View source for Spamd

This page is for pf & spamd from the [[OpenBSD]] team, not the SpamAssasin version. I had [[TLS]] as mandatory in my [[MTA]], so I had to switch that to optional for this to work. Two other options are whitelist yourself initially, or open a submission port (587).
This was what I did on FreeBSD 6.0:

rc.conf:
 pf_enable="YES"
 pf_flags="-f /etc/pf.conf"
 pflog_enable="YES"
 pfsync_enable="NO"
 pfspamd_enable="YES"
 pfspamlogd_enable="YES"
 # I used 5 initially until my whitelists are built, and then maybe I'll go back to the 25 minute default
 pfspamd_flags="-g -v -G 5:4:864"
 

pf.conf:
 table <spamd> persist  
 table <spamd-white> persist
 table <spamd-mywhite> persist file "/var/mail/whitelist.txt"
 rdr pass inet proto tcp from <spamd-white> to $ext_if port \
  smtp -> 127.0.0.1 port smtp
 rdr pass inet proto tcp from <spamd> to $ext_if port \
  smtp -> 127.0.0.1 port spamd
 rdr pass inet proto tcp from !<spamd-mywhite> to $ext_if port \
  smtp -> 127.0.0.1 port spamd
 pass in log inet proto tcp from any to $ext_if port smtp flags S/SA \
  synproxy state
  pass out log inet proto tcp from $ext_if to any port smtp flags S/SA \
  synproxy state

 # /var/mail/whitelist.txt
 127.0.0.1 
 192.168.1/26 

 # cat /usr/local/etc/spamd.conf
 all:\
        :spamhaus:china:korea:whitelist:
 spamhaus:\
        :black:\
        :msg="SPAM. Your address %A is in the Spamhaus Block List\n\
        See http://www.spamhaus.org/sbl and\
        http://www.abuse.net/sbl.phtml?IP=%A for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/SBL.cidr.gz:
 spews1:\
        :black:\
        :msg="SPAM. Your address %A is in the spews level 1 database\n\
        See http://www.spews.org/ask.cgi?x=%A for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/spews_list_level1.txt.gz:
 spews2:\
        :black:\
        :msg="SPAM. Your address %A is in the spews level 2 database\n\
        See http://www.spews.org/ask.cgi?x=%A for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/spews_list_level2.txt.gz:
 china:\
        :black:\
        :msg="SPAM. Your address %A appears to be from China\n\
        See http://www.okean.com/asianspamblocks.html for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/chinacidr.txt.gz:
 korea:\
        :black:\
        :msg="SPAM. Your address %A appears to be from Korea\n\
        See http://www.okean.com/asianspamblocks.html for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/koreacidr.txt.gz:
 whitelist:\
        :white:\
        :file=/var/mail/whitelist.txt:
 relaydb-black:\
        :black:\
        :msg="SPAM. Your address %A is in my relaydb list.":\
        :method=exec:\
        :file=relaydb -4lb:
 relaydb-white:\
        :white:\
        :method=exec:\
        :file=relaydb -4lw:

 # crontab -l
 0 * * * * /usr/local/sbin/spamd-setup

 # /usr/local/libexec/spamlogd
 # /usr/local/etc/rc.d/pfspamd start
 # pfctl -f /etc/pf.conf
  
 # ps auwx | grep pf
 root          19406  0.0  0.3  5016  1432  ??  Is   11:07AM   0:00.01 pflogd: [priv] (pflogd)
 _pflogd       19407  0.0  0.3  5080  1456  ??  S    11:07AM   0:00.09 pflogd: [running] -s 116 -f /var/log/pflog (pflogd)
 nobody        19428  0.0  1.8 11016  9528  ??  Is   11:08AM   0:00.10 spamd: (pf <spamd-white> update) (spamd)
 root          19516  0.0  0.4  8400  2176  ??  S    11:20AM   0:00.04 tcpdump -l -n -e -i pflog0 -q -t port 25 and action pass and tcp[13]&0x12

 # ps auwx | grep spam
 nobody        19428  0.0  1.8 11016  9528  ??  Is   11:08AM   0:00.11 spamd: (pf <spamd-white> update) (spamd)
 nobody        19429  0.0  1.8 11008  9496  ??  I    11:08AM   0:00.09 /usr/local/libexec/spamd -g -v -G 5:4:864
 nobody        19431  0.0  1.8 11000  9512  ??  I    11:08AM   0:00.01 spamd: (/var/db/spamd update) (spamd)

All looks good, time to find out.

 # spamdb
 GREY|127.0.0.1|<dan@example.org>|<myemail@ddress.com>|1172200562|1224040562|1224040562|1|0

Looks like it's working, check back in ahile and see if you have BLACK and WHITE entries. 

 # tail -f /var/log/spamd