Simplistic Mail Filtering with DisSpam

by Daniel Drake (dsd)

About this guide

This guide is written to cover yet another way of efficient mail filtering for Linux and similar operating environments.
There are many different methods to filter your mail, many of which are quite complicated. However, some people, like myself, prefer to take more simplistic approaches where possible.

This guide explains mail filtering with DisSpam. DisSpam is a perl script, that connects to your POP3 server, and deletes any mails that it thinks are spam and/or viruses. You can easily schedule to run at regular intervals.
Note: I am currently working on IMAP mailbox support for DisSpam, which will be included in future versions alongside virus checking if the author accepts my work.

DisSpam does come included with some good documentation, but this guide takes a step-by-step approach for making the software more accessible.

History

December 5th 2003: Guide published.

Software versions used at time of writing

Perl 5.8.0
DisSpam 0.12
SpamAssassin 2.60
ClamAV 0.60

What you need

A POP3 email account. These are probably the most common these days, provided by many ISP's, companies, and also by some free email services.
A working linux installation, with a relatively new version of perl installed.
Root access for ease of installing new perl modules and antivirus software.

1. Required software and perl modules

You will need the following software installed before continuing. As root, install the following packages: Perl ClamAV SpamAssassin Perl modules: Net::DNS, Net::SMTP, Mail::SpamAssassin, MIME::Tools, Mail::ClamAV To install any perl modules that you are missing, you can use CPAN as follows: 
perl -MCPAN -e shell
install Module::Name
exit


Note: Inline::MakeMaker may be required for Mail::ClamAV installation.

The installation is fairly simple for Gentoo Linux users: 
emerge Net-DNS Mail-SpamAssassin MIME-tools
Perl should be already installed, and you will need to obtain the Inline::MakeMaker and Mail::ClamAV modules through CPAN.

Note: Mail::ClamAV fails the "make test" stage and refuses to install. You should install it under CPAN with force install Mail::ClamAV.

You must also install the core ClamAV software, which is available from here. Under Gentoo Linux, you may install this with:
emerge clamav

2. Updating ClamAV

Before we forget, lets ensure ClamAV has the latest virus definitions. As root, type the following at a shell:
freshclam


3. Downloading and patching DisSpam

At the time of writing, DisSpam (version 0.12) only supports spam filtering. I have written a patch to add virus detection and filtering, but this has not been accepted by the maintainer. So for now, we will have to patch the DisSpam source manually.

It is recommended that you use a non-root user to set up and configure disspam. From a shell, run these commands:
wget http://freshmeat.net/redir/disspam/22053/url_tgz/disspam-0.12.tar.gz
tar xzvf disspam-0.12.tar.gz
cd disspam
wget http://www.reactivated.net/patches/disspam-0.12/disspam-virus-checking.patch
patch -p1 < disspam-virus-checking.patch

4. Configuring DisSpam

It's now time to configure DisSpam. Copy the file sample.conf to disspam.conf and open disspam.conf in your favourite text editor, i.e.:
cp sample.conf disspam.conf
nano disspam.conf

At the end of [GLOBAL] section, you will find these four lines:
# spamassassin=yes
# clamav=yes
# avtemporary=/tmp/clamav.temp
# mimestore=/tmp/mimestore
Uncomment all four by removing the # and the space before each setting.
The [RBL] section may be left alone, as we are using SpamAssassin for spam filtering.

Now you must configure a mailbox that DisSpam will filter. You will see a section in the config file marked "Your custom mailbox section(s) start here". Below that, there are some sample values. You need to change the email, host, username, and password keys to your personal values.

Personally, I like to set the backupfile option to store any mails that are filtered and deleted. I have been using SpamAssassin for over a year and it has only turned up one "false positive" that I know about. This option will store all the "spam" mails, and that may be helpful, if you ever lose an important mail!

I also like to enable the sendbounceback option. This option will "bounce" any mails that are filtered out by DisSpam. This informs the senders of any mails that become "false positives" that I have *not* read their mail, and also acts as a spam-the-spammer measure!

If you are interested in the configuration, you should read configuration.txt included in the distribution.

5. Test run

Lets now run DisSpam for the first time, to check our settings. Run the following command:
./disspam.pl disspam.conf

DisSpam should work through all your mails successfully.

6. Automation

Assuming all is working well, you now want to schedule DisSpam to run regularly, and it may also be useful to keep CramAV up to date automatically.

We will use cron here to automate these tasks. As the user that you wish to filter the spam with, run:
crontab -e

We will add a line at the bottom of this file to schedule DisSpam to be run regularly. Mine looks like this:
0 * * * * /home/spam/disspam.pl /home/spam/disspam.conf > /home/spam/spamlog &
Here is a brief explanation of what each part means:
  • 0 * * * * - This is cron notation which means "run every hour, on the hour". Tutorials such as this one do a good job at explaining this notation.
  • /home/spam/disspam.pl - This is the absolute location of my disspam.pl file from the DisSpam distribution.
  • /home/spam/disspam.conf - This is the absolute location of my disspam.conf file which we created in step 4.
  • /home/spam/spamlog - This is a file where I log the output of DisSpam's most recent run. If you don't want to log this, then use /dev/null here.
You may also want to automate the updating of ClamAV's virus definitions. su to root, run crontab -e and add the following line, to make ClamAV update every night at midnight:
0 0 * * * freshclam > /dev/null

7. Conclusion

That should be all you need to benefit from reduced noise in your mailbox. One disadvantage to this method emerges when you check your mail more frequently than DisSpam runs. If you recieve a spam message after DisSpam has run, and you then check your mail before DisSpam next runs, you will recieve that message. One way to combat this is to make DisSpam run more frequently.

Please provide feedback, both to me, and DisSpams author, Mina Naguib.