Dotaz: Jak donutit ClamAV k online scan mailu

[polo23]

Ahoj pouzivam postfix+dovecot+spamassassin+clamav. Potreboval bych doladit nekolik veci:

1) spamassassin nefunguje kdyz je v mailu priloha(soubor)

2) jak donutit ClamAV aby scanoval kazdy mail a popripade daval do hlavicky zpravu zda jde o virus ci ne.

Diky za rady

Odpovědi

[Martin H.]

Nainstaluj si amavis-new, ten řeší jak Spamy, tak Antivir - sám to tak používám.

V podstatě, po instalaci již ve výchozím nastavení je prakticky funkční - nezapomeň v postfixu nastavit content-filter. Instalace a nastavení amavisu se tu už řešilo, prohledej archiv ...

[Petr Bravenec]

Řeší to balík clamsmtpd - funguje to asi tak, že se nastartuje démon clamsmtpd, ten poslouchá na nějakém portu a slouží jako jednoduchý SMTP server. V postfixu se nastaví v souboru main.cf parametr content_filter a v master.cf způsob volání takového filtru. Nastavení filtru je v souboru /etc/clamsmtpd.conf, tam lze určit, co se zavirovanou poštou.

[polo23]

Vse jsem instaloval a konfiguroval podle tohoto navodu.... http://memberwebs.com/stef/software/clamsmtp/postfix.html nebylo na tom nic tezkeho .... clamsmtpd mi bezi ...problem je ze jsme v konfiguraku nastavil aby do hlavicky mailu napsal ze provedl antivirovou kontrolu. On to tam nezapisuje coz ve me vyvolava pochybnosti o tom ze je skutecne skenuje.

Nenapada vas v cem by mohl byt problem?

 

[polo23]

Tak v kombinaci postfix spamassassin clamav a clamsmtp ... jsem se dostal do stavu ze kdyz poslu zpravu tak ona zustane ulozena na serveru v adresari /var/spool/postfix/deffered/ ale klientovi se nedoruci. Muzete mi sem nekdo poslat konfiguraci master.cf. Myslim nekoho kdo pouziva clamsmtp,  popripade i direktivy co jste pridavali do main.cf. Diky

[Petr Bravenec]

Příslušný kus kódu v master.cf vypadá takto:

127.0.0.1:10026 inet n  -       n       -      16       smtpd
  -o content_filter=
  -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
  -o smtpd_helo_restrictions=
  -o smtpd_client_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o mynetworks_style=host
  -o smtpd_authorized_xforward_hosts=127.0.0.0/8

a příslušný kus kódu v main.cf takto:

content_filter = scan:[127.0.0.1]:10025

[polo23]

No tak to mam presne stejne... ted jsme posleni krok pred resenim ale za boha na to nemuzu prijit. Popisu strucne situaci: Poslu mail z Thunderbirda - mail se v poradku odesle. Na prijem pouzivam IMAP. Kdyz TB spoustim napisu heslo prihlasim se a maily ktere mam na serveru ulozene muzu cist. Bohuzel mail ktery odeslu nedojde. Dival jsem se na server do fronty /var/spool/postfix/active a ten mail tam je. Po nejake dobe zmizi a v adresari /var/spool/postfix/flush je soubor mydomain.cz(moje domena) no a v nem pribude zaznam ID cislo toho mailu ... odhaduju ze po nejake dobe jsou ty maily z fronty proste zahazovany misto aby byly doruceny.

Kdyz z cele te kombinace programu ktere pouzivam odstarnim clamsmtp tak to funguje...

[polo23]

Vim ze je to trochu extrem ale nepoznali byste z logu ktera bije? Ja podle toho vypisu nedokazu chybu diagnostikovat:(( Tady je vypis: Jeste dodam ze 10.0.0.1 je adresa serveru(SMTP i IMAP) a 10.0.0.35 je moje adresa(Thundebird). Mam v nem 3 ucty (test(pop3) pavel a xmulle14(imap)) mezi nima si posilam maily pres ten server(je to testovaci). Server je centos postfix dovecot clamAV clamsmtp

 

Jul 30 16:40:08 localhost postfix/postfix-script: stopping the Postfix mail system
Jul 30 16:40:08 localhost postfix/master[6298]: terminating on signal 15
Jul 30 16:40:09 localhost postfix/postfix-script: warning: group or other writable: /etc/postfix/./maillog
Jul 30 16:40:09 localhost postfix/postfix-script: starting the Postfix mail system
Jul 30 16:40:09 localhost postfix/master[6745]: daemon started -- version 2.3.3, configuration /etc/postfix
Jul 30 16:40:10 localhost postfix/qmgr[6747]: EAB763248F: from=<pavel@mydomain.cz>, size=521, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 27D4A3248B: from=<test@mydomain.cz>, size=822, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: warning: connect to transport 127.0.0.0: No such file or directory
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 2A97E3249A: from=<pavel@mydomain.cz>, size=516, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 2A97E3249A: to=<xmulle14@mydomain.cz>, relay=none, delay=26524, delays=26524/0.07/0/0, dsn=4.3.0, status=deferred (mail transport unavailable)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 23C3B3249B: from=<test@mydomain.cz>, size=852, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 881CB32493: from=<pavel@mydomain.cz>, size=520, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: A6F103249E: from=<pavel@mydomain.cz>, size=950, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: A88CA32490: from=<xmulle14@mydomain.cz>, size=2635, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: ABD94323C1: from=<pavel@mydomain.cz>, size=507, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 15CB132499: from=<pavel@mydomain.cz>, size=966, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 1ECFD3248C: from=<pavel@mydomain.cz>, size=834, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 56C41324A6: from=<pavel@mydomain.cz>, size=1386781, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: C037F32495: from=<pavel@mydomain.cz>, size=525, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 6CF523248E: from=<xmulle14@mydomain.cz>, size=2560, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 65219324A0: from=<pavel@mydomain.cz>, size=862, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 0436F3248A: from=<pavel@mydomain.cz>, size=819, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 39C9F3248D: from=<pavel@mydomain.cz>, size=843, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 76987324A2: from=<pavel@mydomain.cz>, size=514, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 4879632494: from=<test@mydomain.cz>, size=509, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost postfix/qmgr[6747]: 4A8503249F: from=<pavel@mydomain.cz>, size=961, nrcpt=1 (queue active)
Jul 30 16:40:10 localhost clamsmtpd: 100001: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 100002: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 100003: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 100004: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 100005: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 100006: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 100007: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 100008: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 100009: accepted connection from: 127.0.0.1
Jul 30 16:40:10 localhost clamsmtpd: 10000A: accepted connection from: 127.0.0.1
Jul 30 16:40:11 localhost dovecot: pop3-login: Login: user=<test>, method=PLAIN, rip=::ffff:10.0.0.35, lip=::ffff:10.0.0.1, TLS
Jul 30 16:40:11 localhost dovecot: POP3(test): Disconnected: Logged out top=0/0, retr=0/0, del=0/7, size=14573
Jul 30 16:40:11 localhost postfix/master[6745]: warning: process /usr/libexec/postfix/smtpd pid 6755 exit status 1
Jul 30 16:40:11 localhost postfix/master[6745]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling
Jul 30 16:40:12 localhost dovecot: imap-login: Login: user=<pavel>, method=PLAIN, rip=::ffff:10.0.0.35, lip=::ffff:10.0.0.1, TLS
Jul 30 16:40:14 localhost postfix/smtpd[6780]: connect from unknown[10.0.0.35]
Jul 30 16:40:14 localhost postfix/cleanup[6783]: warning: regexp map /etc/postfix/mime_headers_checks, line 8: ignoring unrecognized request
Jul 30 16:40:14 localhost postfix/smtpd[6780]: 7B20D32496: client=unknown[10.0.0.35]
Jul 30 16:40:14 localhost postfix/cleanup[6783]: 7B20D32496: message-id=<4A71B10A.1020708@mydomain.cz>
Jul 30 16:40:14 localhost postfix/qmgr[6747]: 7B20D32496: from=<pavel@mydomain.cz>, size=573, nrcpt=1 (queue active)
Jul 30 16:40:14 localhost postfix/smtpd[6780]: disconnect from unknown[10.0.0.35]
Jul 30 16:40:15 localhost dovecot: imap-login: Login: user=<pavel>, method=PLAIN, rip=::ffff:10.0.0.35, lip=::ffff:10.0.0.1, TLS
Jul 30 16:40:21 localhost dovecot: imap-login: Login: user=<xmulle14>, method=PLAIN, rip=::ffff:10.0.0.35, lip=::ffff:10.0.0.1, TLS
Jul 30 16:40:25 localhost postfix/pipe[6784]: 7B20D32496: to=<xmulle14@mydomain.cz>, relay=spamfilter, delay=11, delays=0.19/0.12/0/11, dsn=2.0.0, status=sent (delivered via spamfilter service)
Jul 30 16:40:25 localhost postfix/qmgr[6747]: 7B20D32496: removed
Jul 30 16:40:25 localhost postfix/pickup[6746]: E0F4132496: uid=503 from=<pavel@mydomain.cz>
Jul 30 16:40:25 localhost postfix/cleanup[6783]: E0F4132496: message-id=<4A71B10A.1020708@mydomain.cz>
Jul 30 16:40:25 localhost postfix/qmgr[6747]: E0F4132496: from=<pavel@mydomain.cz>, size=911, nrcpt=1 (queue active)
Jul 30 16:40:31 localhost dovecot: pop3-login: Login: user=<test>, method=PLAIN, rip=::ffff:10.0.0.35, lip=::ffff:10.0.0.1, TLS
Jul 30 16:40:31 localhost dovecot: POP3(test): Disconnected: Logged out top=0/0, retr=0/0, del=0/7, size=14573
Jul 30 16:40:42 localhost dovecot: pop3-login: Login: user=<test>, method=PLAIN, rip=::ffff:10.0.0.35, lip=::ffff:10.0.0.1, TLS
Jul 30 16:40:42 localhost dovecot: POP3(test): Disconnected: Logged out top=0/0, retr=0/0, del=0/7, size=14573

[Petr Bravenec]

Přílohy:

• clamsmtpd.conf (1603 bytů)
• email-virus-notice.sh (1246 bytů)

Hmmm, moc se v tom nevyznám, je to už chvíla, co jsem clamav nastavoval. Ale clamsmtpd se viditelně volá. Proti mým logům tam ale rozdíl je:

Jul 31 07:02:46 picaboj clamsmtpd: 1014A2: accepted connection from: 127.0.0.1
Jul 31 07:02:46 picaboj clamsmtpd: 1014A2: from=XXXX@XXXXXX.cz, to=XXXX@XXXXXX.cz, status=CLEAN

Přiložil jsem vám pro studijní účely vlastní konfigurák clamsmtpd.