(The following subject to correction)

SpamAssassin

Overview

Can run in various modes
For us, runs as a filter that MTA postfix uses
Permanently running spamd (daemon), transiently running spamc (clients)
SpamAssassin scores the email - something else can decide what to do with it
- SpamAssassin adds a header with the score to the email itself
Mailman uses the Spamassassin score
- score > 10 → mailman discards automatically
- score < 5 → mailman accepts
- 5 > score > 10 → mailman submits to moderator for human decision

SpamAssassin docs

http://spamassassin.apache.org/doc.html
/usr/share/doc/spamassassin/

SpamAssassin - MTA - mailing list integration

We use postfix as our MTA
We use mailman as our mailing list manager

SpamAssassin - config

/etc/default/spamassassin
/old/etc/default/spamassassin
/etc/spamassassin/
/old/etc/spamassassin/
/old/var/lib/spamassassin/
I searched for “spamassassin configure debian postfix mailman”
and for reference:
- http://www.debian.org/doc/packaging-manuals/fhs/fhs-2.3.html#VARLIBVARIABLESTATEINFORMATION
- and http://www.nl.debian.org/doc/debian-policy/ch-opersys.html#s9.1
Note that some of the above documents are “out of date”. That's ok, - our distro is “out of date” too so these docs will match our setup
There's way too much here, some packages we don't use (yet? Amavis?) and some if the advice conflicts. Happy research.

update:

I searched for “mailman spamassassin debian” and found:

SpamAssassin Quick & Dirty Config

I found this and tried it out on our site: http://www.xnote.com/howto/postfix-spamassassin.html. It seems to have everything necessary and appears to be working. It's been edited to match what we have set up locally.

Install postfix and get it working for your domain. See http://www.postfix.org for details.
Install SpamAssassin. The easiest way to do this is with the command “perl -MCPAN -e 'install Mail::!SpamAssassin'” OR you can compile it. Another way is to use an RPM (!RedHat or Fedora) or “apt-get install postfix spamassassin spamc” (if you have debian)
As root, create a file at /usr/local/bin/spamfilter.sh with the following content:

    #!/bin/bash
    /usr/local/bin/spamc | /usr/sbin/sendmail -i "$@"
    exit $?

Run:

    chmod 755 /usr/local/bin/spamfilter.sh

 and make sure you have it executable:

    ls -als /usr/local/bin/spamfilter.sh

Create a user called 'spamfilter'. Make it a complete user, with home directory and shell. (set the shell to false)

    example: useradd -m -d /home/spamfilter -s /bin/false spamfilter

chown spamfilter:users /usr/local/bin/spamfilter.sh

In /etc/postfix/master.cf in the “Services” section, alter the 'smtp' line as follows (the “ -o con…” SHOULD be on the next line:

 //NOTE there are two lines that have smtp. Make sure it is the inet line (Usually the first occurrence)//

    # -----------------------------------------------------------------------------------
    smtp inet n - n - - smtpd
        -o content_filter=spamfilter:dummy
    # -----------------------------------------------------------------------------------

In /etc/postfix/master.cf in the “Interfaces to non-Postfix software” section add:

    # -----------------------------------------------------------------------------------
    spamfilter unix - n n - - pipe
        flags=Rq user=spamfilter argv=/usr/local/bin/spamfilter.sh -f ${sender} -- ${recipient}
    # -----------------------------------------------------------------------------------

Make sure that SpamAssassin is configured to run:
- Edit /etc/default/spamassassin and change the enabled line to 1 from 0
- Issue the command “/etc/init.d/spamassassin start” to get it started
- Check /var/log/mail.log to see that the spamd process started
- Make sure the symlinks are in the appropriate runlevel directories
Restart postfix and make sure you can still get email. Send a fake spam through the system (from an outside address) to verify that spam is marked as spam. For information on configuring SpamAssassin, go to http://www.spamassassin.org.