sendmail spamassassin milter

[da...@umiacs.umd.edu]

I've been playing with getting clamav and spamassassin run from within 
sendmail and have had a great deal of luck on a fine RHEL box.

First go-round, I set up procmail as the LDA, set up an /etc/procmail that
ran spamassassin. Next, I used milter instructions to run spamassassin 
within sendmail.

First question; Has anyone had any experience as to which is faster or
more efficient? I would think running it directly from sendmail rather
than the procmail indirection but my benchmarks show them to be roughly
equivalent as to delivery throughput (OK, I  haven't stress-tested the 
box with a slew of messages so maybe that's why they appear the same).

I later started messing with two milters in sendmail but decided to first
just insure that clamav was working correctly so I only put in a milter for
clamav leaving spamassassin out of it. (note that spamd and spam-milter
were still running).   Magically, both attacked incoming mail even tho
Spamassassin isn't even in sendmail.  The current relevant lines in 
sendmail.mc is
INPUT_MAIL_FILTER(`clmilter',`S=local:/var/run/clamav/clmilter.sock, F=, T=S:4m;R:4m')

Does this work because spamass-milter is still running even tho it's
not mentioned in sendmail?

TIA


  =-=-=-=-=-=-=-=-=-=-  generated by /dev/dave -=-=-=-=-=-=-=-=-=-=-=-=
  David Stern                                    University of Maryland
            Institute for Advanced Computer Studies

Re: sendmail spamassassin milter

[Andrzej Adam Filip <an...@priv.onet.pl>]

dave@umiacs.umd.edu wrote:
> I've been playing with getting clamav and spamassassin run from within 
> sendmail and have had a great deal of luck on a fine RHEL box.
> 
> First go-round, I set up procmail as the LDA, set up an /etc/procmail that
> ran spamassassin. Next, I used milter instructions to run spamassassin 
> within sendmail.
> 
> First question; Has anyone had any experience as to which is faster or
> more efficient? I would think running it directly from sendmail rather
> than the procmail indirection but my benchmarks show them to be roughly
> equivalent as to delivery throughput (OK, I  haven't stress-tested the 
> box with a slew of messages so maybe that's why they appear the same).

Deploying SA from milter allows to reject in reply to "the final dot"
*IN* SMTP session. It makes the sending host responsible for generating
bounce messages. Some false positives are unavoidable - let legitimate
senders know "at once" about message rejection.

Deploying SA in LDA would allow to introduce "throughput averaging" and
avoid "peak load" problems of the alternative solution. It can not send
back bounces because envelope sender of spam are "random".

I strongly recommend using a few (2-3) DNS RBLs to reject most spam
before SA gets message.

> I later started messing with two milters in sendmail but decided to first
> just insure that clamav was working correctly so I only put in a milter for
> clamav leaving spamassassin out of it. (note that spamd and spam-milter
> were still running).   Magically, both attacked incoming mail even tho
> Spamassassin isn't even in sendmail.  The current relevant lines in 
> sendmail.mc is
> INPUT_MAIL_FILTER(`clmilter',`S=local:/var/run/clamav/clmilter.sock, F=, 
> T=S:4m;R:4m')
> 
> Does this work because spamass-milter is still running even tho it's
> not mentioned in sendmail?

Sendmail daemons "remembers" sendmail.cf as it was when the daemon was
started. Have you restarted (or HUPed) sendmail daemon after modifying
sendmail.cf ? [It is standard "warm-up" question before investigating
more sinister possibilities]

-- 
Andrzej [en:Andrew] Adam Filip anfi@priv.onet.pl anfi@xl.wp.pl
Home Page http://anfi.homeunix.net/