Assp, AntiSpam for Linux and Windows

I've got to say out of all the Antispam tools using, ASSP has to be the best one so far.
And combining it with XMail easy by far the easier then working with dspam or even a plain SA setup with just rules.

It's both Windows & Linux friendly. And is completely tune-able VIA a web interface, And even learn about your SPAM/HAM message though forwarding of emails.

It can do all of the fallowing:
#1. Filtering spam
#2. Attachment blocking
#3. White listing / Blacklisting
#4. Delaying
#5. Send Validation (PTR,MX,return Domain,etc)
#6. And allot more

Also when you combine it with XMail it can fix some small "issues" that XMail has.
For example ASSP will auto append a domain. ( This helps ALOT on Linux system with mail being sent from crons or other services as you don't need to configure or export any extra vars.)

The setup for XMail is like I said easy.
#1. Download ASSP.
#2. Uncompress it, I recommend putting in a SUB of your MailRoot just for easyier backing up.
#3. Startup ASSP (It will complain about not being able to bind to port 25 and for now that a good thing).
#4. Configure It VIA the web interface (HTTP://MAILSERVER:55555)
#5 Tell ASSP to connect to your mail server at 127.0.0.1:26
#6. Setup XMail to listen on port 26 instead of 25. (Or even just 127.0.0.1:26).
#7. Setup a POSTMASTER type account it you don't have one currently (I recommend not using "postmaster" ( I know I's a standard. But It's a dumb standard. The Standard should be that your required to have a postmaster *like* account. With that account address inside every "error" email send out by your system. Which there is (And the return account address is tune-able on every mail server I've ever worked with including MS Exchange) so requiring a POSTMASTER accout is really just asking for more spam,virus,attacks on that account. But this is just my opinion).
#8. Restart XMail And Then ASSP

ASSP Website

Oh but one last thing: I don't recommend using ASSP built in *local* user validation OR it's auto white listing. And there is a really good reason on both.

If you do try using the local validation and do give it a list of users. You'll from then on need to make sure that list is up today. If it's not local users might be locked from getting email. And if Delaying becomes less effective if at the door ASSP gives the "no user here by that name" instead of a try back later (because if nothing else you just told that spammer that there is no need to try to send mail to that user again. Where as if you tell then to try again later and they don't with in X time. They'll be stuck in a I Don't WTF to do mode (This really just makes them spin there wheel for a short time. And even a short time will cost $$$))

And with ASSPs auto white listing. It's ok in the being when your training it SPAM vs NON-Spam (Ham). But once it's learned the diff I've come to find it better to not add people to it's white list but to it's unprocessed list. This will stop ASSP from learning from these message in the unprocessed list. (think of the unprocessed as a bypass for all filter except things like attachments (this to is configurable though))



UPDATE
As many have figured out ASSP & XMail with SSL over SMTP don't work well together or at all for that matter. So up till no if you had xmail 1.24+ and wanted to use ASSP you had to disable "EnableSMTP-TLS" in the server configure. But starting with 1.3.8 you won't have to do that any more (I fixed the issue in assp.pl and posted my patch witch will not be part of code tree for assp. So we should need to worry about this any more (see:http://www.asspsmtp.org/forums/index.php?topic=460.0)). OR if you don't want to wait you can't always fix the code your self. Heres how...

in assp.pl find this :

and replace it with this:

Thanks ! This looks pretty interesting ...

How do I set xmail to listen on a different port?

edit your xmail start to include the "-Sp PORT" option.

Side Note: The Manual clearly States these options and I would HIGHLY recommend you try reading it.

My apologies, I somehow missed that.

I reference the manual daily, my lack of experience sometimes gets the better of me.

thanks, so far ASSP looks promising.
sam

I'm using it on the same server as XMail. Because it's not our public SMTP server, I'm currently using Filtering and Whitelists only. It's working well for our 7 users.
Thanks NomadCF for the instructions!

This is an excellent HowTo NomadCF!!!

I'm working with the developers of PHPXMail about changing the required domain admin from postmaster to postsysop. I will keep everyone updated!

I look at it from another point of view...

Knowing the script guru that your are , it shouldn't be that difficult to write a pure PHP script that would 1) Pull all domain names from XMail and put them into a plain ASCII file one line per domain and 2) Pull all user addresses including aliases and put them into a plain ASCII file one line per user/alias.

The domain file would go under ASSP -> Relaying -> Local Domains.
The user address file would go under ASSP -> Validate Local Addresses -> Local Addresses.

Then a Scheduled Task(W32)/cron job (linux) could be set up every 20 minutes or whenever you like and when you add something to XMail, it will be added to ASSP in x minutes.

ASSP has a delay feature that works with the local addresses:

And I would gues that you could also put in a 450 Greylisting - please try back in 360 seconds...

*Just a side note, it would also be a good idea to whitelist your RW maillist members.

Thanks again NomadCF!

So if I understand correctly, using:

Validate local addresses to conform with RFC 822

is not a good idea?

Hello everyone, I just finished to code the script in order to keep your local domain and local users txt file updated within ASSP. This script MUST be run in command line mode.

Here is the code:

In order to update those files automatically:

/etc/crontab

add something like this:

*/20 * * * * root /usr/local/bin/php /apps/xmail-1.22/assp/ASSP/update_xmaildata.php > /dev/null

I hope it helps some of you!

sc4vengr

Wow I love this antispam software..

I installed it yesterday on my personal server, it only has like 5 accounts :

I CC all the emails detected as spam to a special account to review them and so far the software didn't make any mistakes.

Thanks for the heads up NomadCF!

alright as far as changing the port at the command line, does this refer to "mailroot\bin\ctrlclnt -Sp 26" ? or something else

also, i believe i installed everything correctly. i changed assp to listen on port 125 in the webadmin -- is this what i want, or do i want it to listen on a different port altogether? i believe when i had it set to port 25 it interfered w/ my mail. Does it matter what port it listens on? (I'll also need to open up the port is uses on my firewall)

how do i know its working correctly? i managed to see that there were some requests coming in under the SMTP Connections but i am still receiving some spam (which i expect), but i dont see anything in the c:\assp\* folders. did i do something wrong; and what?

thanks

I,m ussing ASSP an Xmail on 2 different systems my Xmail is on a linux system and my ASSP is on a Windows 2003 System.
ASSP is cheking the mail and then forewarding it to XMAIL.
every few hours ASSP stops allowing connections and i get errors in the log "<> max errors (10) exceeded -- dropping connection"
In the manual there is something about that kind of problem:
---------------------------------------------------------------------------------------------------

By: clayne ( christopher layne )
2003-09-23 18:43
Assp will stop forwarding new requests to Courier after about half a day (sometimes it can last 24 hours before resulting in this behaviour).

Upon manual telnet connection to port 25, I get an open connection and then an immediately closed connection. After killing and restart assp.pl, the problem goes away - for atleast 12 hours.

----------------------------------

By: ladylong ( Ruth Rogers )
2003-10-15 01:25

I had the same problem with my setup (ASSP with Merak MailServer) and finally discovered that Merak was tarpitting ASSP because of the number of connections it was attempting when things got busy. If your mail server has a similar feature, you might just need to change settings - with Merak it's a matter of telling it to bypass tarpitting for 127.0.0.1 (or wherever you have ASSP running from).

-----------------------------------
By: clayne ( christopher layne )
2003-10-29 20:31

ladylong,

Thanks for the information, this is what was happening. I adjusted courier's settings and ASSP never "hangs" now.
2003-Oct-29 12:46pm jhanna

-----------------------------------------------------------------------------------------------

Could this be the same problem with Xmail and ASSP?? and how do i change the config of Xmail for that problem?

thanks

To : Nick_Nitro => Turn off "max errors" in ASSP.

To : sc4vengr => local validation isn't worth it due to ASSP trying to be transparent as it can passes on the each connction string as it happens. And since XMail does the vailidation it self, it will hang up the phone on a invaild local user. Thous ASSP will hang up the phone. So in the end you have gained nothing except another cron job that need to try syncing XMAIL to somthing else.

To : sc4vengr => Nice script, if your looking for something alittle simpler / faster. A cat awk script would due you just fine also (just a FYI).

NomadCF,

THANK YOU!

ASSP--so far--is fantastic. It is very powerful, very flexible, very complete, very elegant in its implementation, and was relatively very easy to setup. The browser-based admin tool is of high caliber and easy to use.

Now, there are about 1,000 configuration options of which I understand only about 7! So I have a lot of reading and experimenting to do.

I started by setting it up on a test xmail server in my house. It was easy to setup, but I could not really test much since that server sees zero traffic. So I went ahead and installed on my production server which sees thousands of mail messages per day--and a LOT of spam.

Maybe this will help other noobs....when you first setup ASSP, your bayesian filter is "empty". So all messages it sees are "spam". So you want to turn on TEST mode for all the checks. (See TestMode options in the browser-based admin tool.) Also, you should blank out the "Prepend Spam Subject" value at first. Then wait until you have a few hundred messages in your assp/spam folder. Now, go through them and if they are NOT spam, move them to the assp/notspam folder. If you are not sure about a message, just delete it. Once your spam folder has about 400+ authentic spam messages in it (and hopefully no nospam messages), run 'perl rebuildspamdb.pl' which analyzes your spam to build the bayesian filters.

At this point, I set my "Prepend Spam Subject" to "[SPAM]" because now the system is actually trying to weed out spam from nonspam. My plan is to run this way for a few days and if I don't see any false positives, I'll turn off test mode and allow the system to actually block the messages it thinks are spam.

I'm very happy with the performance and robustness and so far the effectiveness after only a few hours.

-Troy

I am using pop3links ASSP can work for me? ASSP works with POP3?