Move from mailscanner to amavisd-new in squeeze

Dopo i recenti aggiornamenti al mio server di posta ho scoperto che mailscanner non viene più mantenuto da Debian (link) , così decido di cercare nuove strade dato che c’è in previsione il passaggio da squeeze a wheezy e volevo avere una macchina aggiornata.

Ricordo i consigli di More+ che mi invitava a provare amavid-new anche se prima ho voluto provare a fare alcuni esperimenti.

L’avventura mi ha divertito ed è stata una bella esperienza anche perchè nel fare le prove ho scoperto pure mailgraph che se non molto preciso ,con amavis funziona un po meglio che con mailscanner.

La seguente modifica è applicabile alla guida che avevo scritto tempo fa , su come preparare un server di posta che funziona come relay reperibile su debianizzati.org, basta solamente sostituire il passaggio dell’installazione e configurazione di mailscanner con quanto segue , per avere amavid-new come email gateway virus-scanner , spam e phishing-detector.

Nella condizione in cui mi trovavo , la prima cosa da fare è stato rimuovere mailscanner commentando nel file di configurazione di Postfix /etc/postfix/main.cf  questa linea:

#header_checks = regexp:/etc/postfix/header_checks

in questo modo dopo aver riavviato il servizi di postfix e terminato mailscanner possiamo cominciare a spippolare sapendo che rimuovendo il commento è possibile tornare alla condizione precedente.

Il file /etc/postfix/header_checks generato in precedenza è stato vuotato del contenuto.

Senza rimuovere nessuna applicazione mi è così possibile poter tornare indietro nel caso  le prove non vadano a buon fine.

Installiamo ora amvisd-new :

#aptitude install amavisd-new

In debianizzati potete trovare un’ottima guida del noto more+ : Server_mail:_Postfix_Amavisd-new_Dovecot_e_MySql

Peccato che non sia riuscito ad attaccare il tutto a un db , ma in qualche modo siamo riusciti a far funzionare amavisd.

Per prima cosa andiamo ad aggiungere al file /etc/postfix/main.cf  la seguente riga.:

#connessione alla porta di amavis
content_filter=smtp-amavis:[127.0.0.1]:10024

procediamo ora con la configurazione modificando il file /etc/postfix/master.cf aggiungendo in fondo :

 smtp-amavis unix    -       -       n       -       2     smtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20

 127.0.0.1:10025 inet n    -       n       -       -     smtpd
    -o content_filter=
    -o smtpd_delay_reject=no
    -o smtpd_client_restrictions=permit_mynetworks,reject
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o smtpd_data_restrictions=reject_unauth_pipelining
    -o smtpd_end_of_data_restrictions=
    -o smtpd_restriction_classes=
    -o mynetworks=127.0.0.0/8
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000
    -o smtpd_client_connection_count_limit=0
    -o smtpd_client_connection_rate_limit=0
    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
    -o local_header_rewrite_clients=

ora siamo pronti per configurare al meglio amavid , i file principali per la configurazione si trovano in /etc/amavis/conf.d .

Abilitiamo la scansione da parte di amavis con antivirus e spamassassin in /etc/amavis/conf.d/15-content_filter_mode

use strict;
################# aggiunto pewr MailZU##################

#add by barabba per amavis-release
$unix_socketname = "/var/lib/amavis/amavisd.sock";  # listen on Unix socket

# alternatively (less common):
# $inet_socket_port = [10024, 9998];  # listen on listed inet tcp ports

# apply policy bank AM.PDP-SOCK on a Unix socket:
#(note that this precludes the use of old amavis-milter
# helper program (with sendmail) on the same socket)
$interface_policy{'SOCK'} = 'AM.PDP-SOCK';

# apply policy bank AM.PDP-INET to some inet tcp socket, e.g. tcp port 9998:
$interface_policy{'9998'} = 'AM.PDP-INET';

$policy_bank{'AM.PDP-INET'} = {
protocol => 'AM.PDP',  # select Amavis policy delegation protocol
inet_acl => [qw( 127.0.0.1 [::1] )],  # restrict access to these IP addresses
auth_required_release => 0,  # don't require secret_id for amavisd-release
};

#$inet_socket_port = 10024;
#$notify_method = 'smtp:[127.0.0.1]:10025';

#  $banned_files_quarantine_method = 'sql:';
#  $spam_quarantine_method         = 'sql:';
#  @storage_sql_dsn = @lookup_sql_dsn;
#  $inet_socket_bind = undef;
#  $inet_socket_port = [10024,9998];

####################################################################

# ADMINISTRATORS:
# Debian suggests that any changes you need to do that should never
# be "updated" by the Debian package should be made in another file,
# overriding the settings in this file.
#
# The package will *not* overwrite your settings, but by keeping
# them separate, you will make the task of merging changes on these
# configuration files much simpler...

#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
#       a list of all variables with their defaults;
#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
#       a traditional-style commented file  
#   [note: the above files were not converted to Debian settings!]
#
#   for more details see documentation in /usr/share/doc/amavisd-new
#   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html

$QUARANTINEDIR = "/var/lib/amavis/virusmails";
$quarantine_subdir_levels = 0; # enable quarantine dir hashing

$log_recip_templ = undef;    # disable by-recipient level-0 log entries
$DO_SYSLOG = 1;              # log via syslogd (preferred)
$syslog_ident = 'amavis';    # syslog ident tag, prepended to all messages
$syslog_facility = 'mail';
$syslog_priority = 'debug';  # switch to info to drop debug output, etc

#$enable_db = 0;              # enable use of BerkeleyDB/libdb (SNMP and nanny)
#$enable_global_cache = 1;    # enable use of libdb-based cache if $enable_db=1

$inet_socket_port = 10024;   # default listening socket

$sa_spam_subject_tag = '***SPAM*** ';
$sa_tag_level_deflt  = 2.0;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 5.5; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 6.9; # triggers spam evasive actions
$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent

$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
$sa_local_tests_only = 0;    # only tests which do not require internet access?

# Quota limits to avoid bombs (like 42.zip)

$MAXLEVELS = 14;
$MAXFILES = 1500;
$MIN_EXPANSION_QUOTA =      100*1024;  # bytes
$MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes

# You should:
#   Use D_DISCARD to discard data (viruses)
#   Use D_BOUNCE to generate local bounces by amavisd-new
#   Use D_REJECT to generate local or remote bounces by the calling MTA
#   Use D_PASS to deliver the message
#
# Whatever you do, *NEVER* use D_REJECT if you have other MTAs *forwarding*
# mail to your account.  Use D_BOUNCE instead, otherwise you are delegating
# the bounce work to your friendly forwarders, which might not like it at all.
#
# On dual-MTA setups, one can often D_REJECT, as this just makes your own
# MTA generate the bounce message.  Test it first.
#
# Bouncing viruses is stupid, always discard them after you are sure the AV
# is working correctly.  Bouncing real SPAM is also useless, if you cannot
# D_REJECT it (and don't D_REJECT mail coming from your forwarders!).

$final_virus_destiny      = D_DISCARD;  # (data not lost, see virus quarantine)
$final_banned_destiny     = D_BOUNCE;   # D_REJECT when front-end MTA  sostituito BOUNCE
$final_spam_destiny       = D_BOUNCE;   # 
$final_bad_header_destiny = D_PASS;     # False-positive prone (for spam)

#$spam_quarantine_to = "postmaster\@$mydomain";
#$spam_quarantine_to = "postmaster\@localhost";
$spam_admin = "postmaster\@localhost";          # Where to send Notification
$virus_admin = "postmaster\@localhost";         # send notification
#Turn quarantining off per bad_header  it by barabba
$bad_header_quarantine_method = undef;

$enable_dkim_verification = 0; #disabled to prevent warning

#$virus_admin = "postmaster\@$mydomain"; # due to D_DISCARD default

# Set to empty ("") to add no header
$X_HEADER_LINE = "Debian $myproduct_name at $mydomain";

# REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS

#
# DO NOT SEND VIRUS NOTIFICATIONS TO OUTSIDE OF YOUR DOMAIN. EVER.
#
# These days, almost all viruses fake the envelope sender and mail headers.
# Therefore, "virus notifications" became nothing but undesired, aggravating
# SPAM.  This holds true even inside one's domain.  We disable them all by
# default, except for the EICAR test pattern.
#

@viruses_that_fake_sender_maps = (new_RE(
  [qr'\bEICAR\b'i => 0],            # av test pattern name
  [qr/.*/ => 1],  # true for everything else
));

@keep_decoded_original_maps = (new_RE(
# qr'^MAIL$',   # retain full original message for virus checking (can be slow)
  qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
  qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
# qr'^Zip archive data',     # don't trust Archive::Zip
));


# for $banned_namepath_re, a new-style of banned table, see amavisd.conf-sample

$banned_filename_re = new_RE(
# qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components

  # block certain double extensions anywhere in the base name
  qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,

  qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?$'i, # Windows Class ID CLSID, strict

  qr'^application/x-msdownload$'i,                  # block these MIME types
  qr'^application/x-msdos-program$'i,
  qr'^application/hta$'i,

# qr'^application/x-msmetafile$'i,    # Windows Metafile MIME type
# qr'^\.wmf$',                # Windows Metafile file(1) type

# qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types

# [ qr'^\.(Z|gz|bz2)$'           => 0 ],  # allow any in Unix-compressed
# [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives
# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within such archives
# [ qr'^application/x-zip-compressed$'i => 0],  # allow any within such archives

  qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic
# qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
#        inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|
#        ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|
#        wmf|wsc|wsf|wsh)$'ix,  # banned ext - long

# qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab.

  qr'^\.(exe-ms)$',                       # banned file(1) types
# qr'^\.(exe|lha|tnef|cab|dll)$',         # banned file(1) types
);
# See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
# and http://www.cknow.com/vtutor/vtextensions.htm


# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING

@score_sender_maps = ({ # a by-recipient hash lookup table,
                        # results from all matching recipient tables are summed

# ## per-recipient personal tables  (NOTE: positive: black, negative: white)
# 'user1@example.com'  => [{'bla-mobile.press@example.com' => 10.0}],
# 'user3@example.com'  => [{'.ebay.com'                 => -3.0}],
# 'user4@example.com'  => [{'cleargreen@cleargreen.com' => -7.0,
#                           '.cleargreen.com'           => -5.0}],

  ## site-wide opinions about senders (the '.' matches any recipient)
  '.' => [  # the _first_ matching sender determines the score boost

   new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist
    [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i         => 5.0],
    [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
    [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
    [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i   => 5.0],
    [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i  => 5.0],
    [qr'^(your_friend|greatoffers)@'i                                => 5.0],
    [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i                    => 5.0],
   ),

#  read_hash("/var/amavis/sender_scores_sitewide"),

# This are some examples for whitelists, since envelope senders can be forged
# they are not enabled by default. 
   { # a hash-type lookup table (associative array)
     #'nobody@cert.org'                        => -3.0,
     #'cert-advisory@us-cert.gov'              => -3.0,
     #'owner-alert@iss.net'                    => -3.0,
     #'slashdot@slashdot.org'                  => -3.0,
     #'securityfocus.com'                      => -3.0,
     #'ntbugtraq@listserv.ntbugtraq.com'       => -3.0,
     #'security-alerts@linuxsecurity.com'      => -3.0,
     #'mailman-announce-admin@python.org'      => -3.0,
     #'amavis-user-admin@lists.sourceforge.net'=> -3.0,
     #'amavis-user-bounces@lists.sourceforge.net' => -3.0,
     #'spamassassin.apache.org'                => -3.0,
     #'notification-return@lists.sophos.com'   => -3.0,
     #'owner-postfix-users@postfix.org'        => -3.0,
     #'owner-postfix-announce@postfix.org'     => -3.0,
     #'owner-sendmail-announce@lists.sendmail.org'   => -3.0,
     #'sendmail-announce-request@lists.sendmail.org' => -3.0,
     #'donotreply@sendmail.org'                => -3.0,
     #'ca+envelope@sendmail.org'               => -3.0,
     #'noreply@freshmeat.net'                  => -3.0,
     #'owner-technews@postel.acm.org'          => -3.0,
     #'ietf-123-owner@loki.ietf.org'           => -3.0,
     #'cvs-commits-list-admin@gnome.org'       => -3.0,
     #'rt-users-admin@lists.fsck.com'          => -3.0,
     #'clp-request@comp.nus.edu.sg'            => -3.0,
     #'surveys-errors@lists.nua.ie'            => -3.0,
     #'emailnews@genomeweb.com'                => -5.0,
     #'yahoo-dev-null@yahoo-inc.com'           => -3.0,
     #'returns.groups.yahoo.com'               => -3.0,
     #'clusternews@linuxnetworx.com'           => -3.0,
     #lc('lvs-users-admin@LinuxVirtualServer.org')    => -3.0,
     #lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,

     # soft-blacklisting (positive score)
     #'sender@example.net'                     =>  3.0,
     #'.example.net'                           =>  1.0,

   },
  ],  # end of site-wide tables
});

1;  # ensure a defined return

 

Ricordatevi di generare la directory  /var/lib/amavis/virusmails  per lo storage di spam e altro , altrimenti modificate a piacere.

a questo punto non resta che riavviare amavisd e postfix

#/etc/init.d/amavis restart

#/etc/init.d/postfix restart

inviamo qualche mail interna o esterna per verificare se il flusso delle mail si completa , in caso ci sia qualche problema consultare i log in  /var/log/mail.error .

Il file di configurazione da me utilizzato lascia spazio di modifica , ho lasciato alcune parti commentate per poter dare la possibilità di capire meglio , altrimenti è possibile approfondire ai seguanti link :

http://www.ijs.si/software/amavisd/

http://www200.pair.com/mecham/spam/amavisd-settings.html

Spamassassin era già attivo e configurato , comunque ho trovato qualche ottimo spunto per l’autolerning : http://faisal.com/docs/salearn.html , mi sono fatto uno script bruttissimo che ho poi messo in cron :

#!/bin/bash
##script per l'automazione dell'auto Learning di SpamAssassin
echo "Auto-Learning Spamassassin in Corso"
#questo è Spam
sa-learn --no-sync --spam /home/user/.Maildir/.Spam/{cur,new}
#questo NON è SPAM ma è HAM
sa-learn --no-sync --ham /home/user/.Maildir/.Ham/{cur,new}
echo  "Auto-Learning Spamassassin Eseguito"

Per il recupero dei file messi in quarantena , occorre eseguire alcuni comandi seguendo le istruzioni della mail di notifica , ad esempio se abbiamo un messaggio di SPAM che vogliamo recuperare , occorre prima prendere nota del codice e per verifica lo cerchiamo , io per facilitarmi il lavoro mi sono fatto un’alias :

alias findamavis='find /var/lib/amavis/virusmails/ -type f |grep $1'

L’utilizzo è semplice , se ho un codice ancE5Z_NN9N9 lo ricerco con :

# findamavis ancE5Z_NN9N9
/var/lib/amavis/virusmails/spam-ancE5Z_NN9N9.gz

ora per il recupero

# amavisd-release spam-ancE5Z_NN9N9.gz
> request=release
> mail_id=ancE5Z_NN9N9
> quar_type=Z
> mail_file=spam-ancE5Z_NN9N9.gz
waiting for response
< setreply=250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 388AD1A4074
250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 388AD1A4074

La ricerca si può utilizzare per codice o per genere (spam,virus,bounced e banned).

Ora voltiamo pagina per continuare nel tuning