Apache SpamAssassin Anti-Spam Filter

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Apache SpamAssassin is the open source, Apache-2.0 licensed anti-spam platform: a rule-based mail filter that scores every message on hundreds of tests - header and body heuristics, Bayesian statistics, DNS blocklists, SPF/DKIM checks and collaborative-filtering signals - and flags anything over a configurable threshold as spam. It is the de facto standard spam filter for Unix mail servers and integrates with Postfix, Exim, Sendmail, amavisd and dovecot. This AMI delivers SpamAssassin fully configured as a ready-to-run scanning appliance: the spamd scanning daemon and the spamc client are installed, a current rule set is fetched, and the daemon is hardened - SSH in and pipe a message through spamc and it is scored immediately.

## Secure by Default - Loopback Only

The spamd daemon is bound to the loopback address (127.0.0.1) and its allow-list is restricted to 127.0.0.1, so nothing off the instance can reach it until you explicitly widen access. The security group opens only SSH. This means the image ships as a non-network service with no exposed scanning port - you decide which trusted mail hosts may connect, using the bundled sa-access tool, and open the matching port in your own security group.

## Why Choose This AMI Over Self-Installation

Standing SpamAssassin up correctly involves more than installing a package: the daemon should run as a non-root user, its network exposure must be locked down, and the rule set must be current and kept fresh. This AMI handles all of it:

• Non-root, hardened daemon - spamd runs as a dedicated non-root system user via a systemd drop-in, using an ambient capability to bind the privileged default port without running as root.
• Loopback-only by default - the daemon listens on 127.0.0.1 and only accepts connections from 127.0.0.1, so it has no attack surface off the box until you open it.
• Current rule set, kept fresh - sa-update fetches a current rule set at build time and the operating system's maintenance schedule keeps refreshing rules on your instance.
• A management CLI for exposure - the bundled sa-access tool lets you allow a trusted mail-host network, revoke it, or revert to loopback-only, and refuses a world-open exposure as a hard guardrail.

## How Spam Scoring Works Here

• A mail system (or you, by hand) pipes a message into spamc
• spamc hands it to the loopback spamd daemon, which scores it against the rule set
• spamd returns the message annotated with X-Spam-Status, an X-Spam-Score and, if it is over the threshold, X-Spam-Flag: YES
• Your mail system routes flagged mail to a spam folder or rejects it
• The standard GTUBE test string always scores as spam, so you can prove detection end to end at any time

## Getting Started

1. Launch the AMI on your preferred EC2 instance type

2. Connect over SSH using your key pair as the default login user

3. Read the instance note with sudo cat /root/spamassassin-info.txt

4. Confirm the daemon and its loopback-only exposure with sudo sa-access status

5. Pipe the GTUBE test string through spamc to see a message flagged as spam

6. When you are ready, open spamd to a trusted mail-host network with sudo sa-access allow, and open TCP 783 to that network in your security group

## Security Practices

SpamAssassin is installed unmodified from the operating system's official package archive, so it is covered by standard unattended security updates. The scanning daemon runs as a non-root user, binds loopback only, and accepts only a loopback allow-list by default. SSH access uses key-based authentication. There is no login, no web interface and no credential - access control is by network, and you grant it only to the networks you trust.

## Use Cases

• Mail-server spam filtering - Score inbound mail for Postfix, Exim, Sendmail, amavisd or dovecot
• Dedicated scanning host - Run spamd as a hardened, network-restricted scanning appliance for a mail cluster
• Spam-rule development and testing - Lint and test custom rules and thresholds against real messages
• Compliance-driven mail hygiene - Add a documented, auditable spam-scoring layer to a mail pipeline

## cloudimg Support

24/7 technical support by email and live chat covers integrating SpamAssassin with your MTA, opening spamd to trusted mail hosts safely, tuning scores and thresholds, custom rule development, keeping the rule set fresh, and Bayesian training. Critical issues receive a one-hour average response.

## Next Steps

Contact support@cloudimg.co.uk to request an integration walkthrough for your mail transport agent, a rule-tuning session, or to ask any pre-purchase questions about the product.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.