23.4. Configuration Examples
23.4. Configuration Examples 23.4.1. SpamAssassin and Postfix SpamAssasin is an open-source mail filter that provides a way to filter unsolicited email (spam messages) from incoming email. [23] When using Red Hat Enterprise Linux, the spamassassin package provides SpamAssassin. Enter the following command to see if the spamassassin package is installed: If it is not installed, use the yum utility as root to install it: SpamAssassin operates in tandem with a mailer such as Postfix to provide spam-filtering capabilities. In order for SpamAssassin to effectively intercept, analyze and filter mail, it must listen on a network interface. The default port for SpamAssassin is TCP/783, however this can be changed. The following example provides a real-world demonstration of how SELinux complements SpamAssassin by only allowing it access to a certain port by default. This example will then demonstrate how to change the port and have SpamAssassin operate on a non-default port. Note that this is an example only and demonstrates how SELinux can affect a simple configuration of SpamAssassin. Comprehensive documentation of SpamAssassin is beyond the scope of this document. See the official SpamAssassin documentation for further details. This example assumes the spamassassin is installed, that any firewall has been configured to allow access on the ports in use, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode: Procedure 23.1. Running SpamAssassin on a non-default port Use the semanage utility as root to show the port that SELinux allows the spamd daemon to listen on by default: This output shows that TCP/783 is defined in spamd_port_t as the port for SpamAssassin to operate on. Edit the /etc/sysconfig/spamassassin configuration file and modify it so that it will start SpamAssassin on the example port TCP/10000: This line now specifies that SpamAssassin will operate on port 10000. The rest of this example will show how to modify the SELinux policy to allow this socket to be opened. Start SpamAssassin and an error message similar to the following will appear: This output means that SELinux has blocked access to this port. A denial message similar to the following will be logged by SELinux: As root, run semanage to modify the SELinux policy in order to allow SpamAssassin to operate on the example port (TCP/10000): Confirm that SpamAssassin will now start and is operating on TCP port 10000: At this point, spamd is properly operating on TCP port 10000 as it has been allowed access to that port by the SELinux policy. [23] For more information, see the Spam Filters section in the System Administrator's Guide .
~]USD rpm -q spamassassin package spamassassin is not installed ~]# yum install spamassassin ~]# semanage port -l | grep spamd spamd_port_t tcp 783 Options to spamd SPAMDOPTIONS="-d -p 10000 -c m5 -H" ~]# systemctl start spamassassin.service Job for spamassassin.service failed. See 'systemctl status spamassassin.service' and 'journalctl -xn' for details. SELinux is preventing the spamd (spamd_t) from binding to port 10000. ~]# semanage port -a -t spamd_port_t -p tcp 10000 ~]# systemctl start spamassassin.service ~]# netstat -lnp | grep 10000 tcp 0 0 127.0.0.1:10000 0.0.0.0:* LISTEN 2224/spamd.pid