Malware Patrol provides block lists compatible with SpamAssassin.
“Apache SpamAssassin is the #1 Open Source anti-spam platform giving system administrators a filter to classify email and block spam (unsolicited bulk email).
It uses a robust scoring framework and plug-ins to integrate a wide range of advanced heuristic and statistical analysis tests on email headers and body text including text analysis, Bayesian filtering, DNS blocklists, and collaborative filtering databases.
Apache SpamAssassin is a project of the Apache Software Foundation (ASF).”
You can follow these simple steps to configure your SpamAssassin to filter malicious URLs and protect your network, computers, and users from getting infected by malware.
1) Make sure your SpamAssassin instance is installed and working properly. There are several resources on the Internet that can help you configure it in your platform. If you are experiencing trouble installing and configuring SpamAssassin, start at: https://spamassassin.apache.org/
2) On the server running SpamAssassin, create a file called malware_patrol_update.sh choosing where to place it, like:
# mkdir /root/sh
# vi /root/sh/malware_patrol_update.sh
3) Log into your account with Malware Patrol and look for SpamAssassin. Right click on “download†and select “Copy link locationâ€. You will need this URL on the next step.
4) Paste the following command into the newly created file, substituting _URL_YOU_JUST_COPIED_ with the URL you copied in the previous step:
wget --no-check-certificate -O /etc/mail/spamassassin/99_malware_patrol_blocklist.cf '_URL_YOU_JUST_COPIED_'
Feel free to customize the output filename. SpamAssassin configuration files are read in an alphanumerical order, meaning 70_*.cf will be read before 99_*.cf.
5) It is very important to make sure that the URL you have copied from your account with Malware Patrol is enclosed in single quotes.
6) Add the following line to the file and save it:
systemctl restart spamassassin.service
If Amavisd is used (so SpamAssassin is managed by it) use the following line instead and save it:
systemctl restart amavisd.service
7) Add execute permissions to the recently created file, executing this command:
# chmod +755 /root/sh/malware_patrol_update.sh
8) Execute the recently created file that will download the latest block list and restart SpamAssassin or Amavisd:
# /bin/sh /root/sh/malware_patrol_update.sh
9) Make sure the new file was correctly processed by SpamAssassin by running the following command:
# spamassassin -D --lint 2>&1 | grep "malware_patrol"
... dbg: config: read file /etc/mail/spamassassin/99_malware_patrol_blocklist.cf
10) You should now create a cron job to automatically update the Malware Patrol block list. The following command should be executed every hour:
/bin/sh /root/sh/malware_patrol_update.sh
Please choose minutes not close to 00, 01 and 59 for your cron job.
If you experience any difficulties configuring SpamAssassin to use Malware Patrol block lists, please make sure it is working properly and contact our tech support at support (@) malwarepatrol.net.
Special thanks to Malware Patrol user fRANz for writing this guide.
Share this post: Tweet