Linux/Mail/AMaViS の履歴(No.6)

そのまま使う設定ファイル

/etc/amavis/conf.d/01-debian
/etc/amavis/conf.d/30-template_localization
/etc/amavis/conf.d/50-user

/etc/amavis/conf.d/05-domain_id

< chomp($mydomain = `head -n 1 /etc/mailname`);
---
> chomp($mydomain = "hoge.org");

/etc/amavis/conf.d/05-node_id

< chomp($myhostname = `hostname --fqdn`);
---
> chomp($myhostname = "mail.hoge.org");

/etc/amavis/conf.d/15-av_scanners

! ['ClamAV-clamd',
!   \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
!   qr/\bOK$/m, qr/\bFOUND$/m,
!   qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
---
&ask_daemonの第2引数をclamavのソケットと合わせる

/etc/amavis/conf.d/15-content_filter_mode

< @bypass_spam_checks_maps = (
<   \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
---
> @bypass_spam_checks_maps = (1);

/etc/amavis/conf.d/20-debian_defaults

< $QUARANTINEDIR = "$MYHOME/virusmails";
< $quarantine_subdir_levels = 1; # enable quarantine dir hashing
---
> ###$QUARANTINEDIR = "$MYHOME/virusmails";
> ###$quarantine_subdir_levels = 1; # enable quarantine dir hashing
==================================================
< @keep_decoded_original_maps = (new_RE(
<   qr'^MAIL$',
<   qr'^MAIL-UNDECIPHERABLE$',
<   qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
<   qr'^Zip archive data',
< ));
---
> @keep_decoded_original_maps = (new_RE(
>   qr'^MAIL$',
>   qr'^MAIL-UNDECIPHERABLE$',
>   qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
> ###qr'^Zip archive data',
> ));
==================================================
! [1] $inet_socket_bind = '127.0.0.1';
! [2] $inet_socket_port = 10026;
! [3] $forward_method = 'smtp:[127.0.0.1]:10025';
! [4] $X_HEADER_TAG = 'X-Virus-Scanned';
! [5] $X_HEADER_LINE = "$myproduct_name at $mydomain";
! [6] $virus_admin = 'admin@mail.hoge.org';
! [7] $spam_admin = 'admin@mail.hoge.org';
---
[1] amavisの待ち受けるIPアドレス
[2] amavisの待ち受けるTCPポート番号
[3] ウイルス検査完了メールの転送先。例だとIP:127.0.0.1-TCP/10025に投げる
[4] ウイルス検査完了メールに付与するヘッダ
[5] ウイルス検査完了メールに付与するヘッダパラメータ
[6] ウイルスメールの転送先アドレス。ドメイン部を$mydomainに置き換え可能
[7] スパムメールの転送先アドレス。ドメイン部を$mydomainに置き換え可能
==================================================
$banned_filename_re = new_RE(
  # [1] Block certain double extensions anywhere in the base name
  qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,

  # [2] Windows Class ID CLSID, strict
  qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?$'i,

  # [3] Block these MIME types
  qr'^application/x-msdownload$'i,
  qr'^application/x-msdos-program$'i,
  qr'^application/hta$'i,

  # [4] Block these file extension
  qr'^(?!cid:).*\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i,
  qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)$'i,
  qr'^\.(exe-ms|dll)$',
);
---
[1] 二重拡張子の添付ファイルを遮断
[2] OSのCLSIDパラメータを遮断
[3] 添付ファイルのMIMEタイプで遮断
[4] 添付ファイルの拡張子で遮断

/etc/amavis/conf.d/25-amavis_helpers

< @mynetworks = qw( 127.0.0.1/32 );
---
> @mynetworks = qw( 127.0.0.1/32 10.0.0.1/32 );
---
@mynetworksはCIDR形式で記入する

/etc/amavisd/amavisd.conf

! [1] @bypass_virus_checks_maps = ( \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
! [2] @bypass_spam_checks_maps  = (1);
---
[1] ウイルスチェックを行う
[2] スパムメールチェックは行わない
==================================================
! [3] $lock_file = "/var/run/amavisd/amavisd.lock";
! [4] $pid_file  = "/var/run/amavisd/amavisd.pid";
---
[3] amavisd起動時のロックファイル
[4] amavisdのプロセス番号ファイル
==================================================
! [5] $log_level = 1;
! [6] $do_syslog = 1;
! [7] $syslog_facility = 'mail';
---
[5] amavisdのウイルスチェックログを記録
[6] amavisdのログをsyslogに出力
[7] syslogのfacilityを設定する
==================================================
<     \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamd.amavisd/clamd.sock"],
---
>     \&ask_daemon, ["CONTSCAN {}\n", "【clamavのソケットと同じにする】"],
==================================================
< $mydomain   = 'example.com';
---
> $mydomain   = 'hoge.org';
> $myhostname = 'mail.hoge.org';
 
< $QUARANTINEDIR   = undef;
---
> # $QUARANTINEDIR = undef;
 
< $db_home   = "$MYHOME/db";
---
> # $db_home = "$MYHOME/db";
 
< @mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 );
---
> @mynetworks = qw( 127.0.0.1/32 10.0.0.1/32 );
 
< $inet_socket_port = 10024;
---
> $inet_socket_bind = '127.0.0.1';
> $inet_socket_port = 10026;
 
< $virus_admin               = undef;
---
> $virus_admin               = 'admin@mail.hoge.org';
> $spam_admin                = 'admin@mail.hoge.org';
 
< $mailfrom_notify_admin     = undef;
< $mailfrom_notify_recip     = undef;
< $mailfrom_notify_spamadmin = undef;
---
> $mailfrom_notify_admin     = "virusalert\@$mydomain";
> $mailfrom_notify_recip     = "virusalert\@$mydomain";
> $mailfrom_notify_spamadmin = "spam.police\@$mydomain";
 
< # $notify_method  = 'smtp:[127.0.0.1]:10025';
---
> $forward_method   = 'smtp:[127.0.0.1]:10025';
> $notify_method    = '$forward_method';
 
< $X_HEADER_TAG  = 'X-Virus-Scanned';
< $X_HEADER_LINE = "$myproduct_name at $mydomain";
 
> $banned_filename_re = new_RE(
>   qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
>   qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?$'i,
>   qr'^application/x-msdownload$'i,
>   qr'^application/x-msdos-program$'i,
>   qr'^application/hta$'i,
>   qr'^(?!cid:).*\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i,
>   qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)$'i,
>   qr'^\.(exe-ms|dll)$',
> );

起動スクリプト調整

# vi /usr/lib/systemd/system/amavisd.service
---
[Unit]
Description=Amavisd-new is an interface between MTA and content checkers.
Documentation=http://www.ijs.si/software/amavisd/#doc
After=network.target
### Wants=clamd@amavisd.service
Wants=postfix.service

　
追加操作

# rm /etc/clamd.d/amavisd.conf
# vi /usr/lib/tmpfiles.d/amavisd-new.conf
# vi /usr/lib/tmpfiles.d/clamd.scan.conf