Unhappy with OS X Server handling of email spam

Question

I'm unhappy with the way that OS X Server (on Mountain Lion) handles email spam.
What I *want* is to be able to set some SpamAssassin rules, and then to have the mail server refuse spam emails (not accept and put into Junk, but refuse to accept them in the first place). I used to do this with Exim and the sa-exim tool. In 10.7 I decided to switch to the built-in mail server, but that doesn't offer this functionality.
I would settle with being able to set some SpamAssassin rules and then have the server filter junk email into my Junk folder. 10.7 Server used to do this; I had to enable webmail and turn on the setting in there, and it would configure Pigeonhole (a Dovecot plugin) to put spam into the Junk folder. 10.8 server no longer offers webmail and no longer comes with Pigeonhole. I can add it myself with MacPorts, but I don't understand how to configure it on OS X Server.
So I have to settle for my OS X Server delivering all junk emails to my inbox, where then I have to delete them one-by-one on my iPhone. I could leave a Mac on at home all day to do the spam filtering, but that just seems silly.
If anyone could tell me how to set up Pigeonhole on OS X Server (10.8) to put my spam into a folder - or even how to set up Postfix to refuse spam in the first place - I would be very, very happy.

Answer 1

The issue you've run into is that postfix uses amavisd as its post queue (I.e. received and accepted by smtp) filter.
If you don't want to set server-side rules ( easiest way is still webmail / Managesieve plugin) to auto move junk mail into a junk folder because of security concerns, then there are other options.
Most of the logic for spam checking is done by amavis.  It calls as subprocessess spamassassin and clam av.
Changes you make in spamassassin conf are used by spamassassin but amavisd may overrule spamassassin.
So your options are:
1. Make webmail a local intranet access only - I.e. use a custom port 8xxx and don't open that to the Internet via your router or firewall rules.
2. Quarantine spam to a new mailbox so it doesn't get delivered to the user.
I haven't done this but, if you have a look at http://wiki.apache.org/spamassassin/IntegratedInPostfixWithAmavis ,
It has some instructions on how to adjust the amavisd conf ( path to server/mail/config/amavisd/amavisd.conf ) , set up a new mailbox and quarantine the spam to there. This saves you having to set up webmail /Managesieve plugin, and means that you don't lose any mail incorrectly classified, although you will need to clean it out from time to time.
If you have a lot of users, number 1. Is a better fit for an administrator because the user can manage their own spam.
At the moment I'm grappling with how to get the child-process spamassassin to look up user-managed auto white lists and prefs set through webmail sauserprefs plugin.  Still a work in progress.......
Hope that helps.