UCS 2.4 - Univention

12.5 Virus filters
can be changed in the Univention Directory Manager user management on the Mail tab of a user ob-
ject via Use global spam folder. If the attribute is set, all e-mails identified as spam are sent to the
spam@ address and can be checked in the appropriate IMAP directory, but are no longer
available for the original recipient to access. The e-mail address for the global spam recipient can be
configured in the Univention Configuration Registry variable mail/antispam/globalfolder.
The scoring threshold at which the e-mails are declared to be spam can also be configured. To do this,
Univention Configuration Registry variable mail/antispam/requiredhits must be set to a number:
the preset is 5. This value is practical for processing with an active Bayes classifier, which generally leads
to higher point numbers. Depending on experience in your personal environment, this value can also be
set lower. This will, however, result in more e-mails being incorrectly designated as spam.
The Bayes classifier will only become active when a sufficient number of undesirable (spam) and desirable
(ham) e-mails are converted into a learning algorithm. To allow the users to pass on their spam and falsely
classified e-mails to the learning algorithm, the Spam and Ham folders are created for each user when
setting up his inbox. These must be created manually for the user accounts created with a UCS version
lower than 2.3.
If the Univention Configuration Registry variable mail/antispam/learndaily on the server is set to
yes, the Cyrus service searches the Spam and Ham folders of all users and the global spam recipient
daily for unknown e-mails. If data are found which have not yet been collected or were previously classified
incorrectly, these are used to update a shared database of collected, statistical data. This function is
deactivated as default.
Alternatively, the learning process can be executed manually using the program sa-learn. If e-mails are
in a file in Mbox format, as is often used or exported by mail programs, the e-mails contained therein can
be classified as spam using the following command:
sa-learn --spam --mbox
or as ham, i.e., desirable e-mails, using
sa-learn --ham --mbox
For the classification of e-mails it is advisable to provide the same quantity of desirable and undesirable
e-mails as is processed via the server. If no manual learning is performed, Spamassassin learns automat-
ically during the filtering procedure. That means that Spamassassin learns incorrectly classified e-mails
incorrectly.
The spam filtering can be deactivated by setting Univention Configuration Registry variable
mail/antivir/spam to no or reactivated by setting it to yes.
Postfix must be subsequently restarted. (See Chapter 12.3.1) When set to no every incoming e-mail is
sent to respective user without being checked first.
12.5 Virus filters
The package univention-antivir-mail sets up the program Amavisd-new as an interface between Postfix
and different virus scanners. The free virus scanner ClamAV is included in the package and enters op-
eration immediately after installation. Other virus scanners can be mounted alternatively or additionally
261