate) problem that I needed to solve was this use case:

Mail is sent to a user on my server, but is automatically forwarded to another email address.
Before the mail is forwarded, it should run through spamassassin (as described above).

The specific use case involves my mother's spevack.org address automatically redirecting to her Yahoo! account. Messages that would normally have been marked as spam were being forwarded along (via a .forward file) before being processed by spamassassin.

I wanted to have those messages run through spamassassin before being forwarded, so that I could then set up a filter in her Yahoo! account that would search for the rewritten subject header and sort the mail accordingly.

The solution, it turns out, was easy:

Delete the .forward file in the user's home directory.
Replace it with a .procmailrc file, also in the user's home directory.

~/.procmailrc

:0
! user@domain.com

All you need to do is replace user@domain.com with the email address to which you want all of the local user's messages to forward. The message will already have run through spamassassin due to the changes you made above in /etc/procmailrc.

Thanks to the TriLUG archives for some help.