11. The software needed against viruses and SPAM

This chapter describes how to install and handle the software against viruses and SPAM

11.1. Getting and installing ClamAV

11.1.1. Download

Origin-Site: http://prdownloads.sourceforge.net/clamav/clamav-0.68.tar.gz

11.1.2. Building and installing

# Adding a group for the clamav user
groupadd clamav

# Adding the clamav user to your system
useradd -g clamav -c "clamav user" clamav

cd /usr/local

tar -xvzf clamav-0.68.tar.gz
cd clamav-0.68

./configure

make && make install

11.1.3. Testing and configuring

To test the funtionality of clamav, you can run clamscan to get some results from the testpatterns that are included in the clamav distribution run clamscan -r -i /usr/local/clamav-0.68

The output should look like this:

/usr/local/clamav-0.68/test/test1: ClamAV-Test-Signature FOUND
/usr/local/clamav-0.68/test/test1.bz2: ClamAV-Test-Signature FOUND
/usr/local/clamav-0.68/test/test2.zip: ClamAV-Test-Signature FOUND
/usr/local/clamav-0.68/test/test2.badext: ClamAV-Test-Signature FOUND
/usr/local/clamav-0.68/contrib/clamdwatch/clamdwatch.tar.gz: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 20482
Scanned directories: 47
Scanned files: 406
Infected files: 5
Data scanned: 5.48 MB
I/O buffer size: 131072 bytes
Time: 2.706 sec (0 m 2 s)

Next step is to setup the automated update of the virus database. This is a important step, because the speed of virus spreading is fast and would pick up even further.

Create the needed logfiles

touch /var/log/clam-update.log
chmod 600 /var/log/clam-update.log
chown clamav /var/log/clam-update.log

I suggest to update the signatures with a hourly cronjob. To edit the crontab issue crontab -e and add the following line, and replace the �x� with a random value between 1 and 59. This is some kind of time based loadbalancing to ensure more people can fetch the updated.

#x * * * *       /usr/local/bin/freshclam --quiet -l /var/log/clam-update.log

To test if the update process is working, please issue the command /usr/local/bin/freshclam -l /var/log/clam-update.log and have a look at the output.

The output should look similar to this:

ClamAV update process started at Tue Mar 23 19:58:11 2004
Reading CVD header (main.cvd): OK
Downloading main.cvd [*]
main.cvd updated (version: 21, sigs: 20094, f-level: 1, builder: tkojm)
Reading CVD header (daily.cvd): OK
Downloading daily.cvd [*]
daily.cvd updated (version: 210, sigs: 596, f-level: 1, builder: acab)
Database updated (20690 signatures) from database.clamav.net (64.74.124.90).

11.2. Razor

Razor is one of the prerequisites of spamassassin.

11.2.1. Download

Origin-Site: http://prdownloads.sourceforge.net/razor/razor-agents-sdk-2.03.tar.gz?download

Origin-Site: http://prdownloads.sourceforge.net/razor/razor-agents-2.40.tar.gz?download
cd /usr/local tar -xvzf razor-agents-sdk-2.03.tar.gz cd razor-agents-sdk-2.03 perl Makefile.PL make && make install cd /usr/local tar -xvzf razor-agents-2.40.tar.gz cd razor-agents-2.40/ perl Makefile.PL make && make install

11.2.2. Registering and setting up

In order to use razor2 you need to register yourself as a user

Choose a unique username and password and issue razor-admin -register -user=some_user -pass=somepass

11.3. Getting and installing spamassassin

Spamassassin is the todays leading opensource project to fight against SPAM. To describe how spamassassin works would be too much for this document. For further information please consult http://eu.spamassassin.org/doc.html

11.3.1. Download

Origin-Site: http://eu.spamassassin.org/released/Mail-SpamAssassin-2.63.tar.gz

11.3.2. Prerequisites

Spamassassin depends on a lot of prerequisites. The easiest way is using the CPAN repository. Issue the command perl -MCPAN -e shell and answer all questions as needed.

11.3.3. Building and installing

cd /usr/local

tar -xvzf Mail-SpamAssassin-2.63.tar.gz

cd Mail-SpamAssassin-2.63

perl Makefile.PL

# You get prompted to run Razor tests which you should answer with "y"
Run Razor v2 tests (these may fail due to network problems)? (y/n) [n] y 

make && make install

11.4. Getting and installing amavisd-new

Amavisd-new is the software that glues all the software described above together to postfix

11.4.1. Download

Origin-Site: http://www.ijs.si/software/amavisd/amavisd-new-20030616-p8.tar.gz

11.4.2. Prerequisites

Amavisd-new needs a lot of prerequisites.

Run perl -MCPAN -e shell and issue:

install ExtUtils::MakeMaker
install HTML::Parser
install DB_File
install Digest::SHA1
install Archive::Tar
install Archive::Zip
install Compress::Zlib
install Convert::TNEF
install Convert::UUlib
install MIME::Base64
install MIME::Parser
install Mail::Internet
install Mail::SPF::Query
install Net::Server
install Net::SMTP
install Net::DNS
install Digest::MD5
install IO::Stringy
install Time::HiRes
install Unix::Syslog

At the end run ./amavisd and have a look at overseen prerequisites.

Edit /etc/amavisd.conf and change the variables $daemon_user to �amavis� and $daemon_group to �amavis�. Another variable to change is $mydomain to match your domain.

Please also consider to change the default settings for virus and spam mails to avoid being notified about every intercepted mail

$final_virus_destiny      = D_DISCARD;  # (defaults to D_BOUNCE)
$final_spam_destiny       = D_DISCARD;  # (defaults to D_REJECT)

In the beginning of SPAM filtering I recommend to set the kill-value to something higher until you tweaked the filters. Change the variable $sa_kill_level_deflt to 8 or even higher.

11.4.3. Building and installing

cd /usr/local

tar -xvzf amavisd-new-20030616-p8.tar.gz

cd amavisd-new-20030616
cp amavisd /usr/local/sbin
cp amavisd.conf /etc
chown root /etc/amavisd.conf
chmod 644  /etc/amavisd.conf

Now it is the the time to define a group and a user for amavisd-new

groupadd amavis
useradd -g amavis -c "Amavisd-new user" amavis

Next you have to define a directory for the quarantined mail:

mkdir /var/virusmails
chown amavis:amavis /var/virusmails
chmod 750 /var/virusmails
mkdir /var/amavis
chown amavis:amavis /var/amavis
chmod 750 /var/amavis

The original init script in the amavisd-new distribution does only work work with Redhat. Other distributions need to install my quick and dirty init-script:

#!/bin/bash
#
# Amavisd-new startup script

case "$1" in
    start)
        # Starting amavisd
        /usr/local/sbin/amavisd
        ;;

    stop)

	# follows later

        ;;

    *)
        echo "Usage: $0 {start|stop}"
        exit 1
        ;;

esac

11.5. Setting up postfix

Postfix needs to be configured to send each mail to amavis-new in order to get sanitized.

You need to add the following line to /etc/postfix/main.cf

content_filter = smtp-amavis:127.0.0.1:10024

The /etc/postfix/master.cf needs also some adjustments to return the results from amavisd-new to the mailingsystem.

Please add the following lines to your configuration:

smtp-amavis unix - - y - 2 smtp -o smtp_data_done_timeout=1200

127.0.0.1:10025 inet n  -       n       -       -  smtpd
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=127.0.0.0/8
    -o strict_rfc821_envelopes=yes
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000

HOWTOs