Связка sendmail+clamav+spamassassin на Centos 5.1




Скачиваем исходники

clamav-0.92.1-1.rf.src.rpm
spamass-milter-0.3.1-5.fc8.i386.rpm


Установка

1.1 уже должны быть установлены вот эти пакеты:
spamassassin-3.1.9-1.el5.i386.rpm
sendmail-8.13.8-2.el5.i386.rpm
sendmail-devel-8.13.8-2.el5.i386.rpm
sendmail-cf-8.13.8-2.el5.i386.rpm
dovecot-1.0-1.2.rc15.el5.i386.rpm
spamass-milter-0.3.1-5.fc8.i386.rpm

1.2 Собираем rpm для clamav:

/root/
[root@localhost ~]# rpmbuild --rebuild clamav-0.92-1.rf.src.rpm
Устанавливается clamav-0.92-1.rf.src.rpm
предупреждение: InstallSourcePackage: Заголовок V3 DSA signature: NOKEY, key ID 6b8d79e6
предупреждение: пользователь dag не существует - используется root
предупреждение: группа dag не существует - используется root
предупреждение: пользователь dag не существует - используется root
предупреждение: группа dag не существует - используется root
предупреждение: пользователь dag не существует - используется root
предупреждение: группа dag не существует - используется root
предупреждение: пользователь dag не существует - используется root
предупреждение: группа dag не существует - используется root
Выполняется(%prep): /bin/sh -e /var/tmp/rpm-tmp.66639
+ umask 022
+ cd /usr/src/redhat/BUILD
+ LANG=C
+ export LANG
+ unset DISPLAY
+ cd /usr/src/redhat/BUILD
+ rm -rf clamav-0.92
+ tar -xvvf -
+ /bin/gzip -dc /usr/src/redhat/SOURCES/clamav-0.92.tar.gz
drwxrwxrwx 1000/1000         0 2007-12-13 02:32:38 clamav-0.92/
-rw-r--r-- 1000/1000        53 2007-12-06 15:59:10 clamav-0.92/FAQ
drwxrwxrwx 1000/1000         0 2007-12-13 02:32:38 clamav-0.92/etc/
-rw-r--r-- 1000/1000      1112 2007-12-06 15:59:09 clamav-0.92/etc/Makefile.am
-rw-r--r-- 1000/1000     10262 2007-12-13 02:06:48 clamav-0.92/etc/Makefile.in
-rw-r--r-- 1000/1000      9062 2007-12-06 15:59:09 clamav-0.92/etc/clamd.conf
-rw-r--r-- 1000/1000      3934 2007-12-06 15:59:09 clamav-0.92/etc/freshclam.conf
-rw-r--r-- 1000/1000        24 2007-12-06 15:59:10 clamav-0.92/BUGS
-rw-r--r-- 1000/1000       473 2007-12-13 01:32:54 clamav-0.92/NEWS
drwxrwxrwx 1000/1000         0 2007-12-13 02:32:38 clamav-0.92/docs/
..................................................................
Записан: /usr/src/redhat/RPMS/i386/clamav-0.92-1.rf.i386.rpm
Записан: /usr/src/redhat/RPMS/i386/clamd-0.92-1.rf.i386.rpm
Записан: /usr/src/redhat/RPMS/i386/clamav-milter-0.92-1.rf.i386.rpm
Записан: /usr/src/redhat/RPMS/i386/clamav-db-0.92-1.rf.i386.rpm
Записан: /usr/src/redhat/RPMS/i386/clamav-devel-0.92-1.rf.i386.rpm
Записан: /usr/src/redhat/RPMS/i386/clamav-debuginfo-0.92-1.rf.i386.rpm
Выполняется(%clean): /bin/sh -e /var/tmp/rpm-tmp.95040
+ umask 022
+ cd /usr/src/redhat/BUILD
+ cd clamav-0.92
+ /bin/rm -rf /var/tmp/clamav-0.92-1.rf-root
+ exit 0
Выполняется(--clean): /bin/sh -e /var/tmp/rpm-tmp.50391
+ umask 022
+ cd /usr/src/redhat/BUILD
+ rm -rf clamav-0.92
+ exit 0


Установка clamav
/usr/src/redhat/RPMS/i386/
[root@localhost i386]# ls | grep clam
clamav-0.92-1.rf.i386.rpm
clamav-db-0.92-1.rf.i386.rpm
clamav-debuginfo-0.92-1.rf.i386.rpm
clamav-devel-0.92-1.rf.i386.rpm
clamav-milter-0.92-1.rf.i386.rpm
clamd-0.92-1.rf.i386.rpm
[root@localhost i386]# rpm -ihv clam*.rpm
Подготовка...     ########################################### [100%]
   1:clamav-db              ########################################### [ 17%]
   2:clamav                 ########################################### [ 33%]
   3:clamd                  ########################################### [ 50%]
   4:clamav-debuginfo       ########################################### [ 67%]
   5:clamav-devel           ########################################### [ 83%]
   6:clamav-milter          ########################################### [100%]


Настройка

2.1 Создадим троих пользователей

/etc/mail/spamassassin
[root@localhost spamassassin]# useradd slava1 -s /sbin/nologin -g users -d /home/slava1
[root@localhost spamassassin]# useradd slava2 -s /sbin/nologin -g users -d /home/slava2
[root@localhost spamassassin]# useradd spam -s /sbin/nologin -g users -d /home/spam

2.2 spamassassin
/etc/mail/spamassassin
[root@localhost spamassassin]# cat local.cf
# These values can be overridden by editing ~/.spamassassin/user_prefs.cf
# (see spamassassin(1) for details)

# These should be safe assumptions and allow for simple visual sifting # without risking lost emails.
#Вводим нашу подсеть в группу доверенных trusted_networks 192.168.50.50.0/24 127/8 trusted_networks 127. whitelist_from localhost
#Устанавливаем порог спама 8 required_hits 8.0 report_safe 0
#Добавляем к теме письма rewrite_header Subject [SPAM] add_header all Report _REPORT_
whitelist_from localhost whitelist_from root whitelist_from MAILER-DAEMON whitelist_from *@spacedust.ru
#Скидываем весь спам юзеру spam all_spam_to spam@spacedust.ru

2.3 Создаем фаил sendmail.mc
/etc/mail/
divert(-1)dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`setup for linux')dnl
OSTYPE(linux)dnl
DOMAIN(generic)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
define(`confCW_FILE', `-o /etc/mail/local-host-names')dnl
FEATURE(mailertable, `hash -o /etc/mail/mailertable')dnl
FEATURE(access_db, `hash -o -T /etc/mail/access')dnl
FEATURE(virtusertable, `hash -o /etc/mail/virtusertable')dnl
FEATURE(local_procmail, `', `procmail -t -Y -a $h -d $u')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
define(`STATUS_FILE', `/var/log/mail/statistics')dnl
define(`confTO_IDENT', `0')dnl
define(`confTO_HELO', `1m')dnl
define(`confTO_MAIL', `1m')dnl
define(`confTO_RCPT', `1m')dnl
FEATURE(blacklist_recipients)dnl
FEATURE(`dnsbl',`sb1.spamhaus.org')dnl
FEATURE(`dnsbl', `relay.ordb.org')dnl
FEATURE(`dnsbl', `dul.ru')dnl
FEATURE(`dnsbl', `bl.spamcop.net')dnl
define(`confMAX_MESSAGE_SIZE', `12500000')dnl
define(`confMAX_DAEMON_SHILDREN', `45')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
dnl# SpamAssassin + ClamAv
INPUT_MAIL_FILTER(`spamassassin',`S=local:/var/run/spamass-milter/spamass-milter.sock, F=T, T=C:15m;S:4m;R:4m;E:10m')dnl
INPUT_MAIL_FILTER(`clmilter',`S=local:/var/clamav/clmilter.socket, F=T, T=C:15m;S:4m;R:4m;E:10m')dnl
define(`confMILTER_MACROS_CONNECT',`t, b, j, _, {daemon_name}, {if_name}, {if_addr}')dnl
define(`confMILTER_MACROS_HELO',`s, {tls_version}, {cipher}, {cipher_bits}, {cert_subject}, {cert_issuer}')dnl
define(`confMILTER_LOG_LEVEL',`6')dnl
define(`confINPUT_MAIL_FILTERS', `spamassassin,clmilter')dnl
FEATURE(`relay_based_on_MX')dnl
FEATURE(`relay_hosts_only')dnl
MASQUERADE_AS(spacedust.ru)dnl
MAILER(procmail)dnl
MAILER(smtp)dnl
divert(0)dnl

Очищаем буфер и создаем начало для нового файла макроса
divert(-1)dnl
divert(0)dnl

Подключаем макропроцессор m4, prochmail и SpamAssassin + Clamav
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl

FEATURE(local_procmail, `', `procmail -t -Y -a $h -d $u')dnl MAILER(procmail)dnl
INPUT_MAIL_FILTER(`spamassassin',`S=local:/var/run/spamass-milter/spamass-milter.sock, F=T, T=C:15m;S:4m;R:4m;E:10m')dnl INPUT_MAIL_FILTER(`clmilter',`S=local:/var/clamav/clmilter.socket, F=T, T=C:15m;S:4m;R:4m;E:10m')dnl define(`confMILTER_MACROS_CONNECT',`t, b, j, _, {daemon_name}, {if_name}, {if_addr}')dnl define(`confMILTER_MACROS_HELO',`s, {tls_version}, {cipher}, {cipher_bits}, {cert_subject}, {cert_issuer}')dnl define(`confMILTER_LOG_LEVEL',`6')dnl define(`confINPUT_MAIL_FILTERS', `spamassassin,clmilter')dnl

Указываем операционную систему
OSTYPE(linux)dnl

Включаем доменное имя во все адреса
FEATURE(always_add_domain)dnl

Выставляем timeout для команд IDENT, HELO, MAIL, RCPT
define(`confTO_IDENT', `0')dnl
define(`confTO_HELO', `1m')dnl
define(`confTO_MAIL', `1m')dnl
define(`confTO_RCPT', `1m')dnl

Включаем проверку по черным спискам
FEATURE(blacklist_recipients)dnl
FEATURE(`dnsbl',`sb1.spamhaus.org')dnl
FEATURE(`dnsbl', `relay.ordb.org')dnl
FEATURE(`dnsbl', `dul.ru')dnl
FEATURE(`dnsbl', `bl.spamcop.net')dnl

Sendamil будет принимать почту на основе MX записей DNS
FEATURE(`relay_based_on_MX')dnl

Параметр redirect позволяет sendmail выдавать сообщение об ошибке для пользователей, адреса которых были перенаправлены на другой хост с помощью метки .REDIRECT.
FEATURE(redirect)dnl

Параметр relay_hosts_only позволяет программе sendmail использовать в базе данных access.db имена хостов и объявлять их с помощью метки RELAY
FEATURE(`relay_hosts_only')dnl

Параметр use_ct_file позволяет программе sendmail, запущенной с параметром -f, читать из файла доверенных пользователей системы
Параметр use_cw_file позволяет программе sendmail читать из файла альтернативных имен для почтового сервера
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl

2.3 Правим файлы

/etc/mail/
[root@localhost mail]# cat local-host-names
# local-host-names - include all aliases for your machine here.
spacedust.ru

/etc/mail/
[root@localhost mail]# cat access
# Check the /usr/share/doc/sendmail/README.cf file for a description
# of the format of this file. (search for access_db in that file)
# The /usr/share/doc/sendmail/README.cf is part of the sendmail-doc
# package.
#
# by default we allow relaying from localhost...
Connect:localhost.localdomain           RELAY
Connect:localhost                       RELAY
Connect:127.0.0.1                       RELAY
192.168.50                              RELAY
To:root@                                OK
To:slava1@                              OK
To:slava2@                              OK
To:spacedust.ru                         ERROR:"550 User unknown"


Запускаем и проверяем

/etc/mail/
[root@localhost mail]# make
[root@localhost mail]# service clamd start
Starting Clam AntiVirus Daemon:                            [  OK  ]
[root@localhost mail]# service clamav-milter start
Starting Clamav Milter Daemon: Your LANG environment variable is set to 'ru_RU.UTF-8'
This is known to cause problems for some clamav-milter installations.
If you get failures with temporary files, please try again with LANG unset.
LibClamAV Warning: **************************************************
LibClamAV Warning: ***  The virus database is older than 7 days!  ***
LibClamAV Warning: ***   Please update it as soon as possible.    ***
LibClamAV Warning: **************************************************
Loaded ClamAV 0.92/5110/Wed Dec 12 23:42:31 2007
ClamAV: Protecting against 345659 viruses
                                                           [  OK  ]
[root@localhost mail]# freshclam
ClamAV update process started at Sun Apr 13 14:08:14 2008
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.92 Recommended version: 0.92.1
DON'T PANIC! Read http://www.clamav.net/support/faq
Downloading main-46.cdiff [100%]
main.inc updated (version: 46, sigs: 231834, f-level: 26, builder: sven)
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Current functionality level = 25, recommended = 26
DON'T PANIC! Read http://www.clamav.net/support/faq
WARNING: getfile: daily-5111.cdiff not found on remote server (IP: 62.181.41.8)
ERROR: getpatch: Can't download daily-5111.cdiff from db.ru.clamav.net
WARNING: getfile: daily-5111.cdiff not found on remote server (IP: 217.147.29.149)
ERROR: getpatch: Can't download daily-5111.cdiff from db.ru.clamav.net
WARNING: getfile: daily-5111.cdiff not found on remote server (IP: 217.20.175.83)
ERROR: getpatch: Can't download daily-5111.cdiff from db.ru.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
Downloading daily.cvd [100%]
daily.cvd updated (version: 6753, sigs: 22848, f-level: 26, builder: ccordes)
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Current functionality level = 25, recommended = 26
DON'T PANIC! Read http://www.clamav.net/support/faq
Database updated (254682 signatures) from db.ru.clamav.net (IP: 213.219.244.126)
Clamd successfully notified about the update.
[root@localhost mail]# service spamassassin start
Запускается spamd:                                         [  OK  ]
[root@localhost mail]# service spamass-milter start
Starting SpamAssassin milter (spamass-milter):             [  OK  ]
[root@localhost mail]# service sendmail start
Запускается sendmail:                                      [  OK  ]
Запускается sm-client:                                     [  OK  ]
[root@localhost mail]# service dovecot start
Запускается Dovecot Imap:                                  [  OK  ]

Apr 13 14:14:35 localhost sendmail[5579]: gethostbyaddr(192.168.50.175) failed: 1
Apr 13 14:14:35 localhost sendmail[5579]: alias database /etc/aliases rebuilt by root
Apr 13 14:14:35 localhost sendmail[5579]: /etc/aliases: 76 aliases, longest 10 bytes, 765 bytes total
Apr 13 14:14:35 localhost sendmail[5583]: gethostbyaddr(192.168.50.175) failed: 1
Apr 13 14:14:35 localhost sendmail[5584]: starting daemon (8.13.8): SMTP+queueing@01:00:00
Apr 13 14:14:35 localhost sm-msp-queue[5592]: starting daemon (8.13.8): queueing@01:00:00

slava1 посылает slava2

Apr 13 14:22:17 localhost sendmail[5850]: m3DAMHFr005850: from=, size=524, class=0, nrcpts=1, msgid=<1547344988.20080414143025@spacedust.ru>, proto=ESMTP, daemon=MTA, relay=[192.168.50.37]
Apr 13 14:22:17 localhost spamd[5280]: spamd: connection from localhost.localdomain [127.0.0.1] at port 2483
Apr 13 14:22:17 localhost spamd[5280]: spamd: setuid to sa-milt succeeded
Apr 13 14:22:17 localhost spamd[5280]: spamd: processing message <1547344988.20080414143025@spacedust.ru> for sa-milt:101
Apr 13 14:22:18 localhost spamd[5280]: spamd: clean message (-98.8/8.0) for sa-milt:101 in 0.2 seconds, 811 bytes.
Apr 13 14:22:18 localhost spamd[5280]: spamd: result: . -98 - ALL_TRUSTED,AWL,DATE_IN_FUTURE_12_24,USER_IN_WHITELIST scantime=0.2,size=811,user=sa-milt,uid=101,required_score=8.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=2483,mid=<1547344988.20080414143025@spacedust.ru>,autolearn=no
Apr 13 14:22:18 localhost spamd[5278]: prefork: child states: II
Apr 13 14:22:18 localhost sendmail[5854]: m3DAMHFr005850: to=, ctladdr= (502/100), delay=00:00:01, xdelay=00:00:00, mailer=local, pri=31300, dsn=2.0.0, stat=Sent

slava2 принял почту
Apr 13 14:24:23 localhost dovecot: pop3-login: Login: user=, method=PLAIN, rip=::ffff:192.168.50.37, lip=::ffff:192.168.50.175
Apr 13 14:24:23 localhost dovecot: POP3(slava2): Disconnected: Logged out top=0/0, retr=2/2842, del=2/2, size=2808

slava1 пытается послать письмо с вирусом slava2
Apr 13 14:30:03 localhost sendmail[5866]: m3DAU2dr005866: from=, size=15415, class=0, nrcpts=1, msgid=<654532184.20080414144355@spacedust.ru>, proto=ESMTP, daemon=MTA, relay=[192.168.50.37]
Apr 13 14:30:03 localhost spamd[5280]: spamd: connection from localhost.localdomain [127.0.0.1] at port 3504
Apr 13 14:30:03 localhost spamd[5280]: spamd: setuid to sa-milt succeeded
Apr 13 14:30:03 localhost spamd[5280]: spamd: processing message <654532184.20080414144355@spacedust.ru> for sa-milt:101
Apr 13 14:30:03 localhost spamd[5280]: spamd: clean message (-99.0/8.0) for sa-milt:101 in 0.3 seconds, 15911 bytes.
Apr 13 14:30:03 localhost spamd[5280]: spamd: result: . -98 - ALL_TRUSTED,AWL,DATE_IN_FUTURE_12_24,USER_IN_WHITELIST scantime=0.3,size=15911,user=sa-milt,uid=101,required_score=8.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=3504,mid=<654532184.20080414144355@spacedust.ru>,autolearn=no
Apr 13 14:30:03 localhost spamd[5278]: prefork: child states: II
Apr 13 14:30:14 localhost sendmail[5866]: m3DAU2dr005866: Milter: data, discard
Apr 13 14:30:14 localhost sendmail[5866]: m3DAU2dr005866: discarded