Difference between revisions of "HowTos/Amavisd"
m (→Configuring sendmail) |
m (→Configuring sendmail) |
||
| Line 126: | Line 126: | ||
== Configuring sendmail == | == Configuring sendmail == | ||
| − | |||
=== Common === | === Common === | ||
Revision as of 09:18, 9 June 2006
Contents
Introduction
I decided to use amavisd-new with Scalix partly because I already had a fair bit of experience using it, but also because I like the way it keeps configuration for both virus & spam filtering largely under one roof & away from Scalix. It also, in my opinion, gives more readily comprehensible control of spam/virus actions (reject, quarantine, etc).
This HOWTO details a setup that uses amavisd-new to do both spam & virus scanning & should be followed in place of the following procedures:
- Scalix Knowledgebase: ScalixReady - SpamAssassin in a Scalix Environment (126747) [RH/FC]
- Scalix Knowledgebase: Configuring SpamAssassin on SuSE Systems (165119) [SuSE]
- Scalix Administration Guide Chapter 18: Virus & Spam Protection (Configuring Scalix Virus Protection)
Test platforms
- Scalix CE on Fedora Core 4
- Scalix CE on CentOS 4
Prerequesites
You'll obviously need the amavisd-new package, plus spamassassin & clamd to do the spam/virus detection if you haven't already got them.
The sendmail-cf package provides the m4 program used to rebuild sendmail.cf. Likely as not you have this already but check!
The gcc & sendmail-devel packages are required to compile amavisd-milter.
Installing amavisd-milter
Firstly, DO NOT install the amavisd-new-milter binary package - despite the 'new' tag this is a different, older version that lacks the ability to add anything other than a hard-coded 'virus scanned by amavisd-new-milter' to the message headers. As a consequence of this it's pretty useless if you want to sort messages into Spam folders downstream.
As far as I'm aware there's no binary package available for amavisd-milter but it's an quick & easy compile, just grab the source from: http://sourceforge.net/project/showfiles.php?group_id=138169 and do the usual:
cd /usr/local/src && tar xvzf /path/to/amavisd-milter-1.x.x.tar.gz cd amavisd-milter-1.x.x ./configure && make && sudo make install
Assuming you compiled in /usr/local/src and ran the commands above, the binary will be installed in /usr/local/sbin
Configuring amavisd-new
The config file for amavisd-new is fairly huge, but don't be put off as most of the values can safely stay at the defaults. The critical ones to add/edit/uncomment/comment are:
$protocol = "AM.PDP"; # Use AM.PDP protocol.
$unix_socketname = "$MYHOME/amavisd.sock"; # uncomment when using milter.
#$inet_socket_port = 10024; #comment out with milter.
$notify_method = 'pipe:flags=q argv=/usr/sbin/sendmail -Ac -i -odd -f ${sender} -- ${recipient}';
$forward_method = undef; #must be set like this with sendmail milter.
$mydomain='example.com #Your domain
$myhostname='cosmo.example.com #The FQDN of the Scalix host
$virusadmin='virusalert\@$mydomain #NDR recipient if virus found
$virusadmin='virusalert\@$mydomain #The sender address for NDRs
This lines below control how amavisd-new will respond to the spam scores from SA. I set the first to undef so that the info headers are always added even if the message is deemed 'ham' (if your box is heavily-loaded you'll probably want to change this after debugging). The second sets the 'is spam' score, above which SA will add the 'X-Spam-Status: Yes' header & (optionally) rewrite the subject line, prepending whatever you define with $sa_spam_subject_tag. You'll probably want to leave the next three commented to prevent amavisd-new doing anything extreme with mail until you're comfortable with the setup. Set the last to undef if you want to leave subject lines alone for spam mail.
$sa_tag_level_deflt = undef; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 3.4; # add 'spam detected' headers at that level #sa_kill_level_deflt = 6.31; # triggers spam evasive actions #sa_dsn_cutoff_level = 9; # spam level beyond which a DSN is not sent #$sa_quarantine_cutoff_level = 20; # spam level beyond which quarantine is off $sa_spam_subject_tag = '[SPAM] '; # Prepended to the subject line if defined.
The following line is analogous to /etc/mail/local-host-names in as far which messages amavisd-new will hand off to spamassassin for checking (all mail is virus scanned). By default it will be set the the value of '$mydomain':
@local_domains_maps = ( [".$mydomain"] );
But you can add additional domains in a variety of ways, eg:
@local_domains_maps = ( [".$mydomain", ".foo.com"] );
See the documentation for more details.
Finally, uncomment the code near the bottom that tells amavis to use the clamd daemon and edit the value /var/run/clamav/clamd to read /var/run/clamav/clamd.sock (matching the value in /etc/clamav.conf)
### http://www.clamav.net/ ['ClamAV-clamd', \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.sock"], qr/\bOK$/, qr/\bFOUND$/, qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
Initscripts/Sysconfig files for amavisd & amavisd-milter
Since originally posting the combined amavisd/milter script/config I've observed that yum has a tendency to stomp on any customised init. scripts when upgrading, so I've separated the milter stuff off into a separate script/config.
NB: Before using the amavisd-milter scripts below, check that the amavisd scripts installed by your package manager don't already contain the code necessary to start the milter:
http://www.redcircleit.com/public/scripts/amavisd-milter-init.txt
http://www.redcircleit.com/public/scripts/amavisd-milter-sysconfig.txt
If necessary, copy the above files to /etc/init.d/amavisd-milter & /etc/sysconfig/amavsid-milter respectively & do:
sudo chkconfig --add amavisd-milter
The standalone amavisd script/config (with the milter stuff removed) is here for completeness but I recommend sticking with the ones installed by your package manager.
http://www.redcircleit.com/public/scripts/amavisd-init.txt
http://www.redcircleit.com/public/scripts/amavisd-sysconfig.txt
If you need them copy to /etc/init.d/amavisd & /etc/sysconfig/amavsid respectively & do:
sudo chkconfig --add amavisd
Configuring sendmail
Common
Virus notification mails are deferred to avoid the the milter being called twice. This means that if amavisd catches an infected mail the '$virusadmin' user won't be sent the notification until the queue is next run, which by default is every hour. Therefore, edit /etc/sysconfig/sendmail & set the queue runner to a reasonably low value at least for debugging, e.g.
QUEUE=1m
With sendmail.mc (preferred)
These instructions are suitable for systems that configure sendmail using sendmail.mc. Distros that do this out of the box inlcude RHEL, CentOS & Fedora Core.
Backup sendmail.cf & sendmail.mc & then edit sendmail.mc, adding the following two lines at the end of the file:
define(`MILTER', 1)dnl INPUT_MAIL_FILTER(`milter-amavis', `S=local:/var/amavis/amavisd-milter.sock, F=T, T=S:10m;R:10m;E:10m')dnl
NB: The suggested lines in the amavisd-milter manpage seem a bit broken!
Rebuild sendmail.cf:
sudo sh -c "m4 sendmail.mc > sendmail.cf"
Run omsendin to reinsert the Scalix mods:
sudo omsendin
Without sendmail.mc
These instructions are suitable for systems that don't use sendmail.mc to configure sendmail.cf, but delegate this task to a tool such as YAST2. Distros that do this out of the box include SuSE.
TODO.
Configuring clamd
Firstly, check that during the installation of clamd that the clamav user was made a member of the amavis group (it needn't be its primary group):
groups clamav
And if not add it with something like:
sudo gpasswd -a clamav amavis
Then, edit /etc/clamav.conf, [un]commenting or changing:
LocalSocket /var/run/clamav/clamd.sock #Must match value in /etc/amavisd.conf #TCPSocket 3310 #Only use one connection method or clamd won't start. AllowSupplementaryGroups #Avoids a raft of permission issues! FixStaleSocket
Then edit /etc/freshclam.conf
UpdateLogFile /var/log/clamav/freshclam.log PidFile /var/clamav/freshclam.pid NotifyClamd
Configuring Scalix
Backup /var/opt/scalix/sys/smtpd.cfg and add the following line to the end:
SMTPFILTER=TRUE
Starting it all up
sudo service spamassassin start sudo service clamd start sudo service amavisd-milter start sudo service amavisd start
Restart sendmail:
sudo service sendmail restart
Restart the Scalix SMTP Relay:
sudo omoff -d0 smtpd && sudo omon smtpd
Debugging
Tail /var/log/maillog and try sending clean, virus and spam mails e.g.
mail -s test me@example.com < clean.txt mail -s test me@example.com < eicar.sig mail -s test me@example.com < gtube.txt
Check the headers of your received mails & your virusadmin mailbox, debug.
There's lots of useful information here, particularly concerning SA integration:
http://www.ijs.si/software/amavisd/
NB: If you encounter any permission errors when debugging, DO NOT attempt to solve them by changing the permissions on /var/amavis away from 0750 - for security reasons milters insist that the work directory is not world-readable or group-writable.
Support
Whilst this isn't an 'officially supported' configuration, it is almost identical to the Scalix/Spamass-milter setup (as detailed in the Tech Note) in the way it interfaces with Scalix/Sendmail & so should be reasonably 'supportable'. I'm pretty active on the support forum, at least for the moment, so will do what I can to keep this document updated & help with issues.
Credits
Big thanks to STrRedWolf for the Scalix/Amavisd-New (using Postfix) HOWTO which enabled me to get a working mailscanning setup up & running in the first place! Whilst the postfix setup still has some advantages (easy integration with Mailguard for one) I hope that this HOWTO will give most users the goodness of amavisd without having to use an additional MTA.
