19.7.7 邮件扫描器

dmtsai{at}linux{dot}vbird{dot}tsai

warning:amavisd-new-2.4.3-1.el4.rf.i386.rpm:V3 DSA signature:NOKEY,key ID 6b
Preparing...                ########################################### [100%]
        package perl-BerkeleyDB-0.31-1.el4.rf is already installed
        ....

[root@linux ～]# vi /etc/amavisd.conf
# 1.首先是关于系统设置的部分，包括主机与领域名称等的设置
$mydomain='vbird.tsai';          <==约在第20行，填写您的领域名
$MYHOME='/var/amavis';           <==约在第22行，这是amavis的默认目录
$inet_socket_port=10024;         <==约在第51行，默认启动的端口
$myhostname='linux.vbird.tsai';  <==约在第113行，改成您的主机名称
$notify_method ='SMTP:[127.0.0.1]:10025';  <==约在第116行，设置连接的端口
$forward_method='SMTP:[127.0.0.1]:10025';  <==约在第117行

# 2. 下面这几行约在第118行之后，用来作为找到病毒或广告邮件后的操作
# 如果您害怕不小心将重要文件删除了，建议先改成D_BOUNCE预先处理
$final_virus_destiny     =D_BOUNCE;  <==找到病毒时的操作
$final_banned_destiny    =D_BOUNCE;  <==找到禁止项目的操作
$final_spam_destiny      =D_PASS;    <==找到广告邮件的操作
$final_bad_header_destiny=D_PASS;    <==找到不良信件标头的操作
# 可以处理的操作主要有
#   D_PASS    无论邮件的内容是否有问题，该邮件都会传给收件者
#   D_DISCARD 邮件被丢弃，而且不会告知收件者与寄件者
#   D_BOUNCE  邮件不会传给收件者，但无法传递的信息会告知寄件者
#   D_REJECT  邮件不会传给收件者，但寄件者会收到拒绝的信息
# 鸟哥在这里由于担心误删一些数据，所以除了病毒与禁止项目会回传错误给寄件者外
# 其他两个先默认可以通过。等到以后邮件服务器用户觉得可以接收后
# 某些部分 (如病毒) 就可以改为 D_DISCARD 来直接丢弃了

# 3.决定病毒扫描的引擎，下面分别是主要与次要扫毒程序
@av_scanners=(                <==大约在309行，里面的项目全部注释
…
);
# 因为所有的病毒扫描引擎都没有安装

@av_scanners_backup=(         <==大约在626行，只要剩下下面这些
  ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
    '-dumb -archive -packed {}', [0,8], [3,6],
    qr/Infection: (.+)|\s+contains\s+(.+)$/ ],
…
);

[root@linux ～]# f-prot -verno
F-PROT ANTIVIRUS
Program version: 4.6.6
Engine version: 3.16.14

VIRUS SIGNATURE FILES
SIGN.DEF created 29 November 2006
SIGN2.DEF created 29 November 2006
MACRO.DEF created 27 November 2006
# 若出现如上的版本宣告，这表示f-port(注意文件名)可以顺利运行

[root@linux ～]# f-prot /ec/crontab
# 如果出现扫描的字样，表示这个软件可以开始进行扫描的工作

# 1. 手动实时在线更新方式
[root@linux ～]# /usr/local/f-prot/tools/check-updates.pl

# 2. 自动更新
[root@linux ～]# vi /etc/crontab
27 4,16 * * * root /usr/local/f-prot/tools/check-updates.pl -cron -quiet

[root@linux ～]# amavisd debug
…
# 下面在说明此软件所监听的接口、端口、执行者的UID/GID等
Nov 30 14:51:53 linux amavisd[3457]:Net::Server:
Binding to TCP port 10024 on 
host 127.0.0.1
Nov 30 14:51:53 linux amavisd[3457]: Net::Server: Setting gid to "102 102"
Nov 30 14:51:53 linux amavisd[3457]:Net::Server: Setting uid to "101"
Nov 30 14:51:53 linux amavisd[3457]:Net::Server:Setting up serialization via 
flock

# 下面在说明各个模块是否有被顺利的加载
Nov 30 14:51:54 linux amavisd[3457]: Module Amavis::Conf   2.072
Nov 30 14:51:54 linux amavisd[3457]: Module Archive::Tar   1.30
Nov 30 14:51:54 linux amavisd[3457]: Module Archive::Zip   1.16
…

# 下面在说明加载哪些资料
Nov 30 14:51:54 linux amavisd[3457]: Amavis::DB code      loaded
Nov 30 14:51:54 linux amavisd[3457]: Amavis::Cache code   loaded
…
Nov 30 14:51:54 linux amavisd[3457]: ANTI-VIRUS code      loaded
Nov 30 14:51:54 linux amavisd[3457]: ANTI-SPAM code       loaded
Nov 30 14:51:54 linux amavisd[3457]: ANTI-SPAM-SA code    loaded
Nov 30 14:51:54 linux amavisd[3457]: Unpackers code       loaded

# 这里说明的是一些文件解压缩的功能
Nov 30 14:51:54 linux amavisd[3457]: Found $file   at /usr/bin/file
Nov 30 14:51:54 linux amavisd[3457]: No $dspam,    not using it
Nov 30 14:51:54 linux amavisd[3457]: Internal decoder for .Mail
Nov 30 14:51:54 linux amavisd[3457]: Internal decoder for .asc
…
Nov 30 14:51:54 linux amavisd[3457]: Found secondary av scanner FRISK 
F-Prot Antivirus at /usr/local/bin/f-prot <==说明有找到 f-port
Nov 30 14:51:54 linux amavisd[3457]:
SpamControl:initializing Mail::SpamAssassin
Nov 30 14:51:56 linux amavisd[3457]: SpamControl: init_pre_fork done
…
# 最后按下Ctrl+C来结束这个debug界面

[root@linux ～]# /etc/init.d/amavisd start

# 测试一下amavisd启动的端口10024是否顺利运行
[root@linux ～]# Telnet 127.0.0.1 10024
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '_]'.
220 [127.0.0.1] ESMTP amavisd-new service ready
ehlo localhost
250-[127.0.0.1]
250-VRFY
250-PIPELINING
250-SIZE
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 XFORWARD NAME ADDR PROTO HELO
quit
221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel
Connection closed by foreign host.

[root@linux ～]# vi /etc/Postfix/Master.cf
# 这几行专门为了病毒、广告邮件作的接
# ====================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ====================================================================
SMTP-amavis unix -      -       n        -       2    SMTP
    -o SMTP_data_done_timeout=1200
    -o SMTP_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20

127.0.0.1:10025 inet n  -       n        -       -    SMTPd
    -o content_filter=
    -o SMTPd_restriction_classes=
    -o SMTPd_delay_reject=no
    -o SMTPd_Client_restrictions=permit_mynetworks,reject
    -o SMTPd_helo_restrictions=
    -o SMTPd_sender_restrictions=
    -o SMTPd_recipient_restrictions=permit_mynetworks,reject
    -o SMTPd_data_restrictions=reject_unauth_pipelining
    -o SMTPd_end_of_data_restrictions=
    -o mynetworks=127.0.0.0/8
    -o SMTPd_error_sleep_time=0
    -o SMTPd_soft_error_limit=1001
    -o SMTPd_hard_error_limit=1000
    -o SMTPd_Client_connection_count_limit=0
    -o SMTPd_Client_connection_rate_limit=0
    -o SMTPd_milters=
    -o local_header_rewrite_Clients=
    -o local_recipient_maps=
    -o Relay_recipient_maps=

[root@linux ～]# vi /etc/Postfix/main.cf
content_filter=SMTP-amavis:[127.0.0.1]:10024

[root@linux ～]# /etc/init.d/Postfix restart

[root@linux ～]# vi /etc/amavisd.conf
$sa_tag_level_deflt =5.0;             <==大约在第61行，将2改成5

[root@linux ～]# vi /etc/Mail/spamassassin/local.cf
required_hits 5                         <==它就是这个分数
report_safe 0
rewrite_header Subject [SPAM]         <==如果是广告邮件，标头会被改写

[root@linux ～]# /etc/init.d/amavisd restart

[root@linux ～]# Mail -s 'spam test' dmtsai <  \
> /usr/share/doc/spamassassin-3.0.6/sample-spam.txt
# 假设您的系统有个用户名为dmtsai ，您寄出广告邮件给它
# 然后用dmtsai收信，您会发现到该封信件的内容

[dmtsai@linux ～]$ Mail
>N 1 dmtsai@linux  Thu Nov 30 23:18  54/2065  "**SPAM** spam test"
#标头多出了一些东西。没错，信件标头会被改写
& 1
From dmtsai@linux.vbird.tsai  Thu Nov 30 23:18:24 2006
X-Original-To: dmtsai@linux.vbird.tsai
Delivered-To: dmtsai@linux.vbird.tsai
X-Quarantine-ID: 
From dmtsai@linux.vbird.tsai Thu Nov 30 23:18:24 2006
X-Original-To: dmtsai@linux.vbird.tsai
Delivered-To: dmtsai@linux.vbird.tsai
X-Quarantine-ID: 
X-Virus-Scanned: amavisd-new at vbird.tsai
X-Spam-Flag: YES
X-Spam-Score: 1001.148
X-Spam-Level: ***********************************************
X-Spam-Status: Yes, score=1001.148 tagged_above=5 required=6.31
        tests=[AWL=-2.025, DNS_FROM_RFC_ABUSE=0.374, GTUBE=1000,
        NO_RELAYS=-0.001, UNWANTED_LANGUAGE_BODY=2.8]
# 上面的特殊字体部分，第一行就是病毒扫描的证据
# 后面这几行则是运算广告邮件总结分数的结果，有趣吧

sa-learn --spam --mbox --dbpath /var/amavis/.spamassassin/ /root/Mail/spam

sa-learn --ham --mbox --dbpath /var/amavis/.spamassassin/ /root/mail/nospam

[root@linux ～]# vi /etc/amavisd.conf

  qr'_\.(exe-ms|dll)$',

  qr'_\.(dll)$',

qr'\.[_./]*[A-Za-z][_./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
  qr'.\.(exe|vbs|pif|scr|cpl)$'i,

  qr'\.[_./]*[A-Za-z][_./]*\.(vbs|pif|scr|cmd|com|cpl|dll)\.?$'i,
  qr'.\.(vbs|pif|scr|cpl)$'i,

[root@linux ～]# /etc/init.d/amavisd restart