RHEL6服务器搭建结合杀毒软件clamav的Mail服务器
此文结合上一篇《RHEL6服务器Mail服务》进行部署
1、查看解析域名
# nslookup mail.cluster.com Server: 10.10.10.15 Address: 10.10.10.15#53 Name: mail.cluster.com Address: 10.10.10.15 # nslookup --验证邮件交换记录 > set type=mx > cluster.com --这里写域，不是域名 Server: 10.10.10.15 Address: 10.10.10.15#53 cluster.com mail exchanger = 0 10.10.10.15.
2、配置main.cf
# vim /etc/postfix/main.cf myhostname = mail.cluster.com mydomain = cluster.com myorigin = $mydomain inet_interfaces = all ---把原来的localhost注释掉 mydestination = $myhostname, localhost.$mydomain, localhost,$mydomain mynetworks =127.0.0.0/8,10.1.1.0/24,172.16.0.0/16
3、安装杀毒软件
（1）建立身份用户
# groupadd -g 108 clamav # useradd -g clamav -u 108 clamav
（2）安装和编译
# tar xvf clamav-0.97.6.tar.gz -C /usr/src # cd /usr/src/clamav-0.97.6 # ./configure # make -j2 && make install
4、配置
（1）配置病毒库和更新病毒库
#vim /usr/local/etc/freshclam.conf # Example ---删除或者注释掉 DatabaseDirectory /var/lib/clamav DatabaseOwner clamav ---病毒库相关文件的拥有者 DatabaseMirror db.cn.clamav.net DatabaseMirror database.clamav.net Checks 24 NotifyClamd /usr/local/etc/clamd.conf # mkdir -p /var/lib/clamav # chown clamav:clamav /var/lib/clamav/
# tar xvf clamav-db.tar -C /var/lib/clamav/ ----解压旧版本的病毒库
升级病毒库 # freshclam
（2）配置杀毒软件主配置文件
#vim /usr/local/etc/clamd.conf #Example LogFile /tmp/clamd.log PidFile /var/run/clamd.pid DatabaseDirectory /var/lib/clamav LocalSocket /tmp/clamd.socket User clamav 将启动脚本拷贝到相应目录 # cp /usr/local/sbin/clamd /etc/rc.d/init.d/ # chmod 755 /etc/rc.d/init.d/clamd 启动杀毒软件 # service clamd start # ls /tmp/clamd.socket /tmp/clamd.socket ---如有，就代表启动成功
（3）扫描病毒和删除病毒文件
# clamscan /usr/src/clamav-0.97.6/test/ 仅仅扫描 # clamscan --remove=yes /usr/src/clamav-0.97.6/test/ 删除感染了病毒的文件
5、将杀毒软件与postfix结合
（1）安装插件clamstmp
# tar xvf clamsmtp-1.10.tar.gz -C /usr/src # cd /usr/src/clamsmtp-1.10/ # ./configure && make -j 2 && make install # cp scripts/clamsmtpd.sh /etc/rc.d/init.d/clamstmpd # chmod 755 !$ # cp scripts/virus_action.sh /usr/local/bin/virus_action.sh # chmod 775 /usr/local/bin/virus_action.sh # cp doc/clamsmtpd.conf /usr/local/etc/
（2）编辑插件配置文件
# vim /usr/local/etc/clamsmtpd.conf OutAddress: 10026 ----把杀毒软件过滤后，没有问题的邮件发送本机10026端口 Listen: 0.0.0.0:10025 ClamAddress: /tmp/clamd.socket Header: X-Virus-Scanned: ClamAV using ClamSMTP Action: drop Quarantine: on User: clamav VirusAction: /usr/local/bin/virus_action.sh # vim /usr/local/bin/virus_action.sh file="/tmp/virus.log" dir="/tmp/quarantine/" # mkdir -p /tmp/quarantine/ # chown clamav:clamav /tmp/quarantine/ # /etc/rc.d/init.d/clamstmpd start ---没有返回报错就对了 # lsof -i:10025 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME clamsmtpd 32275 clamav 3u IPv4 98568 0t0 TCP *:10025 (LISTEN)
（3）配置postfix主配置文件
# vim /etc/postfix/master.cf
.......在配置文件最后添加：让postfix监听10026端口.....
scan unix - - n - 16 smtp
-o smtp_send_xforward_command=yes
-o smtp_enforce_tls=no
127.0.0.1:10026 inet n - n - 16 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks_style=host
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
# vim /etc/postfix/main.cf
content_filter = scan:[127.0.0.1]:10025 ---增加内容过滤的配置
总结：
mail邮件 ---> 25:Postfix ---> 10025：clamstmpd ---> /tmp/clamd.socket 杀毒软件来扫描 ----> 10026:Postfix
重启postfix，让配置生效
# service postfix restart
（4）测试
（1）发送一封本地普通邮件，然后查看杀毒软件是否已经成功和postfix结合。 #cat /var/mail/root From [email protected] Wed Oct 9 07:34:33 2013 Return-Path: <[email protected]> X-Original-To: [email protected] Delivered-To: [email protected] Received: from mail.cluster.com (localhost [127.0.0.1]) by mail.cluster.com (Postfix) with ESMTP id 99AC7E61FE for <[email protected]>; Wed, 9 Oct 2013 07:34:33 +0000 (GMT) Received: from ns1.cluster.com (localhost [127.0.0.1]) by mail.cluster.com (Postfix) with ESMTP id 7B168E61FD for <[email protected]>; Wed, 9 Oct 2013 07:34:33 +0000 (GMT) From: "abc" <[email protected]> To: [email protected] Subject: i am root Date: Wed, 9 Oct 2013 08:34:33 +0100 Message-Id: <[email protected]> X-Mailer: OpenWebMail 2.53 X-OriginatingIP: 192.168.140.1 (abc) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 X-Virus-Scanned: ClamAV using ClamSMTP -----这个头信息就是杀毒软件自动在每一封邮件中添加的，如果可以看到此头信息表示杀毒软件邮件和postfix结合成功 hhhhhhhhh hahahahhahaha （2）发送一封本地带有病毒的邮件 # mutt -f /var/mail/root --用root身份发发送远程邮件。 带病毒的邮件将会被杀毒软件截取存放到/tmp/quarantine/中 # ls /tmp/quarantine/ virus.1bSmxn -------此文件为病毒文件 可以cat一下此病毒文件 # cat /tmp/quarantine/virus.1bSmxn Received: by mail.cluster.com (Postfix, from userid 0) id 71E4EE5B2D; Wed, 9 Oct 2013 06:58:09 +0000 (GMT) Date: Wed, 9 Oct 2013 06:58:09 +0000 From: root <[email protected]> To: [email protected] Subject: hhhh you du Message-ID: <[email protected]> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="IS0zKkzwUGydFO0o" Content-Disposition: inline User-Agent: Mutt/1.5.20 (2009-12-10) --IS0zKkzwUGydFO0o Content-Type: text/plain; charset=us-ascii Content-Disposition: inline dhfsdhflasdjfasldf asdfhasdlfhsdlf sadkfhasdlfhas Content-Type: application/octet-stream Content-Disposition: attachment; filename="clam.7z" -----带病毒文件clam.7z，下面是病毒代码 Content-Transfer-Encoding: base64 N3q8ryccAAO+RgDk+AAAAAAAAABSAAAAAAAAAGbo8T8AJpaGHffyAWsCdZSPp7576Esp80t8 9288RTOTR2aUNxbIWCe6tJsSudsJfjIg6huLUZxwelrgmROyvJBSP3IkMNeRb2jg2uMPPFRt T8/tWOjESj58ReY/w248nmGHcmhtJN/5l2TbdpW0awdnh9i0E90t99cXzOD17wxkBpmRC2OS OIBcjweWvs1+5xghQ27pbjkVvZCLjCY6SsinhghLSeysGaEmhGlK6q489xZaGitz3geNaI/J eXNz9B6d9Q7VTW5OKcEOWxUe3ix7wD/tF+sSl1E09SsgUOV/TzhIs5kDP+Ku/uMoKDRCXrgG 7vyzdtQsn2lIAAEEBgABCYD4AAcLAQABIwMBAQVdAAABAAyCIAAICgH9PAfvAAAFARETAGMA bABhAG0ALgBlAHgAZQAAABQKAQAAAy33vhbKARUGAQAggKSBAAA= --IS0zKkzwUGydFO0o--
--------至此杀毒软件和postfix结合搭建mail服务器完成-------------------