[原]在LINUX+POSTFIX服务器上建立防病毒防垃圾屏障

llzqq

1. 在POSTFIX服务器上建立防病毒防垃圾屏障
   
2. 适用用于linux + postfix系统
   
3. 
   
4. 一、反病毒部分
   
5. 
   
6. 1.        下载软件包：
   
7. 
   
8. amavisd-new-20030616-p6.tar.gz
   
9. clamav-0.65.tar.gz
   
10. unrar-3.2.3-2.9.i386.rpm
    
11. zoo-2.10-11.9.i386.rpm
    
12. unzoo-4.4-2.i386.rpm
    
13. arc-5.21e-6.i386.rpm
    
14. nomarch-1.3-1mdk.i586.rpm
    
15. unarj-2.65-3.9.i386.rpm
    
16. arj-3.10-0.1.i386.rpm
    
17. freeze-2.5.0-7.i386.rpm
    
18. compress-4.0.1.tar.gz
    
19. 
    
20. 2. 安装clamav：
    
21. 
    
22. # tar zvxf clamav-0.65.tar.gz
    
23. # cd clamav-0.65
    
24. # groupadd clamav
    
25. # useradd -g clamav -d /var/run/clamav -s /bin/false clamav
    
26. # ./configure
    
27. # make
    
28. # make install
    
29. # vi /usr/local/etc/clamav.conf
    
30. 
    
31. =============================================================
    
32. #Example
    
33. LogFile /var/log/clamd.log
    
34. LogFileMaxSize 1M
    
35. LogVerbose
    
36. LogTime
    
37. LocalSocket /var/amavis/clamd/clamav.socket
    
38. PidFile /var/run/clamav/clamd.pid
    
39. DataDirectory /usr/local/share/clamav
    
40. MaxDirectoryRecursion 15
    
41. User root
    
42. ScanMail
    
43. ScanArchive
    
44. ClamukoMaxFileSize 6M
    
45. ArchiveMaxFileSize 10M
    
46. ArchiveMaxRecursion 5
    
47. ArchiveMaxFiles 1000
    
48. =============================================================
    
49. 
    
50. # clamd                          ##运行程序
    
51. # freshclam                           ##升级病毒库
    
52. # ps -aux | grep clamd
    
53.   clamav    2653  0.0  3.1 23556 12228 ?       S    13:59   0:00  
    
54. 
    
55. 3. 建立clamd的启动脚本：
    
56. 
    
57. # vi /etc/init.d/clamd
    
58. 
    
59. =============================================================
    
60. #! /bin/bash
    
61. #
    
62. # crond   Start/Stop the clam antivirus daemon.
    
63. #
    
64. # chkconfig: 2345 90 60
    
65. # description: clamdis a standard UNIX program that scans for Viruses.
    
66. # processname: clamd
    
67. # config: /usr/local/etc/clamd.conf
    
68. # pidfile: /var/run/clamav/clamd.pid
    
69. 
    
70. # Source function library.
    
71. . /etc/init.d/functions
    
72. 
    
73. RETVAL=0
    
74. 
    
75. # See how we were called.
    
76. 
    
77. prog="clamd"
    
78. progdir="/usr/local/sbin"
    
79. 
    
80. # Source configuration
    
81. if [ -f /etc/sysconfig/$prog ] ; then
    
82.     . /etc/sysconfig/$prog
    
83. fi
    
84. 
    
85. start() {
    
86.         echo -n $"Starting $prog: "
    
87.         daemon $progdir/$prog
    
88.         RETVAL=$?
    
89.         echo
    
90.         [ $RETVAL -eq 0 ] && touch /tmp/clamd
    
91.         return $RETVAL
    
92. }
    
93. 
    
94. stop() {
    
95.         echo -n $"Stopping $prog: "
    
96.         killproc $prog
    
97.         RETVAL=$?
    
98.         echo
    
99.         [ $RETVAL -eq 0 ] && rm -f /tmp/clamd
    
100.         return $RETVAL
     
101. }
     
102. 
     
103. rhstatus() {
     
104.         status clamd
     
105. }
     
106. 
     
107. restart() {
     
108.         stop
     
109.         start
     
110. }
     
111. 
     
112. reload() {
     
113.         echo -n $"Reloading clam daemon configuration: "
     
114.         killproc clamd -HUP
     
115.         retval=$?
     
116.         echo
     
117.         return $RETVAL
     
118. }
     
119. 
     
120. case "$1" in
     
121.   start)
     
122.         start
     
123.         ;;
     
124.   stop)
     
125.         stop
     
126.         ;;
     
127.   restart)
     
128.         restart
     
129.         ;;
     
130.   reload)
     
131.         reload
     
132.         ;;
     
133.   status)
     
134.         rhstatus
     
135.         ;;
     
136.   condrestart)
     
137.         [ -f /var/lock/subsys/clamd ] && restart || :
     
138.         ;;
     
139.   *)
     
140.         echo $"Usage: $0 {start|stop|status|reload|restart|condrestart}"
     
141.         exit 1
     
142. esac
     
143. 
     
144. exit 0
     
145. =============================================================
     
146. 
     
147. # chmod 755 /etc/init.d/clamd
     
148. # chkconfig --add clamd
     
149. # chkconfig clamd on
     
150. # clamscan -r test                                      ##测试杀毒
     
151. # touch /var/log/clam-update.log                    ##病毒库升级日志
     
152. # chmod 644 /var/log/clam-update.log
     
153. # chown clamav /var/log/clam-update.log            
     
154. # freshclam -d -c 2 -l /var/log/clam-update.log  
     
155. # touch /etc/cron.daily/freshclam                   ##建立定时升级任务
     
156. # vi /etc/cron.daily/freshclam
     
157. 
     
158. =============================================================
     
159. #!/bin/bash
     
160. freshclam --quiet -d -c 2 -l /var/log/clam-update.log
     
161. =============================================================
     
162. 
     
163. # chmod a+xr /etc/cron.daily/freshclam
     
164. 
     
165. 4. 安装amavisd-new
     
166. 
     
167. # rpm -ivh unrar-3.2.3-2.9.i386.rpm
     
168. # rpm -ivh zoo-2.10-11.9.i386.rpm
     
169. # rpm -ivh unzoo-4.4-2.i386.rpm
     
170. # rpm -ivh arc-5.21e-6.i386.rpm
     
171. # rpm -ivh nomarch-1.3-1mdk.i586.rpm
     
172. # rpm -ivh unarj-2.65-3.9.i386.rpm
     
173. # rpm -ivh arj-3.10-0.1.i386.rpm
     
174. # rpm -ivh freeze-2.5.0-7.i386.rpm
     
175. # mkdir cmpress
     
176. # tar -zxvf compress-4.0.1.tar.gz -C compress
     
177. # cd compress
     
178. # make
     
179. # make install
     
180. 
     
181. 通过perl网络安装amavis运行环境
     
182. 
     
183. # perl -MCPAN -e shell        ##在安装前确定你的系统语言不是UTF-8
     
184. 
     
185. =============================================================
     
186. cpan>;
     
187. 
     
188. Instalando
     
189. -----------
     
190. cpan>; install File::MMagic
     
191. cpan>; install Config::IniFiles
     
192. cpan>; install Convert::TNEF
     
193. cpan>; install Convert::UUlib
     
194. cpan>; install Compress::Zlib
     
195. cpan>; install Archive::Tar
     
196. cpan>; install Archive::Zip
     
197. cpan>; install Unix::Syslog
     
198. cpan>; install MIME::Base64
     
199. cpan>; install Net::Server
     
200. cpan>; install Net::SMTP
     
201. Should all FTP connections be passive (y|n) ? [no] no
     
202. cpan>; install Digest::MD5
     
203. cpan>; install Time::HiRes
     
204. cpan>; install Mail::SpamAssassin
     
205. cpan>; exit
     
206. =============================================================
     
207. 
     
208. # adduser -s /bin/false -c "Amavis User" -d /var/amavis amavis
     
209. # tar -zxvf amavisd-new-20030616-p6.tar.gz
     
210. # cd amavisd-new-20030616
     
211. # mkdir -p /var/amavis/clamd
     
212. # chown -R amavis:amavis /var/amavis
     
213. # chmod -R 750 /var/amavis/
     
214. # cp amavisd /usr/local/sbin/
     
215. # ln -s /usr/local/sbin/amavisd /usr/sbin/amavisd
     
216. # cp amavisd.conf /etc/
     
217. # mkdir /var/virusmails
     
218. # chown amavis:amavis /var/virusmails
     
219. # cp amavisd_init.sh /etc/init.d/amavisd
     
220. # chmod 744 /etc/init.d/amavisd
     
221. # chkconfig --add  amavisd
     
222. # chkconfig amavisd on
     
223. # vi /etc/amavisd.conf
     
224. ========================================================================
     
225. $MYHOME = '/var/amavis';          # (default is '/var/amavis')
     
226. $mydomain = 'nero.3322.org';     # (no useful default)
     
227. $daemon_user  = 'amavis';         # (no default;  customary: vscan or amavis)
     
228. $daemon_group = 'amavis';         # (no default;  customary: vscan or amavis)
     
229. 
     
230. $QUARANTINEDIR = '/var/virusmails';
     
231. 
     
232. $log_level = 0;
     
233. 
     
234. $final_virus_destiny      = D_BOUNCE;  # (defaults to D_BOUNCE)
     
235. $final_banned_destiny     = D_BOUNCE;  # (defaults to D_BOUNCE)
     
236. $final_spam_destiny       = D_PASS;   # (defaults to D_REJECT)
     
237. $final_bad_header_destiny = D_PASS;  # (defaults to D_PASS), D_BOUNCE suggested
     
238. 
     
239. $sa_spam_subject_tag = '***SPAM***'
     
240. 
     
241. $virus_admin = "root\@$mydomain";
     
242. $mailfrom_notify_admin     = "root\@$mydomain";
     
243. $mailfrom_notify_recip     = "root\@$mydomain";
     
244. 
     
245. ['Clam Antivirus-clamd',
     
246.    \&ask_daemon, ["CONTSCAN {}\n", '/var/amavis/clamd/clamav.socket'],
     
247.    qr/\bOK$/, qr/\bFOUND$/,
     
248.    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
     
249. ========================================================================
     
250. # amavisd debug
     
251. Mar 20 10:36:21 home amavisd[1252]: starting.  amavisd at home amavisd-new-20030616-p6, Unicode aware, LANG=en_US
     
252. Mar 20 10:36:21 home amavisd[1252]: Perl version               5.008
     
253. Mar 20 10:36:21 home amavisd[1252]: Module Amavis::Conf        1.15
     
254. Mar 20 10:36:21 home amavisd[1252]: Module Archive::Tar        1.08
     
255. Mar 20 10:36:21 home amavisd[1252]: Module Archive::Zip        1.09
     
256. Mar 20 10:36:21 home amavisd[1252]: Module Compress::Zlib      1.33
     
257. Mar 20 10:36:21 home amavisd[1252]: Module Convert::TNEF       0.17
     
258. Mar 20 10:36:21 home amavisd[1252]: Module Convert::UUlib      1.01
     
259. ------------------------
     
260. 启动amavisd服务
     
261. # service amavisd start
     
262. 
     
263. 测试amavis的工作情况
     
264. # telnet 127.0.0.1 10024
     
265. Trying 127.0.0.1...
     
266. Connected to home (127.0.0.1).
     
267. Escape character is '^]'.
     
268. 220 [127.0.0.1] ESMTP amavisd-new service ready
     
269. QUIT
     
270. 221 2.0.0 [127.0.0.1] (amavisd) closing transmission channel
     
271. Connection closed by foreign host.
     
272. 
     
273. 设置postfix，在/etc/postfix/master.cf添加如下内容
     
274. ========================================================================
     
275. smtp-amavis unix -     -       n       -       2  smtp
     
276.         -o smtp_data_done_timeout=1200
     
277.         -o disable_dns_lookups=yes
     
278.                                                                                 
     
279. 127.0.0.1:10025 inet n -       n       -       -  smtpd
     
280.         -o content_filter=
     
281.         -o local_recipient_maps=
     
282.         -o relay_recipient_maps=
     
283.         -o smtpd_restriction_classes=
     
284.         -o smtpd_client_restrictions=
     
285.         -o smtpd_helo_restrictions=
     
286.         -o smtpd_sender_restrictions=
     
287.         -o mynetworks=127.0.0.0/8
     
288. ========================================================================
     
289. 设置postfix，在/etc/postfix/main.cf添加如下内容
     
290. ============================================================================
     
291. content_filter = smtp-amavis:[127.0.0.1]:10024
     
292. ========================================================================
     
293. 测试postfix是否工作
     
294. # telnet 127.0.0.1 10025
     
295. 
     
296. Trying 127.0.0.1...
     
297. Connected to localhost (127.0.0.1).
     
298. Escape character is '^]'.
     
299. 220 nero.3322.org ESMTP Postfix
     
300. QUIT
     
301. 221 Bye
     
302. Connection closed by foreign host.
     
303. 
     
304. 5. 功能测试：
     
305. 
     
306. 扫描/home/data下的所有邮件，并将扫描结果保存在/root下的scan_report文件中
     
307. 
     
308. # clamscan -r -l /root/scan_report /home/data
     
309. # less scan_report
     
310. 
     
311. =============================================================
     
312. /home/data/mail/test/Maildir/courierimapkeywords/.3597840.1079351764.M170269P1241V0000000000000302I00093221_0.home,S=733: Empty file.
     
313. /home/data/mail/test/Maildir/courierimapuiddb: OK
     
314. /home/data/mail/llzqq/Maildir/courierimapuiddb: OK
     
315. /home/data/mail/.bash_history: OK
     
316. 
     
317. ----------- SCAN SUMMARY -----------
     
318. Known viruses: 20482
     
319. Scanned directories: 20
     
320. Scanned files: 3
     
321. Infected files: 0
     
322. Data scanned: 0.00 MB
     
323. I/O buffer size: 131072 bytes
     
324. Time: 0.681 sec (0 m 0 s)
     
325. [root@home root]# less scan_report
     
326. --------------------------------------
     
327. Scan started: Tue Mar 16 10:46:09 2004
     
328. 
     
329. -- summary --
     
330. Known viruses: 20482
     
331. Scanned directories: 20
     
332. Scanned files: 3
     
333. Infected files: 0
     
334. Data scanned: 0.00 MB
     
335. I/O buffer size: 131072 bytes
     
336. Time: 0.681 sec (0 m 0 s)
     
337. =====================================================
     
338. 
     
339. 
     
340. 
     
341. 二、防垃圾邮件部分
     
342. 
     
343. 安装SpamAssassin
     
344. SpamAssassin在上面的过程中安装了
     
345. 配置SpamAssassin
     
346. 
     
347. 把下面的内容放进/etc/mail/spamassassin/local.cf
     
348. ========================================================================
     
349. 
     
350. # How many hits before a message is considered spam.
     
351. required_hits           5.0
     
352. 
     
353. # Whether to change the subject of suspected spam
     
354. rewrite_subject         1
     
355. 
     
356. # Text to prepend to subject if rewrite_subject is used
     
357. subject_tag             *****SPAM*****
     
358. 
     
359. # Encapsulate spam in an attachment
     
360. report_safe             1
     
361. 
     
362. # Use terse version of the spam report
     
363. use_terse_report        0
     
364. 
     
365. # Enable the Bayes system
     
366. use_bayes               1
     
367. 
     
368. # Enable Bayes auto-learning
     
369. auto_learn              1
     
370. 
     
371. # Enable or disable network checks
     
372. skip_rbl_checks         1
     
373. use_razor2              0
     
374. use_dcc                 0
     
375. use_pyzor               0
     
376. 
     
377. # Mail using languages used in these country codes will not be marked
     
378. # as being possibly spam in a foreign language.
     
379. # - chinese english
     
380. ok_languages            zh en
     
381. 
     
382. # Mail using locales used in these country codes will not be marked
     
383. # as being possibly spam in a foreign language.
     
384. ok_locales              en zh
     
385. score           SUBJ_FULL_OF_8BITS      2
     
386. 
     
387. ========================================================================
     
388. 
     

复制代码

hiandy

好

hiandy

有没有FOR sendmail的？

leaper

好东西

kinux

[quote]原帖由 "hiandy"]有没有FOR sendmail的？[/quote 发表：


sendmail有个包不过忘了名, 你到google 找找..

paulwang

怎么过滤带指定附件的邮件啊，

hefish

有必要搞什么启动脚本么？
我可是直接运行的clamd
一点问题都没有。

llzqq

原帖由 "hefish" 发表：
有必要搞什么启动脚本么？
我可是直接运行的clamd
一点问题都没有。

只是想搞个启动脚本。

yejr

/usr/local/sbin/amavisd[20610]: No $file,         not using it
/usr/local/sbin/amavisd[20610]: No $arc,          not using it
/usr/local/sbin/amavisd[20610]: No $gzip,         not using it
/usr/local/sbin/amavisd[20610]: No $bzip2,        not using it
/usr/local/sbin/amavisd[20610]: No $lzop,         not using it
/usr/local/sbin/amavisd[20610]: No $lha,          not using it
/usr/local/sbin/amavisd[20610]: No $unarj,        not using it
/usr/local/sbin/amavisd[20610]: No $uncompress,   not using it
/usr/local/sbin/amavisd[20610]: No $unfreeze,     not using it
/usr/local/sbin/amavisd[20610]: No $unrar,        not using it
/usr/local/sbin/amavisd[20610]: No $zoo,          not using it
/usr/local/sbin/amavisd[20610]: No $cpio,         not using it
/usr/local/sbin/amavisd[20610]: No $rpm2cpio,     not using it
/usr/local/sbin/amavisd[20610]: No $cabextract,   not using it
/usr/local/sbin/amavisd[20610]: No $dspam,        not using it


我也是按照这个安装的，amavis debug，出现如下提示，而上面提到的的这些命令大部分都是存在的，跟踪了一下午的那个perl程序，发现在函数find_program_path()似乎有问题，在这个函数刚开始的时候写一个测试的命令，比如:
print("stat ok\n" if stat('/usr/local/sbin/amavisd');
结果正常输出，在这里stat()没问题，继续往下走...，在for()循环里面的最后一个else中无论如何，stat均失败，真是奇怪:
} else {                         # walk through the specified PATH
print("stat ok\n" if stat('/usr/local/sbin/amavisd');
do_log(0,"stat ok\n";

结果没有print，只有do_log执行了，不知道为什么会这样，我用的版本amavisd-new-20040422，请搞手指教，谢谢！

yejr

原帖由 "yejr" 发表：
No $dspam,        not using it


我也是按照这个安装的，amavis debug，出现如下提示，而上面提到的的这些命令大部分都是存在的，跟踪了一下午的那个perl程序，发现在函数find_program_path()似乎有问题，在这?.........

原来是设置了
daemon_chroot_dir
这个参数导致的，现在可以了~~