From: info from Bugzilla, text by Olegy <olegy at olegy.ru>
Newsgroups: email
Date: Mon, 15 Nov 2004 14:31:37 +0000 (UTC)
Subject: Установка антивируса и спамфильтра для почтовой системы qmail
Установка Антивирус+Спамфильтр для почтовой системы qmail (qmail+ucspi-tcp) OS FreeBSD
Установка нужного программного обеспечения:
-------------------------------------------
1) Обновляем порты если, они вручную не обновляются.
Рабочая конфигурация : amavisd-new-2.1.2 + clamav-0.80 стоит у меня на freebsd 4.9
2) cd /usr/ports/security/amavisd-new/
делаем make, если ругается на perl,
идём в /usr/ports/lang/perl5.8 делаем
make install
если всё поставилось без вопросов, тогда идём в
cd /work
делаем файл use.perl запускным, после чего запускаем -
./use.perl port
Теперь у нас есть perl линейки 5.8 и он анонсирован в системе как дефолтный.
Идём опять в /usr/ports/security/amavisd-new/
И делаем :
make
после чего идём в папку cd /work/amavisd-new-2.1.2
и делаем следующее :
patch <amavisd-new-qmqpqq.patch
Далее :
make install
Это мы поставили приблуду которая свяжет нам спамфильтр и антивирус
(поддерживает около 10-ти антивирусных систем, можно включить все сразу,
"для параноиков" 8-))) ).
3) Ставим спамфильтр - cd /usr/ports/mail/p5-Mail-SpamAssassin/
make
make install
4) Ставим антивирус cd /usr/ports/security/clamav/
make
make install
5) Нам нужно пропатчить наш qmail, ищем папку с исходниками qmail-а,
если таковой уже давно нет, тогда идём на
http://www.opennet.ru/base/net/qmail_antispam.txt.html
и качаем по ссылкам qmail и все нужные патчи к нему, плюс тот что нужен
нам можно найти здесь - http://www.imladris.sk/howto/download/qmail-queue.patch
Далее патчим qmail всеми патчами.
Идём в каталог с qmail-ом, находим файл qmail-qmqpc.c и меняем в нем
#define PORT_QMQP 628
на
#define PORT_QMQP 10628
Устанавливаем qmail туда же где он уже стоит.
Настройка программного обеспечения:
------------------------------------
1) Идём туда где у нас лежит файл с адресами которым разрешен
"открытый релей", у меня такой файл лежит в /etc называется
tcp.smtp, в него нужно добавить строчку:
127.10.10.10:allow,RELAYCLIENT="",QMAILQUEUE="bin/qmail-queue.orig"
Далее нужно создать файл tcp.smtp.amavis и сунуть в него следующее :
В моем случае -
-u 89 : это uid пользователя vpopmail
-u 83 : это gid группы vchkpw
2) В папке /var/qmail/control создать файл qmqpservers и сунуть в него:
127.10.10.10
3) Нам нужен алиал ip на локальном интерфэйсе, для этого запускаем команду:
ifconfig lo0 inet 127.10.10.10 netmask 255.255.255.255 alias
И дописываем в /etc/rc.conf :
ifconfig_lo0_alias0="inet 127.10.10.10 netmask 255.255.255.255"
4) Привожу свой конфигурационный файл от amavisd-new (в нём только нужно
указать ваш дефолтный домен), лежит он /usr/local/etc/amavisd.conf:
use strict;
# a minimalistic configuration file for amavisd-new with all necessary settings
#
# (see amavisd.conf-default for a list of all variables with their defaults)
# (see amavisd.conf-sample for a traditional-style commented file)
# COMMONLY ADJUSTED SETTINGS:
# @bypass_virus_checks_maps = (1); # uncomment to DISABLE anti-virus code
# @bypass_spam_checks_maps = (1); # uncomment to DISABLE anti-spam code
$max_servers = 10; # number of pre-forked children (2..15 is common)
$max_requests = 350;
$daemon_user = 'vscan'; # (no default; customary: vscan or amavis)
$daemon_group = 'vscan'; # (no default; customary: vscan or amavis)
$mydomain = 'ВАШ.ДОМЕН'; # a convenient default for other settings
$MYHOME = '/var/amavis'; # a convenient default for other settings
$TEMPBASE = "$MYHOME/tmp"; # working directory, needs to be created manually
$ENV{TMPDIR} = $TEMPBASE; # environment variable TMPDIR
$QUARANTINEDIR = '/var/virusmails';
# $daemon_chroot_dir = $MYHOME; # chroot directory or undef
$log_level = 0; # verbosity 0..5
$log_recip_templ = undef; # disable by-recipient level-0 log entries
$DO_SYSLOG = 0; # log via syslogd (preferred)
$SYSLOG_LEVEL = 'mail.debug';
$LOGFILE = "$MYHOME/amavis.log";
$enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny)
$enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1
$protocol = "QMQPqq";
$inet_socket_port = 10628; # listen on this local TCP port(s) (see $protocol)
$inet_socket_bind = '127.10.10.10'; # limit socket bind to loopback interface
@inet_acl = qw( 127.10.10.10 );
#$unix_socketname = "$MYHOME/amavisd.sock"; # when using sendmail milter
$sa_tag_level_deflt = 2.0; # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 6.31; # triggers spam evasive actions
$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
$sa_local_tests_only = 1; # only tests which do not require internet access?
$sa_auto_whitelist = 1; # turn on AWL in SA 2.63 or older (irrelevant
# for SA 3.0, cf option is 'use_auto_whitelist')
# @lookup_sql_dsn =
# ( ['DBI:mysql:database=mail;host=127.0.0.1;port=3306', 'user1', 'passwd1'],
# ['DBI:mysql:database=mail;host=host2', 'username2', 'password2'] );
# REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS
@viruses_that_fake_sender_maps = (new_RE(
[qr'bEICARb'i => 0], # av test pattern name
[qr'^(WM97|OF97|Joke.)'i => 0], # adjust names to match your AV scanner
[qr/.*/ => 1], # true for everything else
));
@keep_decoded_original_maps = (new_RE(
# qr'^MAIL$', # retain full original message for virus checking (can be slow)
qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
));
# for $banned_namepath_re, a new-style of banned table, see amavisd.conf-sample
$banned_filename_re = new_RE(
# qr'^UNDECIPHERABLE$', # is or contains any undecipherable components
# block certain double extensions anywhere in the base name
qr'.[^./]*.(exe|vbs|pif|scr|bat|cmd|com|dll).?$'i,
# qr'[{}]', # curly braces in names (serve as Class ID extensions - CLSID)
qr'^application/x-msdownload$'i, # block these MIME types
qr'^application/x-msdos-program$'i,
qr'^application/hta$'i,
# qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types
# [ qr'^.(Z|gz|bz2)$' => 0 ], # allow any type in Unix-compressed
[ qr'^.(rpm|cpio|tar)$' => 0 ], # allow any type in Unix archives
# [ qr'^.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any type within such archives
# ### http://www.f-prot.com/ - backs up F-Prot Daemon
# ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
# '-dumb -archive -packed {}', [0,8], [3,6],
# qr/Infection: (.+)/ ],
# ### http://www.trendmicro.com/ - backs up Trophie
# ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'],
# '-za -a {}', [0], qr/Found virus/, qr/Found virus (.+) in/ ],
# ### http://www.sald.com/, http://drweb.imshop.de/ - backs up DrWebD
# ['drweb - DrWeb Antivirus',
# ['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'],
# '-path={} -al -go -ot -cn -upn -ok-',
# [0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'],
# ['KasperskyLab kavscanner', ['/opt/kav/bin/kavscanner','kavscanner'],
# '-i1 -xp {}', [0,10,15], [5,20,21,25],
# qr/(?:CURED|INFECTED|CUREFAILED|WARNING|SUSPICION) (.*)/ ,
# sub {chdir('/opt/kav/bin') or die "Can't chdir to kav: $!"},
# sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
# ],
# Commented out because the name 'sweep' clashes with Debian and FreeBSD
# package/port of an audio editor. Make sure the correct 'sweep' is found
# in the path when enabling.
#
# ### http://www.sophos.com/ - backs up Sophie or SAVI-Perl
# ['Sophos Anti Virus (sweep)', 'sweep',
# '-nb -f -all -rec -ss -sc -archive -cab -tnef --no-reset-atime {}',
# [0,2], qr/Virus .*? found/,
# qr/^>>> Virus(?: fragment)? '?(.*?)'? found/,
# ],
# # other options to consider: -mime -oe -idedir=/usr/local/sav
# always succeeds (uncomment to consider mail clean if all other scanners fail)
# ['always-clean', sub {0}],
);
1; # insure a defined return
Привожу свой конфигурационный файл от антивируса clamd - /usr/local/etc/clamd.conf :
##
## Example config file for the Clam AV daemon
## Please read the clamd.conf(5) manual before editing this file.
##
# Comment or remove the line below.
#Example
# Uncomment this option to enable logging.
# LogFile must be writable for the user running daemon.
# A full path is required.
# Default: disabled
LogFile /var/log/clamav/clamd.log
# By default the log file is locked for writing - the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run
# the daemon with --config-file option).
# This option disables log file locking.
# Default: disabled
#LogFileUnlock
# Maximal size of the log file.
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 1M
#LogFileMaxSize 2M
# Log time with each message.
# Default: disabled
LogTime
# Also log clean files. Useful in debugging but drastically increases the
# log size.
# Default: disabled
LogClean
# Use system logger (can work together with LogFile).
# Default: disabled
#LogSyslog
# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
# Default: LOG_LOCAL6
#LogFacility LOG_MAIL
# This option allows you to save a process identifier of the listening
# daemon (main thread).
# Default: disabled
PidFile /var/run/clamav/clamd.pid
# Optional path to the global temporary directory.
# Default: system specific (usually /tmp or /var/tmp).
#TemporaryDirectory /var/tmp
# Path to the database directory.
# Default: hardcoded (depends on installation options)
DatabaseDirectory /usr/local/share/clamav
# The daemon works in a local OR a network mode. Due to security reasons we
# recommend the local mode.
# Path to a local socket file the daemon will listen on.
# Default: disabled
LocalSocket /var/run/clamav/clamd
# Remove stale socket after unclean shutdown.
# Default: disabled
FixStaleSocket
# TCP port address.
# Default: disabled
#TCPSocket 3310
# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
# Default: disabled
#TCPAddr 127.0.0.1
# Maximum length the queue of pending connections may grow to.
# Default: 15
#MaxConnectionQueueLength 30
# Close the connection if this limit is exceeded.
# Default: 10M
#StreamMaxLength 20M
# Maximal number of threads running at the same time.
# Default: 10
MaxThreads 20
# Waiting for data from a client socket will timeout after this time (seconds).
# Value of 0 disables the timeout.
# Default: 120
#ReadTimeout 300
# Waiting for a new job will timeout after this time (seconds).
# Default: 30
#IdleTimeout 60
# Execute a command when virus is found. In the command string %v will
# be replaced by a virus name.
# Default: disabled
#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"
# Run as a selected user (clamd must be started by root).
# Default: disabled
User clamav
# Initialize supplementary group access (clamd must be started by root).
# Default: disabled
AllowSupplementaryGroups
# Don't fork into background.
# Default: disabled
#Foreground
# Enable debug messages in libclamav.
# Default: disabled
#Debug
# Do not remove temporary files (for debug purposes).
# Default: disabled
#LeaveTemporaryFiles
# By default clamd uses scan options recommended by libclamav. This option
# disables recommended options and allows you to enable selected ones below.
# DO NOT TOUCH IT unless you know what you are doing.
# Default: disabled
#DisableDefaultScanOptions
##
## Executable files
##
# PE stands for Portable Executable - it's an executable file format used
# in all 32-bit versions of Windows operating systems. This option allows
# ClamAV to perform a deeper analysis of executable files and it's also
# required for decompression of popular executable packers such as UPX, FSG,
# and Petite.
# Default: enabled
#ScanPE
# With this option clamav will try to detect broken executables and mark
# them as Broken.Executable
# Default: disabled
#DetectBrokenExecutables
##
## Documents
##
# This option enables scanning of Microsoft Office document macros.
# Default: enabled
ScanOLE2
# If an email contains URLs ClamAV can download and scan them.
# WARNING: This option may open your system to a DoS attack.
# Never use it on loaded servers.
# Default: disabled
#MailFollowURLs
##
## HTML
##
# Perform HTML normalisation and decryption of MS Script Encoder code.
# Default: enabled
ScanHTML
##
## Archives
##
# ClamAV can scan within archives and compressed files.
# Default: enabled
ScanArchive
# Due to license issues libclamav does not support RAR 3.0 archives (only the
# old 2.0 format is supported). Because some users report stability problems
# with unrarlib it's disabled by default and you must uncomment the directive
# below to enable RAR 2.0 support.
# Default: disabled
ScanRAR
# The options below protect your system against Denial of Service attacks
# using archive bombs.
# Files in archives larger than this limit won't be scanned.
# Value of 0 disables the limit.
# Default: 10M
ArchiveMaxFileSize 15M
# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
# file, all files within it will also be scanned. This options specifies how
# deep the process should be continued.
# Value of 0 disables the limit.
# Default: 5
ArchiveMaxRecursion 8
# Number of files to be scanned within an archive.
# Value of 0 disables the limit.
# Default: 1000
ArchiveMaxFiles 1500
# If a file in an archive is compressed more than ArchiveMaxCompressionRatio
# times it will be marked as a virus (Oversized.ArchiveType, e.g. Oversized.Zip)
# Value of 0 disables the limit.
# Default: 250
#ArchiveMaxCompressionRatio 300
# Use slower but memory efficient decompression algorithm.
# only affects the bzip2 decompressor.
# Default: disabled
#ArchiveLimitMemoryUsage
# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
# Default: disabled
#ArchiveBlockEncrypted
# Mark archives as viruses if ArchiveMaxFiles, ArchiveMaxFileSize, or
# ArchiveMaxRecursion limit is reached.
# Default: disabled
#ArchiveBlockMax
##
## Clamuko settings
## WARNING: This is experimental software. It is very likely it will hang
## up your system!!!
##
# Enable Clamuko. Dazuko (/dev/dazuko) must be configured and running.
# Default: disabled
#ClamukoScanOnAccess
# Set access mask for Clamuko.
# Default: disabled
#ClamukoScanOnOpen
#ClamukoScanOnClose
#ClamukoScanOnExec
# Set the include paths (all files in them will be scanned). You can have
# multiple ClamukoIncludePath directives but each directory must be added
# in a seperate line.
# Default: disabled
#ClamukoIncludePath /home
#ClamukoIncludePath /students
# Set the exclude paths. All subdirectories are also excluded.
# Default: disabled
#ClamukoExcludePath /home/guru
# Don't scan files larger than ClamukoMaxFileSize
# Value of 0 disables the limit.
# Default: 5M
#ClamukoMaxFileSize 10M
5) Идём в папку /usr/local/etc/rc.d, нужно немного подредактировать запускные файлы
amavisd.sh, clamav-clamd.sh и clamav-freshclam.sh, в них во всех нужно
заскоментировать строчки :
в amavisd.sh:
amavisd_enable="YES"
в clamav-clamd.sh:
clamav_clamd_enable="YES"
в clamav-freshclam.sh:
clamav_freshclam_enable="YES"
Теперь всё готово к запуску, НО, всё же ещё рано, нужно занести пользователя
clamav в группу vscan, для этого идём в /etc и открываем файл group, дописываем
clamav в группу vscan и должно получится что-то вроде :
vscan:*:1002:clamav
Теперь наверное всё.
Идём в /usr/local/etc/rc.d и запускаем файлы amavisd.sh, clamav-clamd.sh
и clamav-freshclam.sh.
Смотри процессы ps ax, если всё запустилось нормально, в списке должны быть :
162 ?? Ss 0:10.66 amavisd (master) (perl)
190 ?? Ss 1:32.63 /usr/local/sbin/clamd
197 ?? Is 0:00.18 /usr/local/bin/freshclam -daemon
22326 ?? S 1:17.30 amavisd (ch331-avail) (perl)
22555 ?? S 1:15.20 amavisd (ch327-avail) (perl)
22668 ?? S 1:11.71 amavisd (ch329-avail) (perl)
22723 ?? S 1:09.37 amavisd (ch325-avail) (perl)
22742 ?? S 1:13.26 amavisd (ch325-avail) (perl)
22770 ?? S 1:13.80 amavisd (ch326-avail) (perl)
22803 ?? S 1:15.35 amavisd (ch324-avail) (perl)
22944 ?? R 1:09.06 amavisd (22944-323) (perl)
23023 ?? S 1:10.89 amavisd (ch320-avail) (perl)
23036 ?? S 1:12.03 amavisd (ch324-avail) (perl)
Если всё это есть и amavisd запустился без ошибок, тогда нам
остается на пару секунд зашатдаунить qmail для того чтобы сделать
пару заключительных команд :
cd /var/qmail/bin
mv qmail-queue qmail-queue.orig
ln -s qmail-qmqpc qmail-queue
после чего запускаем qmail и наслаждаемся.
Всю информацию по пойманным вирусам и спаму читать в /var/amavis/amavis.log
909 Прочтений • [Установка антивируса и спамфильтра для почтовой системы qmail (qmail mail spam virus freebsd)] [08.05.2012] [Комментариев: 0]
Vova
