Postfix通过clamsmtp独立运行Clamav

  linux开源邮件系统典型反垃圾方案就是Postfix+Clamav+Amavisd-new+Spamassassin, Amavisd-new调度Clamav和Spamassassin，本文通过clamsmtp将Clamav独立出来,作为postfix单独的content_filter运行，将反病毒和反垃圾分离。

  clamstmp主页：http://thewalter.net/stef/software/clamsmtp/

简介

ClamSMTP is an SMTP filter that allows you to check for viruses using the ClamAV anti-virus software. It accepts SMTP connections and forwards the SMTP commands and responses to another SMTP server. The 'DATA' email body is intercepted and scanned before forwarding.

It aims to be lightweight, reliable, and simple rather than have a myriad of options. It's written in C without major dependencies. If you need more options then you could use something big like AMaViS which is written in PERL and can do almost anything.

目的

我们要实现的邮件流转流程如下:

Internet-Postfix -> Amavisd-new -> Postfix -> Clamsmtpd -> Postfix -> User

Amavisd-new在10028端口监听,并通过10027端口返回
Clamsmtpd在10025端口(不能是其它端口)监听,并通过10026端口返回

安装clamsmtp

tar zxf clamsmtp-1.10.tar.gz
cd clamsmtp-1.10
./configure
make
make install

配置

修改postfix的配置文件main.cf，在此处定义过滤的入口点:

content_filter = amavisfeed:[127.0.0.1]:10028

修改amavisd-new的配置文件amavisd.conf，将邮件返回:

$inet_socket_port = 10028;
$notify_method = 'smtp:[127.0.0.1]:10027';
$forward_method = 'smtp:[127.0.0.1]:10027';

修改amavisd-new的配置文件amavisd.conf, 注释掉clamd那几行，在amavisd-new中去掉对clamav的调用：

# ['ClamAV-clamd',
# &ask_daemon, ["CONTSCAN {}n", "/var/run/clamav/clamd"], //将/var/run/clamav/clamd.socket改成/var/run/clamav/clamd
# qr/bOK$/m, qr/bFOUND$/m,
# qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
# ['Mail::ClamAV', &ask_clamav, "*", [0], [1], qr/^INFECTED: (.+)/m ],

修改postfix的配置文件master.cf:

amavisfeed unix - - n - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20

127.0.0.1:10027 inet n - n - - smtpd
-o content_filter=scan:[127.0.0.1]:10025
scan unix - - n - 2 smtp
-o smtp_send_xforward_command=yes
-o smtp_enforce_tls=no

127.0.0.1:10026 inet n - n - - smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o local_header_rewrite_clients=

建立配置文件/etc/clamsmtp.conf, 内容如下:

OutAddress:127.0.0.1:10026
User:amavis

修改Clamav 的配置文件clamd.conf:

LocalSocket /var/run/clamav/clamd

重启clamd,amavisd,postfix

启动后台进程:

clamsmtpd -f /etc/clamsmtpd.conf

设置开机启动:

echo "/usr/local/sbin/clamsmtpd -f /etc/clamsmtpd.conf" >>/etc/rc.local

这样就完成了我们的改造，现在反病毒模块和反垃圾模块是分离的了。