Spam Tests

• Image Analysis
  Uses a Multi-Pass Optical Character Recognition engine to detect spam text embedded within image files.
• IP Reputation Analysis
  Checks the reputation of the sender’s IP address. The reputation system is fully automated, similar to the anti-fraud mechanisms used for credit cards.
• Bayesian algorithms
  Bayesian algorithm is a probabilistic classifier, used to calculate the probability of a message being a spam. It is accurate, effective and adaptable in doing its job.
• Content-based filtering
  Set custom content filters based on the subject, message headers, message bodies and attachment file type.
• Intent Analysis
  What’s the mail all about? If it’s trying to sell something, it’s probably a spam.
• Keyword blocking
  Mail contains “buy viagra”, definitely spam.
• Rate control
  Protects against spam bots or mail bomb type attacks by throttling incoming connections once a certain threshold is exceeded.
• Real-time Block List and DNS Blacklist support
  Take advantage of external block list sites to further reject unwanted spam.
• Rule-based scoring algorithms
  Identifies spam using a wide range of heuristic tests on mail headers and body text. Uses the open source software SpamAssassin to perform this.
• Sender Policy Framework
  A way to validate the identity of the sender if it is genuine.

Aside from spam filtering, the Barracuda Spam Firewall will also give you several other benefits like

For the company

• Virus filtering
• Anti-spoofing
• Anti-phishing
• Anti-spyware
• Denial of service protection
• Directory harvest protection
• Outbound email filtering
• Compliance and corporate policy monitoring

For the end user

• Web-based interface
• User-based filtering
• Individual spam scoring
• Personal allow and block lists
• End user quarantine
• Digest emails
• Outlook/Lotus Notes integration
• Bayesian analysis

For the administrator

• Web-based interface
• User account administration
• Reports, graphs and statistics
• LDAP interface
• Multiple domain support
• Secure remote administration
• Journaling

You get all the above benefits at a fair price with no per-user fees. Barracuda Networks, the maker of the network appliance was able to achieve this using open source softwares (Linux, SpamAssassin and ClamAV), low cost hardware (AMD processors) and a build-to-order system similar to Dell Computer.

To install Postgrey, we are going to use the precompiled binaries from Dag Wieers RPM packages for Red Hat, RHEL, CentOS and Fedora.

Adding RPMForge to Yum

1. Launch Firefox and go to http://dag.wieers.com/rpm/FAQ.php#B2. Click on the package appropriate for your version of Red Hat Enterprise Linux or CentOS.

2. Choose Open with Software Installer (default) and click Ok.

3. The Installing packages window will appear. Click Apply to proceed.

4. Finally click Ok. You now have access to an extensive library of precompiled binaries.

Installing Postgrey Greylisting Policy Server

If you are using Red Hat Enterprise Linux 4 or CentOS 4, you have an older version of the Package Manager tool. Instead of using the GUI tool below, you can use the command yum install postgrey in a Terminal window to install Postgrey.

1. Click Applications then click Add/Remove Software. This will launch the Package Manager window.

2. Click the Search tab. Next type in postgrey and click the Search button.

3. Select the latest version of postgrey then click Apply. Next click on Continue until it proceeds with the installation.

4. After installation, click Ok. You now have successfully installed Postgrey Postfix Greylisting Policy Server.

Configuring Postfix

1. Edit /etc/postfix/main.cf and add reject_unlisted_recipient and check_policy_service unix:postgrey/socket to the value of smtpd_recipient_restrictions.

check_policy_service unix:postgrey/socket performs the greylisting while adding reject_unlisted_recipient before it enables Postfix to immediately reject unknown recipients instead of having clients go through the greylisting process before being informed that the recipient does not exist.

2. Start Postgrey and restart Postfix or MailScanner (if you have installed MailScanner). Learn how to start and restart services here.

3. Test Postfix. Do not use localhost to connect to Postfix since localhost will bypass Postgrey. After typing in the rcpt to command, it should reply with Recipient address rejected: Greylisted and it should work if you try it again after at least five minutes.

Configuring the Whitelist in Postgrey

Whitelist enables you to disable greylisting for certain email accounts or client ip addresses or hostnames.

1. To disable greylisting for certain email accounts, add their email address into the file /etc/postfix/postgrey_whitelist_recipients.

2. To disable greylisting for certain IP addresses or hostnames, add the IP address, hostname or regular expression to match hostnames into the file /etc/postfix/postgrey_whitelist_clients.local. Hostnames are identified by performing a reverse DNS on the client’s IP address. For sample entries, view the file /etc/postfix/postgrey_whitelist_clients.

If you liked the immense reduction in spam but cannot live with the delay, check out the Barracuda Anti Spam Firewall. It will give you even better spam and virus control without any penalty in time.

To minimize the resource requirements, a more efficient Perl ClamAV module, specified by setting Virus Scanners = clamavmodule in the MailScanner configuration file and installing the necessary Perl modules, was developed.

But this new feature, activated by setting Virus Scanners = clamd in the MailScanner configuration file, bypasses the external program clamscan and Perl ClamAV module and communicates directly with the Clam AntiVirus daemon (clamd) giving a lighter resource usage and better performance.

The MailScanner and ClamAV integration guide has been updated to utilize this new feature.

Here are the installation guides for the above components.

• How to install Postfix SMTP Server
• How to install Clam Anti-virus (ClamAV)
• How to install MailScanner

SpamAssassin is included in Red Hat Enterprise Linux 5 and CentOS 5 and it’s ready to go out of the box. Just add it using the Package Manager tool if you haven’t done so during installation.

Configuring MailScanner

1. Edit the file /etc/MailScanner/MailScanner.conf

%org-name% = your organization name
%org-long-name% = your full organization name
Run As User = postfix
Run As Group = postfix
Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming
Incoming Work Group = clamav
Incoming Work Permissions = 0640
MTA = postfix
Virus Scanners = clamd
Clamd Socket = /tmp/clamd.socket
Use SpamAssassin = yes
SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin

2. Click Applications and click File Browser to launch the File Browser window and go to the /var/spool/MailScanner directory.

3. In the File Browser window, click File and click Create Folder. Name the new folder spamassassin.

4. Recreate the incoming folder to ensure the permission of the contents are set properly. Then right click on the folder incoming and click Properties.

5. In the Properties window, click the Permissions tab. In the Permissions page, set the Owner as postfix and its Folder Access as Create and delete files. Set the Group as clamav and its Folder Access as Access files. Finally, set the Folder Access of Others as None. Click Close when you are done. Repeat this for the quarantine and spamassassin folders.

6. From a terminal window, type in

ln -s /usr/bin/freshclam /usr/local/bin/freshclam

MailScanner will be looking for freshclam in the /usr/local/bin directory so we’ll create a symbolic link to it in that directory.

Integrating MailScanner into Postfix

1. Edit the file /etc/postfix/main.cf and remove the # in front of the line below

header_checks = regexp:/etc/postfix/header_checks

2. Edit the file /etc/postfix/header_checks and add the line below to the bottom of the file

/^Received:/ HOLD

This will now place all incoming mail into the holding area until released by MailScanner.

3. MailScanner should now be the one to start the Postfix service. Stop the Postfix service and start the Clamd and MailScanner service in that order. Learn how to stop and start services here.

4. Test if Postfix is still working. See Test Postfix using Telnet.

If you encounter any problems, check the log file at /var/log/maillog.

Congratulations

Congratulations, your mails are now checked for spam and viruses. Each mail you send or receive will now contain the lines below to indicate that MailScanner is doing its job.

This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

If you would like to change the inline signature above or any MailScanner email templates, go to /etc/MailScanner/reports/en for the English templates.

Installing Clam AntiVirus

If you prefer not to use the GUI tool below, you can also install the Clam AntiVirus by typing in yum install clamd in a Terminal window.

1. Click Applications then click Add/Remove Software. This will launch the Package Manager window.

2. Click the Search tab. Next type in clamd and click the Search button.

3. Select the latest version of clamd then click Apply. Next click on Continue until it proceeds with the installation.

4. After installation, click Ok. You now have successfully installed Clam Antivirus.

5. Start the clamd service. Learn how to stop and start services here.

6. To test ClamAV AntiVirus, type in the command clamscan in a terminal window.

7. To update the virus database, type in the command freshclam in a terminal window.

1. In the Terminal window, type in the commands below.

perl -MCPAN -e shell

This will activate the interactive mode for locating, download and building perl modules from CPAN sites. CPAN stands for Comprehensive Perl Archive Network. CPAN sites contains a large collection of Perl softwares and documentations.

If this is your first time to issue this command, you will be asked to set it up first. Don’t worry, all the setup options has usable default values except the geographic location option. Just hit the Enter key until you read the geographic location option and then select the location closest to you.

install Parse::RecDescent
install Inline
install Mail::ClamAV

2. Edit the file /etc/MailScanner/MailScanner.conf. Find the key below and change it as follows

Virus Scanners = clamavmodule

3. Restart the MailScanner service. Learn how to restart services here.

4. Test if Postfix is still working. See Test Postfix using Telnet.

Here are the installation guides for the above components.

• How to install Postfix SMTP Server
• How to install Clam Anti-virus (ClamAV)
• How to install MailScanner

SpamAssassin is included in CentOS 4 and ready to go out of the box. Just add it using the Package Management tool if you haven’t done so during CentOS installation. SpamAssassin is located in the Mail Server package.

Configuring MailScanner

1. Edit the file /etc/MailScanner/MailScanner.conf

%org-name% = your organization name
%org-long-name% = your full organization name
Run As User = postfix
Run As Group = postfix
Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming
MTA = postfix
Virus Scanners = clamd
Clamd Socket = /tmp/clamd.socket
Use SpamAssassin = yes
SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin

2. Click Applications and click File Browser to launch the File Browser window and go to the /var/spool/MailScanner directory.

3. In the File Browser window, click File and click Create Folder. Name the new folder spamassassin.

4. Right click on the folder incoming and click Properties.

5. In the Properties window, click the Permissions tab. In the Permissions page, set the File owner as postfix, the File group as postfix and check only the Owner Read, Write and Execute. Click Close when you are done. Repeat this for the quarantine and spamassassin folders.

Integrating MailScanner into Postfix

1. Edit the file /etc/postfix/main.cf and remove the # in front of the line below

header_checks = regexp:/etc/postfix/header_checks

2. Edit the file /etc/postfix/header_checks and add the line below to the bottom of the file

/^Received:/ HOLD

This will now place all incoming mail into the holding area until released by MailScanner.

3. MailScanner should now be the one to start the Postfix service. Stop the Postfix service and start the MailScanner service in that order. Learn how to stop and start services here.

4. Test if Postfix is still working. See Test Postfix using Telnet.

Congratulations

Congratulations, your mails are now checked for spam and viruses. Each mail you send or receive will now contain the lines below to indicate that MailScanner is doing its job.

This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Adding Dag Wieers RPM Repository to Yum

1. Click Applications, select System Tools and click Terminal. This will launch the Terminal window. Type in the command cd /etc/yum.repos.d and press Enter. This will bring us to the Yum repository configuration directory.

2. From this directory download the Yum repository configuration file by typing in the command
wget http://www.linux-mail.info/files/dag-clamav.repo and press Enter. This is what the file dag-clamav.repo looks like.

Installing Clam AntiVirus

3. To install ClamAV AntiVirus, type in the command
yum install clamav clamav-devel clamd and press Enter. When asked to confirm download, type in y and press Enter.

Using Clam AntiVirus

4. To use ClamAV AntiVirus, type in the command clamscan and press Enter.

5. To update the virus database, type in the command freshclam and press Enter.