SpamAssassin

Infobox Software
name = SpamAssassin



caption = E-mail recognized as spam by SpamAssassin, here in the Novell Evolution email client.
collapsible = yes
developer = Apache Software Foundation [http://cvs.apache.org/viewcvs.cgi/spamassassin/trunk/CREDITS?root=Apache-SVN&view=markup]
latest release version = 3.2.5
latest release date = release date|2008|07|12
latest preview version =
latest preview date =
operating system = Cross-platform
programming language = Perl
genre = Email spam filter
license = Apache License 2.0
website = http://spamassassin.apache.org

SpamAssassin is a computer program released under the Apache License 2.0 used for e-mail spam filtering based on content-matching rules.

SpamAssassin uses a variety of spam-detection techniques, including DNS-based and checksum-based spam detection, Bayesian filtering, external programs, blacklists and online databases.

The program can be integrated with the mail server to automatically filter all mail for a site. It can also be run by individual users on their own mailbox and integrates with several mail programs. SpamAssassin is highly configurable; if used as a system-wide filter it can still be configured to support per-user preferences.

SpamAssassin was awarded the Linux New Media Award 2006 as the 'Best Linux-based Anti-spam Solution'. [cite web |url=http://www.linux-magazine.com/issue/74/Linux_New_Media_Awards_2006.pdf |title=Linux New Media Awards 2006 |work=Linux Magazine |format=PDF |accessdate=2008-07-10]

History

SpamAssassin was created by Justin Mason who had maintained a number of patches against an earlier program named "filter.plx" by Mark Jeftovic, which in turn was begun in August 1997. Mason rewrote all of Jeftovic's code from scratch and uploaded the resulting codebase to SourceForge.net on April 20, 2001.

Methods of usage

SpamAssassin is a Perl-based application (Mail::SpamAssassin in CPAN) which is usually used to filter all incoming mail for one or several users. It can be run as a standalone application or as a client (spamc) that communicates with a daemon (spamd). The latter mode of operation has performance benefits, but under certain circumstances may introduce additional security risks.

Typically either variant of the application is set up in a generic mail filter program, or it is called directly from a mail user agent that supports this, whenever new mail arrives. Mail filter programs such as procmail can be made to pipe all incoming mail through SpamAssassin with an adjustment to user's .procmailrc file.

Operation

SpamAssassin comes with a large set of rules which are applied to determine whether an email is spam or not. Most rules are based on regular expressions that are matched against the body or header fields of the message, but SpamAssassin also employs a number of other spam-fighting techniques. The rules are called 'tests' in the SpamAssassin documentation

Each test has a score value that will be assigned to a message if it matches the test's criteria. The scores can be positive or negative, with positive values indicating 'spam' and negative 'ham' (non-spam messages). A message is matched against all tests and a SpamAssassin combines the results into a global score which is assigned to the message. The higher the score, the higher the probability that the message is spam

SpamAssassin has an internal (configurable) score threshold to classify a message as spam. Usually a message will only be considered as spam if it matches multiple criteria; matching just a single test will not usually be enough to reach the threshold.

If SpamAssassin considers a message to be spam, it can be further rewritten. In the default configuration, the content of the mail is appended as a MIME attachment, with a brief excerpt in the message body, and a description of the tests which resulted in the mail being classified as spam. If the score is lower than the defined settings, by default the information about the passed tests and total score is still added to the email headers and can be used in post-processing for less severe actions, such as tagging the mail as suspicious.

SpamAssassin allows for a per-user configuration of its behaviour, even if installed as as system-wide service; the configuration can be read from a file or a database. In their configuration users can specify individuals whose emails are never considered spam, or change the scores for certain rules. The user can also define a list of languages which they want to receive mail in, and SpamAssassin then assigns a higher score to all mails that appear to be written in another language.

Network-based filtering methods

SpamAssassin also supports:
* DNS-based blackhole lists
* URI blacklists such as SURBL or URIBL.com which track spam websites
* checksum-based filters such as the Distributed Checksum Clearinghouses, Vipul's Razor and the Cloudmark Authority plug-in (commercial)
* Hashcash
* Sender Policy Frameworkas a means to tell 'ham' from 'spam'.

More methods can be added reasonably easily by writing a Perl plug-in for SpamAssassin.

Bayesian filtering

SpamAssassin by default tries to reinforce its own rules through Bayesian filtering, but Bayesian learning is most effective with actual user input. Typically, the user is expected to "feed" example spam mails "and" example "ham" (useful) mails to the filter, which can then learn the difference between the two. For this purpose, SpamAssassin provides the command-line tool sa-learn, which can be instructed to learn a single mail or an entire mailbox as either ham or spam.

Typically, the user will move unrecognized spam to a separate folder for a while, and then run sa-learn on the folder of non-spam and on the folder of spam separately. Alternatively, if the mail user agent supports it, sa-learn can be called for individual emails. Regardless of the method used to perform the learning, SpamAssassin's Bayesian test will subsequently assign a higher score to e-mails that are similar to previously received spam (or, more precisely, to those emails that are different from "non-spam" in ways similar to previously received spam e-mails).

Licensing

SpamAssassin is free/open source software, licensed under the Apache License 2.0. Versions prior to 3.0 are dual-licensed under the Artistic License and the GNU General Public License.

a-compile

sa-compile is a utility distributed with SpamAssassin as of version 3.2.0. It compiles a SpamAssassin ruleset into a deterministic finite automaton that allows SpamAssassin to use processor power more efficiently.

Testing SpamAssassin

Most implementations of SpamAssassin will trigger on the GTUBE, a 68 byte string not unlike the antivirus EICAR test file. If this string is inserted in an RFC 2822 formatted message and passed through the SpamAssassin engine, SpamAssassin will trigger with a weight of 1000.

See also

The following free/open source applications have support for SpamAssassin:

* [http://www.scalix.com Scalix] - an open source outlook substitute incorporates SpamAssassin
*Citadel - email/groupware server contains built-in support for SpamAssassin integration
*MailScanner - "A Free Anti-Virus and Anti-Spam Filter"
*KMail - supports SpamAssassin and other spam filters, through some modular filters.
*MIMEDefang
*SmarterMail
*Mozilla Thunderbird
*Novell Evolution
*Claws Mail
*SpamAware integrates SpamAssassin into MS Outlook or Outlook Express.

SpamAssassin has also been used in many commercial products including:

*Atmail uses the Spamassassin engine, includes custom rulesets, filters and Web interface for users to modify SA runtime preferences
*AntibodyMX incorporates SpamAssassin
*McAfee uses SpamAssassin in its anti-spam tool "SpamKiller"
*Spamnix is also based on SpamAssassin
*SmatPOP2Exchange runs SpamAssassin as a Windows Service.
*Alt-N Technologies' MDaemon Email Server incorporates SpamAssassin
*Kerio MailServer uses SpamEliminator, which is based on SpamAssassin, for heuristic spam filtering
*MailLaunder is a hosted spam and virus solution that uses SpamAssassin as part of the filtering process
*Mac OS X Server's email component integrates Spam Assassin
*SmarterMail Enterprise - Enterprise version
*Sophos PureMessage

References

External links

* [http://spamassassin.apache.org/ SpamAssassin official homepage]
* [http://wiki.apache.org/spamassassin/ SpamAssassin Wiki]
* [http://wiki.apache.org/spamassassin/RuleUpdates#head-b6f1953fb1dc659b7de160effffbe95e9e00d3b1 sa-update] Automatically updating SA
* [http://www.rulesemporium.com/ SpamAssassin Rules Emporium (SARE)] containing many very good rules for filtering with SA.
* [http://saupdates.openprotect.com/ OpenProtect's SpamAssassin sa-update channel] to automatically update SA with the newest and best SARE rules.
* [http://www.linuxnewmedia.com/Press/Press_Releases/Awards_2006 Linux New Media Awards 2006] showing that SpamAssassin received 69% of the vote for "best Linux-based anti-spam solution."
* [http://razor.sourceforge.net/ Vipul's Razor (SourceForge)]
* [http://pyzor.sourceforge.net/ Pyzor (SourceForge)]
* [http://www.christopherlewis.com/ExchangeSpamAssassin.htm Exchange-SpamAssassin Sink]
* [http://www.nabble.com/forum/ViewPost.jtp?post=9428488&framed=y Questions about sa-compile]