Spam Assassin scanning for outgoing email

ro573 · Dec 13, 2020

Hello,

I have tried (and perhaps succeeded) to setup Spam Assassin scanning for outgoing emails in Exim. But my Exim skills are not as good as the experts on this great board so perhaps someone with more experience could give some feedback.

This is what I've done so far.

1. Add router for scanning outgoing mail

Add to /etc/exim.routers.pre.conf (or in exim.conf at top after "begin routers")

Code:

### start: scan outgoing email for spam

# Spam Assassin
spamcheck_director_outgoing:
  driver = accept
  condition = "${if and { \
            {!eq {$received_protocol}{spam-scanned}} \
            {<{$message_size}{200k}} \
        } {1}{0}}"
  domains = ! +local_domains
  ignore_target_hosts = 127.0.0.0/8
  retry_use_local_part
  headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
  transport = spamcheck_outgoing
  no_verify

# remove messages with spam score >= 4
domain_filter_outgoing:
  driver = redirect
  domains = ! +local_domains
  ignore_target_hosts = 127.0.0.0/8
  allow_filter
  no_check_local_user
  user = "mail"
  group = "mail"
  file = /etc/virtual/exim_spamscore4.filter
  directory_transport = address_file
  pipe_transport = virtual_address_pipe
  retry_use_local_part
  no_verify
  no_expn

### end: scan outgoing email for spam

2. Add transport for scanning outgoing mail

Add to /etc/exim.transports.pre.conf (or in exim.conf after "begin transports")

Code:

### start: scan outgoing email for spam

spamcheck_outgoing:
  driver = pipe
  batch_max = 100
  command = /usr/sbin/exim -oMr spam-scanned -bS
  current_directory = "/tmp"
  group = mail
  home_directory = "/tmp"
  log_output = true
  message_prefix =
  message_suffix =
  return_fail_output
  no_return_path_add
  transport_filter = /usr/bin/spamc -u spamcheckoutgoing
  use_bsmtp
  user = mail

### end: scan outgoing email for spam

3. Create /etc/virtual/exim_spamscore4.filter:

Code:

# Exim Filter

if error_message then finish endif

if
        $h_X-Spam-Level: contains "****"
then
        seen finish
endif

#end filter

# NOTE: You could add any limit here, not just 4 (****)

4. Fix rights

chown mail:mail /etc/virtual/exim_spamscore4.filter

5. Create user spamcheckoutgoing

Could probably be done via DA or via command prompt.

6. Add custom spamd settings to /home/spamcheckoutgoing/.spamassassin/user_prefs like,

Code:

required_score 10.0
#rewrite_header subject [spam?]
report_safe     0

As far as I can see this seems to work just fine. I was under the impression that this would be harder to setup. Perhaps I've missed something.

Only drawback so far is that outgoing mail that are stopped are just silently stopped, the user is not notified. I tried to add a fail message in the exim filter but did not succeed (filtering command "fail" is disabled). I tried to change user for the filter call but did not manage to get it to work. You could probably setup a cron that checks for "domain_filter_outgoing" in the exim log and notify the user.

Do you have any feedback?

[edit: fixed the chown command]

Spam Assassin scanning for outgoing email

ro573

New member