help with mailscanner

[westconn1]

anyone got experience doing this?
i need to try to limit the amount of spam coming through a mail server
the mail is coming through a postfix server and mailscanner checks with some list, but the amount of spam is growing rapidly

i tried to do header checks in postfix using regular expressions, but with very little success, few of the ones i wanted to catch were caught, and some that should have passed, were caught, for no reason i could see.
i believe it is better to use mailscanner rather than the postfix for checking, but i have no experience in either.

any pointers or links to exceeeding basic instructions would be good
the sever is remote to me, but i can access using webmin, the linux is
CentOS Linux 4.0

[TomGibbons]

Personally, I use spamassassin, very successfully. I run spamc on each email using procmail.

If you're using CentOS you should be able to install spamassassin via yum. Here is a guide on getting spamassassin to work via procmail.

[TomGibbons]

I just noticed that you said you have access using webmin. I've never used that myself, do you have SSH access? I don't know how flexible webmin is but you'll need to install software and access files on the server.

[westconn1]

from webmin, i can access files on the server, and can run commands (if i knew what they were), i presume that it use ssh, but not sure, but i am remote to the server and cannot easily put a disk in the drive
spamassassin is already installed and running, but i do not know if it is actually doing anything

the amount of spam coming through has esculated considerably since i started this thread

[TomGibbons]

Did you ever get this working?

[westconn1]

not really made any progress, i just don't know enough about linux

the mail is checked against spamlist at spamcop or spamhaus, by mailscanner
this is the last line in mailscanner.conf
SpamAssassin Prefs File = /etc/MailScanner/spam.assassin.prefs.conf
so i believe spamassassin is running
and a lot of emails everyday are sent to spam on the server (14,000 since may 6), but hundreds are still getting through, i have about 1000 since july 10, just to my mailbox

[TomGibbons]

Check the headers of incoming email message, see if they make reference to Spamassassin and if the message has a score.

[westconn1]

the header only has reference to mailscanner

Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-RPD-ScanID: Class unknown; VirusThreatLevel unknown, RefID str=0001.0A150204.4880ED6C.007B,ss=1,fgs=0
MailScanner-NULL-Check: 1217014008.88093@6Dxfscznph8jKZ9mlLqGeg
X-Westconn-MailScanner-Information: Please contact the ISP for more information
X-MailScanner-ID: 9097EF0434.175AF
X-Westconn-MailScanner: Found to be clean
X-Westconn-MailScanner-From: ???.com.au
Status: O
X-UID: 433468
Content-Length: 116
X-Keywords:
X-Antivirus: AVG for E-mail 8.0.136 [270.5.0/1558]

[TomGibbons]

Then it's not being scanned by spamassassin. spamassassin adds headers into the emails. For example, taken from an email I received today:

X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on mail.[redacted]
X-Spam-Level:
X-Spam-Status: No, score=-1.2 required=5.0 tests=AWL,BAYES_00, HTML_IMAGE_ONLY_24,HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI, MPART_ALT_DIFF autolearn=no version=3.2.4

Checking against blacklists isn't really enough to keep your inbox clean. I don't have any experience configuring mailscanner so you'll have to see if anyone else on the board can help you with that.