[Mimedefang] sa-update

[Paul Murphy]

John,

>I'm about to start down the path of learning sa-update and using it with 
>MIMEDefang.  Does anyone have any special tips, warnings, or even 
>how-to's, for how to use it with MIMEDefang?

Ensure that either you are using a version of SpamAssassin greater than 3.1.4, or you have applied the fix to include the SpamAssassin LOCAL_STATE_DIR in your filter - see http://lists.roaringpenguin.com/pipermail/mimedefang/2006-April/030092.html

Then, simply run the update from a cron job, ensuring that MD re-reads its configuration afterwards to bring in any updated rules:

mail2 /home/defang> crontab -l
15 0 * * *              /home/defang/sa_update

mail2 /home/defang> cat ~/sa_update
sa-update
md-mx-ctrl reread

The new rules will be in /var/lib/spamassassin/<version>, or whatever your local state dir point to, e.g. mine contains:

mail2 /home/defang> cd /var/lib/spamassassin/

mail2 lib/spamassassin> ls 3.001007/
updates_spamassassin_org  updates_spamassassin_org.cf  updates_spamassassin_org.pre

mail2 lib/spamassassin> ls 3.001007/updates_spamassassin_org
10_misc.cf             20_phrases.cf        25_hashcash.cf  30_text_pt_br.cf
20_advance_fee.cf      20_porn.cf           25_pyzor.cf     50_scores.cf
20_anti_ratware.cf     20_ratware.cf        25_razor2.cf    60_awl.cf
20_body_tests.cf       20_uri_tests.cf      25_replace.cf   60_whitelist.cf
20_compensate.cf       23_bayes.cf          25_spf.cf       60_whitelist_dk.cf
20_dnsbl_tests.cf      25_accessdb.cf       25_textcat.cf   60_whitelist_dkim.cf
20_drugs.cf            25_antivirus.cf      25_uribl.cf     60_whitelist_spf.cf
20_fake_helo_tests.cf  25_body_tests_es.cf  30_text_de.cf   60_whitelist_subject.cf
20_head_tests.cf       25_body_tests_pl.cf  30_text_fr.cf   70_iadb.cf
20_html_tests.cf       25_dcc.cf            30_text_it.cf   80_additional.cf
20_meta_tests.cf       25_dkim.cf           30_text_nl.cf   empty.pre
20_net_tests.cf        25_domainkeys.cf     30_text_pl.cf   MIRRORED.BY

The best sign that this is working appears to be the TVD_* rules, which aren't present in RDJ or the SA base set, but which trigger regularly on my spam-laden traffic.

Best Wishes,

Paul.
-- 

-------------------------------------------------------
Paul Murphy
Head of I.T.
Argenta Discovery
Tel. 01279 645 554
Fax. 01279 645 646