Integrating SpamAssassin into Postfix using spamd

The easiest way to integrate postfix and spamassassin is to use spamd in an [http://www.postfix.org/FILTER_README.html after-queue] inspection. This configuration does not allow rejecting messages within the SMTP transaction, so it unfortunately contributes to backscatter email. On the other hand, it has important performance advantages over [http://www.postfix.org/SMTPD_PROXY_README.html before-queue] inspection.

First, edit /etc/postfix/master.cf, find the

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (50)
# ==========================================================================
...
smtp      inet  n       -       n       -       -       smtpd
...

line and just add " -o content_filter=spamassassin" to the end of the line:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (50)
# ==========================================================================
...
smtp      inet  n       -       n       -       -       smtpd -o content_filter=spamassassin
...

Then, go to the end of the file, and add this:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (50)
# ==========================================================================
...
spamassassin
          unix  -       n       n       -       -       pipe
   user=nobody argv=/path/to/spamc -e /path/to/postfix/sendmail -oi -f ${sender} ${recipient}
# make sure it's all on one line or
# start the consecutive lines with a whitespace
# like I did here

Make sure that you have adjusted the path to the spamc and sendmail commands above! (Please make sure that the path you've given is Postfix's sendmail and not Sendmail the SMTP server. Nothing will work if you're using the wrong one!). Then, setup spamd to start with the system, and you are ready to go. If you wish to provide spamassassin preferences, change "user=nobody" to a valid system user (except for root, since Postfix will NOT call external programs as root), and add .spamassassin into that user's home directory.

If you use user preferences stored in SQL, you should change "spamassassin" service in master.cf to following:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (50)
# ==========================================================================
...
spamassassin
          unix  -       n       n       -       -       pipe
   flags=Rq user=nobody argv=/path/to/spamc -u ${recipient} -e /path/to/postfix/sendmail -oi -f ${sender} ${recipient}

Notice "-u ${recipient}" added. Otherwise "username" field in database will always appear as user which postfix is invoking spamc(in this example it is 'nobody').

Note that this exact method of invoking SpamAssassin is not very robust. Postfix's pipe error behavior is as follows:

• If the exec() fails (e.g., /path/to/spamc is incorrect), Postfix will bounce the message.
• If the command returns EX_OSERR or EX_TEMPFAIL (defined in /usr/include/sysexits.h), Postfix will defer the message.
• If the command returns EX_OK, Postfix will consider the message done. The command should deliver it; it will be discarded otherwise.
• If the command returns any other error code, Postfix will bounce the message.
  

With spamc -e, spamc will return EX_OK when spamd is unavailable but sendmail is working, so Postfix will deliver the message. You probably want it to be deferred instead. This is not possible with spamc directly, but you can do so with a simple script. Replace the lines above with:

spamassassin
          unix  -       n       n       -       -       pipe
   flags=Rq user=nobody argv=/path/to/filter.sh -oi -f ${sender} ${recipient}

and create a filter.sh as follows:

#!/bin/sh
SENDMAIL="/usr/sbin/sendmail -i"
SPAMASSASSIN=/usr/bin/spamc

# Exit codes from <sysexits.h>
EX_TEMPFAIL=75
EX_UNAVAILABLE=69

umask 077

OUTPUT="`mktemp mailfilter.XXXXXXXXXX`"
if [ "$?" != 0 ]; then
    /usr/bin/logger -s -p mail.warning -t filter \
        "Unable to create temporary file."
    exit $EX_TEMPFAIL
fi

# Clean up when done or when aborting.
trap "rm -f $OUTPUT" EXIT SIGTERM

$SPAMASSASSIN -x > $OUTPUT
return="$?"
if [ "$return" == 1 ]; then
    echo "Message content rejected"
    exit $EX_UNAVAILABLE
elif [ "$return" != 0 ]; then
    /usr/bin/logger -s -p mail.warning -t filter \
        "Temporary SpamAssassin failure (spamc return $return)"
    exit $EX_TEMPFAIL
fi

$SENDMAIL "$@" < $OUTPUT
exit $?

You still must be careful that the script is in the right place and executable or email will bounce. However, this will defer messages on most failures.

A more complex solution is the one proposed in the [http://www.postfix.org/FILTER_README.html FILTER_README file] that comes with the Postfix distribution. See IntegratePostfixViaSpampd for one approach.

Only mail received by SMTP will be scanned with this method, i.e. mail injected with sendmail(1) will not be fed to SpamAssassin.