Postfix 邮件反垃圾和病毒处理

ClamAV是一个unix系统平台上的开源反病毒工具,它是特地为在邮件网关上进行邮件扫描而设计的。整套软件提供了许多的实用工具,包括一个可伸缩和可升级的多线程守护进程、一个命令行扫描工具和病毒库自动升级工具。

SpamAssassin 是目前最好的、最流行的开源反垃圾邮件软件之一。它是一个邮件过滤器,使用了多种反垃圾邮件技术,如:文本分析、贝叶斯过滤、DNS黑名单和分布式协同过滤数据库等。

amavisd-new是一个连接MTA和内容检测工具(诸如病毒扫描工具和 SpamAssassin)的高性能接口程序,使用perl语言写成。它一般通过SMTP、ESMTP或者LMTP和MTA进行通讯,当然也可以借助于其它外部程序进行。同postfix(MTA)协同工作时表现尤佳。当它呼叫SpamAssassin进行内容过滤时,对于一封邮件只需要呼叫一次,而不管这封邮件将发往多少个收件人;同时,它亦会尽力保证实现每一位收件人的偏好设置,如接收/拒绝,检测/不检测,垃圾邮件级别等;它还会在邮件头部分插入 spam相关信息。

【安装ClamAV】
(1)升级安装ClamAV的支持
最新的clamav-0.96.1需要zlib-1.2.2以上的版本的支持,而centos5上的版本为zlib-1.2.3因此不需要升级,但是为了确保,最好还是确认下:
#rpm -qa | grep zlib zlib-1.2.3-3 zlib-devel-1.2.3-3
如果不是最新的,请使用yum update zlib进行升级。
(2)安装ClamAV
添加ClamAV运行所需的组和用户:
#groupadd clamav #useradd -g clamav -s /sbin/nologin -M clamav
添加配合amavisd-new使用的用户amavis
#groupadd amavis #useradd -g amavis -s /sbin/nologin -M amavis
#tar zxvf clamav-0.96.1.tar.gz
#cd clamav-0.96.1
#./configure –prefix=/usr/local/clamav –with-dbdir=/usr/local/clamav/share –sysconfdir=/etc/clamav
#make
#make install
(3)配置Clam AntiVirus
编辑主配置文件:
#vi /etc/clamav/clamd.conf
注释掉第八行的Example,如下:
# Example
找到如下行
#LogFile /tmp/clamd.log
#PidFile /var/run/clamd.pid LocalSocket /tmp/clamd.socket
#DatabaseDirectory /var/lib/clamav
#User clamav
修改为:
LogFile /var/log/clamav/clamd.log
PidFile /var/run/clamav/clamd.pid
LocalSocket /var/run/clamav/clamd.socket
DatabaseDirectory /usr/local/clamav/share
User amavis
启用以下选项
LogSyslog yes
LogFacility LOG_MAIL
LogVerbose yes
StreamMaxLength 20M (后面的数值应该与邮件服务器允许的最大附件值相一致)
编辑更新进程的配置文件
#vi /etc/clamav/freshclam.conf
注释掉Example,
如下:
# Example
找到如下行
#DatabaseDirectory /var/lib/clamav
#UpdateLogFile /var/log/freshclam.log
分别修改为:
DatabaseDirectory /usr/local/clamav/share
UpdateLogFile /var/log/clamav/freshclam.log
启用以下选项:
DatabaseMirror db.XY.clamav.net (您可以去clamav官方网站查看升级服务器并添加至此处db.CN.clamav.net)
LogSyslog yes
LogFacility LOG_MAIL
LogVerbose yes

(4)建立日志所在的目录、进程与socket所在的目录,并让它属于clamav用户:
# mkdir -v /var/log/clamav
# chown -R amavis.amavis /var/log/clamav
# mkdir -v /var/run/clamav
# chmod 700 /var/run/clamav
# chown -R amavis.amavis /var/run/clamav
建立日志文件
#touch /var/log/clamav/freshclam.log
#chown clamav.clamav /var/log/clamav/freshclam.log

(5)配置crontab,让Clam AntiVirus每小时检测一次新的病毒库:
# crontab -e 添加: 37 * * * * /usr/local/clamav/bin/freshclam

(6)配置库文件搜索路径:
# echo “/usr/local/clamav/lib”>> /etc/ld.so.conf
# ldconfig

(7)配置clamav开机自动启动
# echo /usr/local/clamav/sbin/clamd /etc/rc.local

【安装SpamAssassin-3.3.1】
(1)依赖关系的解决,安装Spamassassin需要很多perl模块的支持,以下是所需模块列表及安装方法

必须的软件包:
Digest::SHA1
HTML::Parser
Net::DNS
LWP (aka libwww-perl)
HTTP::Date
IO::Zlib
Archive::Tar

可选的软件包,其中有些后面的amavisd也有可能会用到:
MIME::Base64
DB_File
Net::SMTP
Mail::SPF
IP::Country::Fast
Net::Ident
IO::Socket::INET6
IO::Socket::SSL
Compress::Zlib
Time::HiRes
Mail::DKIM
Mail::DomainKeys
DBI *and* DBD driver/modules
Encode::Detect
Apache::Test
Razor2

推荐使用CPAN自动安装(你的主机要能连上Internet),它能够自动下载安装,并能解决安装过程中的依赖关系。您可以使用类同的以下的命令来进行安装:
#perl -MCPAN -e shell
cpan> install Digest::SHA1
………………

如果您的主机无法直接连接到Internet,您也可以到http://search.cpan.org上搜索下载所需要的软件包,而后使用类同的下列命令安装:

#tar zxvf 软件包.tar.gz
#cd 软件包
#perl Makefile.PL
#make
#make install
说明:某些软件包安装的过程中可能需要已经列出的其它软件包的支持(可以先尝试安装Spamassassin,然后按提示补充所需软件包),请安照提示自行调整安装顺序。另外,其中有个软件包安装过程中可能要求声明环境变量LC_ALL,此时,可输入如下命令,并重新进行软件包的编译安装即可。
#export LC_ALL=C

(2)安装Mail-SpamAssassin-3.3.1

#tar jxvf Mail-SpamAssassin-3.3.1.tar.bz2
#cd Mail-SpamAssassin-3.3.1
#perl Makefile.PL #make
#make install
编辑主配置文件
vim /etc/mail/spamassassin/local.cf
required_hits 10.0
rewrite_subject 1
required_score 5.0
rewrite_header Subject *****SPAM*****
report_safe  1
use_bayes  1
bayes_auto_learn  1
skip_rbl_checks  1
use_razor2  0
use_pyzor  0
ok_locales  all

在这部分安装的过程中可能会遇到一些问题,请使用perl -MCPAN -e shell之后
>cpan install spamassassin.

(3)测试spamassassin
#spamassassin -t < sample-nonspam.txt > nonspam.out
#spamassassin -t < sample-spam.txt > spam.out
任意创建上述2个txt即可

(4)查看测试结果:
#less nonspam.out
#less spam.out

(5)检查配置文件
#spamassassin -d –lint

(6)启动进程,并将其加入到自动启动队列
#/usr/bin/spamd -d
#echo “/usr/bin/spamd -d” >> /etc/rc.local

【安装amavisd-new】
(1)依赖关系的解决
以下为官方声明所必须的软件包列表,使用perl -MCPAN -e shell进行安装
Archive::Zip
Compress::Zlib
Convert::TNEF
Convert::UUlib
MIME::Base64
MIME::Parser
Mail::Internet
Net::Server
Digest::MD5
IO::Stringy
Time::HiRes
Unix::Syslog
BerkeleyDB
有些可能在上面已经安装,但是为了保险起见,还是建议逐个验证一遍。

(2)创建运行时目录,并赋予amavis用户(前文中所建)
# mkdir -pv /var/amavis/{tmp,var,db,home}
# chown -R amavis:amavis /var/amavis
#chmod -R 750 /var/amavis

(3)安装amavisd-new-2.6.4
# tar -zxvf amavisd-new-2.6.4.tar.gz
# cd amavisd-new-2.6.4
拷贝服务端至$PATH中指定的目录,推荐拷贝至/usr/local/sbin:
#cp amavisd /usr/local/sbin/
#chown root /usr/local/sbin/amavisd
#chmod 755 /usr/local/sbin/amavisd
拷贝主配置文件至/etc,并修改相应的权限:
#cp amavisd.conf /etc
# chown root:amavis /etc/amavisd.conf
# chmod 640 /etc/amavisd.conf
创建amavisd运行中所需要的隔离区域:
# mkdir -v /var/virusmails
# chown amavis:amavis /var/virusmails/
# chmod 750 /var/virusmails/

(4)编辑主配置文件
#vi /etc/amavisd.conf
确保您的如下选项的值如下文所示:
$daemon_user = ‘amavis’;
$daemon_group = ‘amavis’;
$mydomain = ‘xxt.cn’;  (此处可更改为自己的DNS域)
$virus_admin = “postmaster\@$mydomain”;
$mailfrom_notify_admin = “postmaster\@$mydomain”;
$mailfrom_notify_recip = “postmaster\@$mydomain”;
$mailfrom_notify_spamadmin = “postmaster\@$mydomain”;
$mailfrom_to_quarantine = ”; virus_admin_maps => [“postmaster\@$mydomain”] (指定报告病毒和垃圾邮件时发送系统邮件的用户身份) spam_admin_maps => [“postmaster\@$mydomain”]

启用ClamAV,(大概在第363行)去掉如下行前的注释符:
#[‘ClamAV-clamd’,
# \&ask_daemon, [“CONTSCAN {}\n”, “/var/run/clamav/clamd”],
# qr/\bOK$/, qr/\bFOUND$/,
# qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
# [‘Mail::ClamAV’, \&ask_clamav, “*”, [0], [1], qr/^INFECTED: (.+)/],
—在375行 并将如上行中的/var/run/clamav/clamd修改为:/var/run/clamav/clamd.socket

(5)测试启动
#/usr/local/sbin/amavisd 也可以按如下命令调试启动:
#/usr/local/sbin/amavisd debug
注意加到开机启动中
echo “/usr/local/sbin/amavisd”>>etc/rc.d/rc.local
可能会遇到下面的错误:
fetch_modules: error loading optional module MIME/Decoder/BinHex.pm: Can’t locate Convert/BinHex.pm in @INC (@INC contains: /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.8/i386-linux-thread-multi /usr/lib/perl5/5.8.8) at /usr/lib/perl5/site_perl/5.8.8/MIME/Decoder/BinHex.pm line 43. BEGIN failed–compilation aborted at /usr/lib/perl5/site_perl/5.8.8/MIME/Decoder/BinHex.pm line 43. Compilation failed in require at /usr/local/sbin/amavisd line 197.
这个时候就需要下载Convert-BinHex-1.119.tar.gz,安装后再启动。
#tar -zxvf Convert-BinHex-1.119.tar.gz
#cd Convert-BinHex-1.119
#perl Makefile.PL
#make
#make install

【配置postfix,让它能调用amavisd,以实现病毒及垃圾邮件的过滤】
(1)配置/etc/postfix/master.cf
#vi /etc/postfix/master.cf
在文末添加如下内容:
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#  (yes) (yes) (yes) (never) (100)
# ==========================================================================
#
amavisfeed unix –  –  n  –  2  smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20
127.0.0.1:10025 inet n –  n  –  –  smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8,192.168.0.0/16
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o local_header_rewrite_clients=

# 说明:注意每行“-o”前的空格

(2)修改/etc/postfix/main.cf
#vi /etc/postfix/main.cf
在文末添加如下行:
content_filter=amavisfeed:[127.0.0.1]:10024
(3)让postfix重新加载主配置文件,并查看启动情况
# postfix reload && tail -f /var/log/maillog

(4)查看amavisd是否在监听10024端口,并测试服务启动情况:
[root@10.10.10.144 ~]$ telnet 127.0.0.1 10024
Trying 127.0.0.1…
Connected to 127.0.0.1.
Escape character is ‘^]’.
220 [127.0.0.1] ESMTP amavisd-new service ready
ehlo localhost
250-[127.0.0.1]
250-VRFY
250-PIPELINING
250-SIZE
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 XFORWARD NAME ADDR PORT PROTO HELO IDENT SOURCE
quit
221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel
Connection closed by foreign host.

5)postfix重新加载配置文件后将授权并激活”127.0.0.1:10025″端口

一个正常的服务连接应该类同下面所示:
[root@10.10.10.144 ~]$ telnet 127.0.0.1 10025
Trying 127.0.0.1…
Connected to 127.0.0.1.
Escape character is ‘^]’.
220 mail.jkr99.com ESMTP Postfix (2.8.12)
ehlo localhost
250-mail.jkr99.com
250-PIPELINING
250-SIZE 512000000
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye
Connection closed by foreign host.

(6)通过amavisd测试发信
[root@10.10.10.144 ~]# telnet localhost 10024
Trying 127.0.0.1…
Connected to localhost.localdomain (127.0.0.1).
Escape character is ‘^]’.
220 [127.0.0.1] ESMTP amavisd-new service ready
HELO localhost
250 [127.0.0.1]
MAIL FROM:<>
250 2.1.0 Sender <> OK
RCPT TO:
250 2.1.5 Recipient OK
DATA
354 End data with .

From:Anti-Virus tester
To: MailServer Admin
Subject:amavisd test!
amavisd test!!
.
250 2.0.0 Ok, id=32278-01, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 3FE6A7488EB
quit
221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel
Connection closed by foreign host.

(7)使用EXTmail登陆xp用户查看邮件的情况,如果收到则说明功能正常。

【测试使用反病毒及反垃圾模块】
(1)病毒邮件发送测试
发送带有病毒附件的邮件(病毒样本在一个压缩包中),查看发送情况:
#tail –f /var/log/maillog
Dec  5 16:58:01 mail postfix/qmgr[28773]: 00DBD1DE31A: from=<liupeng@test.com>, size=35020, nrcpt=1 (queue active)
Dec  5 16:58:02 mail postfix/smtpd[30442]: warning: dict_nis_init: NIS domain name not set – NIS lookups disabled
Dec  5 16:58:02 mail postfix/smtpd[30442]: connect from JMS[127.0.0.1]
Dec  5 16:58:02 mail postfix/smtpd[30442]: 0321F1DE32A: client=JMS[127.0.0.1]
Dec  5 16:58:02 mail postfix/cleanup[30012]: 0321F1DE32A: message-id=<VAv19xIM_VAlxk@mail.test.com>
Dec  5 16:58:02 mail postfix/qmgr[28773]: 0321F1DE32A: from=<virusalert@test.com>, size=2439, nrcpt=1 (queue active)
Dec  5 16:58:02 mail postfix/smtpd[30442]: disconnect from JMS[127.0.0.1]
Dec  5 16:58:02 mail amavis[25054]: (25054-02) Blocked INFECTED (Worm.Mydoom.I) {DiscardedInbound,Quarantined}, [124.193.x.x]:1948 [124.193.x.x] <liupeng@test.com> -> <lijun@test.com>, quarantine: virus-v19xIM_VAlxk, Queue-ID: 00DBD1DE31A, mail_id: v19xIM_VAlxk, Hits: -, size: 35020, 146 ms
Dec  5 16:58:02 mail postfix/smtp[30014]: 00DBD1DE31A: to=<lijun@test.com>, relay=127.0.0.1

[127.0.0.1]:10024, delay=1, delays=0.89/0/0/0.15, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, id=25054-02 – INFECTED: Worm.Mydoom.I)

Dec  5 16:58:02 mail postfix/qmgr[28773]: 00DBD1DE31A: removed
Dec  5 16:58:02 mail postfix/pipe[30443]: 0321F1DE32A: to=<virusalert@test.com>, relay=maildrop, delay=0.02, delays=0.01/0.01/0/0.01, dsn=2.0.0, status=sent (delivered via maildrop service)

此条目发表在Postfix分类目录。将固定链接加入收藏夹。