DSPAM? Why not in gentoo? Something bad about it?

adammorley · n00b Joined: 29 Sep 2002 Posts: 55

Hi,

I noticed that DSPAM doesn't seem to be in gentoo, even though it looks rather promising. I was surprised, because it seemed like it would be in gentoo. Is there a reason? Like, was it once, but it turned out to not be so great or something?

http://www.nuclearelephant.com/projects/dspam/

Thanks,
adam

banadushi · Posted: Tue Sep 30, 2003 9:50 am Post subject:

There is an ebuild for DSpam 2.6.4 in the bugs db.

https://bugs.gentoo.org/show_bug.cgi?id=26744

banadushi · Posted: Tue Oct 07, 2003 11:05 am Post subject:

adammorley · n00b Joined: 29 Sep 2002 Posts: 55

Is this going into portage sometime? Or is it still being tested?

banadushi · Posted: Thu Oct 16, 2003 2:16 am Post subject:

Cornfed · n00b Joined: 22 Dec 2003 Posts: 59

Anyone have any news of this getting entered into portage?

drakos7 · Posted: Tue Feb 24, 2004 2:42 pm Post subject:

Especially now that it is at 2.8.3 AND was featured on =slashdot.
I guess the thing to do is make and submit another ebuild to bugs.gentoo
_________________
"People demand freedom of speech as a compensation for the freedom of thought which they seldom use." Soren Kierkegaard (1813 - 1855)

adammorley · n00b Joined: 29 Sep 2002 Posts: 55

drakos7 · Posted: Tue Feb 24, 2004 3:48 pm Post subject:

Sure, but at the bottom of the dspam site it lists gadoyanspam as the " DSPAM agent designed with qmail in mind". So there should probably be 2 ebuilds, one for dspam and one for gadoyanspam.
Disclaimer: I do not run qmail so I cannot speak authoritatively on this.

adammorley · n00b Joined: 29 Sep 2002 Posts: 55

[quote="drakos7"]Sure, but at the bottom of the dspam site it lists [url=http://oss.mdamt.net/gadoyanspam/]gadoyanspam[/url] as the "[i] DSPAM agent designed with qmail in mind[/i]". So there should probably be 2 ebuilds, one for dspam and one for gadoyanspam.
[i]Disclaimer:[/i] I do not run qmail so I cannot speak authoritatively on this.[/quote]

I'm currently looking at gadoyanspam, but so far, I haven't decided if its what I'm looking for. I will say that its pretty close.

BobOki · n00b Joined: 23 Feb 2004 Posts: 67 Location: Svannah, Ga

Install instructions for gadoyanspam ("I don't liek spam") are as follows:

HOW TO USE
* Install DSPAM. I use version 2.8.1
We dont use the "dspam" program that come with the package,
but we need the other executables and libdspam
from the package. Dont forget to setup the USERDIR.
READ the documentation

* Compile gadoyanspam:

# gcc -o gadoyanspam gadoyanspam.c -ldspam -I/path/to/dspam-source-code

If your dspam installation is not in your library path, you can try:

# gcc -o gadoyanspam gadoyanspam.c -ldspam -I/path/to/dspam-source-code\
-L/path/to/dspam/lib

* Install it somewhere in your PATH

# cp gadoyanspam /usr/bin

* Put it in your .qmail file, like:

|/path/to/gadoyanspam
./Maildir/username

* by default you can send:
- normal messages to: user@domain.com
- spam messages to: user-spam@domain.com
- false positives to: user-notspam@domain.com

dont forget to create email user-spam@domain.com and user-notspam@domain.com
these address dont have to have a mailbox, /dev/null is ok. But if you are
using quarantine feature, at least user-spam@domain.com needs to have a maildir
installed.

Sounds like it would be easy to make a package for it?
_________________
We the willing lead by the unknowing have done so much for so long with so little, we are now capable of doing everything with nothing.

adammorley · n00b Joined: 29 Sep 2002 Posts: 55

Donovan

So, how does one have both a spam filtering solution in place AND a virus scanning solution at the same time with Qmail?

Previously I had Qmail-Scanner + ClamAV + F-Prot + SpamAssassin... it stopped working just recently, and I ended up removing SpamAssassin (which wasn't identifying spam anymore) and ClamAV (which was giving memory errors).

How do I impliment, POPFile (or) CRM114 (or) DSPAM (and soon after that MailMan) into Qmail? Qmail-Scanner only supports SpamAssassin for spam filtering.

...Dono
_________________
Gentoo Linux * DirecTivo * Who needs heaven?

adammorley · n00b Joined: 29 Sep 2002 Posts: 55

Integrate spam filtering and virus filtering? Well, I've never done virus filtering (we're a unix shop, so its less of a problem for us. But I've tested TMDA (love it, wish it had a maildir pending directory. that's coming soon though), and am now testing bogofilter. Bogofilter has been quite effective.

cat .qmail
|condredirect <spam email box> /command/bogofilter -u
./.Maildir/

where <spam email box> is another alias (say, bob-spam@domain.com) that goes to a folder for the email that is filtered. read the followings:

http://article.gmane.org/gmane.mail.bogofilter.general/711
http://www.chrishardie.com/tech/qmail/qmail-antispam.html (that's where I got my bogofilter .qmail file)

I looked at dspam, but it turns out i didn't like how it integrated with qmail. It also looked like it used a system wide db for the spam detection, and I didn't like that. I could be wrong on both since I never actually put it into production. But I found bogofilter, and had already started with TMDA.

tecknojunky · Posted: Fri Mar 19, 2004 7:34 pm Post subject:

Anyone can provides some insights on how dspam compares to spam assassin?

I'm compeled to try it since my MTA is running on a P1 box. Perl is awfully slow on that box (so is any interpretted language, for that matter) and has a big footprint to remain resident in memory.

Since spamassassin is a heuristic based filtering while dspam is a statistical based filtering, does it do a better or worst job? Does it require a lot of maintenance?

Thanks
_________________
(7 of 9) Installing star-trek/species-8.4.7.2::talax.

cbreaker · Posted: Sun Mar 28, 2004 7:13 am Post subject:

I would like to be able to use DSPAM in the way that I use SpamAssassin.

I'm using Exchange. So, needless to say there's no maildirs or mboxes or users on the unix box. I just want to filter some spam, for everyone. I don't care if it's not 100% tailored to each individual users. They don't care, they just want the spam to stop, and my users don't care if one or two false positives get deleted. Internet e-mail can be unreliable anyways! With autowhitelisting this isn't really something that's likely to happen much.

SO, I have postfix with amavisd-new and spamassassin. The combo has worked great in the past. I have a mailbox on the unix box that people can forward spam to when they get it. Every night a cron job runs through the mailbox to update the bayes filter. With the scoring system being able to score bayes hits depending on how sure it is, along with the razor and other tests, I've never had a false positive ever. And I used to only get one or two spams a day, versus the 50 before putting it in.

Unfortunately, the bayes filter seems kinda weak. I've been getting more and more spam lately. I've read other people say the same thing. So, looking around I only see DSPAM as the alternative.

Unfortunately, most of these kinds of things (including spamassassin, if it weren't for amavisd) assume you're running all your mailboxes off the unix box and that your users care enough/are willing to manage their own spam settings and such. DSPAM seems to fall into this category.

It looks like I can do what I want to do with DSPAM but it's going to take a lot of work, I think. If anyone has a configuration suggestion to point me in the right direction, please do so. I can switch off of postfix if need be, I don't really care. But I gotta try something new.

mallchin · Posted: Fri Apr 16, 2004 2:51 pm Post subject:

I'd like to use dspam with Courier's mailfilters. If anyone has information or success stories relating to this I would be intrigued.
_________________
6700 @ 2.66GHz, 4Gb RAM, 2 x 500Gb, 8800 GTX, PhysX, X-Fi, 24" Widescreen, Tux mascot

zeek · Posted: Sun Apr 18, 2004 8:34 pm Post subject:

mallchin · Posted: Mon Apr 19, 2004 12:39 pm Post subject:

Still, two spam thwaters are better then one

_________________
6700 @ 2.66GHz, 4Gb RAM, 2 x 500Gb, 8800 GTX, PhysX, X-Fi, 24" Widescreen, Tux mascot

jeffk · l33t Joined: 13 Sep 2003 Posts: 671

I am still getting my sea legs for writing ebuilds, mostly sticking to small libraries and python extensions. I'm still new to postfix and qmail, and that's been holding me back from trying any manual DSPAM installs. For anyone with the experience to get DSPAM running properly with gentoo and postfix, Many would really appreciate some ebuilds for the latest versions.

The current versions are
Stable[ v2.10.3-STABLE ] April 2, 2004
Devel [ v3.0.0-ALPHA-4 ] April 16, 2004
http://www.nuclearelephant.com/projects/dspam/#download

Our spam situation, like everyone else's, is growing serious, and DSPAM is the package I want to try. Based on what I've read about it, I'd very much like to see this package get into the gentoo mainstream. Thanks.

n0cturne · n00b Joined: 28 Dec 2002 Posts: 14 Location: NE, USA

I will second jeffk's request. I have tried a manual install and got it "somewhat" working, but I haven't had time to fiddle with it any more. I seem to have some problems with permissions as far as I can tell. If there was a good "howto" for gentoo/postfix/dspam even, I would be happy. An ebuild would be better of course!

_________________
/\/octurne

tweakt · Posted: Tue Apr 27, 2004 4:47 pm Post subject: A fresh start?

Dspam is clearly the most effective spam filter right now. Spamassiin served me well for a quite a while but it just stopped holding up to the onslaught of nasty spam being thrown at me these days. This tool should definately be available in portage and hopefully become the recommended spam filter for Gentoo.

I will volunteer to write a HOWTO. I have also made an ebuild from scratch which I would really love to get some feedback on. I have a few things to work out and maybe some others have some clever solutions. I didn't realize there was one in the bug db, I'll take a look at it, but it sounds like they're collecting dust.

The tricky part is supporting the wide variety of configurations out there. I think the best approach is to not to try to do everything automatically, but provide example configs ready to drop in.

What I have so far:

mysql USE flag will enable mysql support instead of libdb4, I've packed and scripted everything necessary to create the database, mysql user account, and tables, as well as the purge script that should be run from cron. Running 'ebuild XXX.ebuild configure' will set things up for you.

The dspam webapp is installed to manage the spam quarantine. I borrowed what I could from packages like phpMyAdmin but I could use some guidance regarding virtual hosting, etc. I know there's been an effort in this area, so I'd like to do things the most correct way. There are also security/permissions issues to work out with that, I've got a compromise that works currently. This addes a depend on apache and perl. I could use some feedback on this. I want to make it as turnkey as possible without losing too much flexibility.

I'm running with postfix and have come up with a better configuration than what is documented in the README. It allows postfix to deliver as the dspam user and not the target user, this keeps the permissions correct. (Initially I had files in the dspam data directory group readable by 'users', oops!)

I'm wondering if there is sufficient interest to either make a local USE flag or a dspam-lite ebuild that installs and sets up to deliver spam instead of quarantining it for those who prefer not to use the webapp. You can then filter with procmail by looking at the X-DSPAM-Result header, and send false-negatives back in with a nonspam mail alias. There is also a way to set things up to call dspam directly from procmail for a single user.

On the 'NICE-TO-HAVE' list:

Currently, dspam ships with a util which reads /etc/passwd to generate a list of aliases which forward to dspam for retraining on false negatives. I don't really care for this approach and I think it should be done dynamically.

It shouldn't be that hard to create a dynamic filter that matches spam-$USER and reinjects to dspam for false-negatives as that user automatically. Certain restrictions could be added to prevent delivery for system accounts. Ideally this should use PAM.

Dspam likes to keep data and spam quaranting, and certain config files all in the same folder. I'd like to have /etc/dspam for config, and /var/spool/dspam for everything else. It shouldn't be too hard to create a patch to supply a new autoconf parameter to specifiy that and hopefully it would get committed upstream

That's it for now. I can't promise anything within a specific timeframe but I have the basics in place now and it's working EXTREMELY well, so I really want to share with the rest of the Gentoo community.

I haven't played with the 3.x release yet, I'll take a look at it down the road though.

n0cturne · n00b Joined: 28 Dec 2002 Posts: 14 Location: NE, USA

Thanks for the info tweakt! I fell back to Spamassassin because I really didn't have a lot of extra time to mess with Dspam. I *would* like to try it and I wouldn't mind doing a little testing for you if you need any help on that side of things.

I agree with your thoughts on providing the example configs rather than trying to do everything with an ebuild. Lots of variables out there, different MTAs, delivery agents, etc.

The mysql support, the webapp, and the idea of the "lite" version of dspam are perfect!

I am glad to hear you have come up with a better solution to the permissions problem. That was the biggest concern I had... I really didn't like the way it worked using the config from the README.

Keep up the good work and keep us informed of your progress! I appreciate your work on this!
_________________
/\/octurne

jeffk · l33t Joined: 13 Sep 2003 Posts: 671

DSPAM 3.0.0.beta.1 was just released, this might make it stable enough for a potential ebuild. They seem to be zipping along at a release every few weeks.

psi0nik · n00b Joined: 21 Nov 2003 Posts: 31

i've seen a few posts in this thread regarding virus scanning with qmail. rather than going the clamAV route and firing off a hefty perl process with qmail-scanner, i've been using russell nelson's qmail-smtpd-virusscan patch available at http://qmail.org/qmail-smtpd-viruscan-1.3.patch

this reads a list of virus signatures from a file, and blocks attachments matching those signatures at the smtp level, so it's VERY cheap, very low overhead, and very effective.

the net effect of this is that you can't send windows executable attachments into your mail server anymore - it will simply reject them with a message stating 'we don't accept executable attachments, please zip this'

this way, if someone's sending legit attachments, they'll get a bounce from their server, they can zip the thing, and resend it. nice and easy. and there's no good reason to be sending an exe attachment w/o at least compressing it first anyway.