Well, there are several ways, but this is what I've found to work. After you have postfix, dovecot, spamassassin, and (I recommend procmail) setup, you can tell procmail/spamassassin how to distrubute spam into various folders. With dovecot. I use the following 4 folders:
spam (for known spam based on Bayes setting)
spam-learn (for spam that slipped through, you move it here)
spam-probably (for spam ID'd as probably spam by Bayes setting)
spam-unlearn (messages flagged as spam, that are NOT spam go here)
with the folders setup and postfix configured to filter mail through procmail with:
mailbox_command = /usr/bin/procmail -a "$EXTENSION"
you can now setup your procmailrc to put the spam in the correct place as it comes to your inbox. Your ~/.procmailrc should look something like this:
PATH=/usr/bin/vendor_perl:/usr/bin:/bin:/usr/local/bin:.
MAILDIR=$HOME/Mail/
LOGDIR=$HOME/log
#DEFAULT=$HOME/Mail/
LOGFILE=$LOGDIR/procmail.log
VERBOSE=ON
## with spamc
:0fw: spamc.lock
* < 256000
| spamc
#| /usr/bin/vendor_perl/spamc
# Mails with a score of 15 or higher are almost certainly spam (with 0.05%
# false positives according to rules/STATISTICS.txt). Let's put them in a
# different mbox. (This one is optional.)
:0:
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
spam
#Mail/spam
# All mail tagged as spam (eg. with a score higher than the set threshold)
# is moved to "probably-spam".
:0:
* ^X-Spam-Status: Yes
spam-probably
#Mail/spam-probably
# Work around procmail bug: any output on stderr will cause the "F" in "From"
# to be dropped. This will re-add it.
:0
* ^^rom[ ]
{
LOG="*** Dropped F off From_ header! Fixing up. "
:0 fhw
| sed -e '1s/^/F/'
}
Now the final key to making it all work automatically is to use fetchmail to scan messages as they arrive in your inbox handing off to procmail to put the spam/spam probably in the right folders and to read the messages in the spam (to delete) and spam-unlearn (to learn as ham). A typical fetchmail script to do with is your ~/.fetchmailrc. It will simply contain commands to poll your mailbox:
poll mail.yourserver.com protocol IMAP : user yourname with password yourpass ssl \
sslfingerprint "D9:73:1A:FE:C6:7C:E7:9B:F1:31:F8:A1:A0:E1:F9:27"
(you can get your server fingerprint by simple running fetchmail --verbose against your .fetchmailrc file and it will print the server fingerprint, check your current one, tell you they don't match and close the connection -- but -- you just got the correct fingerprint for next time :-)
Lastly, set up a couple of cron jobs to run this whole thing by reading your spam-learn and spam-unlearn folders. Hourly is good enough. The script can look like this:
#!/bin/bash
## log file location and per-user name
LDIR=/home/admin/log
LFN="${LDIR}/${USER}.log"
## Retrieve and Process Spam & Ham from 'spam-learn' & 'spam-unlearn' folders
/usr/bin/fetchmail -a -s -n --folder spam-learn -m '/usr/bin/vendor_perl/sa-learn --spam' &>/dev/null
mss=$?
sleep 2
/usr/bin/fetchmail -a -s -n --folder spam-unlearn -m '/usr/bin/vendor_perl/sa-learn --ham' &>/dev/null
mhs=$?
## test and create log dir in noexist
[[ -d "$LDIR" ]] || mkdir -p "$LDIR"
if [[ -w "$LDIR" ]]; then
## check return from fetchmail and write log info
if [[ $(($mhs+$mss)) -le 2 ]]; then
echo "$(date +'%b %e %R:%S') $HOSTNAME ${0##*/}: sa-learn completed successfully for user $USER" >>$LFN
else
echo "$(date +'%b %e %R:%S') $HOSTNAME ${0##*/}: sa-learn FAILED for user $USER" >>$LFN
fi
fi
And the cron job simply execute the spamv.sh file above:
05 * * * * /usr/local/bin/spamv.sh
I have run servers like this for nearly a decade and it works well. The training files reside in the user's home dir and can be easily moved box-to-box to provide a good base set for new users. Good luck. I did a short howto on this setup years ago for openSuSE 11.0. There may be a little more info there as well.
P.S. Rayzor is worth loading.
-e /usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop}part. It bounced with '(Uknown User)'. I did try using-a ${recipient}instead of-d ${user}@${nexthop}, but then it literally just got lost in the ether (It said it had sent, but nothing was recieved). So I just ended up using-e /usr/sbin/sendmail -oi -f ${sender} ${recipient}instead, and it works a charm :D – Exotoxin