Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:mail_c6:spam_3 [10.06.2012 12:28. ] – [Installation] django | centos:mail_c6:spam_3 [20.05.2021 12:42. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| + | ====== Grundinstallation von AMaViS ====== | ||
| + | {{: | ||
| + | |||
| + | ===== Grundlagen ===== | ||
| + | Bei der Definition der [[centos: | ||
| + | * **Stufe 1** : Greylisting mit Hilfe von [[centos: | ||
| + | * **Stufe 2** : Nutzung des Policy-Daemon [[centos: | ||
| + | * **Stufe 3** : Einbindung und Nutzung von [[|SpamAssassin]] und [[|ClamAV]] mit Hilfe von [[http:// | ||
| + | |||
| + | Der prinzipielle Ablauf und die Einbindung des AMaViS veranschaulich folgende Skizze. | ||
| + | |||
| + | <uml> | ||
| + | |||
| + | state MX_ISP { | ||
| + | MX_ISP : ===================================== | ||
| + | MX_ISP : Internet Service Provider - Austausch von eMails | ||
| + | MX_ISP : von und an Kunden, Interessenten, | ||
| + | MX_ISP : ===================================== | ||
| + | } | ||
| + | |||
| + | state eMail_Infrastruktur { | ||
| + | state Mailserver { | ||
| + | state MX_smtp { | ||
| + | MX_smtp : Postfix 2.6.6 | ||
| + | MX_smtp : ---------------- | ||
| + | MX_smtp : SMTP " | ||
| + | MX_smtp : versendet | ||
| + | MX_smtp : Nachrichten | ||
| + | } | ||
| + | state MX_smtpd_25 { | ||
| + | MX_smtpd_25 : Postfix 2.6.6 | ||
| + | MX_smtpd_25 : ------------------------------------ | ||
| + | MX_smtpd_25 : SMTP Daemon - Port 25 | ||
| + | MX_smtpd_25 : ext. Interface (eth0) 88.217.127.21 | ||
| + | MX_smtpd_25 : int. Interface (eth1) 10.0.0.80 | ||
| + | } | ||
| + | state MX_smtpd_10025 { | ||
| + | MX_smtpd_10025 : Postfix 2.6.6 | ||
| + | MX_smtpd_10025 : ------------------------------- | ||
| + | MX_smtpd_10025 : SMTP Daemon - Port 10025 | ||
| + | MX_smtpd_10025 : int. Interface (eth1) 10.0.0.80 | ||
| + | MX_smtpd_10025 : zur Rückleitung der AMaViS | ||
| + | MX_smtpd_10025 : Verbindungen | ||
| + | } | ||
| + | state MX_postgrey { | ||
| + | MX_postgrey : postgrey 1.34 | ||
| + | MX_postgrey : ----------------------------------------- | ||
| + | MX_postgrey : Greylisting Daemon - UNIX Socket | ||
| + | MX_postgrey : verzögerte Annahme von eMails von | ||
| + | MX_postgrey : unbekannten Kommunikationspartnern | ||
| + | } | ||
| + | state MX_policyd_weight { | ||
| + | MX_policyd_weight : policyd-weight 0.1.15 | ||
| + | MX_policyd_weight : ------------------------------------ | ||
| + | MX_policyd_weight : Greylisting Daemon - Port 12525 | ||
| + | MX_policyd_weight : gewichtete Prüfung anhand des | ||
| + | MX_policyd_weight : Envelope Sender, Envelope To | ||
| + | MX_policyd_weight : und der HELO-Daten | ||
| + | } | ||
| + | } | ||
| + | state AMaViS { | ||
| + | state AMaViS_10024 { | ||
| + | AMaViS_10024 : amavisd-new 2.5.4 | ||
| + | AMaViS_10024 : ------------------------------------- | ||
| + | AMaViS_10024 : AMaViS (A MAil Virus Scanner) | ||
| + | AMaViS_10024 : Frontendsystem zur Steuerung | ||
| + | AMaViS_10024 : der Hilfsprogramme wie Entpacker, | ||
| + | AMaViS_10024 : Scanner und Spamassassin | ||
| + | AMaViS_10024 : Einbindung als smtpd_proxy_filter | ||
| + | AMaViS_10024 : Einlieferung auf Port 10024 | ||
| + | AMaViS_10024 : Host : amavis.dmz.nausch.org | ||
| + | } | ||
| + | state AMaViS_smtp { | ||
| + | AMaViS_smtp : amavisd-new 2.5.4 | ||
| + | AMaViS_smtp : --------------------- | ||
| + | AMaViS_smtp : SMTP " | ||
| + | AMaViS_smtp : leitet eMail | ||
| + | AMaViS_smtp : an Quelle-MTA | ||
| + | AMaViS_smtp : zurück | ||
| + | } | ||
| + | state Spamassassin { | ||
| + | Spamassassin : SpamAssassin 3.3.1 | ||
| + | Spamassassin : ---------------------------------- | ||
| + | Spamassassin : SPAM-Berwertungs Daemon | ||
| + | Spamassassin : via UNIX Socket | ||
| + | Spamassassin : Überprüfung und Bewertung | ||
| + | Spamassassin : ein- und ausgehender eMails | ||
| + | Spamassassin : auf unerwünschte Inhalte | ||
| + | } | ||
| + | state ClamD { | ||
| + | ClamD : clamav 0.9.73 | ||
| + | ClamD : ----------------------------------- | ||
| + | ClamD : Clam AntiVirus Daemon | ||
| + | ClamD : via Port 3310 | ||
| + | ClamD : zum Scannen auf Schadcode | ||
| + | ClamD : ein- und ausgehender eMails | ||
| + | } | ||
| + | } | ||
| + | |||
| + | state Backend_Systeme { | ||
| + | state dovecot { | ||
| + | dovecot : dovecot 2.0.9 | ||
| + | dovecot : ------------------------------------- | ||
| + | dovecot : Dovecot IMAP-Server | ||
| + | dovecot : Einlieferung auf Port 24 (LMTP) | ||
| + | dovecot : Auslieferung via Port 143 (IMAP) | ||
| + | dovecot : und 993 (IMAPS) | ||
| + | dovecot : Sieve Mail Filter Daemon | ||
| + | dovecot : Port 4190 (SIEVE) | ||
| + | dovecot : Host imap.dmz.nausch.org | ||
| + | } | ||
| + | state mailman { | ||
| + | mailman : mailman 2.1.12 | ||
| + | mailman : --------------------------------- | ||
| + | mailman : Mailinglisten Server / Daemon | ||
| + | mailman : Host mailman.dmz.nausch.org | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | | ||
| + | ClamD --> AMaViS_10024 | ||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | </ | ||
| + | |||
| + | AMaVis übernimmt in unserem eMailworkflow eigentlich nur die Steuerung des Ablaufes, sie nimmt also die eMail vom MTA an und leitet diese an die Backendsysteme weiter: | ||
| + | * **PACKER** Zum Entpacken von Dateianhängen | ||
| + | * **Virenscanner** Zur Prüfung der eMail und der Inhalte auf Schadcode, in unserem Fall übernimmt dies das freie Projekt **ClamAV** | ||
| + | * **Spamassassin** Zur Prüfung der eMail auf unerwünschte Inhalte (SPAM und UCE) | ||
| + | |||
| + | ===== Installation ===== | ||
| + | Wie gerade schon erwähnt, stellt **AMaViS** das Frontend-System zur Verfügung. Daher werden wir im ersten Schritt mit der Installation von **amavisd-new** beginnen. Es ist natürlich klar, dass ohne die Backend-Systeme wie **SpamAssassin** oder **ClamAV**, der Einsatz von **AMaViS** nicht gerade viel bringt, sehen wir mal von der Möglichkeit vom Einfügen der **DKIM-Signaturen** ab. Auf diese gehen wir später in einem gesonderten [[centos: | ||
| + | |||
| + | Für die Installation von **amavisd-new** und der zugehörigen Pakete nutzen wir am besten das Repository [[centos: | ||
| + | # yum install amavisd-new -y | ||
| + | |||
| + | Was uns das Paket alle bei der Installation mitgebracht hat, zeigt uns ein Blick in das installierte **rpm**. | ||
| + | # rpm -qil amavisd-new | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Install Date: Sun 10 Jun 2012 12:35:06 PM CEST Build Host: lisse.hasselt.wieers.com | ||
| + | Group : System Environment/ | ||
| + | Size : 2796438 | ||
| + | Signature | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | AMaViS is a program that interfaces a mail transfer agent (MTA) with | ||
| + | one or more virus scanners. | ||
| + | |||
| + | Amavisd-new is a branch created by Mark Martinec that adds serveral | ||
| + | performance and robustness features. It's partly based on | ||
| + | work being done on the official amavisd branch. Please see the | ||
| + | README.amavisd-new-RELNOTES file for a detailed description. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | /var/amavis | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | |||
| + | ===== Grundkonfiguration ===== | ||
| + | Für die weitere Viren- und Spam-Prüfung der uns angetragenen elektronischen Post, verwenden wir die **smtp_proxy_filter**-Funktionen, | ||
| + | |||
| + | Der externe Mailserver versucht mit unserer neuen Konfiguration eine eMail bei uns auf Port **25** abzusetzen. Unser Postfix reicht diese direkt an den Port 10024 unseres **AMaViS-Daemon** weiter, der die Nachricht // | ||
| + | |||
| + | ==== AMaViS ==== | ||
| + | Im ersten Schritt definieren wir also die ersten drei Parameter, **Hostnamen**, | ||
| + | # vim / | ||
| + | < | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: $mydomain = ' | ||
| + | $mydomain = ' | ||
| + | |||
| + | ... | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: $log_level = 0; | ||
| + | $log_level = 3; # verbosity 0..5, -d | ||
| + | |||
| + | ... | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # @mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10 | ||
| + | # | ||
| + | @mynetworks = qw( 127.0.0.0/8 10.0.0.0/24 ); | ||
| + | |||
| + | ... | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: unset # listening only on localhost | ||
| + | $inet_socket_bind = ' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: @inet_acl = qw( 127.0.0.1 ::1 ); | ||
| + | @inet_acl = qw( 127.0.0.1 10.0.0.80/ | ||
| + | |||
| + | ... | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: $sa_tag2_level_deflt = 6.2; | ||
| + | $sa_tag2_level_deflt = 6.31; # add 'spam detected' | ||
| + | # Django : 2012-05-21 | ||
| + | # default: $sa_kill_level_deflt = 6.9; | ||
| + | $sa_kill_level_deflt = 6.31; # triggers spam evasive actions (e.g. blocks mail) | ||
| + | |||
| + | ... | ||
| + | |||
| + | # Django : 2010-05-21 | ||
| + | # default: unset | ||
| + | $myhostname = ' | ||
| + | |||
| + | ... | ||
| + | |||
| + | # Django : 2010-05-21 | ||
| + | # definiert wohin der amavisd-new SMTP-Client überprüfte eMails senden soll | ||
| + | # default: # $notify_method | ||
| + | $notify_method | ||
| + | # Django : 2010-05-21 | ||
| + | # definiert wohin der amavisd-new SMTP-Client Benachrichtigungen, | ||
| + | # default: # $forward_method = ' | ||
| + | $forward_method = ' | ||
| + | |||
| + | ... | ||
| + | |||
| + | </ | ||
| + | |||
| + | |||
| + | ==== Postfix ==== | ||
| + | Wie schon beim Punkt [[centos: | ||
| + | |||
| + | Bei der Konfiguration unseres Postfix-Mailservers kommt es nun darauf an, ob **Postfix** und **AMaViS** auf einem Host betrieben wird, oder ob beide Daemons auf getrennten Hosts laufen. | ||
| + | |||
| + | === single based host === | ||
| + | Im ersten Beispiel gehen wir auf die Konfiguration beider Daemon auf einem gemeinsamen Host ein. | ||
| + | Die Konfiguration selbst wird in der Konfigurationsdatei **master.cf** vorgenommen - wir erweitern also die Datei **/ | ||
| + | # vim / | ||
| + | <code bash># | ||
| + | # Postfix master process configuration file. For details on the format | ||
| + | # of the file, see the master(5) manual page (command: "man 5 master" | ||
| + | # | ||
| + | # ========================================================================== | ||
| + | # service | ||
| + | # | ||
| + | # ========================================================================== | ||
| + | smtp inet n | ||
| + | # Django : 2012-05-21 | ||
| + | # AMaViS-Intergration als smtpd_proxy_filter | ||
| + | -o smtpd_proxy_filter=localhost: | ||
| + | -o content_filter= | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # AMaViS-Intergration als smtpd_proxy_filter | ||
| + | localhost: | ||
| + | -o content_filter= | ||
| + | -o smtpd_proxy_filter= | ||
| + | -o smtpd_authorized_xforward_hosts=127.0.0.0/ | ||
| + | -o smtp_client_restrictions= | ||
| + | -o smtp_helo_restrictions= | ||
| + | -o smtp_sender_restrictions= | ||
| + | -o smtpd_recipient_restrictions=permit_mynetworks, | ||
| + | -o smtp_data_restrictions= | ||
| + | -o mynetworks=127.0.0.0/ | ||
| + | -o receive_override_options=no_unknown_recipient_checks | ||
| + | </ | ||
| + | |||
| + | === dual based host === | ||
| + | Laufen **Postfix** und **AMaViS** auf zwei getrennten Maschinen, sieht die Konfiguration geringfügig anders aus. Auf dem Host **10.0.0.80** läuft in dem Beispiel **Postfix** und auf dem Host **10.0.0.60** **AMaViS**. | ||
| + | # vim / | ||
| + | <code bash># | ||
| + | # Postfix master process configuration file. For details on the format | ||
| + | # of the file, see the master(5) manual page (command: "man 5 master" | ||
| + | # | ||
| + | # ========================================================================== | ||
| + | # service | ||
| + | # | ||
| + | # ========================================================================== | ||
| + | smtp inet n | ||
| + | # Django : 2012-05-21 | ||
| + | # AMaViS-Intergration als smtpd_proxy_filter | ||
| + | -o smtpd_proxy_filter=10.0.0.60: | ||
| + | -o content_filter= | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # AMaViS-Intergration als smtpd_proxy_filter | ||
| + | 10.0.0.80: | ||
| + | -o content_filter= | ||
| + | -o smtpd_proxy_filter= | ||
| + | -o smtpd_authorized_xforward_hosts=10.0.0.60/ | ||
| + | -o smtp_client_restrictions= | ||
| + | -o smtp_helo_restrictions= | ||
| + | -o smtp_sender_restrictions= | ||
| + | -o smtpd_recipient_restrictions=permit_mynetworks, | ||
| + | -o smtp_data_restrictions= | ||
| + | -o mynetworks=10.0.0.60/ | ||
| + | -o receive_override_options=no_unknown_recipient_checks | ||
| + | </ | ||
| + | |||
| + | ===== erster Programmstart - Aktivierung der Konfiguration ===== | ||
| + | ==== AMaViS ==== | ||
| + | Nun ist es an der Zeit, unser **AMaViS**-System das erste mal zu starten. | ||
| + | # service amavisd start | ||
| + | |||
| + | | ||
| + | |||
| + | Im Maillog wird uns der Start entsprechend quittiert. | ||
| + | < | ||
| + | Jun 10 19:00:24 vml000060 amavis[14167]: | ||
| + | Jun 10 19:00:24 vml000060 amavis[14167]: | ||
| + | Jun 10 19:00:24 vml000060 amavis[14167]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14167]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14167]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14167]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:25 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:28 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:28 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:28 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:28 vml000060 amavis[14168]: | ||
| + | Jun 10 19:00:28 vml000060 amavis[14182]: | ||
| + | Jun 10 19:00:28 vml000060 amavis[14183]: | ||
| + | </ | ||
| + | Die Meldungen **No primary av scanner** und **No secondary av scanner** braucht uns nicht zu beunruhigen, | ||
| + | |||
| + | Über den Port **10024** sollte nun unser daemon ansprechbar sein. Was wir auch sehr einfach mittels **lsof** überprüfen können: | ||
| + | # lsof -i :10024 | ||
| + | < | ||
| + | amavisd 14168 amavis | ||
| + | amavisd 14182 amavis | ||
| + | amavisd 14183 amavis | ||
| + | </ | ||
| + | |||
| + | Via **netstat -tulpen** können wir ebenfalls abfragen, ob der amavis-Daemon läuft. | ||
| + | # netstat -tulpen | grep 10024 | ||
| + | |||
| + | | ||
| + | |||
| + | Via **telnet localhost 10024** können wir uns nun zum virusscanner-daemon verbinden. | ||
| + | # telnet localhost 10024 | ||
| + | < | ||
| + | Connected to localhost. | ||
| + | Escape character is ' | ||
| + | 220 [127.0.0.1] ESMTP amavisd-new service ready | ||
| + | quit | ||
| + | 221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel | ||
| + | Connection closed by foreign host. | ||
| + | </ | ||
| + | |||
| + | ==== Postfix ==== | ||
| + | Zum Aktivieren der Konfigurationsänderung am **Postfix**-Mailserver starten wir diesen einmal durch. | ||
| + | # service postfix restart | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | Ob nun neben unserem Standard SMTP-Port **25** auch der weitere **10025** können wir nun wie folgt überprüfen. | ||
| + | # netstat -tulpen | grep master | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | ===== iptables Paketfilter ===== | ||
| + | Betreiben wir unseren **AMaViS**-Host und unseren **Postfix**-Mailserver auf zwei getrennten Hosts müssen wir noch unsere Paketfilter entsprechend anpassen. | ||
| + | |||
| + | ==== AMaVis ==== | ||
| + | Für die Einlieferung der Nachrichten auf Port 10024 öffnen wir nun Port **10024** auf unserem AMaViS-Host, | ||
| + | |||
| + | Hierzu tragen wir folgende Zeile in die Konfigurationsdatei ** / | ||
| + | # vim / | ||
| + | <code bash># Django : 2012-05-21 Port 10024 für den Postfix-Mailserver in der DMZ geöffnet | ||
| + | -A INPUT -m state --state NEW -m tcp -i eth0 -s 10.0.0.80 -p tcp --dport 10024 -j ACCEPT | ||
| + | # Django : end | ||
| + | </ | ||
| + | |||
| + | Anschließend starten wir den Paketfilter einmal durch. | ||
| + | # service iptables restart | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Nun können wir vom Postfix-Mailserver aus den AMaVS-Host auf Port 10024 erreichen. | ||
| + | # telnet amavis.dmz.nausch.org 10024 | ||
| + | < | ||
| + | Connected to amavis.dmz.nausch.org. | ||
| + | Escape character is ' | ||
| + | 220 [10.0.0.60] ESMTP amavisd-new service ready | ||
| + | quit | ||
| + | 221 2.0.0 [10.0.0.60] amavisd-new closing transmission channel | ||
| + | Connection closed by foreign host. | ||
| + | </ | ||
| + | |||
| + | ==== Postfix ==== | ||
| + | Für die Rückleitung der Nachrichten auf Port 10025 öffnen wir nun Port **10025** auf unserem Postfix-Mailserver, | ||
| + | |||
| + | Hierzu tragen wir folgende Zeile in die Konfigurationsdatei ** / | ||
| + | # vim / | ||
| + | <code bash># Django : 2012-05-21 Port 10025 für die Rückleitung der AMaViS-Verbindung in der DMZ geöffnet | ||
| + | -A INPUT -m state --state NEW -m tcp -i eth0 -s 10.0.0.60 -p tcp --dport 10025 -j ACCEPT | ||
| + | # Django : end | ||
| + | </ | ||
| + | |||
| + | Anschließend starten wir den Paketfilter einmal durch. | ||
| + | # service iptables restart | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Nun können wir vom AMaViS-Host aus den Postfix-Mailserver auf Port 10025 erreichen. | ||
| + | |||
| + | # telnet mail.dmz.nausch.org 10025 | ||
| + | < | ||
| + | Connected to mail.dmz.nausch.org. | ||
| + | Escape character is ' | ||
| + | 220 mx1.nausch.org ESMTP Postfix | ||
| + | quit | ||
| + | 221 2.0.0 Bye | ||
| + | Connection closed by foreign host. | ||
| + | </ | ||
| + | |||
| + | ===== automatisches Starten des Dienste beim Systemstart ===== | ||
| + | Damit nun unser AMaViS-Server beim Booten automatisch gestartet wird, nehmen wir noch folgende Konfigurationsschritte vor. | ||
| + | # chkconfig amavisd on | ||
| + | Anschließend überprüfen wir noch unsere Änderung: | ||
| + | # chkconfig --list | grep amavisd | ||
| + | |||
| + | | ||
| + | |||
| + | |||
| + | ===== vorläufige Konfiguration ===== | ||
| + | Bevor wir uns nun an die Konfiguration der beiden Backend-Systeme [[centos: | ||
| + | # vim / | ||
| + | <file perl / | ||
| + | |||
| + | # a minimalistic configuration file for amavisd-new with all necessary settings | ||
| + | # | ||
| + | # see amavisd.conf-default for a list of all variables with their defaults; | ||
| + | # see amavisd.conf-sample for a traditional-style commented file; | ||
| + | # for more details see documentation in INSTALL, README_FILES/ | ||
| + | # and at http:// | ||
| + | |||
| + | |||
| + | # COMMONLY ADJUSTED SETTINGS: | ||
| + | |||
| + | # @bypass_virus_checks_maps = (1); # controls running of anti-virus code | ||
| + | # @bypass_spam_checks_maps | ||
| + | # $bypass_decode_parts = 1; # controls running of decoders& | ||
| + | |||
| + | $max_servers = 2; # num of pre-forked children (2..30 is common), -m | ||
| + | $daemon_user | ||
| + | $daemon_group = " | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: $mydomain = ' | ||
| + | $mydomain = ' | ||
| + | |||
| + | # Django : 2012-06-25 "by localhost" | ||
| + | # default: unset | ||
| + | $localhost_name = ""; | ||
| + | |||
| + | # $MYHOME = '/ | ||
| + | $TEMPBASE = " | ||
| + | $ENV{TMPDIR} = $TEMPBASE; | ||
| + | $QUARANTINEDIR = "/ | ||
| + | # $quarantine_subdir_levels = 1; # add level of subdirs to disperse quarantine | ||
| + | # $release_format = ' | ||
| + | # $report_format | ||
| + | |||
| + | # $daemon_chroot_dir = $MYHOME; | ||
| + | |||
| + | $db_home | ||
| + | # $helpers_home = " | ||
| + | # $lock_file = " | ||
| + | # $pid_file | ||
| + | #NOTE: create directories $MYHOME/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: $log_level = 0; | ||
| + | $log_level = 3; # verbosity 0..5, -d | ||
| + | $log_recip_templ = undef; | ||
| + | $DO_SYSLOG = 1; # log via syslogd (preferred) | ||
| + | $syslog_facility = ' | ||
| + | # e.g.: mail, daemon, user, local0, ... local7 | ||
| + | $syslog_priority = ' | ||
| + | # choose from: emerg, alert, crit, err, warning, notice, info, debug | ||
| + | |||
| + | $enable_db = 1; # enable use of BerkeleyDB/ | ||
| + | $enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1 | ||
| + | $nanny_details_level = 2; # nanny verbosity: 1: traditional, | ||
| + | $enable_dkim_verification = 1; # enable DKIM signatures verification | ||
| + | $enable_dkim_signing = 1; # load DKIM signing code, keys defined by dkim_key | ||
| + | |||
| + | @local_domains_maps = ( [" | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # @mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10 | ||
| + | # | ||
| + | @mynetworks = qw( 127.0.0.0/8 10.0.0.0/24 ); | ||
| + | |||
| + | $unix_socketname = " | ||
| + | # option(s) -p overrides $inet_socket_port and $unix_socketname | ||
| + | |||
| + | $inet_socket_port = 10024; | ||
| + | # $inet_socket_port = [10024, | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: unset # listening only on localhost | ||
| + | $inet_socket_bind = ' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: @inet_acl = qw( 127.0.0.1 ::1 ); | ||
| + | @inet_acl = qw( 127.0.0.1 10.0.0.80/ | ||
| + | |||
| + | $policy_bank{' | ||
| + | originating => 1, # is true in MYNETS by default, but let's make it explicit | ||
| + | os_fingerprint_method => undef, | ||
| + | }; | ||
| + | |||
| + | # it is up to MTA to re-route mail from authenticated roaming users or | ||
| + | # from internal hosts to a dedicated TCP port (such as 10026) for filtering | ||
| + | $interface_policy{' | ||
| + | |||
| + | $policy_bank{' | ||
| + | originating => 1, # declare that mail was submitted by our smtp client | ||
| + | allow_disclaimers => 1, # enables disclaimer insertion if available | ||
| + | # notify administrator of locally originating malware | ||
| + | virus_admin_maps => [" | ||
| + | spam_admin_maps | ||
| + | warnbadhsender | ||
| + | # forward to a smtpd service providing DKIM signing service | ||
| + | forward_method => ' | ||
| + | # force MTA conversion to 7-bit (e.g. before DKIM signing) | ||
| + | smtpd_discard_ehlo_keywords => [' | ||
| + | bypass_banned_checks_maps => [1], # allow sending any file names and types | ||
| + | terminate_dsn_on_notify_success => 0, # don't remove NOTIFY=SUCCESS option | ||
| + | }; | ||
| + | |||
| + | $interface_policy{' | ||
| + | |||
| + | # Use with amavis-release over a socket or with Petr Rehor' | ||
| + | # (with amavis-milter.c from this package or old amavis.c client use ' | ||
| + | $policy_bank{' | ||
| + | protocol => ' | ||
| + | auth_required_release => 0, # do not require secret_id for amavisd-release | ||
| + | }; | ||
| + | |||
| + | $sa_tag_level_deflt | ||
| + | # Django : 2012-05-21 | ||
| + | # default: $sa_tag2_level_deflt = 6.2; | ||
| + | $sa_tag2_level_deflt = 6.31; # add 'spam detected' | ||
| + | # Django : 2012-05-21 | ||
| + | # default: $sa_kill_level_deflt = 6.9; | ||
| + | $sa_kill_level_deflt = 6.31; # triggers spam evasive actions (e.g. blocks mail) | ||
| + | $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent | ||
| + | $sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From | ||
| + | # $sa_quarantine_cutoff_level = 25; # spam level beyond which quarantine is off | ||
| + | $penpals_bonus_score = 8; # (no effect without a @storage_sql_dsn database) | ||
| + | $penpals_threshold_high = $sa_kill_level_deflt; | ||
| + | $bounce_killer_score = 100; # spam score points to add for joe-jobbed bounces | ||
| + | |||
| + | $sa_mail_body_size_limit = 400*1024; # don't waste time on SA if mail is larger | ||
| + | $sa_local_tests_only = 0; # only tests which do not require internet access? | ||
| + | |||
| + | # @lookup_sql_dsn = | ||
| + | # ( [' | ||
| + | # | ||
| + | # | ||
| + | # @storage_sql_dsn = @lookup_sql_dsn; | ||
| + | |||
| + | # $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP; | ||
| + | # | ||
| + | |||
| + | $virus_admin | ||
| + | |||
| + | $mailfrom_notify_admin | ||
| + | $mailfrom_notify_recip | ||
| + | $mailfrom_notify_spamadmin = " | ||
| + | $mailfrom_to_quarantine = ''; | ||
| + | |||
| + | @addr_extension_virus_maps | ||
| + | @addr_extension_banned_maps | ||
| + | @addr_extension_spam_maps | ||
| + | @addr_extension_bad_header_maps = (' | ||
| + | # $recipient_delimiter = ' | ||
| + | # when enabling addr extensions do also Postfix/ | ||
| + | |||
| + | $path = '/ | ||
| + | # $dspam = ' | ||
| + | |||
| + | $MAXLEVELS = 14; | ||
| + | $MAXFILES = 1500; | ||
| + | $MIN_EXPANSION_QUOTA = 100*1024; | ||
| + | $MAX_EXPANSION_QUOTA = 300*1024*1024; | ||
| + | |||
| + | $sa_spam_subject_tag = ' | ||
| + | $defang_virus | ||
| + | $defang_banned = 1; # MIME-wrap passed mail containing banned name | ||
| + | # for defanging bad headers only turn on certain minor contents categories: | ||
| + | $defang_by_ccat{+CC_BADH.", | ||
| + | $defang_by_ccat{+CC_BADH.", | ||
| + | $defang_by_ccat{+CC_BADH.", | ||
| + | |||
| + | |||
| + | # OTHER MORE COMMON SETTINGS (defaults may suffice): | ||
| + | |||
| + | # Django : 2010-05-21 | ||
| + | # default: unset | ||
| + | $myhostname = ' | ||
| + | |||
| + | # Django : 2010-05-21 | ||
| + | # default: # $notify_method | ||
| + | $notify_method | ||
| + | # Django : 2010-05-21 | ||
| + | # default: # $forward_method = ' | ||
| + | $forward_method = ' | ||
| + | |||
| + | # $final_virus_destiny | ||
| + | # $final_banned_destiny | ||
| + | # $final_spam_destiny | ||
| + | # $final_bad_header_destiny = D_PASS; | ||
| + | # $bad_header_quarantine_method = undef; | ||
| + | |||
| + | # $os_fingerprint_method = ' | ||
| + | |||
| + | ## hierarchy by which a final setting is chosen: | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | |||
| + | |||
| + | # SOME OTHER VARIABLES WORTH CONSIDERING (see amavisd.conf-default for all) | ||
| + | |||
| + | # $warnbadhsender, | ||
| + | # $warnvirusrecip, | ||
| + | # | ||
| + | # @bypass_virus_checks_maps, | ||
| + | # @bypass_banned_checks_maps, | ||
| + | # | ||
| + | # @virus_lovers_maps, | ||
| + | # @banned_files_lovers_maps, | ||
| + | # | ||
| + | # @blacklist_sender_maps, | ||
| + | # | ||
| + | # $clean_quarantine_method, | ||
| + | # $bad_header_quarantine_to, | ||
| + | # | ||
| + | # $defang_bad_header, | ||
| + | |||
| + | |||
| + | # REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS | ||
| + | |||
| + | @keep_decoded_original_maps = (new_RE( | ||
| + | qr' | ||
| + | qr' | ||
| + | qr' | ||
| + | # qr' | ||
| + | )); | ||
| + | |||
| + | |||
| + | # for $banned_namepath_re (a new-style of banned table) see amavisd.conf-sample | ||
| + | |||
| + | $banned_filename_re = new_RE( | ||
| + | |||
| + | ### BLOCKED ANYWHERE | ||
| + | # qr' | ||
| + | qr' | ||
| + | # qr' | ||
| + | |||
| + | ### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES: | ||
| + | # [ qr' | ||
| + | [ qr' | ||
| + | |||
| + | qr' | ||
| + | # qr' | ||
| + | |||
| + | ### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES: | ||
| + | # [ qr' | ||
| + | |||
| + | qr' | ||
| + | qr' | ||
| + | qr' | ||
| + | |||
| + | # qr' | ||
| + | # qr' | ||
| + | |||
| + | # qr' | ||
| + | # qr' | ||
| + | |||
| + | # block certain double extensions in filenames | ||
| + | qr' | ||
| + | |||
| + | # qr' | ||
| + | # qr' | ||
| + | |||
| + | qr' | ||
| + | # qr' | ||
| + | # qr' | ||
| + | # inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst| | ||
| + | # ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs| | ||
| + | # wmf|wsc|wsf|wsh)$' | ||
| + | # qr' | ||
| + | # qr' | ||
| + | |||
| + | # qr' | ||
| + | ); | ||
| + | # See http:// | ||
| + | # and http:// | ||
| + | |||
| + | |||
| + | # ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING | ||
| + | |||
| + | @score_sender_maps = ({ # a by-recipient hash lookup table, | ||
| + | # results from all matching recipient tables are summed | ||
| + | |||
| + | # ## per-recipient personal tables | ||
| + | # ' | ||
| + | # ' | ||
| + | # ' | ||
| + | # ' | ||
| + | |||
| + | ## site-wide opinions about senders (the ' | ||
| + | ' | ||
| + | |||
| + | | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | ), | ||
| + | |||
| + | # read_hash("/ | ||
| + | |||
| + | { # a hash-type lookup table (associative array) | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | | ||
| + | | ||
| + | |||
| + | # soft-blacklisting (positive score) | ||
| + | ' | ||
| + | ' | ||
| + | |||
| + | }, | ||
| + | ], # end of site-wide tables | ||
| + | }); | ||
| + | |||
| + | |||
| + | @decoders = ( | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | # [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | # [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | # [' | ||
| + | [' | ||
| + | ); | ||
| + | |||
| + | |||
| + | @av_scanners = ( | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # # NOTE: run clamd under the same user as amavisd, or run it under its own | ||
| + | # # uid such as clamav, add user clamav to the amavis group, and then add | ||
| + | # # | ||
| + | # # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in | ||
| + | # # this entry; when running chrooted one may prefer socket " | ||
| + | |||
| + | # ### http:// | ||
| + | # # note that Mail:: | ||
| + | # [' | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # ['AVG Anti-Virus', | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # ' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # pack(' | ||
| + | # pack(' | ||
| + | # length(" | ||
| + | # ' | ||
| + | # pack(' | ||
| + | # pack(' | ||
| + | # '/ | ||
| + | # # '/ | ||
| + | # # '/ | ||
| + | # # ' | ||
| + | # ], | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # ], | ||
| + | # # NOTE: If using amavis-milter, | ||
| + | # # length(" | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ['/ | ||
| + | '/ | ||
| + | '-p / | ||
| + | [0,3,6,8], qr/ | ||
| + | qr/ | ||
| + | ], | ||
| + | # NOTE: one may prefer [0], | ||
| + | # currupted or protected archives are to be handled | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '-* -P -B -Y -O- {}', [0,3,6,8], [2, | ||
| + | qr/ | ||
| + | sub {chdir('/ | ||
| + | sub {chdir($TEMPBASE) or die " | ||
| + | ], | ||
| + | |||
| + | ### The kavdaemon and AVPDaemonClient have been removed from Kasperky | ||
| + | ### products and replaced by aveserver and aveclient | ||
| + | [' | ||
| + | [ '/ | ||
| + | '/ | ||
| + | '/ | ||
| + | '/ | ||
| + | " | ||
| + | # change the startup-script in / | ||
| + | # | ||
| + | # (or perhaps: | ||
| + | # adjusting /var/amavis above to match your $TEMPBASE. | ||
| + | # The ' | ||
| + | # can find, read, and write its pid file, etc., see 'man kavdaemon' | ||
| + | # defUnix.prf: | ||
| + | # | ||
| + | # cd / | ||
| + | # cp AvpDaemonClient /opt/AVP/ | ||
| + | # su - vscan -c " | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | [' | ||
| + | "-a s --timeout=60 --temp=$TEMPBASE -y $QUARANTINEDIR ". | ||
| + | " | ||
| + | [0,3], [1,2,5], | ||
| + | qr/(?x)^\s* (?: | ||
| + | # Adjust the path of the binary and the virus database as needed. | ||
| + | # ' | ||
| + | # the quarantine directory, and the quarantine option can not be disabled. | ||
| + | # If $QUARANTINEDIR is not used, then another directory must be specified | ||
| + | # to appease ' | ||
| + | # protected files are to be considered infected. | ||
| + | |||
| + | ### http:// | ||
| + | ### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira Antivirus | ||
| + | [' | ||
| + | ' | ||
| + | qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) | | ||
| + | (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s' | ||
| + | # NOTE: if you only have a demo version, remove -z and add 214, as in: | ||
| + | # ' | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '-all -archive -packed {}', [50], [51,52,53], | ||
| + | qr/ | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ' | ||
| + | qr/^Files Infected: | ||
| + | qr/ | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ' | ||
| + | [0], qr/ | ||
| + | qr/ | ||
| + | # NOTE: check options and patterns to see which entry better applies | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # ' | ||
| + | # ' | ||
| + | # | ||
| + | |||
| + | ### http:// | ||
| + | | ||
| + | ['/ | ||
| + | ' | ||
| + | ' | ||
| + | qr/ | ||
| + | # NOTE: internal archive handling may be switched off by ' | ||
| + | # to prevent fsav from exiting with status 9 on broken archives | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # | ||
| + | |||
| + | ['CAI InoculateIT', | ||
| + | '-sec -nex {}', [0], [100], | ||
| + | qr/was infected by virus (.+)/m ], | ||
| + | # see: http:// | ||
| + | |||
| + | ### http:// | ||
| + | ['CAI eTrust Antivirus', | ||
| + | '-arc -nex -spm h {}', [0], [101], | ||
| + | qr/is infected by virus: (.+)/m ], | ||
| + | # NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer | ||
| + | # see http:// | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '-s {}/*', [0], [1,2], | ||
| + | qr/--[ \t]*(.+)/m ], | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '-s -q {}', [0], [1..7], | ||
| + | qr/^... (\S+)/m ], | ||
| + | |||
| + | # ### http:// | ||
| + | # ['ESET NOD32 for Linux Mail servers', | ||
| + | # | ||
| + | # ' | ||
| + | # '-w -a --action-on-infected=accept --action-on-uncleanable=accept '. | ||
| + | # ' | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # ['ESET NOD32 Linux Mail Server - command line interface', | ||
| + | # | ||
| + | # ' | ||
| + | |||
| + | # ### http:// | ||
| + | # ['ESET Software ESETS Command Line Interface', | ||
| + | # | ||
| + | # ' | ||
| + | |||
| + | ### http:// | ||
| + | ['ESET Software ESETS Command Line Interface', | ||
| + | ['/ | ||
| + | ' | ||
| + | qr/: | ||
| + | |||
| + | ## http:// | ||
| + | ['ESET NOD32 for Linux File servers', | ||
| + | ['/ | ||
| + | ' | ||
| + | '-w -a --action=1 -b {}', | ||
| + | [0], [1,10], qr/ | ||
| + | |||
| + | # Experimental, | ||
| + | # ['ESET Software NOD32 Client/ | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '-c -l:0 -s -u -temp: | ||
| + | qr/(?i).* virus in .* -> \' | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ['/ | ||
| + | '-auto -aex -heu -cmp -nbr -nor -nos -eng -nob {}', | ||
| + | qr/Number of files infected[ .]*: 0+(?!\d)/m, | ||
| + | qr/Number of files infected[ .]*: 0*[1-9]/m, | ||
| + | qr/Found virus :\s*(\S+)/m ], | ||
| + | # NOTE: for efficiency, start the Panda in resident mode with 'pavcl -tsr' | ||
| + | # before starting amavisd - the bases are then loaded only once at startup. | ||
| + | # To reload bases in a signature update script: | ||
| + | # / | ||
| + | # Please review other options of pavcl, for example: | ||
| + | # -nomalw, -nojoke, -nodial, -nohackt, -nospyw, -nocookies | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # [0], [0x10, 0x30, 0x50, 0x70, 0x90, 0xB0, 0xD0, 0xF0], | ||
| + | # | ||
| + | |||
| + | # GeCAD AV technology is acquired by Microsoft; RAV has been discontinued. | ||
| + | # Check your RAV license terms before fiddling with the following two lines! | ||
| + | # [' | ||
| + | # ' | ||
| + | # # NOTE: the command line switches changed with scan engine 8.5 ! | ||
| + | # # (btw, assigning stdin to /dev/null causes RAV to fail) | ||
| + | |||
| + | ### http:// | ||
| + | ['NAI McAfee AntiVirus (uvscan)', | ||
| + | ' | ||
| + | qr/(?x) Found (?: | ||
| + | \ the\ (.+)\ (?: | ||
| + | \ (?: | ||
| + | :\ (.+)\ NOT\ a\ virus)/m, | ||
| + | # sub {$ENV{LD_PRELOAD}='/ | ||
| + | # sub {delete $ENV{LD_PRELOAD}}, | ||
| + | ], | ||
| + | # NOTE1: with RH9: force the dynamic linker to look at / | ||
| + | # anything else by setting environment variable LD_PRELOAD=/ | ||
| + | # and then clear it when finished to avoid confusing anything else. | ||
| + | # NOTE2: to treat encrypted files as viruses replace the [13] with: | ||
| + | # qr/ | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | "{} -ss -i ' | ||
| + | qr/: ' | ||
| + | # VirusBuster Ltd. does not support the daemon version for the workstation | ||
| + | # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of | ||
| + | # binaries, some parameters AND return codes have changed (from 3 to 1). | ||
| + | # See also the new Vexira entry ' | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # | ||
| + | # # HINT: for an infected file it always returns 3, | ||
| + | # # although the man-page tells a different story | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ' | ||
| + | # sub {$ENV{VSTK_HOME}='/ | ||
| + | ], | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '-a -i -n -t=A {}', [0], [1], qr/ | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ' | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ' | ||
| + | qr/ | ||
| + | qr/ | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '--arc --mail {}', qr/ | ||
| + | qr/ | ||
| + | qr/ | ||
| + | # consider also: --all --nowarn --alev=15 --flev=15. | ||
| + | # not apply to your version of bdc, check documentation and see 'bdc --help' | ||
| + | |||
| + | ### ArcaVir for Linux and Unix http:// | ||
| + | [' | ||
| + | '-v 1 -summary 0 -s {}', [0], [1,2], | ||
| + | qr/ | ||
| + | |||
| + | # ### a generic SMTP-client interface to a SMTP-based virus scanner | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # [' | ||
| + | # use File::Scan; my($fn)=@_; | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # : ($vname ne '' | ||
| + | # | ||
| + | |||
| + | # ### fully-fledged checker for JPEG marker segments of invalid length | ||
| + | # [' | ||
| + | # sub { use JpegTester (); Amavis:: | ||
| + | # | ||
| + | # # NOTE: place file JpegTester.pm somewhere where Perl can find it, | ||
| + | # # for example in / | ||
| + | |||
| + | ); | ||
| + | |||
| + | |||
| + | @av_scanners_backup = ( | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | " | ||
| + | [0], qr/: | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ' | ||
| + | [0, | ||
| + | qr/ | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '-dumb -archive -packed {}', [0,8], [3, | ||
| + | qr/ | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | '-za -a {}', [0], qr/Found virus/m, qr/Found virus (.+) in/m ], | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | ['/ | ||
| + | ' | ||
| + | [0,32], [1,9,33], qr' infected (?: | ||
| + | |||
| + | ### http:// | ||
| + | | ||
| + | | ||
| + | '/ | ||
| + | '/ | ||
| + | ' | ||
| + | | ||
| + | # sub {chdir('/ | ||
| + | # sub {chdir($TEMPBASE) or die " | ||
| + | ], | ||
| + | |||
| + | # Commented out because the name ' | ||
| + | # package/ | ||
| + | # in the path when enabling. | ||
| + | # | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # ' | ||
| + | # | ||
| + | # | ||
| + | # ], | ||
| + | # # other options to consider: -idedir=/ | ||
| + | |||
| + | # Always succeeds and considers mail clean. | ||
| + | # Potentially useful when all other scanners fail and it is desirable | ||
| + | # to let mail continue to flow with no virus checking (when uncommented). | ||
| + | # [' | ||
| + | |||
| + | ); | ||
| + | |||
| + | |||
| + | 1; # insure a defined return value | ||
| + | </ | ||
| + | |||
| + | ====== Links ====== | ||
| + | * **[[centos: | ||
| + | * **[[wiki: | ||
| + | * **[[http:// | ||
| + | |||