Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:mail_c6:spam_4 [10.06.2012 21:17. ] – django | centos:mail_c6:spam_4 [20.05.2021 12:43. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| + | ====== Installation und Konfiguration von ClamAV ====== | ||
| + | {{: | ||
| + | ===== Grundlagen ===== | ||
| + | Die Überprüfung der eMail wie auch der Dateianhänge übernimmt das freie Antivirus Toolkit [[http:// | ||
| + | |||
| + | Die wichtigsten Funktionen von **ClamAV** sind: | ||
| + | * Kommandozeilen Scanner | ||
| + | * performanter Multi-Threaded Daemon mit der Unterstützung von on-access scannen | ||
| + | * Komplexes Update-Programm für die Datenbank mit Unterstützung für scripted Updates und digitale Signaturen | ||
| + | * Virus Scanner Bibliothek in C | ||
| + | * On-Access Scanning | ||
| + | * Mehrmals tägliche Updates der Virusdatenbank (siehe Homepage für die gesamte Anzahl von Signaturen) | ||
| + | * Integrierte Unterstützung für verschieden Archiv-Formate wie Zip, RAR, Tar, Gzip, Bzip2, OLE2, Cabinet, CHM, BinHex, SIS und andere | ||
| + | * Integrierte Unterstützung für nahezu alle Mail Dateien Formate | ||
| + | * Eingebaute Unterstützung für ELF executables und Portable Executable Dateien komprimiert mit UPX, FSG, Petite, NsPack, wwpack32, MEW, Upack und verschleiert mit SUE, Y0da Cryptor und anderen | ||
| + | |||
| + | <uml> | ||
| + | |||
| + | state " | ||
| + | smtp_25 : (Mail Transport Agent) | ||
| + | smtp_25 : andere SMTP-Server | ||
| + | smtp_25 : im Internet bzw. Intranet | ||
| + | smtp_25 : TCP/IP - Port 25 | ||
| + | |||
| + | state Postfix { | ||
| + | state " | ||
| + | smtpd_25 : SMTP-Daemon | ||
| + | smtpd_25 : TCP/IP Port 25 | ||
| + | smtpd_25 : mit smtpd_proxy_filter | ||
| + | |||
| + | state " | ||
| + | smtpd_10025 : SMTP-Daemon | ||
| + | smtpd_10025 : TCP/IP Port 10025 | ||
| + | smtpd_10025 : *ohne* smtpd_proxy_filter | ||
| + | |||
| + | state " | ||
| + | work : weitere Be-/ | ||
| + | work : der eMail durch den | ||
| + | work : Mail-Transport-Agent Postfix | ||
| + | } | ||
| + | |||
| + | state AMaViS { | ||
| + | state " | ||
| + | smtpd_10024 : SMTP-Daemon | ||
| + | smtpd_10024 : TCP/IP Port 10024 | ||
| + | |||
| + | state " | ||
| + | amavis : Master Prozess | ||
| + | amavis : (Frontend-System) | ||
| + | | ||
| + | state " | ||
| + | packer : Backend-System zum | ||
| + | packer : Entpacken von Dateianhängen | ||
| + | state " | ||
| + | virus : Backend-System zum | ||
| + | virus : Prüfen der eMail und der | ||
| + | virus : Anhänge auf Schadcode | ||
| + | state " | ||
| + | spam : Backend-System zum | ||
| + | spam : Prüfen der eMail auf | ||
| + | spam : unerwünschte Inhalte | ||
| + | } | ||
| + | |||
| + | state Cyrus { | ||
| + | state " | ||
| + | smtpd_24 : Mail-Delivery-Agent | ||
| + | smtpd_24 : Dovecot IMAP-Server | ||
| + | } | ||
| + | |||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | virus -up-> amavis | ||
| + | | ||
| + | spam -right-> amavis | ||
| + | |||
| + | | ||
| + | |||
| + | work -right-> smtpd_24 | ||
| + | </ | ||
| + | |||
| + | |||
| + | Hauptsächlich wird **// | ||
| + | |||
| + | Nachfolgend befassen wir uns nun mit der Installation und Konfiguration von ClamAV im Mailserverumfeld. | ||
| + | |||
| + | ===== Installation ===== | ||
| + | Für die Installation von **clamav** und der zugehörigen Pakete nutzen wir am besten das Repository [[centos: | ||
| + | # yum install clamd clamav clamav-db -y | ||
| + | ===== Programminfo ===== | ||
| + | Was uns die einzelnen Pakete alle bei der Installation mitgebracht haben, zeigt uns jeweilsein Blick in das installierte **rpm**. | ||
| + | |||
| + | ==== clamav ==== | ||
| + | # rpm -qil clamav | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Install Date: Sun 10 Jun 2012 11:38:35 PM CEST Build Host: lisse.hasselt.wieers.com | ||
| + | Group : Applications/ | ||
| + | Size : 6113818 | ||
| + | Signature | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main purpose of | ||
| + | this software is the integration with mail servers (attachment scanning). | ||
| + | The package provides a flexible and scalable multi-threaded daemon, a | ||
| + | command line scanner, and a tool for automatic updating via Internet. | ||
| + | |||
| + | The programs are based on a shared library distributed with the Clam | ||
| + | AntiVirus package, which you can use with your own software. Most | ||
| + | importantly, | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | ==== clamav-db ==== | ||
| + | # rpm -qil clamav-db | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Install Date: Sun 10 Jun 2012 11:38:34 PM CEST Build Host: lisse.hasselt.wieers.com | ||
| + | Group : Applications/ | ||
| + | Size : 33616088 | ||
| + | Signature | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | The actual virus database for clamav | ||
| + | / | ||
| + | / | ||
| + | /var/clamav | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | ==== clamd ==== | ||
| + | # rpm -qil clamd | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Install Date: Sun 10 Jun 2012 11:38:37 PM CEST Build Host: lisse.hasselt.wieers.com | ||
| + | Group : System Environment/ | ||
| + | Size : 602939 | ||
| + | Signature | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | The Clam AntiVirus Daemon | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | /var/clamav | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ===== Konfiguration ===== | ||
| + | |||
| + | ==== clamd ==== | ||
| + | Die Konfigurationsdatei ** / | ||
| + | <file bash / | ||
| + | ## Example config file for the Clam AV daemon | ||
| + | ## Please read the clamd.conf(5) manual before editing this file. | ||
| + | ## | ||
| + | |||
| + | |||
| + | # Comment or remove the line below. | ||
| + | #Example | ||
| + | |||
| + | # Uncomment this option to enable logging. | ||
| + | # LogFile must be writable for the user running daemon. | ||
| + | # A full path is required. | ||
| + | # Default: disabled | ||
| + | LogFile / | ||
| + | |||
| + | # By default the log file is locked for writing - the lock protects against | ||
| + | # running clamd multiple times (if want to run another clamd, please | ||
| + | # copy the configuration file, change the LogFile variable, and run | ||
| + | # the daemon with --config-file option). | ||
| + | # This option disables log file locking. | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # Maximum size of the log file. | ||
| + | # Value of 0 disables the limit. | ||
| + | # You may use ' | ||
| + | # and ' | ||
| + | # in bytes just don't use modifiers. | ||
| + | # Default: 1M | ||
| + | LogFileMaxSize 0 | ||
| + | |||
| + | # Log time with each message. | ||
| + | # Default: no | ||
| + | LogTime yes | ||
| + | |||
| + | # Also log clean files. Useful in debugging but drastically increases the | ||
| + | # log size. | ||
| + | # Default: no | ||
| + | #LogClean yes | ||
| + | |||
| + | # Use system logger (can work together with LogFile). | ||
| + | # Default: no | ||
| + | LogSyslog yes | ||
| + | |||
| + | # Specify the type of syslog messages - please refer to 'man syslog' | ||
| + | # for facility names. | ||
| + | # Default: LOG_LOCAL6 | ||
| + | # | ||
| + | |||
| + | # Enable verbose logging. | ||
| + | # Default: no | ||
| + | #LogVerbose yes | ||
| + | |||
| + | # Log additional information about the infected file, such as its | ||
| + | # size and hash, together with the virus name. | ||
| + | # | ||
| + | |||
| + | # This option allows you to save a process identifier of the listening | ||
| + | # daemon (main thread). | ||
| + | # Default: disabled | ||
| + | PidFile / | ||
| + | |||
| + | # Optional path to the global temporary directory. | ||
| + | # Default: system specific (usually /tmp or /var/tmp). | ||
| + | TemporaryDirectory /var/tmp | ||
| + | |||
| + | # Path to the database directory. | ||
| + | # Default: hardcoded (depends on installation options) | ||
| + | DatabaseDirectory /var/clamav | ||
| + | |||
| + | # Only load the official signatures published by the ClamAV project. | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # The daemon can work in local mode, network mode or both. | ||
| + | # Due to security reasons we recommend the local mode. | ||
| + | |||
| + | # Path to a local socket file the daemon will listen on. | ||
| + | # Default: disabled (must be specified by a user) | ||
| + | LocalSocket / | ||
| + | |||
| + | # Sets the group ownership on the unix socket. | ||
| + | # Default: disabled (the primary group of the user running clamd) | ||
| + | # | ||
| + | |||
| + | # Sets the permissions on the unix socket to the specified mode. | ||
| + | # Default: disabled (socket is world accessible) | ||
| + | # | ||
| + | |||
| + | # Remove stale socket after unclean shutdown. | ||
| + | # Default: yes | ||
| + | FixStaleSocket yes | ||
| + | |||
| + | # TCP port address. | ||
| + | # Default: no | ||
| + | TCPSocket 3310 | ||
| + | |||
| + | # TCP address. | ||
| + | # By default we bind to INADDR_ANY, probably not wise. | ||
| + | # Enable the following to provide some degree of protection | ||
| + | # from the outside world. | ||
| + | # Default: no | ||
| + | TCPAddr 127.0.0.1 | ||
| + | |||
| + | # Maximum length the queue of pending connections may grow to. | ||
| + | # Default: 200 | ||
| + | MaxConnectionQueueLength 30 | ||
| + | |||
| + | # Clamd uses FTP-like protocol to receive data from remote clients. | ||
| + | # If you are using clamav-milter to balance load between remote clamd daemons | ||
| + | # on firewall servers you may need to tune the options below. | ||
| + | |||
| + | # Close the connection when the data size limit is exceeded. | ||
| + | # The value should match your MTA's limit for a maximum attachment size. | ||
| + | # Default: 25M | ||
| + | # | ||
| + | |||
| + | # Limit port range. | ||
| + | # Default: 1024 | ||
| + | # | ||
| + | # Default: 2048 | ||
| + | # | ||
| + | |||
| + | # Maximum number of threads running at the same time. | ||
| + | # Default: 10 | ||
| + | MaxThreads 50 | ||
| + | |||
| + | # Waiting for data from a client socket will timeout after this time (seconds). | ||
| + | # Default: 120 | ||
| + | ReadTimeout 300 | ||
| + | |||
| + | # This option specifies the time (in seconds) after which clamd should | ||
| + | # timeout if a client doesn' | ||
| + | # Default: 5 | ||
| + | # | ||
| + | |||
| + | # This option specifies how long to wait (in miliseconds) if the send buffer is full. | ||
| + | # Keep this value low to prevent clamd hanging | ||
| + | # | ||
| + | # Default: 500 | ||
| + | # | ||
| + | |||
| + | # Maximum number of queued items (including those being processed by MaxThreads threads) | ||
| + | # It is recommended to have this value at least twice MaxThreads if possible. | ||
| + | # WARNING: you shouldn' | ||
| + | # the following condition should hold: | ||
| + | # MaxThreads*MaxRecursion + (MaxQueue - MaxThreads) + 6< RLIMIT_NOFILE (usual max is 1024) | ||
| + | # | ||
| + | # Default: 100 | ||
| + | #MaxQueue 200 | ||
| + | |||
| + | # Waiting for a new job will timeout after this time (seconds). | ||
| + | # Default: 30 | ||
| + | # | ||
| + | |||
| + | # Don't scan files and directories matching regex | ||
| + | # This directive can be used multiple times | ||
| + | # Default: scan all | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Maximum depth directories are scanned at. | ||
| + | # Default: 15 | ||
| + | # | ||
| + | |||
| + | # Follow directory symlinks. | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # Follow regular file symlinks. | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # Scan files and directories on other filesystems. | ||
| + | # Default: yes | ||
| + | # | ||
| + | |||
| + | # Perform a database check. | ||
| + | # Default: 600 (10 min) | ||
| + | #SelfCheck 600 | ||
| + | |||
| + | # Execute a command when virus is found. In the command string %v will | ||
| + | # be replaced with the virus name. | ||
| + | # Default: no | ||
| + | #VirusEvent / | ||
| + | |||
| + | # Run as another user (clamd must be started by root for this option to work) | ||
| + | # Default: don't drop privileges | ||
| + | User clamav | ||
| + | |||
| + | # Initialize supplementary group access (clamd must be started by root). | ||
| + | # Default: no | ||
| + | AllowSupplementaryGroups yes | ||
| + | |||
| + | # Stop daemon when libclamav reports out of memory condition. | ||
| + | #ExitOnOOM yes | ||
| + | |||
| + | # Don't fork into background. | ||
| + | # Default: no | ||
| + | #Foreground yes | ||
| + | |||
| + | # Enable debug messages in libclamav. | ||
| + | # Default: no | ||
| + | #Debug yes | ||
| + | |||
| + | # Do not remove temporary files (for debug purposes). | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # Detect Possibly Unwanted Applications. | ||
| + | # Default: no | ||
| + | #DetectPUA yes | ||
| + | |||
| + | # Exclude a specific PUA category. This directive can be used multiple times. | ||
| + | # See http:// | ||
| + | # categories. | ||
| + | # Default: Load all categories (if DetectPUA is activated) | ||
| + | #ExcludePUA NetTool | ||
| + | #ExcludePUA PWTool | ||
| + | |||
| + | # Only include a specific PUA category. This directive can be used multiple | ||
| + | # times. | ||
| + | # Default: Load all categories (if DetectPUA is activated) | ||
| + | #IncludePUA Spy | ||
| + | #IncludePUA Scanner | ||
| + | #IncludePUA RAT | ||
| + | |||
| + | # In some cases (eg. complex malware, exploits in graphic files, and others), | ||
| + | # ClamAV uses special algorithms to provide accurate detection. This option | ||
| + | # controls the algorithmic detection. | ||
| + | # Default: yes | ||
| + | # | ||
| + | |||
| + | |||
| + | ## | ||
| + | ## Executable files | ||
| + | ## | ||
| + | |||
| + | # PE stands for Portable Executable - it's an executable file format used | ||
| + | # in all 32 and 64-bit versions of Windows operating systems. This option allows | ||
| + | # ClamAV to perform a deeper analysis of executable files and it's also | ||
| + | # required for decompression of popular executable packers such as UPX, FSG, | ||
| + | # and Petite. If you turn off this option, the original files will still be | ||
| + | # scanned, but without additional processing. | ||
| + | # Default: yes | ||
| + | ScanPE yes | ||
| + | |||
| + | # Executable and Linking Format is a standard format for UN*X executables. | ||
| + | # This option allows you to control the scanning of ELF files. | ||
| + | # If you turn off this option, the original files will still be scanned, but | ||
| + | # without additional processing. | ||
| + | # Default: yes | ||
| + | ScanELF yes | ||
| + | |||
| + | # With this option clamav will try to detect broken executables (both PE and | ||
| + | # ELF) and mark them as Broken.Executable. | ||
| + | # Default: no | ||
| + | DetectBrokenExecutables yes | ||
| + | |||
| + | |||
| + | ## | ||
| + | ## Documents | ||
| + | ## | ||
| + | |||
| + | # This option enables scanning of OLE2 files, such as Microsoft Office | ||
| + | # documents and .msi files. | ||
| + | # If you turn off this option, the original files will still be scanned, but | ||
| + | # without additional processing. | ||
| + | # Default: yes | ||
| + | ScanOLE2 yes | ||
| + | |||
| + | |||
| + | # With this option enabled OLE2 files with VBA macros, which were not | ||
| + | # detected by signatures will be marked as " | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # This option enables scanning within PDF files. | ||
| + | # If you turn off this option, the original files will still be scanned, but | ||
| + | # without decoding and additional processing. | ||
| + | # Default: yes | ||
| + | #ScanPDF yes | ||
| + | |||
| + | |||
| + | ## | ||
| + | ## Mail files | ||
| + | ## | ||
| + | |||
| + | # Enable internal e-mail scanner. | ||
| + | # If you turn off this option, the original files will still be scanned, but | ||
| + | # without parsing individual messages/ | ||
| + | # Default: yes | ||
| + | ScanMail yes | ||
| + | |||
| + | # Scan RFC1341 messages split over many emails. | ||
| + | # You will need to periodically clean up $TemporaryDirectory/ | ||
| + | # WARNING: This option may open your system to a DoS attack. | ||
| + | # Never use it on loaded servers. | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | |||
| + | # With this option enabled ClamAV will try to detect phishing attempts by using | ||
| + | # signatures. | ||
| + | # Default: yes | ||
| + | # | ||
| + | |||
| + | # Scan URLs found in mails for phishing attempts using heuristics. | ||
| + | # Default: yes | ||
| + | # | ||
| + | |||
| + | # Always block SSL mismatches in URLs, even if the URL isn't in the database. | ||
| + | # This can lead to false positives. | ||
| + | # | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # Always block cloaked URLs, even if URL isn't in database. | ||
| + | # This can lead to false positives. | ||
| + | # | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # Allow heuristic match to take precedence. | ||
| + | # When enabled, if a heuristic scan (such as phishingScan) detects | ||
| + | # a possible virus/phish it will stop scan immediately. Recommended, | ||
| + | # scan-time. | ||
| + | # When disabled, virus/phish detected by heuristic scans will be reported only at | ||
| + | # the end of a scan. If an archive contains both a heuristically detected | ||
| + | # virus/ | ||
| + | # | ||
| + | # Keep this disabled if you intend to handle " | ||
| + | # differently from " | ||
| + | # If a non-heuristically-detected virus (signature-based) is found first, | ||
| + | # the scan is interrupted immediately, | ||
| + | # | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | ## | ||
| + | ## Data Loss Prevention (DLP) | ||
| + | ## | ||
| + | |||
| + | # Enable the DLP module | ||
| + | # Default: No | ||
| + | # | ||
| + | |||
| + | # This option sets the lowest number of Credit Card numbers found in a file | ||
| + | # to generate a detect. | ||
| + | # Default: 3 | ||
| + | # | ||
| + | |||
| + | # This option sets the lowest number of Social Security Numbers found | ||
| + | # in a file to generate a detect. | ||
| + | # Default: 3 | ||
| + | # | ||
| + | |||
| + | # With this option enabled the DLP module will search for valid | ||
| + | # SSNs formatted as xxx-yy-zzzz | ||
| + | # Default: yes | ||
| + | # | ||
| + | |||
| + | # With this option enabled the DLP module will search for valid | ||
| + | # SSNs formatted as xxxyyzzzz | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | |||
| + | ## | ||
| + | ## HTML | ||
| + | ## | ||
| + | |||
| + | # Perform HTML normalisation and decryption of MS Script Encoder code. | ||
| + | # Default: yes | ||
| + | # If you turn off this option, the original files will still be scanned, but | ||
| + | # without additional processing. | ||
| + | #ScanHTML yes | ||
| + | |||
| + | |||
| + | ## | ||
| + | ## Archives | ||
| + | ## | ||
| + | |||
| + | # ClamAV can scan within archives and compressed files. | ||
| + | # If you turn off this option, the original files will still be scanned, but | ||
| + | # without unpacking and additional processing. | ||
| + | # Default: yes | ||
| + | ScanArchive yes | ||
| + | |||
| + | # Mark encrypted archives as viruses (Encrypted.Zip, | ||
| + | # Default: no | ||
| + | ArchiveBlockEncrypted no | ||
| + | |||
| + | |||
| + | ## | ||
| + | ## Limits | ||
| + | ## | ||
| + | |||
| + | # The options below protect your system against Denial of Service attacks | ||
| + | # using archive bombs. | ||
| + | |||
| + | # This option sets the maximum amount of data to be scanned for each input file. | ||
| + | # Archives and other containers are recursively extracted and scanned up to this | ||
| + | # value. | ||
| + | # Value of 0 disables the limit | ||
| + | # Note: disabling this limit or setting it too high may result in severe damage | ||
| + | # to the system. | ||
| + | # Default: 100M | ||
| + | # | ||
| + | |||
| + | # Files larger than this limit won't be scanned. Affects the input file itself | ||
| + | # as well as files contained inside it (when the input file is an archive, a | ||
| + | # document or some other kind of container). | ||
| + | # Value of 0 disables the limit. | ||
| + | # Note: disabling this limit or setting it too high may result in severe damage | ||
| + | # to the system. | ||
| + | # Default: 25M | ||
| + | # | ||
| + | |||
| + | # Nested archives are scanned recursively, | ||
| + | # file, all files within it will also be scanned. This options specifies how | ||
| + | # deeply the process should be continued. | ||
| + | # Note: setting this limit too high may result in severe damage to the system. | ||
| + | # Default: 16 | ||
| + | # | ||
| + | |||
| + | # Number of files to be scanned within an archive, a document, or any other | ||
| + | # container file. | ||
| + | # Value of 0 disables the limit. | ||
| + | # Note: disabling this limit or setting it too high may result in severe damage | ||
| + | # to the system. | ||
| + | # Default: 10000 | ||
| + | #MaxFiles 15000 | ||
| + | |||
| + | |||
| + | ## | ||
| + | ## Clamuko settings | ||
| + | ## | ||
| + | |||
| + | # Enable Clamuko. Dazuko must be configured and running. Clamuko supports | ||
| + | # both Dazuko (/ | ||
| + | # is the preferred option. For more information please visit www.dazuko.org | ||
| + | # Default: no | ||
| + | # | ||
| + | |||
| + | # The number of scanner threads that will be started (DazukoFS only). | ||
| + | # Having multiple scanner threads allows Clamuko to serve multiple | ||
| + | # processes simultaneously. This is particularly beneficial on SMP machines. | ||
| + | # Default: 3 | ||
| + | # | ||
| + | |||
| + | # Don't scan files larger than ClamukoMaxFileSize | ||
| + | # Value of 0 disables the limit. | ||
| + | # Default: 5M | ||
| + | # | ||
| + | |||
| + | # Set access mask for Clamuko (Dazuko only). | ||
| + | # Default: no | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set the include paths (all files inside them will be scanned). You can have | ||
| + | # multiple ClamukoIncludePath directives but each directory must be added | ||
| + | # in a seperate line. (Dazuko only) | ||
| + | # Default: disabled | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set the exclude paths. All subdirectories are also excluded. (Dazuko only) | ||
| + | # Default: disabled | ||
| + | # | ||
| + | |||
| + | # With this option you can whitelist specific UIDs. Processes with these UIDs | ||
| + | # will be able to access all files. | ||
| + | # This option can be used multiple times (one per line). | ||
| + | # Default: disabled | ||
| + | # | ||
| + | |||
| + | # With this option enabled ClamAV will load bytecode from the database. | ||
| + | # It is highly recommended you keep this option on, otherwise you'll miss detections for many new viruses. | ||
| + | # Default: yes | ||
| + | #Bytecode yes | ||
| + | |||
| + | # Set bytecode security level. | ||
| + | # Possible values: | ||
| + | # None - no security at all, meant for debugging. DO NOT USE THIS ON PRODUCTION SYSTEMS | ||
| + | # This value is only available if clamav was built with --enable-debug! | ||
| + | # | ||
| + | # insert runtime safety checks for bytecode loaded from other sources | ||
| + | # | ||
| + | # Recommended: | ||
| + | # Note that by default only signed bytecode is loaded, currently you can only | ||
| + | # load unsigned bytecode in --enable-debug mode. | ||
| + | # | ||
| + | # Default: TrustSigned | ||
| + | # | ||
| + | |||
| + | # Set bytecode timeout in miliseconds. | ||
| + | # | ||
| + | # Default: 5000 | ||
| + | # BytecodeTimeout 1000 | ||
| + | </ | ||
| + | Möchte man sich die gesamte Konfiguration ohne die vielen Kommentarzeilen anzeigen lassen, so kann man sich diese mit einem geschickten **egrep** ausgeben lassen. | ||
| + | # egrep -v ' | ||
| + | <code bash> | ||
| + | LogFileMaxSize 0 | ||
| + | LogTime yes | ||
| + | LogSyslog yes | ||
| + | PidFile / | ||
| + | TemporaryDirectory /var/tmp | ||
| + | DatabaseDirectory /var/clamav | ||
| + | LocalSocket / | ||
| + | FixStaleSocket yes | ||
| + | TCPSocket 3310 | ||
| + | TCPAddr 127.0.0.1 | ||
| + | MaxConnectionQueueLength 30 | ||
| + | MaxThreads 50 | ||
| + | ReadTimeout 300 | ||
| + | User clamav | ||
| + | AllowSupplementaryGroups yes | ||
| + | ScanPE yes | ||
| + | ScanELF yes | ||
| + | DetectBrokenExecutables yes | ||
| + | ScanOLE2 yes | ||
| + | ScanMail yes | ||
| + | ScanArchive yes | ||
| + | ArchiveBlockEncrypted no | ||
| + | </ | ||
| + | |||
| + | In der Konfigurationsdatei unseres **AMaViS**-Daemon finden wir folgenden Konfigurationshinweis für die Einbindung und Nutzung von **ClamAV**. | ||
| + | < | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # # NOTE: run clamd under the same user as amavisd, or run it under its own | ||
| + | # # uid such as clamav, add user clamav to the amavis group, and then add | ||
| + | # # | ||
| + | # # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in | ||
| + | # # this entry; when running chrooted one may prefer socket " | ||
| + | </ | ||
| + | |||
| + | Wir überpüfen also noch kurz, ob der User **clamav** bereits Mitglied der Gruppe **amavis** ist. | ||
| + | # grep amavis /etc/group | ||
| + | |||
| + | | ||
| + | |||
| + | In der Gruppe **amavis** befindet sich also nur ein Nutzer mit der ID **494**. Ein Blick in die ** /etc/passwd ** zeigt us wer dieser User ist. | ||
| + | # grep 494 /etc/passwd | ||
| + | |||
| + | | ||
| + | |||
| + | Dies ist also " | ||
| + | # usermod -a -G amavis clamav | ||
| + | |||
| + | Ein erneuter Blick zeigt uns nun, dass wie bei den Hinweisen in der ** / | ||
| + | # grep amavis /etc/group | ||
| + | |||
| + | | ||
| + | |||
| + | ==== freshclamd ==== | ||
| + | Damit [[http:// | ||
| + | |||
| + | In der Standardkonfiguration sorgt **freshclam** dafür, dass **1x am Tag** ein Update der Virenpattern-Datenbank vorgenommen wird. Bei Bedarf können wir den Updatezyklus unseren Erfordernissen anpassen und so z.B. alle Stunde überprüfen lassen ob neue Patternfiles vorhanden sind und diese dann auf unseren Rechner herunterzuladen und in die lokale Datenbak einfließen zu lassen. Hierbei stehen uns prinzipiell zwei Mechanismen zur Verfügung, die **crontab** und der **Daemon-Modus**. Beide Varianten könnten im System parallel genutzt werden - nachfolgend werden bei Möglichkeiten kurz beschrieben. | ||
| + | |||
| + | === Nutzung crontab === | ||
| + | Die erste und einfache Variante besteht darin das Update-Script, | ||
| + | Das Updatescript beinhaltet folgende Parameter und Aufrufe: | ||
| + | <file freshclam># | ||
| + | |||
| + | ### A simple update script for the clamav virus database. | ||
| + | ### This could as well be replaced by a SysV script. | ||
| + | |||
| + | ### fix log file if needed | ||
| + | LOG_FILE="/ | ||
| + | if [ ! -f " | ||
| + | touch " | ||
| + | chmod 644 " | ||
| + | chown clamav.clamav " | ||
| + | fi | ||
| + | |||
| + | / | ||
| + | --quiet \ | ||
| + | --datadir="/ | ||
| + | --log=" | ||
| + | --daemon-notify="/ | ||
| + | </ | ||
| + | |||
| + | Wir verschieben also das Script bei Bedarf nach // | ||
| + | # mv / | ||
| + | |||
| + | === Nutzung Daemon-Modus === | ||
| + | Die zuvor erwähnte zweite Möglichkeit zum Updaten der Virenpattern-Datenbank ist die Nutzung des **freshclam-Daemons**, | ||
| + | |||
| + | == Startscript == | ||
| + | Da bei unserer Installation kein passendes Init-V-Script mitgeliefert wurde legen wir uns ein eigenes Startscript an. | ||
| + | # vim / | ||
| + | <file bash freshclamd> | ||
| + | #!/bin/sh | ||
| + | # | ||
| + | # freshclamd | ||
| + | # | ||
| + | # chkconfig: - 62 38 | ||
| + | # description: | ||
| + | # | ||
| + | # processname: | ||
| + | # config: / | ||
| + | # pidfile: / | ||
| + | |||
| + | # Source function library | ||
| + | . / | ||
| + | |||
| + | # Get network config | ||
| + | . / | ||
| + | |||
| + | test -f / | ||
| + | |||
| + | RETVAL=0 | ||
| + | DATA_DIR="/ | ||
| + | CLAMD_CONF_FILE="/ | ||
| + | LOG_FILE="/ | ||
| + | |||
| + | if [ ! -f " | ||
| + | touch " | ||
| + | chmod 644 " | ||
| + | chown clamav.clamav " | ||
| + | fi | ||
| + | |||
| + | start() { | ||
| + | echo -n $" | ||
| + | # Start me up! | ||
| + | # | ||
| + | # | ||
| + | daemon / | ||
| + | -c 48 \ | ||
| + | --quiet \ | ||
| + | --datadir=" | ||
| + | --daemon-notify=" | ||
| + | RETVAL=$? | ||
| + | echo | ||
| + | [ $RETVAL -eq 0 ] && touch / | ||
| + | return $RETVAL | ||
| + | } | ||
| + | |||
| + | stop() { | ||
| + | echo -n $" | ||
| + | killproc freshclam | ||
| + | RETVAL=$? | ||
| + | echo | ||
| + | [ $RETVAL -eq 0 ] && rm -f / | ||
| + | return $RETVAL | ||
| + | } | ||
| + | |||
| + | restart() { | ||
| + | stop | ||
| + | start | ||
| + | } | ||
| + | |||
| + | reload() { | ||
| + | echo -n $" | ||
| + | killproc freshclam -ALRM | ||
| + | RETVAL=$? | ||
| + | echo | ||
| + | return $RETVAL | ||
| + | } | ||
| + | |||
| + | |||
| + | case " | ||
| + | start) | ||
| + | start | ||
| + | ;; | ||
| + | stop) | ||
| + | stop | ||
| + | ;; | ||
| + | status) | ||
| + | status freshclam | ||
| + | ;; | ||
| + | restart) | ||
| + | restart | ||
| + | ;; | ||
| + | condrestart) | ||
| + | [ -f / | ||
| + | ;; | ||
| + | reload) | ||
| + | reload | ||
| + | ;; | ||
| + | *) | ||
| + | echo $" | ||
| + | exit 1 | ||
| + | esac | ||
| + | |||
| + | exit $? | ||
| + | </ | ||
| + | Anschließend passen wir noch die Dateirechte an: | ||
| + | # chmod +x / | ||
| + | |||
| + | == Konfiguration == | ||
| + | Wir passen nun in der Konfigurationsdatei ** // / | ||
| + | <code bash># vim / | ||
| + | |||
| + | ... | ||
| + | # Number of database checks per day. | ||
| + | # Default: 12 (every two hours) | ||
| + | # Django 2009-05-17 für halbstündlichen Virenpatterndatenbankcheck | ||
| + | Checks 48 | ||
| + | ... | ||
| + | </ | ||
| + | ==== amavisd ==== | ||
| + | Die Konfiguration unseres AV-Scanners [[http:// | ||
| + | # vim / | ||
| + | |||
| + | Die Pfadangaben passen wir unseren Gegebenheiten an: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Ebenso: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Für den ersten Programmstart drehen wir den Loglevel auf den Wert **3**, den wir im späteren Produktivbetrieb dann auf **2** herabsetzen können. Somit erhalten wir in der Anfangsphase wertvolle und ausreichende Hinweise, falls etwas nicht wie geplant laufen sollte. | ||
| + | | ||
| + | |||
| + | Da wir uns weder mit **Viren**, noch mit **Spam** oder den **unerwünschten Dateianhängen** herumschlagen wollen, weisen wir AMaViS an, diese Nachrichten über den Mailserver direkt ablehnt. | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Da wir AMaViS in erster Linie in der dämonisierten Variante und als Fallback als Backup-Scanner verwenden wollen, | ||
| + | |||
| + | <WRAP round important> | ||
| + | Die Pfadangaben des **Socket** müssen zu den Angaben in der vorweg beschriebenen **/ | ||
| + | </ | ||
| + | |||
| + | <code bash># ### http:// | ||
| + | # Django : 2012-05-21 | ||
| + | # ClamAV in der daemonisierten Variante aktiviert | ||
| + | # default: unset | ||
| + | # [' | ||
| + | # \& | ||
| + | # qr/\bOK$/m, qr/ | ||
| + | # qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ], | ||
| + | [' | ||
| + | \& | ||
| + | qr/\bOK$/m, qr/ | ||
| + | qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ], | ||
| + | # # NOTE: run clamd under the same user as amavisd, or run it under its own | ||
| + | # # uid such as clamav, add user clamav to the amavis group, and then add | ||
| + | # # | ||
| + | # # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in | ||
| + | # # this entry; when running chrooted one may prefer socket " | ||
| + | </ | ||
| + | |||
| + | <WRAP round tip> | ||
| + | </ | ||
| + | |||
| + | Die komplette AMaViS-Konfiguration lautet demnach nunmehr. | ||
| + | # less / | ||
| + | <file perl / | ||
| + | |||
| + | # a minimalistic configuration file for amavisd-new with all necessary settings | ||
| + | # | ||
| + | # see amavisd.conf-default for a list of all variables with their defaults; | ||
| + | # see amavisd.conf-sample for a traditional-style commented file; | ||
| + | # for more details see documentation in INSTALL, README_FILES/ | ||
| + | # and at http:// | ||
| + | |||
| + | |||
| + | # COMMONLY ADJUSTED SETTINGS: | ||
| + | |||
| + | # @bypass_virus_checks_maps = (1); # controls running of anti-virus code | ||
| + | # @bypass_spam_checks_maps | ||
| + | # $bypass_decode_parts = 1; # controls running of decoders& | ||
| + | |||
| + | $max_servers = 2; # num of pre-forked children (2..30 is common), -m | ||
| + | $daemon_user | ||
| + | $daemon_group = " | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: $mydomain = ' | ||
| + | $mydomain = ' | ||
| + | |||
| + | # Django : 2012-06-25 "by localhost" | ||
| + | # default: unset | ||
| + | $localhost_name = ""; | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: unset | ||
| + | $MYHOME = '/ | ||
| + | $TEMPBASE = " | ||
| + | $ENV{TMPDIR} = $TEMPBASE; | ||
| + | $QUARANTINEDIR = "/ | ||
| + | # $quarantine_subdir_levels = 1; # add level of subdirs to disperse quarantine | ||
| + | # $release_format = ' | ||
| + | # $report_format | ||
| + | |||
| + | # $daemon_chroot_dir = $MYHOME; | ||
| + | |||
| + | $db_home | ||
| + | # Django : 2012-05-21 | ||
| + | # default: unset | ||
| + | $helpers_home = " | ||
| + | # Django : 2012-05-21 | ||
| + | # default: unset | ||
| + | $lock_file = " | ||
| + | # Django : 2012-05-21 | ||
| + | # default: unset | ||
| + | $pid_file | ||
| + | #NOTE: create directories $MYHOME/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: $log_level = 0; | ||
| + | $log_level = 3; # verbosity 0..5, -d | ||
| + | $log_recip_templ = undef; | ||
| + | $DO_SYSLOG = 1; # log via syslogd (preferred) | ||
| + | $syslog_facility = ' | ||
| + | # e.g.: mail, daemon, user, local0, ... local7 | ||
| + | $syslog_priority = ' | ||
| + | # choose from: emerg, alert, crit, err, warning, notice, info, debug | ||
| + | |||
| + | $enable_db = 1; # enable use of BerkeleyDB/ | ||
| + | $enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1 | ||
| + | $nanny_details_level = 2; # nanny verbosity: 1: traditional, | ||
| + | $enable_dkim_verification = 1; # enable DKIM signatures verification | ||
| + | $enable_dkim_signing = 1; # load DKIM signing code, keys defined by dkim_key | ||
| + | |||
| + | @local_domains_maps = ( [" | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # @mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10 | ||
| + | # | ||
| + | @mynetworks = qw( 127.0.0.0/8 10.0.0.0/24 ); | ||
| + | |||
| + | $unix_socketname = " | ||
| + | # option(s) -p overrides $inet_socket_port and $unix_socketname | ||
| + | |||
| + | $inet_socket_port = 10024; | ||
| + | # $inet_socket_port = [10024, | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: unset # listening only on localhost | ||
| + | $inet_socket_bind = ' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: @inet_acl = qw( 127.0.0.1 ::1 ); | ||
| + | @inet_acl = qw( 127.0.0.1 10.0.0.80/ | ||
| + | |||
| + | $policy_bank{' | ||
| + | originating => 1, # is true in MYNETS by default, but let's make it explicit | ||
| + | os_fingerprint_method => undef, | ||
| + | }; | ||
| + | |||
| + | # it is up to MTA to re-route mail from authenticated roaming users or | ||
| + | # from internal hosts to a dedicated TCP port (such as 10026) for filtering | ||
| + | $interface_policy{' | ||
| + | |||
| + | $policy_bank{' | ||
| + | originating => 1, # declare that mail was submitted by our smtp client | ||
| + | allow_disclaimers => 1, # enables disclaimer insertion if available | ||
| + | # notify administrator of locally originating malware | ||
| + | virus_admin_maps => [" | ||
| + | spam_admin_maps | ||
| + | warnbadhsender | ||
| + | # forward to a smtpd service providing DKIM signing service | ||
| + | forward_method => ' | ||
| + | # force MTA conversion to 7-bit (e.g. before DKIM signing) | ||
| + | smtpd_discard_ehlo_keywords => [' | ||
| + | bypass_banned_checks_maps => [1], # allow sending any file names and types | ||
| + | terminate_dsn_on_notify_success => 0, # don't remove NOTIFY=SUCCESS option | ||
| + | }; | ||
| + | |||
| + | $interface_policy{' | ||
| + | |||
| + | # Use with amavis-release over a socket or with Petr Rehor' | ||
| + | # (with amavis-milter.c from this package or old amavis.c client use ' | ||
| + | $policy_bank{' | ||
| + | protocol => ' | ||
| + | auth_required_release => 0, # do not require secret_id for amavisd-release | ||
| + | }; | ||
| + | |||
| + | $sa_tag_level_deflt | ||
| + | # Django : 2012-05-21 | ||
| + | # default: $sa_tag2_level_deflt = 6.2; | ||
| + | $sa_tag2_level_deflt = 6.31; # add 'spam detected' | ||
| + | # Django : 2012-05-21 | ||
| + | # default: $sa_kill_level_deflt = 6.9; | ||
| + | $sa_kill_level_deflt = 6.31; # triggers spam evasive actions (e.g. blocks mail) | ||
| + | $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent | ||
| + | $sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From | ||
| + | # $sa_quarantine_cutoff_level = 25; # spam level beyond which quarantine is off | ||
| + | $penpals_bonus_score = 8; # (no effect without a @storage_sql_dsn database) | ||
| + | $penpals_threshold_high = $sa_kill_level_deflt; | ||
| + | $bounce_killer_score = 100; # spam score points to add for joe-jobbed bounces | ||
| + | |||
| + | $sa_mail_body_size_limit = 400*1024; # don't waste time on SA if mail is larger | ||
| + | $sa_local_tests_only = 0; # only tests which do not require internet access? | ||
| + | |||
| + | # @lookup_sql_dsn = | ||
| + | # ( [' | ||
| + | # | ||
| + | # | ||
| + | # @storage_sql_dsn = @lookup_sql_dsn; | ||
| + | |||
| + | # $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP; | ||
| + | # | ||
| + | |||
| + | $virus_admin | ||
| + | |||
| + | $mailfrom_notify_admin | ||
| + | $mailfrom_notify_recip | ||
| + | $mailfrom_notify_spamadmin = " | ||
| + | $mailfrom_to_quarantine = ''; | ||
| + | |||
| + | @addr_extension_virus_maps | ||
| + | @addr_extension_banned_maps | ||
| + | @addr_extension_spam_maps | ||
| + | @addr_extension_bad_header_maps = (' | ||
| + | # $recipient_delimiter = ' | ||
| + | # when enabling addr extensions do also Postfix/ | ||
| + | |||
| + | $path = '/ | ||
| + | # $dspam = ' | ||
| + | |||
| + | $MAXLEVELS = 14; | ||
| + | $MAXFILES = 1500; | ||
| + | $MIN_EXPANSION_QUOTA = 100*1024; | ||
| + | $MAX_EXPANSION_QUOTA = 300*1024*1024; | ||
| + | |||
| + | $sa_spam_subject_tag = ' | ||
| + | $defang_virus | ||
| + | $defang_banned = 1; # MIME-wrap passed mail containing banned name | ||
| + | # for defanging bad headers only turn on certain minor contents categories: | ||
| + | $defang_by_ccat{+CC_BADH.", | ||
| + | $defang_by_ccat{+CC_BADH.", | ||
| + | $defang_by_ccat{+CC_BADH.", | ||
| + | |||
| + | |||
| + | # OTHER MORE COMMON SETTINGS (defaults may suffice): | ||
| + | |||
| + | # Django : 2010-05-21 | ||
| + | # default: unset | ||
| + | $myhostname = ' | ||
| + | |||
| + | # Django : 2010-05-21 | ||
| + | # default: # $notify_method | ||
| + | $notify_method | ||
| + | # Django : 2010-05-21 | ||
| + | # default: # $forward_method = ' | ||
| + | $forward_method = ' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # default: unset | ||
| + | $final_virus_destiny | ||
| + | # Django : 2012-05-21 | ||
| + | # default: unset | ||
| + | $final_banned_destiny | ||
| + | # Django : 2012-05-21 | ||
| + | # default: unset | ||
| + | $final_spam_destiny | ||
| + | # $final_bad_header_destiny = D_PASS; | ||
| + | # $bad_header_quarantine_method = undef; | ||
| + | |||
| + | # $os_fingerprint_method = ' | ||
| + | |||
| + | ## hierarchy by which a final setting is chosen: | ||
| + | ## | ||
| + | ## | ||
| + | ## | ||
| + | |||
| + | |||
| + | # SOME OTHER VARIABLES WORTH CONSIDERING (see amavisd.conf-default for all) | ||
| + | |||
| + | # $warnbadhsender, | ||
| + | # $warnvirusrecip, | ||
| + | # | ||
| + | # @bypass_virus_checks_maps, | ||
| + | # @bypass_banned_checks_maps, | ||
| + | # | ||
| + | # @virus_lovers_maps, | ||
| + | # @banned_files_lovers_maps, | ||
| + | # | ||
| + | # @blacklist_sender_maps, | ||
| + | # | ||
| + | # $clean_quarantine_method, | ||
| + | # $bad_header_quarantine_to, | ||
| + | # | ||
| + | # $defang_bad_header, | ||
| + | |||
| + | |||
| + | # REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS | ||
| + | |||
| + | @keep_decoded_original_maps = (new_RE( | ||
| + | qr' | ||
| + | qr' | ||
| + | qr' | ||
| + | # qr' | ||
| + | )); | ||
| + | |||
| + | |||
| + | # for $banned_namepath_re (a new-style of banned table) see amavisd.conf-sample | ||
| + | |||
| + | $banned_filename_re = new_RE( | ||
| + | |||
| + | ### BLOCKED ANYWHERE | ||
| + | # qr' | ||
| + | qr' | ||
| + | # qr' | ||
| + | |||
| + | ### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES: | ||
| + | # [ qr' | ||
| + | [ qr' | ||
| + | |||
| + | qr' | ||
| + | # qr' | ||
| + | |||
| + | ### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES: | ||
| + | # [ qr' | ||
| + | |||
| + | qr' | ||
| + | qr' | ||
| + | qr' | ||
| + | |||
| + | # qr' | ||
| + | # qr' | ||
| + | |||
| + | # qr' | ||
| + | # qr' | ||
| + | |||
| + | # block certain double extensions in filenames | ||
| + | qr' | ||
| + | |||
| + | # qr' | ||
| + | # qr' | ||
| + | |||
| + | qr' | ||
| + | # qr' | ||
| + | # qr' | ||
| + | # inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst| | ||
| + | # ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs| | ||
| + | # wmf|wsc|wsf|wsh)$' | ||
| + | # qr' | ||
| + | # qr' | ||
| + | |||
| + | # qr' | ||
| + | ); | ||
| + | # See http:// | ||
| + | # and http:// | ||
| + | |||
| + | |||
| + | # ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING | ||
| + | |||
| + | @score_sender_maps = ({ # a by-recipient hash lookup table, | ||
| + | # results from all matching recipient tables are summed | ||
| + | |||
| + | # ## per-recipient personal tables | ||
| + | # ' | ||
| + | # ' | ||
| + | # ' | ||
| + | # ' | ||
| + | |||
| + | ## site-wide opinions about senders (the ' | ||
| + | ' | ||
| + | |||
| + | | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | [qr' | ||
| + | ), | ||
| + | |||
| + | # read_hash("/ | ||
| + | |||
| + | { # a hash-type lookup table (associative array) | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | | ||
| + | | ||
| + | |||
| + | # soft-blacklisting (positive score) | ||
| + | ' | ||
| + | ' | ||
| + | |||
| + | }, | ||
| + | ], # end of site-wide tables | ||
| + | }); | ||
| + | |||
| + | |||
| + | @decoders = ( | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | # [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | # [' | ||
| + | [' | ||
| + | [' | ||
| + | [' | ||
| + | # [' | ||
| + | [' | ||
| + | ); | ||
| + | |||
| + | |||
| + | @av_scanners = ( | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | |||
| + | # ### http:// | ||
| + | # Django : 2012-05-21 | ||
| + | # ClamAV in der daemonisierten Variante aktiviert | ||
| + | # default: unset | ||
| + | # [' | ||
| + | # \& | ||
| + | # qr/\bOK$/m, qr/ | ||
| + | # qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ], | ||
| + | [' | ||
| + | \& | ||
| + | qr/\bOK$/m, qr/ | ||
| + | qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ], | ||
| + | # # NOTE: run clamd under the same user as amavisd, or run it under its own | ||
| + | # # uid such as clamav, add user clamav to the amavis group, and then add | ||
| + | # # | ||
| + | # # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in | ||
| + | # # this entry; when running chrooted one may prefer socket " | ||
| + | |||
| + | # ### http:// | ||
| + | # # note that Mail:: | ||
| + | # [' | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # ['AVG Anti-Virus', | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # ' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # pack(' | ||
| + | # pack(' | ||
| + | # length(" | ||
| + | # ' | ||
| + | # pack(' | ||
| + | # pack(' | ||
| + | # '/ | ||
| + | # # '/ | ||
| + | # # '/ | ||
| + | # # ' | ||
| + | # ], | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # ], | ||
| + | # # NOTE: If using amavis-milter, | ||
| + | # # length(" | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ['/ | ||
| + | # '/ | ||
| + | # '-p / | ||
| + | # [0,3,6,8], qr/ | ||
| + | # qr/ | ||
| + | # ], | ||
| + | # # NOTE: one may prefer [0], | ||
| + | # # currupted or protected archives are to be handled | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '-* -P -B -Y -O- {}', [0,3,6,8], [2, | ||
| + | # qr/ | ||
| + | # sub {chdir('/ | ||
| + | # sub {chdir($TEMPBASE) or die " | ||
| + | # ], | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### The kavdaemon and AVPDaemonClient have been removed from Kasperky | ||
| + | # ### products and replaced by aveserver and aveclient | ||
| + | # [' | ||
| + | # [ '/ | ||
| + | # '/ | ||
| + | # '/ | ||
| + | # '/ | ||
| + | # " | ||
| + | # # change the startup-script in / | ||
| + | # # | ||
| + | # # (or perhaps: | ||
| + | # # adjusting /var/amavis above to match your $TEMPBASE. | ||
| + | # # The ' | ||
| + | # # can find, read, and write its pid file, etc., see 'man kavdaemon' | ||
| + | # # defUnix.prf: | ||
| + | # # | ||
| + | # # cd / | ||
| + | # # cp AvpDaemonClient /opt/AVP/ | ||
| + | # # su - vscan -c " | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # [' | ||
| + | # "-a s --timeout=60 --temp=$TEMPBASE -y $QUARANTINEDIR ". | ||
| + | # " | ||
| + | # [0,3], [1,2,5], | ||
| + | # qr/(?x)^\s* (?: | ||
| + | # # Adjust the path of the binary and the virus database as needed. | ||
| + | # # ' | ||
| + | # # the quarantine directory, and the quarantine option can not be disabled. | ||
| + | # # If $QUARANTINEDIR is not used, then another directory must be specified | ||
| + | # # to appease ' | ||
| + | # # protected files are to be considered infected. | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # ### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira Antivirus | ||
| + | # [' | ||
| + | # ' | ||
| + | # qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) | | ||
| + | # (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s' | ||
| + | # # NOTE: if you only have a demo version, remove -z and add 214, as in: | ||
| + | # # ' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '-all -archive -packed {}', [50], [51,52,53], | ||
| + | # qr/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # qr/^Files Infected: | ||
| + | # qr/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # [0], qr/ | ||
| + | # qr/ | ||
| + | # # NOTE: check options and patterns to see which entry better applies | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # ' | ||
| + | # ' | ||
| + | # | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # | ||
| + | # ['/ | ||
| + | # ' | ||
| + | # ' | ||
| + | # qr/ | ||
| + | # # NOTE: internal archive handling may be switched off by ' | ||
| + | # # to prevent fsav from exiting with status 9 on broken archives | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ['CAI InoculateIT', | ||
| + | # '-sec -nex {}', [0], [100], | ||
| + | # qr/was infected by virus (.+)/m ], | ||
| + | # # see: http:// | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # ['CAI eTrust Antivirus', | ||
| + | # '-arc -nex -spm h {}', [0], [101], | ||
| + | # qr/is infected by virus: (.+)/m ], | ||
| + | # # NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer | ||
| + | # # see http:// | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '-s {}/*', [0], [1,2], | ||
| + | # qr/--[ \t]*(.+)/m ], | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '-s -q {}', [0], [1..7], | ||
| + | # qr/^... (\S+)/m ], | ||
| + | |||
| + | # ### http:// | ||
| + | # ['ESET NOD32 for Linux Mail servers', | ||
| + | # | ||
| + | # ' | ||
| + | # '-w -a --action-on-infected=accept --action-on-uncleanable=accept '. | ||
| + | # ' | ||
| + | # | ||
| + | |||
| + | # ### http:// | ||
| + | # ['ESET NOD32 Linux Mail Server - command line interface', | ||
| + | # | ||
| + | # ' | ||
| + | |||
| + | # ### http:// | ||
| + | # ['ESET Software ESETS Command Line Interface', | ||
| + | # | ||
| + | # ' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # ['ESET Software ESETS Command Line Interface', | ||
| + | # ['/ | ||
| + | # ' | ||
| + | # qr/: | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ## http:// | ||
| + | # ['ESET NOD32 for Linux File servers', | ||
| + | # ['/ | ||
| + | # ' | ||
| + | # '-w -a --action=1 -b {}', | ||
| + | # [0], [1,10], qr/ | ||
| + | |||
| + | # Experimental, | ||
| + | # ['ESET Software NOD32 Client/ | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '-c -l:0 -s -u -temp: | ||
| + | # qr/(?i).* virus in .* -> \' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ['/ | ||
| + | # '-auto -aex -heu -cmp -nbr -nor -nos -eng -nob {}', | ||
| + | # qr/Number of files infected[ .]*: 0+(?!\d)/m, | ||
| + | # qr/Number of files infected[ .]*: 0*[1-9]/m, | ||
| + | # qr/Found virus :\s*(\S+)/m ], | ||
| + | # # NOTE: for efficiency, start the Panda in resident mode with 'pavcl -tsr' | ||
| + | # # before starting amavisd - the bases are then loaded only once at startup. | ||
| + | # # To reload bases in a signature update script: | ||
| + | # # / | ||
| + | # # Please review other options of pavcl, for example: | ||
| + | # # -nomalw, -nojoke, -nodial, -nohackt, -nospyw, -nocookies | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # [0], [0x10, 0x30, 0x50, 0x70, 0x90, 0xB0, 0xD0, 0xF0], | ||
| + | # | ||
| + | |||
| + | # GeCAD AV technology is acquired by Microsoft; RAV has been discontinued. | ||
| + | # Check your RAV license terms before fiddling with the following two lines! | ||
| + | # [' | ||
| + | # ' | ||
| + | # # NOTE: the command line switches changed with scan engine 8.5 ! | ||
| + | # # (btw, assigning stdin to /dev/null causes RAV to fail) | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # ['NAI McAfee AntiVirus (uvscan)', | ||
| + | # ' | ||
| + | # qr/(?x) Found (?: | ||
| + | # \ the\ (.+)\ (?: | ||
| + | # \ (?: | ||
| + | # :\ (.+)\ NOT\ a\ virus)/m, | ||
| + | # # sub {$ENV{LD_PRELOAD}='/ | ||
| + | # # sub {delete $ENV{LD_PRELOAD}}, | ||
| + | # ], | ||
| + | # # NOTE1: with RH9: force the dynamic linker to look at / | ||
| + | # # anything else by setting environment variable LD_PRELOAD=/ | ||
| + | # # and then clear it when finished to avoid confusing anything else. | ||
| + | # # NOTE2: to treat encrypted files as viruses replace the [13] with: | ||
| + | # # qr/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # "{} -ss -i ' | ||
| + | # qr/: ' | ||
| + | # # VirusBuster Ltd. does not support the daemon version for the workstation | ||
| + | # # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of | ||
| + | # # binaries, some parameters AND return codes have changed (from 3 to 1). | ||
| + | # # See also the new Vexira entry ' | ||
| + | |||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # | ||
| + | # # HINT: for an infected file it always returns 3, | ||
| + | # # although the man-page tells a different story | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # # sub {$ENV{VSTK_HOME}='/ | ||
| + | # ], | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '-a -i -n -t=A {}', [0], [1], qr/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # qr/ | ||
| + | # qr/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '--arc --mail {}', qr/ | ||
| + | # qr/ | ||
| + | # qr/ | ||
| + | # # consider also: --all --nowarn --alev=15 --flev=15. | ||
| + | # # not apply to your version of bdc, check documentation and see 'bdc --help' | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### ArcaVir for Linux and Unix http:// | ||
| + | # [' | ||
| + | # '-v 1 -summary 0 -s {}', [0], [1,2], | ||
| + | # qr/ | ||
| + | |||
| + | # ### a generic SMTP-client interface to a SMTP-based virus scanner | ||
| + | # [' | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # [' | ||
| + | # use File::Scan; my($fn)=@_; | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # : ($vname ne '' | ||
| + | # | ||
| + | |||
| + | # ### fully-fledged checker for JPEG marker segments of invalid length | ||
| + | # [' | ||
| + | # sub { use JpegTester (); Amavis:: | ||
| + | # | ||
| + | # # NOTE: place file JpegTester.pm somewhere where Perl can find it, | ||
| + | # # for example in / | ||
| + | |||
| + | ); | ||
| + | |||
| + | |||
| + | @av_scanners_backup = ( | ||
| + | |||
| + | ### http:// | ||
| + | [' | ||
| + | " | ||
| + | [0], qr/: | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # [0, | ||
| + | # qr/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '-dumb -archive -packed {}', [0,8], [3, | ||
| + | # qr/ | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # '-za -a {}', [0], qr/Found virus/m, qr/Found virus (.+) in/m ], | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ['/ | ||
| + | # ' | ||
| + | # [0,32], [1,9,33], qr' infected (?: | ||
| + | |||
| + | # Django : 2012-05-21 | ||
| + | # Eintrag deaktiviert | ||
| + | # ### http:// | ||
| + | # | ||
| + | # | ||
| + | # '/ | ||
| + | # '/ | ||
| + | # ' | ||
| + | # | ||
| + | ## sub {chdir('/ | ||
| + | ## sub {chdir($TEMPBASE) or die " | ||
| + | # ], | ||
| + | |||
| + | # Commented out because the name ' | ||
| + | # package/ | ||
| + | # in the path when enabling. | ||
| + | # | ||
| + | # ### http:// | ||
| + | # [' | ||
| + | # ' | ||
| + | # ' | ||
| + | # | ||
| + | # | ||
| + | # ], | ||
| + | # # other options to consider: -idedir=/ | ||
| + | |||
| + | # Always succeeds and considers mail clean. | ||
| + | # Potentially useful when all other scanners fail and it is desirable | ||
| + | # to let mail continue to flow with no virus checking (when uncommented). | ||
| + | # [' | ||
| + | |||
| + | ); | ||
| + | |||
| + | |||
| + | 1; # insure a defined return value | ||
| + | </ | ||
| + | |||
| + | ===== erster Programmstart ===== | ||
| + | |||
| + | ==== clamd ==== | ||
| + | Nun starten wir unseren ClamAV-Daemon das erste mal. | ||
| + | # service clamd start | ||
| + | |||
| + | | ||
| + | |||
| + | Im Logfile ** / | ||
| + | # less / | ||
| + | |||
| + | < | ||
| + | Mon Jun 11 12:08:26 2012 -> clamd daemon 0.97.4 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) | ||
| + | Mon Jun 11 12:08:26 2012 -> Running as user clamav (UID 496, GID 493) | ||
| + | Mon Jun 11 12:08:26 2012 -> Log file size limited to -1 bytes. | ||
| + | Mon Jun 11 12:08:26 2012 -> Reading databases from /var/clamav | ||
| + | Mon Jun 11 12:08:26 2012 -> Not loading PUA signatures. | ||
| + | Mon Jun 11 12:08:26 2012 -> Bytecode: Security mode set to " | ||
| + | Mon Jun 11 12:08:30 2012 -> Loaded 1256207 signatures. | ||
| + | Mon Jun 11 12:08:30 2012 -> TCP: Bound to address 127.0.0.1 on port 3310 | ||
| + | Mon Jun 11 12:08:30 2012 -> TCP: Setting connection queue length to 30 | ||
| + | Mon Jun 11 12:08:30 2012 -> LOCAL: Unix socket file / | ||
| + | Mon Jun 11 12:08:30 2012 -> LOCAL: Setting connection queue length to 30 | ||
| + | Mon Jun 11 12:08:30 2012 -> Limits: Global size limit set to 104857600 bytes. | ||
| + | Mon Jun 11 12:08:30 2012 -> Limits: File size limit set to 26214400 bytes. | ||
| + | Mon Jun 11 12:08:30 2012 -> Limits: Recursion level limit set to 16. | ||
| + | Mon Jun 11 12:08:30 2012 -> Limits: Files limit set to 10000. | ||
| + | Mon Jun 11 12:08:30 2012 -> Archive support enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> Algorithmic detection enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> Portable Executable support enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> ELF support enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> Detection of broken executables enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> Mail files support enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> OLE2 support enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> PDF support enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> HTML support enabled. | ||
| + | Mon Jun 11 12:08:30 2012 -> Self checking every 600 seconds. | ||
| + | Mon Jun 11 12:08:39 2012 -> Pid file removed. | ||
| + | </ | ||
| + | |||
| + | ==== freshclamd ==== | ||
| + | Unseren Updatemechanismus **freshclam-daemon** starten wir wie gewohnt mit: | ||
| + | # service freshclamd start | ||
| + | |||
| + | | ||
| + | |||
| + | Im Logfile // ** / | ||
| + | # less / | ||
| + | |||
| + | < | ||
| + | ClamAV update process started at Mon Jun 11 12:32:48 2012 | ||
| + | main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven) | ||
| + | Downloading daily-15026.cdiff [100%] | ||
| + | Downloading daily-15027.cdiff [100%] | ||
| + | daily.cld updated (version: 15027, sigs: 217122, f-level: 63, builder: ccordes) | ||
| + | bytecode.cvd is up to date (version: 185, sigs: 39, f-level: 63, builder: neo) | ||
| + | Database updated (1261548 signatures) from db.de.clamav.net (IP: 212.1.60.18) | ||
| + | WARNING: Clamd was NOT notified: Can't connect to clamd through / | ||
| + | -------------------------------------- | ||
| + | </ | ||
| + | |||
| + | Die Meldung | ||
| + | **WARNING: Clamd was NOT notified: Can't connect to clamd through / | ||
| + | |||
| + | Daher starten wir nun auch den ClamAV-Daemon erneut an. | ||
| + | # service clamd start | ||
| + | |||
| + | | ||
| + | |||
| + | Starten wir nun unseren freshclam-Daemon einmal durch und kontrollieren anschließend dessen logfile. | ||
| + | # service freshclamd restart | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | Ein Blick in das Logfile des freshclam-Daemon zeigt nun, keine entsprechende Fehlermeldung mehr! | ||
| + | # less / | ||
| + | |||
| + | < | ||
| + | freshclam daemon 0.97.4 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) | ||
| + | ClamAV update process started at Mon Jun 11 12:39:25 2012 | ||
| + | main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven) | ||
| + | daily.cld is up to date (version: 15027, sigs: 217122, f-level: 63, builder: ccordes) | ||
| + | bytecode.cvd is up to date (version: 185, sigs: 39, f-level: 63, builder: neo) | ||
| + | </ | ||
| + | ==== amavisd ==== | ||
| + | Zum Aktivieren der [[centos: | ||
| + | # service amavisd restart | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | Der Start wird im Maillogfile entsprechend protokolliert. | ||
| + | < | ||
| + | Jun 11 13:21:43 vml000060 amavis[18664]: | ||
| + | Jun 11 13:21:43 vml000060 amavis[18664]: | ||
| + | Jun 11 13:21:43 vml000060 amavis[18664]: | ||
| + | Jun 11 13:21:43 vml000060 amavis[18664]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18664]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18664]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:44 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:46 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:46 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:46 vml000060 amavis[18665]: | ||
| + | Jun 11 13:21:46 vml000060 amavis[18679]: | ||
| + | Jun 11 13:21:46 vml000060 amavis[18680]: | ||
| + | </ | ||
| + | ===== automatisches Starten der Dienste beim Systemstart ===== | ||
| + | |||
| + | ==== clamd ==== | ||
| + | Damit nun unser clamav-daemon beim Booten automatisch gestartet wird, nehmen wir noch folgende Konfigurationsschritte vor. | ||
| + | # chkconfig clamd on | ||
| + | Anschließend überprüfen wir noch unsere Änderung: | ||
| + | # chkconfig --list | grep clamd | ||
| + | |||
| + | | ||
| + | |||
| + | ==== freshclamd ==== | ||
| + | Damit nun auch unser freshclamd beim Booten automatisch gestartet wird, nehmen wir noch folgende Konfigurationsschritte vor. | ||
| + | # chkconfig freshclamd on | ||
| + | Anschließend überprüfen wir noch unsere Änderung: | ||
| + | # chkconfig --list | grep freshclamd | ||
| + | |||
| + | | ||
| + | |||
| + | |||
| + | ==== amavisd ==== | ||
| + | Bei unserem Frontend **AMaViS** muss keinerlei Änderung vorgenommen werden, haben wir die nötige [[centos: | ||
| + | ===== Test (eicar) ===== | ||
| + | Zum Testen schicken wir eine eMail an einen Empfänger und hängen im Anhang einfach mal einen [[http:// | ||
| + | |||
| + | Der Versuch scheitert natürlich kläglich und dem einliefernden Mailclient wird auch promt der Grund angegeben, warum die Nachricht nicht angenommern werden konnte. | ||
| + | |||
| + | < | ||
| + | The mail server responded: | ||
| + | Please check the message and try again. | ||
| + | </ | ||
| + | |||
| + | Im Maillog unseres AMaViS-Hosts wird der erfolglose Versuch der Einlieferung der eAmil mit dem Eicar-Textpattern im Anhang entsprechend protokolliert. | ||
| + | # less / | ||
| + | |||
| + | < | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | Jun 11 16:48:13 vml000060 amavis[19055]: | ||
| + | </ | ||
| + | |||
| + | Dem Postmaster // **virusalert@nausch.org** // wird hier auch eine Hinweisnachricht geschickt, | ||
| + | |||
| + | < | ||
| + | Date: Mon, 11 Jun 2012 16:48:12 +0200 (CEST) | ||
| + | Subject: VIRUS (Eicar-Test-Signature) in mail FROM [192.168.10.45] | ||
| + | < | ||
| + | To: < | ||
| + | Message-ID: < | ||
| + | |||
| + | This is a multi-part message in MIME format... | ||
| + | |||
| + | ------------=_1339426093-19055-1 | ||
| + | Content-Type: | ||
| + | Content-Disposition: | ||
| + | Content-Transfer-Encoding: | ||
| + | |||
| + | A virus was found: Eicar-Test-Signature | ||
| + | |||
| + | Scanner detecting a virus: ClamAV-clamd | ||
| + | |||
| + | Content type: Virus | ||
| + | Internal reference code for the message is 19055-06/ | ||
| + | |||
| + | First upstream SMTP client IP address: [192.168.10.45] | ||
| + | According to a ' | ||
| + | [192.168.10.45], | ||
| + | with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits) No client certificate | ||
| + | requested | ||
| + | |||
| + | Return-Path: | ||
| + | From: Django < | ||
| + | Message-ID: < | ||
| + | Subject: TesteMail mit Eicar-Testfile im Anhang | ||
| + | Not quarantined. | ||
| + | |||
| + | Notification to sender will not be mailed. | ||
| + | |||
| + | The message WAS NOT relayed to: | ||
| + | < | ||
| + | 554 5.7.0 Reject, id=19055-06 - INFECTED: Eicar-Test-Signature | ||
| + | |||
| + | Virus scanner output: | ||
| + | p004: Eicar-Test-Signature FOUND | ||
| + | p005: Eicar-Test-Signature FOUND | ||
| + | |||
| + | |||
| + | ------------=_1339426093-19055-1 | ||
| + | Content-Type: | ||
| + | Content-Disposition: | ||
| + | Content-Transfer-Encoding: | ||
| + | Content-Description: | ||
| + | |||
| + | Return-Path: | ||
| + | Received: from pml010051.nausch.org (unknown [192.168.10.45]) | ||
| + | (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) | ||
| + | (No client certificate requested) | ||
| + | by mx1.nausch.org (Postfix) with ESMTPS | ||
| + | for < | ||
| + | Message-ID: < | ||
| + | Date: Mon, 11 Jun 2012 16:48:13 +0200 | ||
| + | From: Django < | ||
| + | User-Agent: Mozilla/5.0 (X11; Linux i686; rv:11.0) Gecko/ | ||
| + | MIME-Version: | ||
| + | To: Django@nausch.org | ||
| + | Subject: TesteMail mit Eicar-Testfile im Anhang | ||
| + | Content-Type: | ||
| + | | ||
| + | </ | ||
| + | |||
| + | Bei Bedarf kann man diese Benachrichtigung abstellen. Hierzu sind folgende werte in der **amavis.conf** relevant. | ||
| + | |||
| + | <code bash> | ||
| + | |||
| + | $mailfrom_notify_admin | ||
| + | $mailfrom_notify_recip | ||
| + | </ | ||
| + | |||
| + | |||
| + | ===== Optimierung / RAM-Disk für AMaViS ===== | ||
| + | Da sich bei entsprechenden Traffic die Zugriffe auf die Harddisk ungünstig auf die Performance auswirkt, legen wir eine RAM-Disk für den Virenscanner an. Dort kann ClamAV dann die Dateianhänge der Nachrichten entpacken, ablegen und auf Schadcode hin überprüfen. | ||
| + | |||
| + | Damit wir die Zugriffsrechte auf die Ramdisk richtig setzen können, schließlich soll nicht jedermann die Inhalte der eMails lesen können, ermitteln wird zu erst noch die **gid** und **uid**. | ||
| + | |||
| + | # grep amavis /etc/group | ||
| + | |||
| + | | ||
| + | |||
| + | # grep amavis /etc/passwd | ||
| + | |||
| + | | ||
| + | |||
| + | Für unsere Zwecke legen uns eine 250 MB große RAM-Disk an: | ||
| + | |||
| + | # vim /etc/fstab | ||
| + | |||
| + | # RAM-Disk für ClamAV | ||
| + | / | ||
| + | |||
| + | Anschließend mounten wir unser neues Laufwerk mit | ||
| + | # mount / | ||
| + | Je nach Belastung werden nun in unserem Arbeitsverzeichnis die Daten abgelegt | ||
| + | # df -h -t tmpfs | ||
| + | |||
| + | | ||
| + | / | ||
| + | |||
| + | ====== Links ====== | ||
| + | * **[[centos: | ||
| + | * **[[wiki: | ||
| + | * **[[http:// | ||
| + | |||