一、 假設下列套件褲1.、2.皆有安裝

      1.安裝EPEL Extra Packages for Enterprise Linux repository configuration

      2.安裝RPMforge

二、更新套件庫

      yum -y update

三、再檢查clam資料是否存在於套件庫

[root@dns yum.repos.d]# yum list | grep clam
clamav.i686                              0.98-2.el6                     epel    
clamav.x86_64                            0.98-2.el6.rf                  rpmforge
clamav-db.x86_64                         0.98-2.el6.rf                  rpmforge
clamav-devel.i686                        0.98-2.el6                     epel    
clamav-devel.x86_64                      0.98-2.el6.rf                  rpmforge
clamav-milter.x86_64                     0.98-2.el6.rf                  rpmforge
clamav-unofficial-sigs.noarch            3.7.1-6.el6                    epel    
clamd.x86_64                             0.98-2.el6.rf                  rpmforge
clamsmtp.x86_64                          1.10-6.el6                     epel    
clamtk.noarch                            4.25-1.el6.rf                  rpmforge
clamz.x86_64                             0.5-0.el6                      epel    
claws-mail-plugins-clamd.x86_64          3.9.0-2.el6                    epel

四、確認存在後安裝 clamd,就會安裝相依的程式

[root@dns yum.repos.d]# yum install clamd
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
 * base: mirrors.grandcloud.cn
 * epel: ftp.cuhk.edu.hk
 * extras: mirrors.btte.net
 * rpmforge: ftp.kddilabs.jp
 * updates: mirror.esocc.com
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package clamd.x86_64 0:0.98-2.el6.rf will be installed
--> Processing Dependency: clamav = 0.98-2.el6.rf for package: clamd-0.98-2.el6.rf.x86_64
--> Processing Dependency: libclamav.so.6(CLAMAV_PRIVATE)(64bit) for package: clamd-0.98-2.el6.rf.x86_64
--> Processing Dependency: libclamav.so.6(CLAMAV_PUBLIC)(64bit) for package: clamd-0.98-2.el6.rf.x86_64
--> Processing Dependency: libclamav.so.6()(64bit) for package: clamd-0.98-2.el6.rf.x86_64
--> Running transaction check
---> Package clamav.x86_64 0:0.98-2.el6.rf will be installed
--> Processing Dependency: clamav-db for package: clamav-0.98-2.el6.rf.x86_64
--> Running transaction check
---> Package clamav-db.x86_64 0:0.98-2.el6.rf will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package           Arch           Version                Repository        Size
================================================================================
Installing:
 clamd             x86_64         0.98-2.el6.rf          rpmforge         147 k
Installing for dependencies:
 clamav            x86_64         0.98-2.el6.rf          rpmforge         2.2 M
 clamav-db         x86_64         0.98-2.el6.rf          rpmforge          34 M

Transaction Summary
================================================================================
Install       3 Package(s)

Total download size: 37 M
Installed size: 42 M
Is this ok [y/N]: y
Downloading Packages:
(1/3): clamav-0.98-2.el6.rf.x86_64.rpm                   | 2.2 MB     00:05     
(2/3): clamav-db-0.98-2.el6.rf.x86_64.rpm                |  34 MB     02:10     
(3/3): clamd-0.98-2.el6.rf.x86_64.rpm                    | 147 kB     00:00     
--------------------------------------------------------------------------------
Total                                           274 kB/s |  37 MB     02:17     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : clamav-db-0.98-2.el6.rf.x86_64                               1/3
  Installing : clamav-0.98-2.el6.rf.x86_64                                  2/3
  Installing : clamd-0.98-2.el6.rf.x86_64                                   3/3
  Verifying  : clamav-0.98-2.el6.rf.x86_64                                  1/3
  Verifying  : clamd-0.98-2.el6.rf.x86_64                                   2/3
  Verifying  : clamav-db-0.98-2.el6.rf.x86_64                               3/3

Installed:
  clamd.x86_64 0:0.98-2.el6.rf                                                  

Dependency Installed:
  clamav.x86_64 0:0.98-2.el6.rf         clamav-db.x86_64 0:0.98-2.el6.rf        

Complete!

五、編輯/etc/clamd.conf

      註記掉#TCPSocket 3310

      重新啟動clam 

      /etc/init.d/clamd start

      更新病毒碼

      freshclam

     或設定為每一天自動更新一次病毒碼

     freshclam -d -c 2

六、自動執行clam

[root@dns etc]# chkconfig clamd on
[root@dns etc]# chkconfig --list | grep clamd
clamd              0:關閉    1:關閉    2:開啟    3:開啟    4:開啟    5:開啟    6:關閉

七、ClamAV的圖形介面ClamTK

      於 http://code.google.com/p/clamtk/ 

      下載檔案安裝即可

八、安裝SpamAssassin

      1.yum install spamassassin

      2.備份設定檔 /etc/mail/spamassassin/local.cf

      3.設定local.cf

         檢視可設定參數  perldoc Mail::SpamAssassin::Conf

         設定內容

         required_hits 5
         report_safe 0    # 就算是spam也不要修改mail body
         rewrite_header Subject [SPAM]
         use_bayes 1
         bayes_auto_learn 1
         skip_rbl_checks 0
         use_razor2 1                           #must install razor2 plugin
         use_dcc 1                                #must install dcc plugin
         use_pyzor 1                            #must install pyzoe plugin
         ok_languages all                   #check all languages
         ok_locales all          

     4.安裝其他垃圾信件程式與spamassassin協同作業

        先安裝razor2、pyzor、razor-agents與perl-Razor-Agent

        yum install pyzor

        yum install perl-Razor-Agent

        yum install razor-agents

        DCC必須在九、amavisd-new完成後再執行安裝DCC

        下載最新版DCC http://www.rhyolite.com/dcc/source/dcc.tar.Z 

        tar xzvf dcc.tar.Z //目前版本是dcc-1.3.152

        cd dcc-1.3.152

        ./configure --with-uid=amavis 

        //amavis帳號在九、amavisd-new才會建立完成

        make

        make install

        chown -R amavis:amavis /var/dcc

     //amavis群組與帳號在九、amavisd-new才會建立完成

        ln -s /var/dcc/libexec/dccifd /usr/local/bin/dccifd

 

        pyzor http://sourceforge.net/apps/trac/pyzor/

        razor http://razor.sourceforge.net/

        dcc http://www.rhyolite.com/dcc/

 

     5.確認/etc/mail/spamassassin/v310.pre 檔案中下列沒備註解掉,若有請移除註解

        loadplugin Mail::SpamAssassin::Plugin::DCC
        loadplugin Mail::SpamAssassin::Plugin::Pyzor
        loadplugin Mail::SpamAssassin::Plugin::Razor2
        loadplugin Mail::SpamAssassin::Plugin::AWL
        loadplugin Mail::SpamAssassin::Plugin::TextCat

     6.檢查設定參數是否正確 spamassassin -x -D --lint

        檢測發現有模組未安裝訊息如下......

        11月 15 15:58:03.192 [27247] dbg: diag: [...] module not installed: Mail::SPF ('require' failed)
        11月 15 15:58:03.192 [27247] dbg: diag: [...] module not installed: IP::Country::Fast ('require' failed)
        11月 15 15:58:03.192 [27247] dbg: diag: [...] module not installed: Net::Ident ('require' failed)

        執行指令perl -MCPAN -e shell 進入CPAN安裝上列缺少模組

          install Mail::SPF

          install IP::Country::Fast

          install Net::Ident

          備註:

                  1.若發生於CPAN中無法安裝模組的狀況時,請使用下列方式安裝

                  yum install 'perl(Mail::SPF)'
                  yum install 'perl(IP::Country::Fast)'
                  yum install 'perl(Net::Ident)'

                 2.若執行perl -MCPAN -e shell發生下列錯誤時

                   [root@dns 下載]#  perl -MCPAN -e shell
                   Can't locate CPAN.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .).
                   BEGIN failed--compilation aborted.

                  請先執行 yum install perl-CPAN

      

        反覆執行spamassassin -x -D --lint 並檢視錯誤訊息後解決錯誤

     7.測試spamassassin

       spamassassin -t -D razor2 < /usr/share/doc/spamassassin-3.3.1/sample-spam.txt
       spamassassin -t -D pyzor < /usr/share/doc/spamassassin-3.3.1/sample-spam.txt
       cdcc info

九、安裝amavisd-new

      1.於 http://www.ijs.si/software/amavisd/ 下載檔案 amavisd-new-2.8.2-rc1.tar.bz2

      2.建立家目錄 /var/amavis

      3.新增群組  groupadd -r amavis

      4.新增帳號 useradd -g amavis -d '/var/amavis' -c 'Amavis email scan user' -s '/sbin/nologin' -r amavis

      5.將clamav加入群組amavis  

         gpasswd -a clamav amavis

      6.再於 /var/amavis下建立 var、tmp、db、home四個目錄

         mkdir /var/amavis/tmp /var/amavis/var /var/amavis/db /var/amavis/home

      7.更改/var/amavis的權限

        chown -R amavis:amavis /var/amavis
        chmod -R 750 /var/amavis

      8.將下載的檔案解壓縮到 /usr/local/amavisd/

      9.設定執行檔

        cp /usr/local/amavisd/amavisd /usr/local/sbin/
        chown root /usr/local/sbin/amavisd
        chmod 755  /usr/local/sbin/amavisd

       ln -s /usr/local/sbin/amavisd /usr/sbin/amavisd

     10.設定amavis的設定檔

          cp /usr/local/amavisd/amavisd.conf /etc/
          chown root:amavis /etc/amavisd.conf
          chmod 640 /etc/amavisd.conf

     11.建立病毒信件隔離目錄

          mkdir /var/virusmails
          chown amavis:amavis /var/virusmails
          chmod 750 /var/virusmails

     12.修改設定檔/etc/amavisd.conf

          將下列三個項目註記移除

          $MYHOME   = '/var/amavis';
          $TEMPBASE = "$MYHOME/tmp";
          $db_home  = "$MYHOME/db";

          更改domain

         $mydomain = '我的網域名稱';   # a convenient default for other settings

         修改執行帳號與群組為上列步驟建立的amavis

         $daemon_user  = 'amavis';     # (no default;  customary: vscan or amavis), -u
         $daemon_group = 'amavis';     # (no default;  customary: vscan or amavis), -g

         設定主機名稱

         $myhostname = '我的完整主機名稱';  # must be a fully-qualified domain name!

         /etc/amavisd.conf 中的 “/var/run/clamav/clamd.sock" 要和

         /etc/clamd.conf 檔中的 "LocalSocket /var/run/clamav/clamd.sock" 設定相吻合,並取消幾行註解如下:

         # ### http://www.clamav.net/
         ['ClamAV-clamd',
         \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.sock"],
         qr/\bOK$/m, qr/\bFOUND$/m,
         qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
         # # NOTE: run clamd under the same user as amavisd - or run it under its own
         # #   uid such as clamav, add user clamav to the amavis group, and then add
         # #   AllowSupplementaryGroups to clamd.conf;
         # # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
         # #   this entry; when running chrooted one may prefer a socket under $MYHOME.    

      13.以除錯模式執行amavisd

           It is wise to start it up for the first time with a 'debug' option:
           /usr/local/sbin/amavisd -u amavis debug
           or:
           /usr/local/sbin/amavisd debug
           When checking SpamAssassin operations, the following can be useful:
           /usr/local/sbin/amavisd debug-sa

          執行結果.......

           [root@dns bin]#  /usr/local/sbin/amavisd debug-sa
           ERROR: MISSING REQUIRED BASIC MODULES:
           IO::Stringy
           Unix::Syslog
           MIME::Words
           MIME::Head
           MIME::Body
           MIME::Entity
           MIME::Parser
           MIME::Decoder
           MIME::Decoder::Base64
           MIME::Decoder::Binary
           MIME::Decoder::QuotedPrint
           MIME::Decoder::NBit
           MIME::Decoder::UU
           MIME::Decoder::Gzip64
           Net::Server
           Net::Server::PreFork
           BEGIN failed--compilation aborted at /usr/local/sbin/amavisd line 242.

      14.在13步驟發現缺少Perl元件,Stringy,使用CPAN來安裝

          執行   perl -MCPAN -e shell  進入交談模式

          依序執行 

          install IO::Stringy
          install Unix::Syslog
          install MIME::Words
          install MIME::Head
          install MIME::Body
          install MIME::Entity
          install MIME::Parser
          install MIME::Decoder
          install MIME::Decoder::Base64
          install MIME::Decoder::Binary
          install MIME::Decoder::QuotedPrint
          install MIME::Decoder::NBit
          install MIME::Decoder::UU
          install MIME::Decoder::Gzip64
          install Net::Server
          install Net::Server::PreFork

          由於某些模組可能包在一起安裝,最後安裝某些元件後再執行13步驟檢查缺少的模組,

          某些功能需要g++  ,若需要安裝則執行 yum install gcc-c++  安裝

          某些需要YAML,CPAN中執行 install YAML安裝

          某些功能需要DBI,CPAN中執行install DBI安裝

         上列皆成功安裝完成後再次以除錯模式執行amavisd

[root@dns var]# /usr/local/sbin/amavisd debug
fetch_modules: error loading optional module MIME/Decoder/BinHex.pm:
  Can't locate Convert/BinHex.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5) at /usr/local/share/perl5/MIME/Decoder/BinHex.pm line 45.
  BEGIN failed--compilation aborted at /usr/local/share/perl5/MIME/Decoder/BinHex.pm line 45.
  Compilation failed in require at /usr/local/sbin/amavisd line 203.
drop_priv: No such username: vscan

        套件相依的問題,一樣執行CPAN安裝 BinHex

        install Convert::BinHex

       上列皆成功安裝完成後再次以除錯模式執行amavisd

[root@dns var]# /usr/local/sbin/amavisd debug
Problem in Amavis::DB or Amavis::DB::SNMP code: Can't locate BerkeleyDB.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5) at (eval 83) line 21.
BEGIN failed--compilation aborted at (eval 83) line 21.

      套件相依的問題,先執行CPAN安裝BerkeleyDB

      install BerkeleyDB

      cpan會嘗試安裝版本BerkeleyDB-0.54.tar.gz

      若使用CPAN安裝BerkeleyDB模組發生問題,改用

      yum install perl-BerkeleyDB

      yum會安裝版本 perl-BerkeleyDB.x86_64 0:0.43-3.el6

 

      若執行/usr/local/sbin/amavisd debug 無錯誤訊息,就設定讓其開機自動啟動

      cp /usr/local/amavisd/amavisd_init.sh /etc/init.d/amavisd
      chmod 755 /etc/init.d/amavisd
      chkconfig --add amavisd
      chkconfig amavisd on

十、設定postfix讓postfix使用amavis當作content filter

      1.

         vi /etc/postfix/main.cf

         加上

         #use amavisd as filter on port 10024

         content_filter=amavisd:[127.0.0.1]:10024

      2.

       vi /etc/postfix/master.cf

      於檔案最後面加上下列文字

amavisd unix - - n - 2 lmtp
-o lmtp_data_done_timeout=1200
-o lmtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20

127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject_unauth_destination,reject_non_fqdn_sender,reject_unknown_sender_domain,reject,check_policy_service unix:postgrey/socket
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o local_header_rewrite_clients=
-o smtpd_milters=
-o local_recipient_maps=
-o relay_recipient_maps=

      3.重啟動amavisd

         service amavisd restart      

     4.重啟postfix

        service postfix restart 

 

備註:

外部寄信過來時發生無法收信的狀況,

於/var/log/messages發現下列訊息:

Jan  2 00:52:28 dns kernel: type=1400 audit(1388595148.764:41): avc:  denied  { read } for  pid=10289 comm="clamd" name="parts" dev=dm-0 ino=2888613 scontext=system_u:system_r:antivirus_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir
Jan  2 00:52:28 dns clamd[2234]: lstat() failed on: /var/amavis/tmp/amavis-20140102T005228-09919-eJEnXPA_/parts

 

發現又是SELinux造成的問題

執行下列指令

[root@dns log]# getsebool -a | grep antivirus
antivirus_can_scan_system --> off
antivirus_use_jit --> off
發現有兩個與防毒程式相關的參數預設為關閉
執行下列指令開啟
[root@dns log]# setsebool -P antivirus_can_scan_system 1
[root@dns log]#setsebool -P antivirus_use_jit 1

 

參考資料:

http://wiki.centos.org/HowTos/Amavisd?highlight=%28clamav%29

http://www.rootlinks.net/2013/04/20/install-clamav-for-centos-6-3-x86_64/

http://www.ijs.si/software/amavisd/

http://wiki.centos.org/zh-tw/HowTos/Amavisd

arrow
arrow

    K 發表在 痞客邦 留言(0) 人氣()