Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm aware of SpamAssassin-based solutions, but I'm looking for a free or low(er) cost spam filtering solution that's similar in functionality to the Barracuda Spam Filter. The Barracuda works well, but the hardware is questionable in the low-to-midrange units and the costs have been creeping up. I'm seeking something I can recommend to clients that's easier for end users to administer than a raw SpamAssassin installation.

Any recommendations?

share|improve this question
1  
I think you can make a solid argument that for any given "premium" solution, the reason they can chanrge a premium is because there is no lower cost solution (that's why they call it competition). I think any answer would be subjective. As an example forefront protection online is certainly easier to maintain and potentially alot cheaper- whether it actually is depends on a whole host of factors –  Jim B May 26 '11 at 21:35
    
I've sold quite a few Barracuda units, but the prices are creeping up. For the type of organizations I work with, it's difficult to recommend the $3700 appliance without having a lower-cost alternative. But if that's the current landscape, then it is what it is. –  ewwhite May 26 '11 at 21:37
    
I hear that but the problem is that costs are subjective. For instance with microsoft (in general) the more you buy the less each additional thing costs, and from a management perspective - well it's a microsoft tool- which you already use. additionaly with office 365, google apps- you can make the argument that keeping mail in house is too expensive to begin with. –  Jim B May 26 '11 at 21:47
    
I think if you took out the cost portion of the question, and worded it to ask about alternative spam filters in general, you might get more traction without being subjective. –  Holocryptic May 26 '11 at 23:26
    
I don't see how specifying "lower cost" in a question may make it subjective beyond usefulness. Of course because of pricing techniques the same product can end up costing different sums for different companies, but you wouldn't hesitate calling EnterpriseDB "lower cost" than Oracle because of that, right? In my opinion the whole "prices are subjective" movement robs the people of the possibility of making this very valid kind of question, and that's unfair for the customer. –  Eduardo Ivanec May 27 '11 at 14:21

5 Answers 5

up vote 5 down vote accepted

I've gotta agree with John Gardeniers here. Mailcleaner is by far the best opensource spam filtering solution I've found, and I've tested pretty much any that I've been able to locate (mostly those integrated into other firewall-type-linux-distributions).

I've used Mailcleaner for several years now to protect my domain (stormnine.net), while using Barracuda M600s at work (dfa.arkansas.gov). While the Barracudas at my work see a lot more traffic overall, the percentage-rates-by-volume are nearly identical to what I experience with Mailcleaner. I also like the fact that Mailcleaner supports tagging as well as quarantine. Personally, I don't use quarantining on stormnine.net because it's much less long-term maintenance to simply use tagging within MailCleaner and then let my Exchange server process tagged emails into the user's Junk Email folder, which has a 30 day expiry. This ensures that my Mailcleaner anti-spam appliance never uses much disc-space, and ensures that my Exchange MessageStore doesn't outgrow the disc space allotted to it's virtual-machine-container. I have both Mailcleaner & Exchange running from within VMWare ESXi virtual servers, on the same host even, and I don't see any remarkable performance hit to the host or the VMs from doing so.

I've also used Mailcleaner on Physical hardware, and it worked great there too, but in the long run I've found that it's much better to virtualize Mailcleaner, shutdown the Mailcleaner VM and replicate it to a virtual appliance after you've configured Mailcleaner for your domain and authentication system(s), then bring Mailcleaner back online. This ensures that if you should decide to get under the hood and do any experimentation or development on Mailcleaner, that you'll still have a fully working copy, ready to deploy at any time, that will only take about 10 to 20 minutes to return to service after a catastrophic failure of the VM due to altering. Mailcleaner can be very ticky under the hood... this is due to the custom structure that the developer(s) use, which doesn't correspond to Debian defaults (though Mailcleaner, itself, is based on Debian-Sarge). Still, some modifications can be done... just be sure you know what you're doing when you get in there, if you do any mods. Otherwise, be sure to keep a spare copy of the VM ready to deploy just in case it goes belly-up.

Now, all of that said, Mailcleaner is very dependable, if installed according to the instructions. On it's own, with no modifications, it fully supports LDAP, SMTP, or local-authentication. Personally, I use Active Directory (LDAP) auth, which is easy to setup if you're fluent with LDAP query structure, or at least have setup a Barracuda to talk to AD/LDAP, since it's basically the same sort of syntax. With the model I use, with Mailcleaner & Exchange virtualized and a spare Mailcleaner virtual-appliance image backed-up, I have very, very little maintenance or interaction with either system, except when I add a new user, and even then all I have to do is add the user to AD, normally, because Mailcleaner is using AD on the back-end to validate all email addresses & users. Since I use tagging instead of quarantining, my users don't even know it's there until they actually look into the headers of emails that are in their Junk Email folder. And me... I haven't had a complaint on that domain regarding spam in nearly 8 years. :)

share|improve this answer
    
Thank you. I will explore this option since the Barracuda units are getting a bit silly on price/performance. –  ewwhite Nov 29 '11 at 15:23

I'm using Mailcleaner for the company spam filtering. The community edition is free, although you do need to put some effort into training the system. Once the initial training databases have been created they can be copied from machine to machine.

Documentation is sparse but there is a forum where you can get more information. It should be noted though that many questions posted on the forum go unanswered. There appears to be a clicky core group of forum users and the rest tend to get ignored a bit. Nevertheless, most issues have already been discussed and/or solved, so there should be little need to post new requests for help.

share|improve this answer

There are VM applicances built for this very purpose. I haven't really used any, as my current customers don't require easy administration (probably because Barracuda is way out of their reach), but here's one: SpamVigilante (docs):

Of course it's based on SpamAssasin, but it also includes Apache and a web administration console apparently written from scratch ("Spam Viewer").

share|improve this answer
    
According to redbudcomputer.com/downloads.htm, the last update goes back to 2006. I'm afraid this project died... –  Daniel Alder Dec 31 '13 at 14:10

Whilst I've never administered it a couple of my email accounts are protected by mailscaner which seems to catch almost all the spam I get sent. It also has modules to check that URLs in messages actually point to the server that the text implies they do, so can provide extra protection against phishing.

share|improve this answer

If you are wanting free but still give end-users control over their own settings, you could try a SpamAssassin + Amavisd-new configuration, using one of the 3rd party addons for Amavsid found here.

But something I like to keep in mind when making recommendations is that I often find that the less you pay for something the more work you will put into setting up and maintaining it (not always the case but very often). Something that is free now may not be so free once you figure in hours and hours of labor.

Now, I am not trying dismiss any of the fine free/open source products out there (I use SpamAssasin+Amavisd heavily). It is just something to keep in mind.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.