Web Hosting Tutorials

What is Spam Assassin and How it is work ?

Posted on December 26th, 2006 by Alex P..
Categories: Cpanel Hosting, Linux, web Hosting, EXIM, VPS / OpenVZ.

What is Spam Assassin ?
The SpamAssassin system is software for analyzing email messages, determining how likely they are to be spam, and reporting its conclusions. It is a rule-based system that compares different parts of email messages with a large set of rules. Each rule adds or removes points from a message’s spam score. A message with a high enough score is reported to be spam.
Spam Assassin is a e-mail spam filtering system that sits side by side with account with us to help block, mark or filter out mail you don’t want.

How do I access Spam Assassin?
First thing you will want to do is log into your cPanel. From there, under the “Mail” box look at the nine a link that reads “Spam Assassin”. From here it will tell you if Spam Assassin is currently enabled or disabled. Clicking the boxes to enable or disable Spam Assassin is how you can turn it on or off. To configure the Spam Assassin settings click the button that reads: “Configure Spam Assassin (required to rewrite subjects)”

How do I configure Spam Assassin?
If you do not know what it is you are looking at, the next screen could be a little confusing. To help you understand here’s a break down of what you should see on the screen and what do do with it:

required_hits - The number of e-mails received before marked as spam.
rewrite_subject - The tells Spam Assassin if it should rewrite your subject line or not as you define. (1 is yes and 0 is no)
subject_tag - What the spam is marked with in the subject line. (usually ***SPAM*** or something else that could be picked up by your own mail filters on your mail client of choice)
blacklist_from - An e-mail address you definitely want to be marked as spam. (you could also use *@something.com to get every email from that address filtered)
whitelist_from - An e-mail address you definitely do NOT want to be marked as spam. (you could also use *@something.com to get every email from that address NOT filtered)

Once you’re done, just hit save and whatever you defined on the earlier page will now be in effect. If you picked to rewrite the subject, then you could now go into your mail client and write a new “rule” that would filter all mail with “***SPAM***” to go into a SPAM folder so that you could check it from time to time making sure you did not get any false positives.

How do I use the Spam Box ?
You can turn your spam box enable and disable from the same page as Spam Assassin. It’s just that easy! With the recent upgrades to cPanel, the TotalChoice Hosting team has been paying more attention to the users of Spam Assassin.

In the previous build you would need to use a imap client to get to your spam box.
Well not anymore. You can create a “new” e-mail account that has precisely the same settings as your e-mail account, but add: “/spam” to the end of the e-mail account user name. This will retrieve only your Spam Box mail.

In order for this to be useful, you will want to set up your e-mail client to deliver this Spam Box mail to a special folder (perhaps called spam?) automatically.

How spamassassin works

Check out its feature on how it works.

–> There are several ways that SpamAssassin makes up its mind about a
message:
–> The message headers can be checked for consistency and adherence to
Internet standards (e.g., is the date formatted properly?).
–> The headers and body can be checked for phrases or message elements
commonly found in spam (e.g., “MAKE MONEY FAST” or instructions on how to be
removed from future mailings)-in several languages.
–> The headers and body can be looked up in several online databases that
track message checksums of verified spam messages.
–> The sending system’s IP address can be looked up in several online lists
of sites that have been used by spammers or are otherwise suspicious.
–> Specific addresses, hosts, or domains can be blacklisted or whitelisted.
A whitelist can be automatically constructed based on the sender’s past
history of messages.
–> SpamAssassin can be trained to recognize the types of spam that you
receive by learning from a set of messages that you consider spam and a set
that you consider non-spam. (SpamAssassin and the spam-filtering community
often refer to non-spam messages as ham. )
–> The sending system’s IP address can be compared to the sender’s domain
name using the Sender Policy Framework (SPF) protocol (http://spf.pobox.com)
to determine if that system is permitted to send messages from users at that
domain. This feature requires SpamAssassin 3.0.
–> SpamAssassin can privilege senders who are willing to expend some extra
computational power in the form of Hashcash (http://www.hashcash.org).
Spammers cannot do these computations and still send out huge amounts of
mail rapidly. This feature requires SpamAssassin 3.0.

Most of SpamAssassin’s behavior is controlled through a systemwide
configuration file and a set of per-user configuration files. The per-user
configuration can also be stored in an SQL database.

How to Configure it ? : -
——————-

You can easily customize how SpamAssassin tags and identifies spam by
creating a spamassassin/user_prefs file. You can customize the number of
“spam points” required to identify a message as spam, create new rules, and
re-weight existing rules. Here is a sample user_prefs file. It raises the
threshold for identifying spam from 5 to 6, disables including spam warnings
in the subject and body, reweights a known rule, and adds several blacklist,
whitelist, and header rules.

Listing 1. A typical user_prefs configuration file

================================================================

#How many hits before a mail is considered spam?
required_hits 6

#Don’t mangle the messages so badly
rewrite_subject 0
use_terse_report 1

#whitelist and blacklist
whitelist_from *@www.sgugal.com
blacklist_from annoying-person@xyz.com

#reweight an existing rule
score BASE64_ENC_TEXT 3

#add some new rules
header KNOWN_LIST List-Id =~ /a-mailing-list-i-like/
score KNOWN_LIST -3

body EVITE /This invitation was sent to you by .* using Evite/
describe EVITE Looks like an eVite
score EVITE -3

Alex

0 comments.