Installation von AMaViS (amavisd-new, SpamAssassin und BitDefender) (auf 1&1 Rootserver mit SUSE 8.x und Postfix) Funktionsweise AMaViS stellt das Bindeglied zwischen Mailserver (hier Postfix), einem Spam-Filter (SpamAssassin) und der Antivirensoftware (hier BitDefender) dar. AMaViS unterstützt eine Vielzahl handelsüblicher Virenscanner. Die Auswahl fiel hier jedoch auf BitDefender (www.bitdefender.com), da dieser Scanner in seiner LINUX-Version kostenlos zur Verfügung gestellt wird. Im folgenden Text sind Ein- und Ausgaben im SSHclient blau und Kommentare zu diesen Ein- und Ausgaben grau geschrieben. Schritt 1 - Die Installation des Virenscanners (BitDefender) Unter www.bitdefender.com im Menü "Downloads/Free Products/BitDefender Linux Edition" die passende Version auswählen. Hier wurde BitDefender-Console-Antivirus-7.0.1-3.linux-gcc29x.i586.run verwendet, nachdem beim Versuch die *linux-gcc3x* Version zu installieren ein Update der GLIBC verlangt wurde. Also einfach im Browser (IE) mit der Mouse über die gewünschte Version, dann Rechtsklick -> "Verküpfung kopieren" und weiter im SSHclient (hier PuTTY): p12345678:/ # cd /usr/local/src p12345678:/usr/local/src # wget ftp://ftp.bitdefender.com/pub/linux/free/bitdefender-console/en/bitdefender- Console-Antivirus-7.0.1-3.linux-gcc29x.i586.run (wenn man vorher wie oben beschrieben die Verküpfung in die Zwischablage kopiert hat, muß man hinter "wget[lerrzeichen]" nur noch mit der rechten Mousetaste in das PuTTY-Fester klicken, dann wird der Link hineinkopiert) p12345678:/usr/local/src # sh./bitdefender-console-antivirus-7.0.1-3.linux-gcc29x.i586.run (nun kommt diverser Text - das Kleingedruckte - einfach durchlesen, mit der Leertaste weiterschalten bis ans Ende des Textes, dann "accept" eintippen und ENTER) p12345678:/usr/local/src # Please enter "accept" if you agree to the License Agreement. Enter anything else if you don't agree to the terms in the License Agreement. The installation process will stop. accept[enter] p12345678:/usr/local/src # accept Please enter installation directory [ default = /opt ]: (hier einfach mit [ENTER] das voreingestellte Verzeichnis übernehmen) Created directory /var/bdc/infected... Created directory /var/bdc/suspected... Created symlink for /opt/bdc/bdc in /usr/bin Thank you for installing BitDefender for Linux console Free Edition in the following path: /opt/bdc Your quarantine directory is /var/bdc Please see README and FAQ files before reporting any problems to: support@bitdefender.com If you will ever plan to uninstall this product, please take a look at bdc-uninstall file located in /opt/bdc directory (Damit ist die eigentliche Installation des Virenscanners erledigt, fehlt nur noch das regelmäßige Update. Dazu richten wir noch einen cronjob ein, der stündlich auf neue Versionen checkt:) p12345678:/usr/local/src # crontab -e p12345678:/usr/local/src # #testet auf virenscanner update (bitdefender) 0 * * * * /usr/bin/bdc --update > /dev/null
(In den Editiermodus schalten ("i") und neuen cronjob eintragen, im Beispiel hier wird der zu jeder vollen Stunde ausgeführt. Geht alles glatt, werden die Ausgaben nach /dev/null ins Nirwana geschickt, nur im Fehlerfall wird eine email an root versendet. Nach dem Editieren abspeichern ("[ESC]:wq[ENTER]) p12345678:/usr/local/src # crontab: installing new crontaben p12345678:/usr/local/src # (So, das war der Virenscanner...) Schritt 2 - Die Installation von AMaViS (amavisd-new) und SpamAssassin Zuerst laden wir wieder das Installationsarchiv, beispielsweise unter http://www.ijs.si/software/amavisd/. p12345678:/usr/local/src # wget http://www.ijs.si/software/amavisd/amavisd-new-2.2.0.tar.gz (dann entpacken:) p12345678:/usr/local/src # tar -xvzf amavisd-new-2.2.0.tar.gz (jetzt kommen diverse Ausgaben von tar... dann wechseln wir in das entpackte Verzeichnis) p12345678:/usr/local/src # cd amavisd-new-2.2.0 (amavisd-new ist ein PERL-Script und muß daher nicht übersetzt werden, wir müssen nun nur noch einige Dateien kopieren und diverse Verzeichnisse anlegen sowie Rechte setzen:) p12345678:/usr/local/src/amavisd-new-2.2.0 # cp amavisd.conf /etc p12345678:/usr/local/src/amavisd-new-2.2.0 # cp amavisd /usr/sbin Bevor es jetzt weiter geht müssen wir sicherstellen, daß es einen Benutzer "vscan" und eine Gruppe "vscan" gibt, der dieser Benutzer "vscan" angehört. Prüfen bzw. Erledigen Sie das am besten mittels YAST. Die User- ID muß unterhalb 500 und die Gruppen-ID unter 100 liegen. Dem Benutzer teilen Sie als LogIn-shell "/bin/false" zu. Ist das erledigt, geht es weiter... p12345678:/usr/local/src/amavisd-new-2.2.0 # cd.. p12345678:/usr/local/src # mkdir /var/amavis p12345678:/usr/local/src # mkdir /var/amavis/tmp p12345678:/usr/local/src # mkdir /var/amavis/db p12345678:/usr/local/src # mkdir /var/virusmails p12345678:/usr/local/src # chown vscan:vscan /var/amavis p12345678:/usr/local/src # chown vscan:vscan /var/amavis/tmp p12345678:/usr/local/src # chown vscan:vscan /var/amavis/db p12345678:/usr/local/src # chown vscan:vscan /var/virusmails p12345678:/usr/local/src # chmod 750 /var/amavis p12345678:/usr/local/src # chmod 750 /var/amavis/tmp p12345678:/usr/local/src # chmod 750 /var/amavis/db p12345678:/usr/local/src # chmod 750 /var/virusmails Nun müssen weitere Voraussetzungen geschaffen bzw. geprüft werden, die zur Funktion des Ganzen notwendig sind. Zuerst sollten möglichst viele Pack- und Entpackprogramme auf dem Server installiert sein. Dies ist notwendig, weil AMaViS Dateianhänge entpackt bevor sie an den Virenscanner übergeben werde. Also sollten z.b. mindestens: lha, bzip2, arc, gzip, arj, unarj, rar, unrar, zoo installiert sein. Fehlen ein oder mehrere, läuft AMaViS
trotzdem, nur werden eben einige Anhänge nicht korrekt geprüft. Nun müssen noch diverse PERL-Bibliotheken installiert werden, sofern sie noch nicht vorhanden sind. Dies geschieht relativ komfortabel über den CPAN-Server. Insbesondere benötigen wir folgendes: Archive::Tar Archive::Zip Compress::Zlib Convert::TNEF Convert::UUlib MIME::Base64 MIME::Parser Mail::Internet Mail::SpamAssassin Net::Server Net::SMTP Digest::MD5 IO::Stringy Time::HiRes Unix::Syslog BerkeleyDB Achten Sie am Ende einer jeden installierten Bibliothek auf das "/usr/bin/make install -- OK" was Ihnen sagt, daß die Installation dieses Moduls glatt gegangen ist. Bei Fehlern machen Sie erst einmal mit dem nächsten Modul weiter und wiederholen Sie die fehlerhaften im Anschluß nochmals. Auf die Meldungen, die bei der Installation jedes einzelnen Moduls auftreten soll hier des Umfanges wegen verzichtet werden. Hier nur als Beispiel die Installation von Compress::Zlib - achten Sie in jedem Fall auch auf die Groß- und Kleinschreibung der Paket-Namen, da sie sonst nicht gefunden werden. p12345678:/usr/local/src # perl -MCPAN -e shell cpan> install Compress::Zlib...... (diverse Meldungen des Installationsprozesses)...... /usr/bin/make install -- OK cpan> quit (Mit quit Beenden Sie nach der erfolgreichen Installation aller Module) p12345678:/usr/local/src # Schritt 3 - Konfiguration, Test, Starten Bevor AMaViS in Postfix eingebunden wird, müssen noch einige wenige Anpassungen in der Konfigurationsdatei /etc/amavisd.conf vorgenommen werden. Dazu hier die komplette amavisd.conf (erstellt aus der amavisd-sample.conf - enthält alle möglichen Konfigurationsparameter). Einzig die rot markierten Werte (3 Stück) müssen entsprechend Ihrem Server angepaßt werden, es wird vorausgesetzt, daß Ihre logs unter /var/log liegen und die postmaster@meine_domain.de existiert. Kopieren Sie einfach den Inhalt zwischen den --------------------------------------------------------------------------------------------------------- und ersetzen die Datei /etc/amavis.conf damit. --------------------------------------------------------------------------------------------------------- use strict; ## A CONFIGURATION FILE FOR AMAVISD-NEW, LISTING ALL CONFIGURATION VARIABLES ## WITH THEIR DEFAULT VALUES (FOR REFERENCE ONLY, NON-AUTHORITATIVE) ## This software is licensed under the GNU General Public License (GPL). ## See comments at the start of file amavisd for the whole license text. ## Copyright (C) 2002,2003,2004 Mark Martinec, All Rights Reserved. ## See file amavisd.conf-sample for explanations and examples. ## The 'after-default' comment indicates that these variables obtain their ## default value if the config file left them undefined. It means these values ## are not yet available during processing of the configuration file, but that ## they can derive their value from other configurations variables no matter ## where in the configuration file they appear. ## GENERAL $myhostname = 'meine_domain.de'; $mydomain = 'meine_domain.de'; $daemon_user = 'vscan'; #... predefined default from uname(3), must be a FQDN #... no useful default, should be set if used in expressions
$daemon_group = 'vscan'; $MYHOME = '/var/amavis'; # a convenient default for other settings $TEMPBASE = "$MYHOME/tmp"; # working directory, needs to be created manually; after-default $ENV{TMPDIR} = $TEMPBASE; # environment variable TMPDIR #NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually # $helpers_home = $MYHOME; # after-default # $db_home = "$MYHOME/db"; # after-default # $pid_file = "$MYHOME/amavisd.pid"; # after-default # $lock_file = "$MYHOME/amavisd.lock"; # after-default # $daemon_chroot_dir = undef; $max_servers = 3; # number of pre-forked children (2..15 is common) # $max_requests = 10; # retire a child after that many accepts # $child_timeout = 8*60; # $localpart_is_case_sensitive = 0; $enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny); $enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1 @local_domains_maps = ( [".$mydomain"] ); # @local_domains_maps = (\%local_domains,\@local_domains_acl,\$local_domains_re); # @mynetworks = qw( 127.0.0.0/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ); # @mynetworks_maps = (\@mynetworks); ## LOGGING AND DEBUGGING $log_level = 0; # verbosity 0..5 $log_recip_templ = undef; # disable by-recipient level-0 log entries $DO_SYSLOG = 0; # log via syslogd (preferred) $SYSLOG_LEVEL = 'mail.debug'; $LOGFILE = '/var/log/amavis.log'; # $log_templ =... built-in default at the end of file amavisd # $log_recip_templ =... built-in default at the end of file amavisd # @debug_sender_maps = (\@debug_sender_acl); @debug_sender_acl = (); # $sa_debug = 0; ## MTA INTERFACE - INPUT # $unix_socketname = undef; # Unix socket to accept amavis helper protocol $inet_socket_port = 10024; # listen on this local TCP port(s) (see $protocol) # $inet_socket_bind = '127.0.0.1'; # @inet_acl = qw( 127.0.0.1 ::1 ); # $protocol =... defaults to SMTP or LMTP (autodetect) on inet socket # and to AM.CL (old amavis helper protocol) on Unix socket; # Possible values: ESMTP or SMTP or LMTP, AM.CL, AM.PDP, # and with appropriate patches applied also: COURIER or QMQPqq $smtpd_recipient_limit = 1100; # $smtpd_message_size_limit = undef; # site-wide limit # @message_size_limit_maps = (); # per-recipient limits # $smtpd_greeting_banner = '${helo-name} ${protocol} ${product} service ready'; # $smtpd_quit_banner = '${helo-name} ${product} closing transmission channel'; # $auth_required_inp = undef; # @auth_mech_avail=(); # empty list disables incoming AUTH; or: qw(plain LOGIN) ## MTA INTERFACE - OUTPUT ## see also $notify_method, $forward_method and $*_quarantine_method $localhost_name = 'vscan-meine_domain'; # my EHLO name $local_client_bind_address = 'localhost'; # $auth_required_out = undef; # $amavis_auth_user = undef; # for submitting notifications and quarantine # $amavis_auth_pass = undef; # $auth_reauthenticate_forwarded = undef; # our credentials for forwarding too ## MAIL FORWARDING
# $forward_method = 'smtp:[127.0.0.1]:10025'; # set to undef with milter! $final_virus_destiny = D_BOUNCE; # subj to @viruses_that_fake_sender_maps $final_banned_destiny = D_BOUNCE; $final_spam_destiny = D_BOUNCE; # subject to $sa_dsn_cutoff_level $final_bad_header_destiny = D_PASS; ## QUARANTINE # $virus_quarantine_method = 'local:virus-%i-%n'; # $spam_quarantine_method = 'local:spam-%b-%i-%n'; # $banned_files_quarantine_method = 'local:banned-%i-%n'; # $bad_header_quarantine_method = 'local:badh-%i-%n'; $QUARANTINEDIR = '/var/virusmails'; # $virus_quarantine_to = 'virus-quarantine'; # via %local_delivery_aliases # $banned_quarantine_to = 'banned-quarantine'; # $bad_header_quarantine_to= 'bad-header-quarantine'; # $spam_quarantine_to = 'spam-quarantine'; # $spam_quarantine_bysender_to = undef; # @virus_quarantine_to_maps = (\$virus_quarantine_to); # @banned_quarantine_to_maps = (\$banned_quarantine_to); # @bad_header_quarantine_to_maps = (\$bad_header_quarantine_to); # @spam_quarantine_to_maps = (\$spam_quarantine_to); # @spam_quarantine_bysender_to_maps = (\$spam_quarantine_bysender_to); # %local_delivery_aliases... predefined, used by method 'local:' $mailfrom_to_quarantine = undef; # undef keeps original sender ## NOTIFICATIONS # $notify_method = 'smtp:[127.0.0.1]:10025'; $virus_admin = "postmaster\@$mydomain"; # notifications recip. covers also banned and bad-header # $spam_admin = undef; # @virus_admin_maps = (\%virus_admin, \$virus_admin); # @spam_admin_maps = (\%spam_admin, \$spam_admin); # $hdr_encoding = 'iso-8859-1'; # header field bodies charset # $bdy_encoding = 'iso-8859-1'; # notification body text charset # $hdr_encoding_qb = 'Q'; # quoted-printable (Q or B) # $notify_sender_templ =... built-in default at the end of file amavisd # $notify_virus_sender_templ =... built-in default at the end of file amavisd # $notify_spam_sender_templ =... built-in default at the end of file amavisd # $notify_virus_admin_templ =... built-in default at the end of file amavisd # $notify_spam_admin_templ =... built-in default at the end of file amavisd # $notify_virus_recips_templ =... built-in default at the end of file amavisd # $notify_spam_recips_templ =... built-in default at the end of file amavisd $mailfrom_notify_admin = "postmaster\@$myhostname"; $mailfrom_notify_recip = "postmaster\@$myhostname"; $mailfrom_notify_spamadmin = "postmaster\@$myhostname"; ## these are after-defaults: $hdrfrom_notify_sender = "\"MailSecureCheck at $myhostname\" <postmaster\@$myhostname>"; #die nächsten 3 Variablen werden von $mailfrom_notify_recip... übernommen $hdrfrom_notify_recip = "postmaster"; $hdrfrom_notify_admin = "postmaster"; $hdrfrom_notify_spamadmin = "postmaster"; # $warnvirussender = undef; # $warnspamsender = undef;
# $warnbannedsender = undef; # $warnbadhsender = undef; # $warn_offsite = undef; # $warnvirusrecip = undef; # $warnbannedrecip = undef; # $warnbadhrecip = undef; # @warnvirusrecip_maps = (\$warnvirusrecip); # @warnbannedrecip_maps = (\$warnbannedrecip); # @warnbadhrecip_maps = (\$warnbadhrecip); ## MODIFICATIONS TO PASSED MAIL # $insert_received_line = 1; # behave like MTA: insert 'Received:' header # $remove_existing_x_scanned_headers = 0; # $remove_existing_spam_headers = 1; # $X_HEADER_TAG = 'X-Virus-Scanned'; # after-default # $X_HEADER_LINE = "$myproduct_name at $mydomain"; # after-default $defang_virus = 1; # MIME-wrap passed infected mail $defang_banned = 1; # MIME-wrap passed mail containing banned name # $defang_bad_header = undef; # $defang_undecipherable = undef; # $defang_spam = undef; # $defang_all = undef; # mostly for testing # $undecipherable_subject_tag = '***UNCHECKED*** '; $sa_spam_subject_tag = '***SPAM*** '; # $sa_spam_modifies_subj = 1; # $sa_spam_level_char = '*'; # $sa_spam_report_header = undef; # @spam_modifies_subj_maps= (\$sa_spam_modifies_subj); # @spam_subject_tag_maps = (\$sa_spam_subject_tag1); # N.B.: inconsistent name # @spam_subject_tag2_maps = (\$sa_spam_subject_tag); # N.B.: inconsistent name ## ADDING ADDRESS EXTENSIONS TO RECIPIENTS - 'plus addressing' # $recipient_delimiter = '+'; # undef disables address extensions altogether # $replace_existing_extension = 1; # $addr_extension_virus = undef; # $addr_extension_spam = undef; # $addr_extension_banned = undef; # $addr_extension_bad_header = undef; @addr_extension_virus_maps = ('virus'); @addr_extension_spam_maps = ('spam'); @addr_extension_banned_maps = ('banned'); @addr_extension_bad_header_maps = ('badh'); # @addr_extension_virus_maps = (\$addr_extension_virus); # @addr_extension_spam_maps = (\$addr_extension_spam); # @addr_extension_banned_maps = (\$addr_extension_banned); # @addr_extension_bad_header_maps = (\$addr_extension_bad_header); ## MAIL DECODING # $bypass_decode_parts = undef; # $keep_decoded_original_re = undef; @keep_decoded_original_maps = (new_re( # qr'^mail$', # retain full original message for virus checking (can be slow) qr'^mail-undecipherable$', # recheck full mail if it contains undecipherables qr'^(ascii(?! cpio) text uuencoded xxencoded binhex)'i, # qr'^zip archive data', # don't trust Archive::Zip
)); # $map_full_type_to_short_type_re =... predefined regexp lookup table # @map_full_type_to_short_type_maps = (\$map_full_type_to_short_type_re); $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin'; $file = 'file'; # file(1) utility; use recent versions $gzip = 'gzip'; $bzip2 = 'bzip2'; $lzop = 'lzop'; $rpm2cpio = ['rpm2cpio.pl','rpm2cpio']; $uncompress = ['uncompress', 'gzip -d', 'zcat']; $cabextract = 'cabextract'; $unfreeze = ['unfreeze', 'freeze -d', 'melt', 'fcat']; $arc = ['nomarch', 'arc']; $unarj = ['arj', 'unarj']; $unrar = ['rar', 'unrar']; $zoo = 'zoo'; $lha = 'lha'; $cpio = ['gcpio','cpio']; $ar = 'ar'; $MAXLEVELS = 14; $MAXFILES = 1500; $MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not enforced) $MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes (default undef, not enforced) # $MIN_EXPANSION_FACTOR = 5; # times original mail size # $MAX_EXPANSION_FACTOR = 500; # times original mail size ## ANTI-VIRUS AND INVALID/FORBIDDEN CONTENTS CONTROLS @av_scanners = ( ### http://www.bitdefender.com/ ['BitDefender', 'bdc', '--all --arc --mail {}', qr/^infected files *:0+(?!\d)/, qr/^(?:infected files Identified viruses Suspect files) *:0*[1-9]/, qr/(?:suspected infected): (.*)(?:\033 $)/ ], ); @av_scanners_backup = ( ### http://www.bitdefender.com/ ['BitDefender', 'bdc', '--all --arc --mail {}', qr/^infected files *:0+(?!\d)/, qr/^(?:infected files Identified viruses Suspect files) *:0*[1-9]/, qr/(?:suspected infected): (.*)(?:\033 $)/ ], ); # $first_infected_stops_scan = undef; # $viruses_that_fake_sender_re = undef; @viruses_that_fake_sender_maps = (new_re( [qr'\beicar\b'i => 0], # av test pattern name [qr'^(wm97 OF97 Joke\.)'i => 0], # adjust names to match your AV scanner [qr/.*/ => 1], # true for everything else )); # $banned_namepath_re = undef; # new-style $banned_filename_re = new_re( # qr'^undecipherable$', # is or contains any undecipherable components # block certain double extensions anywhere in the base name qr'\.[^./]*\.(exe vbs pif scr bat cmd com cpl dll)\.?$'i, # qr'[{}]', # curly braces in names (serve as Class ID extensions - CLSID)
qr'^application/x-msdownload$'i, qr'^application/x-msdos-program$'i, qr'^application/hta$'i, # block these MIME types # qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types # [ qr'^\.(z gz bz2)$' => 0 ], # allow any type in Unix-compressed [ qr'^\.(rpm cpio tar)$' => 0 ], # allow any type in Unix archives # [ qr'^\.(zip rar arc arj zoo)$'=> 0 ], # allow any type within such archives qr'.\.(exe vbs pif scr bat cmd com cpl)$'i, # banned extension - basic # qr'.\.(ade adp app bas bat chm cmd com cpl crt exe fxp hlp hta inf ins isp # js jse lnk mda mdb mde mdw mdt mdz msc msi msp mst ops pcd pif prg # reg scr sct shb shs vb vbe vbs wsc wsf wsh)$'ix, # banned ext - long # qr'.\.(mim b64 bhx hqx xxe uu uue)$'i, # banned extension - WinZip vulnerab. qr'^\.(exe-ms)$', # banned file(1) types # qr'^\.(exe lha tnef cab dll)$', # banned file(1) types ); # @banned_filename_maps = (\$banned_filename_re); # traditional # $virus_check_negative_ttl= 3*60; # time to cache contents as not infected # $virus_check_positive_ttl= 30*60; # time to cache contents as infected # @bypass_virus_checks_maps = (\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re); # @bypass_banned_checks_maps = (\%bypass_banned_checks, \@bypass_banned_checks_acl, \$bypass_banned_checks_re); # @bypass_header_checks_maps = (\%bypass_header_checks, \@bypass_header_checks_acl, \$bypass_header_checks_re); # @virus_lovers_maps = (\%virus_lovers, \@virus_lovers_acl, \$virus_lovers_re); # @banned_files_lovers_maps = (\%banned_files_lovers, \@banned_files_lovers_acl, \$banned_files_lovers_re); # @bad_header_lovers_maps = (\%bad_header_lovers, \@bad_header_lovers_acl, \$bad_header_lovers_re); ## ANTI-SPAM CONTROLS $sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger $sa_local_tests_only = 0; # only tests which do not require internet access? $sa_auto_whitelist = 1; # turn on AWL in SA 2.63 or older (irrelevant # for SA 3.0, cf option is 'use_auto_whitelist') $dspam = 'dspam'; # $sa_timeout = 30; # $spam_check_negative_ttl = 30*60; # time to cache contents as not spam # $spam_check_positive_ttl = 30*60; # time to cache contents as spam # @bypass_spam_checks_maps = (\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re); # @spam_lovers_maps = (\%spam_lovers, \@spam_lovers_acl, \$spam_lovers_re); $sa_tag_level_deflt = 2.0; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level $sa_kill_level_deflt = 6.31; # triggers spam evasive actions $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent # @spam_tag_level_maps = (\$sa_tag_level_deflt); # @spam_tag2_level_maps = (\$sa_tag2_level_deflt); # @spam_kill_level_maps = (\$sa_kill_level_deflt); # @spam_dsn_cutoff_level_maps = (\$sa_dsn_cutoff_level); # @score_sender_maps = (); # new variable, no backwards compatibility needed
@score_sender_maps = ({ # a by-recipient hash lookup table, # results from all matching recipient tables are summed # ## per-recipient personal tables (NOTE: positive: black, negative: white) # 'user1@example.com' => [{'bla-mobile.press@example.com' => 10.0}], # 'user3@example.com' => [{'.ebay.com' => -3.0}], # 'user4@example.com' => [{'cleargreen@cleargreen.com' => -7.0, # '.cleargreen.com' => -5.0}], ## site-wide opinions about senders (the '.' matches any recipient) '.' => [ # the _first_ matching sender determines the score boost new_re( # regexp-type lookup table, just happens to be all soft-blacklist [qr'^(bulkmail offers cheapbenefits earnmoney foryou)@'i => 5.0], [qr'^(greatcasino investments lose_weight_today market\.alert)@'i=> 5.0], [qr'^(money2you MyGreenCard new\.tld\.registry opt-out opt-in)@'i=> 5.0], [qr'^(optin saveonlsmoking2002k specialoffer specialoffers)@'i => 5.0], [qr'^(stockalert stopsnoring wantsome workathome yesitsfree)@'i => 5.0], [qr'^(your_friend greatoffers)@'i => 5.0], [qr'^(inkjetplanet marketopt MakeMoney)\d*@'i => 5.0], ), # read_hash("/var/amavis/sender_scores_sitewide"), { # a hash-type lookup table (associative array) 'nobody@cert.org' => -3.0, 'cert-advisory@us-cert.gov' => -3.0, 'owner-alert@iss.net' => -3.0, 'slashdot@slashdot.org' => -3.0, 'bugtraq@securityfocus.com' => -3.0, 'ntbugtraq@listserv.ntbugtraq.com' => -3.0, 'security-alerts@linuxsecurity.com' => -3.0, 'mailman-announce-admin@python.org' => -3.0, 'amavis-user-admin@lists.sourceforge.net'=> -3.0, 'notification-return@lists.sophos.com' => -3.0, 'owner-postfix-users@postfix.org' => -3.0, 'owner-postfix-announce@postfix.org' => -3.0, 'owner-sendmail-announce@lists.sendmail.org' => -3.0, 'sendmail-announce-request@lists.sendmail.org' => -3.0, 'donotreply@sendmail.org' => -3.0, 'ca+envelope@sendmail.org' => -3.0, 'noreply@freshmeat.net' => -3.0, 'owner-technews@postel.acm.org' => -3.0, 'ietf-123-owner@loki.ietf.org' => -3.0, 'cvs-commits-list-admin@gnome.org' => -3.0, 'rt-users-admin@lists.fsck.com' => -3.0, 'clp-request@comp.nus.edu.sg' => -3.0, 'surveys-errors@lists.nua.ie' => -3.0, 'emailnews@genomeweb.com' => -5.0, 'yahoo-dev-null@yahoo-inc.com' => -3.0, 'returns.groups.yahoo.com' => -3.0, 'clusternews@linuxnetworx.com' => -3.0, lc('lvs-users-admin@linuxvirtualserver.org') => -3.0, lc('owner-textbreakingnews@cnnimail12.cnn.com') => -5.0, # soft-blacklisting (positive score) 'sender@example.net' => 3.0, '.example.net' => 1.0, }, ], # end of site-wide tables }); # @blacklist_sender_maps = (\%blacklist_sender, \@blacklist_sender_acl, \$blacklist_sender_re); # @whitelist_sender_maps = (\%whitelist_sender, \@whitelist_sender_acl, \$whitelist_sender_re);
# $per_recip_blacklist_sender_lookup_tables = undef; # $per_recip_whitelist_sender_lookup_tables = undef; # deprecated ## SQL & LDAP # @lookup_sql_dsn = (); # SQL data source name, or empty # $sql_select_policy = 'SELECT *,users.id FROM users,policy'. # ' WHERE (users.policy_id=policy.id) AND (users.email IN (%k))'. # ' ORDER BY users.priority DESC'; # $sql_select_white_black_list = 'SELECT wb FROM wblist,mailaddr'. # ' WHERE (wblist.rid=?) AND (wblist.sid=mailaddr.id)'. # ' AND (mailaddr.email IN (%k))'. # ' ORDER BY mailaddr.priority DESC'; ## LDAP, Please see file README.lookups for more info. # $enable_ldap = 1; # # $default_ldap = { # hostname => 'localhost', # port => 389, # timeout => 120, # tls => 0, # base => undef, # scope => 'sub', # query_filter => '(&(objectclass=amavisaccount)(mail=%m))', # bind_dn => undef, # bind_password => undef, # }; ## POLICY BANKS # %interface_policy = (); # maps input interface/port to policy bank name # $policy_bank{''} = {...predefined... }; ## the built-in policy bank (empty name) is predefined, and includes ## references to most other variables listed above (the dynamic config ## variables), which are accessed only indirectly through the currently ## installed policy bank. Overlaying a policy bank with another policy ## bank may bring-in references to entirely different variables, ## possibly unnamed. Here is a list of configuration variables ## referenced from the built-in policy bank by keys of the same name ## (e.g. { log_level => \$log_level, inet_acl => \@inet_acl,...} ) ## ## $policy_bank_name $protocol @inet_acl @mynetworks ## $log_level $log_templ $log_recip_templ ## $forward_method $notify_method ## $amavis_auth_user $amavis_auth_pass $auth_reauthenticate_forwarded ## $auth_required_out $auth_required_inp @auth_mech_avail ## $local_client_bind_address ## $localhost_name $smtpd_greeting_banner $smtpd_quit_banner ## $final_virus_destiny $final_spam_destiny ## $final_banned_destiny $final_bad_header_destiny ## $warnvirussender $warnspamsender $warnbannedsender $warnbadhsender ## $warn_offsite ## @av_scanners @av_scanners_backup $first_infected_stops_scan ## $bypass_decode_parts ## $defang_virus $defang_banned $defang_spam ## $defang_bad_header $defang_undecipherable $defang_all ## $undecipherable_subject_tag ## $sa_spam_report_header $sa_spam_level_char $sa_mail_body_size_limit ## $localpart_is_case_sensitive $recipient_delimiter $replace_existing_extension ## $hdr_encoding $bdy_encoding $hdr_encoding_qb
## $notify_xmailer_header $X_HEADER_TAG $X_HEADER_LINE ## $remove_existing_x_scanned_headers $remove_existing_spam_headers ## $hdrfrom_notify_sender $hdrfrom_notify_recip ## $hdrfrom_notify_admin $hdrfrom_notify_spamadmin ## $mailfrom_notify_sender $mailfrom_notify_recip ## $mailfrom_notify_admin $mailfrom_notify_spamadmin ## $mailfrom_to_quarantine $virus_quarantine_method $spam_quarantine_method ## $banned_files_quarantine_method $bad_header_quarantine_method ## %local_delivery_aliases $notify_sender_templ ## $notify_virus_sender_templ $notify_spam_sender_templ ## $notify_virus_admin_templ $notify_spam_admin_templ ## $notify_virus_recips_templ $notify_spam_recips_templ ## $banned_namepath_re ## $per_recip_whitelist_sender_lookup_tables ## $per_recip_blacklist_sender_lookup_tables ## @local_domains_maps @mynetworks_maps ## @bypass_virus_checks_maps @bypass_spam_checks_maps ## @bypass_banned_checks_maps @bypass_header_checks_maps ## @virus_lovers_maps @spam_lovers_maps ## @banned_files_lovers_maps @bad_header_lovers_maps ## @warnvirusrecip @warnbannedrecip @warnbadhrecip ## @virus_admin_maps @spam_admin_maps @virus_quarantine_to_maps ## @banned_quarantine_to_maps @bad_header_quarantine_to_maps ## @spam_quarantine_to_maps @spam_quarantine_bysender_to_maps ## @banned_filename_maps ## @spam_tag_level_maps @spam_tag2_level_maps @spam_kill_level_maps ## @spam_dsn_cutoff_level_maps @spam_modifies_subj_maps ## @spam_subject_tag_maps @spam_subject_tag2_maps ## @whitelist_sender_maps @blacklist_sender_maps @score_sender_maps ## @addr_extension_virus_maps @addr_extension_spam_maps ## @addr_extension_banned_maps @addr_extension_bad_header_maps ## @debug_sender_maps 1; --------------------------------------------------------------------------------------------------------- Nachdem die Änderungen an der /etc/amavisd.conf gespeichert sind, starten wir amavisd erst einmal im Vordergrund, so sind evtl. Fehlerausgaben und Logmeldungen am besten sichtbar. p12345678:/usr/local/src # amavisd foreground (Hier folgen nun diverse Meldungen, die Sie nach evtl. Fehlern durchsuchen, prinzipiell, sollte aber, wenn die vorangegangenen Schritte so wie beschrieben durchgeführt wurden, alles in Ordnung sein. Stoppen Sie nun amavisd indem Sie [Strg+C] drücken und starten Sie amavisd neu:) p12345678:/usr/local/src # amavisd start (Nun testen wir, ob amavisd den Port 10024 geöffnet hat:) p12345678:/usr/local/src # telnet localhost 10024 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 [127.0.0.1] ESMTP amavisd-new service ready quit 221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel Connection closed by foreign host. p12345678:/usr/local/src # (Ok, so muß es sein... Nun müssen wir noch festlegen, daß amavisd bei jedem Systemstart automatisch startet, dazu erstellen wir eine Datei /etc/init.d/amavisd mit folgendem Inhalt:) p12345678:/usr/local/src # vi /etc/init.d/amavisd (jetzt in den Editiermodus schalten ("i") und folgendes eingeben:) #! /bin/sh # /etc/init.d/amavisd #
### BEGIN INIT INFO # Provides: amavisd-new # Required-Start: $syslog $network # Required-Stop: $syslog $network # Default-Start: 3 # Default-Stop: 0 1 2 6 # Short-Description: antivir antispam ### END INIT INFO # case "$1" in start) echo -n "Starting amavisd-new" startproc /usr/sbin/amavisd start >> /var/log/messages 2>&1 # Remember status and be verbose rc_status -v ;; stop) echo -n "Shutting down amavisd-new" killproc /usr/sbin/amavisd stop >> /var/log/messages 2>&1 # Remember status and be verbose rc_status -v ;; *) echo "Usage: $0 {start stop}" exit 1 ;; esac exit 0 (Nach der Eingabe [ESC]:wq[ENTER] und die Ausführungsrechte setzen:) p12345678:/usr/local/src # chmod a+x /etc/init.d/amavisd (Jetzt müssen wir noch die nötigen Links in /etc/init.d/rc3.d bzw. wenn gewünscht auch in anderen Runleveln erzeugen:) p12345678:/usr/local/src # ln -s /etc/init.d/amavisd /etc/init.d/rc3.d/s13amavisd p12345678:/usr/local/src # ln -s /etc/init.d/amavisd /etc/init.d/rc3.d/k08amavisd (Die Zahlen hinter dem S bzw. K richten sich nach Ihrem System, achten Sie jedoch darauf, daß amavisd vor Postfix gestartet - also Sxxamavisd < Sxxpostfix - und nach Postfix gekillt - also Kxxamavis > Kxxpostfix - wird.) p12345678:/usr/local/src # Jetzt fehlt nur noch die Einbindung in Postfix. Dazu werden wir zuerst eine neue Transportmethode in der /etc/postfix/master.cf definieren: p12345678:/usr/local/src # vi /etc/postfix/master.cf (erzeugen Sie eine neue Zeile mit folgendem Inhalt:) smtp-amavis unix - - n - 2 smtp -o smtp_data_done_timeout=1800 -o disable_dns_lookups=yes (Weiterhin benötigen wir noch einen smtpd, auf dem Postfix die gescannten Mails ohne content_filter wieder entgegen nimmt, dieser Eintrag ist u.u. bereits vorhanden und muß nur vom führenden # befreit werden, ansonsten neu erzeugen:) localhost:10025 inet n - n - - smtpd -o content_filter= (Nach dem Abspeichern [ESC]:wq[ENTER] müssen wir Postfix neu starten und prüfen ob es auf Port 10025 antwortet:)
p12345678:/usr/local/src # rcpostfix restart p12345678:/usr/local/src # telnet localhost 10025 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 p15132719.pureserver.info ESMTP Postfix quit 221 Bye Connection closed by foreign host. p12345678:/usr/local/src # (So soll es sein, nun haben wir es fast geschafft...) Bevor der letzte Schritt hoffentlich zum erfolg führt, hier noch eine kurze Hintergrundinformation zur Funktionsweise dessen, was wir hier soeben eingerichtet haben: Also, mit dem letzten noch ausstehenden Konfigurationsschritt weisen wir Postfix an, alle eingehenden Mails über den Transportweg smtp-amaris an localhost Port 10024 weiterzuleiten. Dort werden sie von amavisdnew übernommen und an Spamassassin und den Virenscanner (BitDefender) zur Prüfung übergeben. Werden die Mails als "sauber" erkannt, gibt amavisd-new diese über Port 10025 wieder an Postfix zurück, da wir dort content_filter = <leer> definiert hatten, erfolgt keine neuerliche Filterung, sondern die Mails weden bestimmungsgemäß durch Postfix ausgeliefert. So, nun zum letzten Schritt, wir editieren die /etc/postfix/main.cf: p12345678:/usr/local/src # vi /etc/postfix/main.cf (Hier fügen wir folgende Zeile ein:([i])) content_filter = smtp-amavis:[127.0.0.1]:10024 (Jetzt wieder speichern, schließen [ESC]:wq[ENTER] und Postfix neu starten:) p12345678:/usr/local/src # rcpostfix restart (Nun wechseln wir in das amavisd-installationsverzeichnis und senden eine Testmail (mit Testvirus):) p12345678:/usr/local/src # cd amavisd-new-2.2.0/test-messages p12345678:/usr/local/src/amavisd-new-2.2.0/test-messages # sendmail info@meine_domain.de < samplevirus-simple.txt p12345678:/usr/local/src/amavisd-new-2.2.0/test-messages # Damit haben wir es vollbracht. Die versendete Testmail sollte eine Notification-Mail an den Postmaster erzeugt haben und die testweise verseuchte Mail darf natürlich bei info@meine_domain.de nicht angekommen sein. Daß Ihr AMaViS funktioniert erkennen Sie auch an zusätzlichen Header-Zeilen in jeder Mail: Received: from vscan-meine_domain (localhost.localdomain [127.0.0.1]) by p12345678.pureserver.info (Postfix) with ESMTP id B6F564901B8 for <web1p1@meine_domain.de>; Thu, 6 Jan 2005 14:51:32 +0100 (CET) Received: from p12345678.pureserver.info ([127.0.0.1]) by vscan-meine_domain (meine_domain.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 06361-01 for <web1p1@meine_domain.de>; Thu, 6 Jan 2005 14:51:31 +0100 (CET) sowie X-Virus-Scanned: amavisd-new at meine_domain.de Viel Spaß beim Installieren und ein Spam- und Viren- freies Postfach, ohne jegliche Garantie für das Funktionieren und die Fehlerfreiheit dieser Anleitung wünscht André [aly2000]