Using CRM114 and qmail to Filter Spam

By Dave Voorhis <dave@armchair.mb.ca> February 26, 2003.
Revised November 03, 2003.
Revised November 10, 2003.
Revised September 30, 2019.

How Does it Work?

A .qmail file intercepts mail to the user's usual address (say, yourname@yourdomain.com) and passes it via stdin to a modified CRM114 mail filter. The filter classifies the mail and resends it to one email address for 'non-spam' messages and another address for 'spam'. The 'non-spam' address is usually configured to drop mail into the user's main mailbox or Maildir; the 'spam' address usually drops mail into a subfolder of the user's main Maildir or delivers it to another account.

This is accomplished with a combination of .qmail files and modified mailfilter.crm and mailfilterconfig.crm files based on those found in the CRM114 distribution.

Changes to the Original CRM114 mail filter:

• Mail detected as spam is sent to the 'spam' address without prepending any text to the message. This causes the email to appear in the spam folder or account in its original form, thus making it easier to verify or identify without reading the message. A short blurb is still appended to the message to indicate that it was classified as 'spam' by the filter.

• Mail classified as 'non-spam' is sent to an email address defined in the mailfilterconfig.crm configuration file, while still sending 'non-spam' messages to stdout.

• Mail is sent to the 'non-spam' or the 'spam' addresses using qmail-inject.

Download

• CRM114. Get it at http://crm114.sourceforge.net and install it.

• qmail You probably wouldn't be here unless you were already running qmail, but my generosity and helpfulness are unbounded. Here's the link: https://cr.yp.to/qmail.html.

• Patched mailfilter.crm and mailfilterconfig.crm files, available at http://www.armchair.mb.ca/~dave/crmqmail/mailfilter.tar.gz.

Prerequisites

• CRM114 and qmail installed.
• Patched mailfilter.crm and mailfilterconfig.crm files, downloaded as described above.
• A basic understanding of .qmail files and how they work. Try man qmail for more information.
• Access to .qmail files specific to your account and/or the ability to create them.
• Permission to create, edit and write files in your home directory or wherever the .qmail files for your account are stored.
• A spam email message, and a non-spam email message. These will be used to create initial versions of the required anti-spam filter files, spam.css and nonspam.css.

Installation

1. Install CRM114. Read the documentation.

2. Copy the following files from the CRM114 directory to your home directory, or wherever your personal .qmail files are kept:
   • blacklist.mfp
   • whitelist.mfp
   • priolist.mfp

   You may want to copy the supplied spam.css and nonspam.css files, but it's not a requirement. The mail filter will create them as needed, and will learn rapidly from your own spam and non-spam if you train it. (See Teaching Your Mail Filter to Behave below.)

3. Gunzip and untar the patched mailfilter.crm and mailfilterconfig.crm files into your home directory, or wherever your personal .qmail files are kept.

4. If you have an existing .qmail file, copy it to a new file named .qmail-cleanXXXXX, where XXXXX is a random number.

   If you do not have an existing .qmail file, create a new file named .qmail-cleanXXXXX, where XXXXX is a random number.

   The .qmail-cleanXXXXX file should be configured to deliver mail to your main mailbox or Maildir, eg:

   .qmail-clean19835:

   ./Maildir/

   The random number XXXXX will help prevent spamsters who read this article from easily guessing your 'non-spam' address. Naturally, you should not distribute it or publish it on the Web -- not that there would be any reason to do so.

5. If you wish to redirect spam mail to a sub-address of your own account such as yourname-spam@yourdomain.com, you will need to create a file named .qmail-spam   That file should contain instructions to direct spam mail to a useful place. For example:

   .qmail-spam:

   ./Maildir/.Spam/

   If spam mail will be redirected to some other account, you don't need to do this.

6. Temporarily shut off your mail feed. If you have a .qmail file, you can do this with

   chmod +t .qmail

7. Edit your .qmail file, or create one if you don't have one. The correct contents may be system-specific, but the following should work on a typical installation:

   .qmail:

   |/usr/bin/crm ./mailfilter.crm > /dev/null; echo "Filtered by mailfilter"

8. Edit your mailfilterconfig.crm file to contain your password (See Teaching Your Mail Filter to Behave below) and the appropriate 'non-spam' and 'spam' email addresses. If you're using sub-addresses, the 'non-spam' address will be something like yourname-clean19835@yourdomain.com and the 'spam' address will be something like yourname-spam@yourdomain.com

9. Reactivate your mail feed. If you used chmod as described above, you'll probably want to

   chmod -t .qmail

10. Email a spam message to yourself with the 'command <yourpassword> spam' header, as described under Teaching Your Mail Filter to Behave below. This will create the spam.css file, if it doesn't exist.

11. Email a non-spam message to yourself with the 'command <yourpassword> nonspam' header, as described under Teaching Your Mail Filter to Behave below. This will create the nonspam.css file, if it doesn't exist.

12. At this point, you may wish to ensure that you are still receiving email. If you aren't, you have either failed to perform the previous two steps, or something is (probably) wrong with the contents of your .qmail file. Solutions to this are beyond the scope of this article, but the qmail log files should provide hints.