Ausgangspunkt ist (bei mir war es so) ein frisch reinitialisierter 1&1 Root L (sowohl V1 als auch V2)
mit installiertem Procmail
Die Einstellungen von Confixx (admin.pl) was den Spamassassin angeht lasse ich mal weg.
Allerdings: Hatte ich das Problem, daß der Spamassassin zwar gelaufen ist
sich aber nicht die Einstellungen für die User aus der Confixx-Datenbank geholt hat.
Dies lag daran, das er die von Confixx erzeugte /etc/mail/spamassassin/local.cf
nicht lesen kann, da diese User und Gruppe "root" hat, der spamd allerdings als
User spamd läuft. Abhilfe schafft da einfach ein kleines Script,
das per Cron läuft.
neu anlegen: /root/chg_localcf.sh
Code: Select all
#!/bin/sh
chown spamd.spamd /etc/mail/spamassassin/local.cf > /dev/null 2>&1
Code: Select all
chmod 744 /root/chg_localcf.shalle X Minuten (wies euch passt :-D ) aufrufen
Die local.cf sollte nur immer beim Start/Restart vom spamd die richtigen Rechte haben
Code: Select all
*/X * * * * /root/chg_localcf.sh
1. Damit Confixx nicht irgendwo zwischenfunkt den (die) Einträge (counterscript) in der /etc/cron.d/confixx
auskommentieren.
Eventuell noch den Postfix stoppen
(2. Optional: Den SuSE Spamassassin 2.55 runterschmeissen und per Hand den 2.63 installieren)
Deinstallation per Yast oder rpm
Installation 2.63:
Code: Select all
# cd /usr/local/src
# wget http://www.spamassassin.org/released/Mail-SpamAssassin-2.63.tar.gz
# tar xvfz Mail-SpamAssassin-2.63.tar.gz
# cd Mail-SpamAssassin-2.63
# perl Makefile.PL
# make
# make install
Code: Select all
# groupadd clamav
# useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav
Code: Select all
# tar xvfz clamav-0.xx.tar.gz
# cd clamav-0.xx
# ./configure --sysconfdir=/etc
# make
# make install
Die /etc/clamav.conf editieren
Code: Select all
# Comment or remove the line below.
#Example
LogFile /var/log/clamd.log
#LogFileUnlock
#LogFileMaxSize 2M
LogTime
LogClean
LogSyslog
LogFacility LOG_MAIL
LogVerbose
#PidFile /var/run/clamd.pid
#TemporaryDirectory /var/tmp
#DatabaseDirectory /var/lib/clamav
LocalSocket /tmp/clamd
#FixStaleSocket
#TCPSocket 3310
#TCPAddr 127.0.0.1
#MaxConnectionQueueLength 30
#StreamSaveToDisk
#StreamMaxLength 10M
#MaxThreads 10
#ReadTimeout 300
MaxDirectoryRecursion 15
#FollowDirectorySymlinks
#FollowFileSymlinks
#SelfCheck 600
#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"
User clamav
#AllowSupplementaryGroups
#Foreground
#Debug
#LeaveTemporaryFiles
ScanOLE2
ScanMail
ScanArchive
#ScanRAR
ArchiveMaxFileSize 10M
ArchiveMaxRecursion 5
ArchiveMaxFiles 1000
ArchiveMaxCompressionRatio 200
#ArchiveBlockEncrypted
#ClamukoScanOnAccess
ClamukoScanOnOpen
ClamukoScanOnClose
ClamukoScanOnExec
ClamukoIncludePath /home
#ClamukoIncludePath /students
#ClamukoExcludePath /home/guru
ClamukoMaxFileSize 1M
ClamukoScanArchive
/etc/init.d/clamd erstellen
Code: Select all
#!/bin/bash
TMPDIR=/tmp
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin
case "$1" in
start)
echo "Starting ClamAV..."
if [ -S /tmp/clamd ]; then
echo "ClamAV is already running!"
else
/usr/local/bin/freshclam -d -c 10 --datadir=/usr/local/share/clamav
/usr/local/sbin/clamd
fi
echo "ClamAV is now up and running!"
;;
stop)
echo "Shutting down ClamAV..."
array=(`ps ax | grep -iw '/usr/local/bin/freshclam' | grep -iv 'grep'
| awk '{print $1}' | cut -f1 -d/ | tr 'n' ' '`)
element_count=${#array[@]}
index=0
while [ "$index" -lt "$element_count" ]
do
kill -9 ${array[$index]}
let "index = $index + 1"
done
array=(`ps ax | grep -iw '/usr/local/sbin/clamd' | grep -iv 'grep'
| awk '{print $1}' | cut -f1 -d/ | tr 'n' ' '`)
element_count=${#array[@]}
index=0
while [ "$index" -lt "$element_count" ]
do
kill -9 ${array[$index]}
let "index = $index + 1"
done
if [ -S /tmp/clamd ]; then
rm -f /tmp/clamd
fi
echo "ClamAV stopped!"
;;
restart)
$0 stop && sleep 3
$0 start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
esac
exit 0
Code: Select all
# chmod 744 /etc/init.d/clamd
# ln -sf /etc/init.d/clamd /usr/sbin/rcclamduudeview:
Code: Select all
# wget http://www.fpx.de/fp/Software/UUDeview/download/uudeview-0.5.19.tar.gz
# tar xvfz uudeview-0.5.19.tar.gz
# cd uudeview-0.5.19
# ./configure
# make
# make install
Code: Select all
# cd /usr/local/src/clamav-0.xx/contrib/trashscan/
# tar xvzf trashscan-0.08.tar.gz
# cd trashscan-0.08/
# cp -pf trashscan /usr/local/sbin/
Code: Select all
#! /bin/bash
#
# TrashScan v0.12; Scan email for viruses
# ZapCoded by Trashware; 22.04.2004
# Email: trashware@gmx.de
# Web: http://trashware.mirrorz.com
#
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin:/usr/local/sbin
# ------------------------------------------------- Begin Settinx ------------------------------------------------- #
SCANDIR=/tmp # Temp directory for virus scans.
# Security: Don't define public
# accessible directories here !!!
# $HOME/tmp should be fine.
#DECODER=metamail # Decoder: "metamail" or "uudeview"
#DECODPRG=/usr/bin/metamail # Absolute path to decoder: metamail
DECODER=uudeview # Decoder: "metamail" or "uudeview"
DECODPRG=/usr/local/bin/uudeview # Absolute path to decoder: uudeview
VSCANNER=clamav # Scanner: "clamav". If you are using
# clamav and you define "clamav" here
# then the name of the detected virus
# will be reported
VSCANPRG=/usr/local/bin/clamscan # Absolute path to the virus scanner
VSCANOPT="--quiet --tempdir=/tmp --recursive --max-files=500
--max-space=30M --unzip=/usr/bin/unzip --unrar=/usr/bin/unrar
--unarj=/usr/bin/unarj --lha=/usr/bin/lha --jar=/usr/bin/unzip
--tar=/bin/tar --tgz=/bin/tar" # Parameters for the virus scanner.
# Security: Don't choose public
# accessible directories for the
# --tempdir definition !!!
# --tempdir=$HOME/tmp should be fine.
VSCANVEX=1 # Exitcode of the virus scanner if a
# virus was found
VSCANSUSP=mail.virus # File to store suspicious mail (see
# procmail.trashscan)
FORMAIL=/usr/bin/formail # Absolute path to formail
PROCMAIL=/usr/bin/procmail # Absolute path to procmail
SENDMAIL=/usr/sbin/sendmail # Absolute path to sendmail
AWK=/usr/bin/awk # Absolute path to awk
CAT=/bin/cat # Absolute path to cat
GREP=/bin/grep # Absolute path to grep
LOGGER=/bin/logger # Absolute path to logger
LOGPRIO=mail.warn # Log level for logger
MKDIR=/bin/mkdir # Absolute path to mkdir
RM=/bin/rm # Absolute path to rm
SED=/bin/sed # Absolute path to sed
ALERT=no # send alert messages if a virus
# was detected (yes | no)
ALERTRCVR=mailadmin@trashware.net # Receiver of virus alert messages
ALERTSNDR=mailservice@trashware.net # Sender of virus alert messages
ALERTCTCT=trash@trashware.net # Person to contact (appears in the
# mail body of the virus alert)
NOTIFY=no # Notify the sender and the receiver
# of the original message if a virus
# was detected (yes | no).
# Warning: Some virii fake the From:
# and To: headers !!!
# VKLUDGE="X-My-Very-Own-Kludge:" # Optional: This kludge marks email
# as scanned and is needed for
# further procmail operation.
# See example in procmail.trashscan.
# Warning: Don't define this keyword
# if you don't know what you are
# doing !!!
# -------------------------------------------------- End Settinx -------------------------------------------------- #
[...]
Scroll to the end
[...]
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "************************************************************************"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "Suspicious code in mail attachment detected !!!"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "From: $FROM"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "To: $TO"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "Subj: $SUBJ"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "Date: $DATE"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "Virus: $VIRNAME"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "Alert: $ALERTMSG"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "Notification: $NOTIFYMSG"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "Check $VSCANSUSP !!!"
${LOGGER} -p ${LOGPRIO} -t "$TSC[$$]" "************************************************************************"
Diese Zeile ändern
Code: Select all
${FORMAIL} -I "$VKLUDGE !Suspicious! Virus $VIRNAME found" < ${MSGDIR}/rec.msg | ${PROCMAIL}Code: Select all
else
${FORMAIL} -I "$VKLUDGE Scanned by $TSCV running on $HOSTNAME" < ${MSGDIR}/rec.msg | ${PROCMAIL}
fi
${RM} -rf ${TASKDIR}
exit 0
/etc/procmailrc editieren
Code: Select all
DROPPRIVS=yes
LOGFILE=/var/log/procmail
#VERBOSE=ON
SHELL=/bin/sh
STRIPPED_EXECUTABLES=/etc/stripped
# ------------------------------------------------------------------------------------- #
# Virus scan section ... #
# ------------------------------------------------------------------------------------- #
# 1. Run TrashScan
:0fw
* multipart
* !^X-Virus-Scan:
| /usr/local/sbin/trashscan
# ------------------------------------------------------------------------------------- #
# Sanitize the mail
# ------------------------------------------------------------------------------------- #
INCLUDERC=/etc/sanitize.rc
# ------------------------------------------------------------------------------------- #
# Spamassassin #
# ------------------------------------------------------------------------------------- #
:0fw
* !^X-SPAM-CHECKER-VERSION: SpamAssassin 2.63 (2004-01-11) on $yourhost #Nicht mehr scannen wenn schon auf eurem Server gescannt
* !^X-Virus-Scan: !Suspicious!
| /usr/bin/spamc -f
# Work around procmail bug: any output on stderr will cause the "F" in "From"
# to be dropped. This will re-add it.
:0 H
* ! ^From[ ]
* ^rom[ ]
{
LOG="*** Dropped F off From_ header! Fixing up. "
:0 fhw
| sed -e 's/^rom /From /'
}
die Mails auf Viren überprüft. Allerdings nur wenn die Mails 1. einen Anhang besitzen und
2. kein Eintrag X-Virus-Scan im Header vorhanden ist.
Danach wird die sanitize.rc aufgerufen (das Original bekommt ihr hier: http://www.impsec.org/email-tools/html-trap.procmail.gz)
Ich hab sie ein wenig auf meine Bedürfnisse angepasst. ( http://www.server2-dnb.de/sanitize.rc )
Die wichtigste Ã?nderung ist, das das ganze nur ausgeführt wird wenn ClamAV vorher eine Mail mit
X-Virus-Scan: !Suspicious! markiert hat.
/etc/sanitize.rc
Code: Select all
PATH="/usr/bin:$PATH:/usr/local/bin"
SHELL=/bin/sh
# possible bug workaround?
LINEBUF=8192
# Size LINEBUF dynamically to deal with excessively large headers
:0 H
* 32000^0
* 1^1 .
{
LINEBUF="$="
}
# override csh and cousins
:0
* SHELL ?? csh$
{
SHELL="/bin/sh"
}
# Make sure $LOGFILE exists so the shells don't barf
LOGFILE=${LOGFILE:-"/dev/null"}
#################################################################
#Mail nur sanitizen wenn ClamAV vorher einen Virus gefunden hat #
#################################################################
:0
* ^X-Virus-Scan: !Suspicious!
{
#################################################################
#---------------------------------------------------------------------------
# Grab some info for logging
#
[...Sanitize Code...]
# zap it, just in case
:0
/dev/null
}
}
}
#########################################
# Ende von: #
# :0 #
# * ^X-Virus-Scan: !Suspicious! #
# { #
#########################################
}
#########################################
#eof
Anhänge abschneidet.
Dazu dient der Eintrag
Code: Select all
STRIPPED_EXECUTABLES=/etc/strippedDas heisst wir brauchen jetzt noch die Datei /etc/stripped ---> http://www.server2-dnb.de/stripped
Spamassassin
Wie oben schon angegeben scannt der Spamassassin nur Mails die nicht als Virus markiert sind,
da das unnötiger Aufwand wäre.
Da ich das alles aus dem Gedächtnis tippe kann ich euch keine Garantie geben, daß nicht irgendwo
Fehler drin sind, aber bei mir funktioniert es gut.
Giffi
