Subversion Repositories

configuration:

loadplugin Greylisting /usr/share/perl5/Mail/SpamAssassin/Plugin/Greylisting.pm

describe GREYLIST_ISWHITE The incoming server has been whitelisted for this recipient and sender

score GREYLIST_ISWHITE  -1.5

priority GREYLIST_ISWHITE 99999

(It is a long-standing bug that the module is installed in the wrong

directory, which is why the full path has to be specified on the

existing installations.)

If two messages from the same /24 network (or IP address, depending on

greylistfourthbyte), with the same sender, with the same list of

recipient, and with a score below dontgreylistthreshold are seen at

least greylistsecs apart, the triplet will be whitelisted and the

GREYLIST_ISWHITE rule will be considered to match thenceforth. That

will signal to the local_scan library to raise SAtempreject to let the

message through, in addition to the negative spam score it carries.

Notice that messages can be permanently rejected (score above

SApermreject) and still get a triplet whitelisted if the score is

below dontgreylistthreshold. If dontgreylistthreshold or SAtempreject

+ SAgreylistraisetempreject are less than SApermreject, some mail may

be temporarily rejected indefinitely.

***********************

* SPAMD CONFIGURATION *

***********************

By default, spamd runs as root and assumes the identity of the user it

is told it is scanning mail on behalf of by whoever connects to it

(see README.spamd.gz in the spamassassin package for a discussion on

security). When SA-Exim runs spamc, this user will normally be

Debian-exim. You can set the SAspamcUser option in sa-exim.conf to

override this, but since a mail can have multiple recipients and is

only scanned once, per-user setups are problematic. Also, the

greylisting module won't work unless all users can write to the

tuplets directory.

Thus, when using SpamAssassin together with SA-Exim you may want to

run spamd under a specific system account by modifying the OPTIONS

variable in /etc/default/spamassassin to include a --username option.

However, if you ONLY use SpamAssassin with SA-Exim this is in practice

not strictly necessary.

You should NOT run spamd as the "nobody" user and/or the "nogroup"

group if you configure SpamAssassin to use sa-exim's greylisting

module, the bayesian classifier, or any helper module that needs to

write files, because nobody/nogroup should be completely unprivileged

and thus not own any files. Instead you should create a dedicated

account to run spamd under. You can then adjust the ownership of

/var/spool/sa-exim/tuplets and the username in

/etc/cron.d/greylistclean accordingly.