Debian13.5 : Clamav(アンチウイルス) , Mailサーバー

# apt -y install clamav clamav-daemon

# sed -i -e "s/^NotifyClamd/#NotifyClamd/g" /etc/clamav/freshclam.conf
# systemctl stop clamav-freshclam

# freshclam
Tue May 19 11:46:50 2026 -> ClamAV update process started at Tue May 19 11:46:50 2026
Tue May 19 11:46:50 2026 -> daily.cvd database is up-to-date (version: 28004, sigs: 355454, f-level: 90, builder: svc.clamav-publisher)
Tue May 19 11:46:50 2026 -> main.cvd database is up-to-date (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
Tue May 19 11:46:50 2026 -> bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder: nrandolp)

# systemctl start clamav-freshclam

# vi /etc/logrotate.d/clamav-freshclam
7行目
create 640 clamav adm
↓
create 640 clamav clamav

# service clamav-freshclam status

次のように表示される
● clamav-freshclam.service - ClamAV virus database updater
     Loaded: loaded (/usr/lib/systemd/system/clamav-freshclam.service; disabled; preset: enabled)
     Active: active (running) since Tue 2026-05-19 11:47:42 JST; 2min 7s ago
 Invocation: fc38cbce18734375a9a3db2dbf8a1226
       Docs: man:freshclam(1)
             man:freshclam.conf(5)
             https://docs.clamav.net/
   Main PID: 17732 (freshclam)
      Tasks: 1 (limit: 4593)
     Memory: 3M (peak: 3.3M)
        CPU: 15ms
     CGroup: /system.slice/clamav-freshclam.service
             └─17732 /usr/bin/freshclam -d --foreground=true

May 19 11:47:42 Lepard systemd[1]: Started clamav-freshclam.service - ClamAV virus database updater.
May 19 11:47:42 Lepard freshclam[17732]: Tue May 19 11:47:42 2026 -> ClamAV update process started at Tue May 19 11:47:42 2026
May 19 11:47:42 Lepard freshclam[17732]: Tue May 19 11:47:42 2026 -> daily.cvd database is up-to-date (version: 28004, sigs: 355454, f-level: 90, buil>
May 19 11:47:42 Lepard freshclam[17732]: Tue May 19 11:47:42 2026 -> main.cvd database is up-to-date (version: 63, sigs: 3287027, f-level: 90, builder>
May 19 11:47:42 Lepard freshclam[17732]: Tue May 19 11:47:42 2026 -> bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder>

# clamscan --infected --remove --recursive /home

----------- SCAN SUMMARY -----------
Known viruses: 3627862
Engine version: 1.4.3
Scanned directories: 3
Scanned files: 7
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 11.211 sec (0 m 11 s)
Start Date: 2026:05:19 11:50:52
End Date:   2026:05:19 11:51:03

# wget https://secure.eicar.org/eicar.com.txt

# clamscan --infected --remove --recursive
/root/eicar.com.txt: Eicar-Test-Signature FOUND
/root/eicar.com.txt: Removed.

----------- SCAN SUMMARY -----------
Known viruses: 3627862
Engine version: 1.4.3
Scanned directories: 2
Scanned files: 7
Infected files: 1
Data scanned: 0.02 MB
Data read: 0.01 MB (ratio 2.00:1)
Time: 8.982 sec (0 m 8 s)
Start Date: 2026:05:19 11:52:17
End Date:   2026:05:19 11:52:26

# mkdir /opt/script

# vi /opt/script/clam-full.sh

clam-full.sh の内容(新規作成)
#!/bin/sh

echo =========================================
date
hostname
clamscan / \
--infected \
--recursive \
--log=/var/log/clamav/clamscan.log \
--move=/var/log/clamav/virus \
--exclude-dir=^/boot \
--exclude-dir=^/sys \
--exclude-dir=^/proc \
--exclude-dir=^/dev \
--exclude-dir=^/var/log/clamav/virus
if [ $? = 0 ]; then
echo “virus undetected.”
else
echo “virus detection!!”
fi

# chmod +x /opt/script/clam-full.sh

# mkdir /var/log/clamav/virus

# /opt/script/clam-full.sh

Tue May 19 11:56:55 AM JST 2026
Lepard

----------- SCAN SUMMARY -----------
Known viruses: 3627862
Engine version: 1.4.3
Scanned directories: 4880
Scanned files: 35613
Infected files: 0
Data scanned: 3159.49 MB
Data read: 1211.31 MB (ratio 2.61:1)
Time: 499.014 sec (8 m 19 s)
Start Date: 2026:05:19 11:56:55
End Date:   2026:05:19 12:05:14
“virus undetected.”

# crontab -e
0 2 * * mon /opt/script/clam-full.sh >> /var/log/clamav/clamascan.log

# apt -y install postfix sasl2-bin

# cp /usr/share/postfix/main.cf.dist /etc/postfix/main.cf
# vi /etc/postfix/main.cf

82行目：コメント解除
mail_owner = postfix

108行目：ホスト名指定追加
myhostname = mail.<domain name>

115行目：ドメイン名指定追加
mydomain = <domain name>

133行目 : コメント
#myorigin = /etc/mailname

135行目：コメント解除
myorigin = $mydomain

149行目：コメント解除
inet_interfaces = all

197行目：コメント解除
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

240行目：コメント解除
local_recipient_maps = unix:passwd.byname $alias_maps

285行目：コメント解除
mynetworks_style = subnet

299行目：コメント解除し、自ネットワークに変更
mynetworks = 192.168.11.0/24, 127.0.0.0/8

423行目：コメント解除
alias_maps = hash:/etc/aliases

434行目：コメント解除
alias_database = hash:/etc/aliases

456行目：コメント解除
home_mailbox = Maildir/

592行目：コメントにしてその下に追記
#smtpd_banner = $myhostname ESMTP $mail_name (Debian)
smtpd_banner = $myhostname ESMTP

666行目：追加
sendmail_path = /usr/sbin/postfix

670行目：コメント解除
newaliases_path = /usr/bin/newaliases

675行目：コメント解除
mailq_path = /usr/bin/mailq

681行目：コメント解除
setgid_group = postdrop

最終行へ追記
SMTP VRFY コマンドは無効にする
disable_vrfy_command = yes
クライアントに対して HELO コマンドを要求する
smtpd_helo_required = yes
送受信メールサイズを10Mに制限
message_size_limit = 10485760
メールボックスサイズを1Gに制限
mailbox_size_limit = 1073741824
SMTP-Auth 設定
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_mynetworks, permit_auth_destination, permit_sasl_authenticated, reject

# vi /etc/postfix/master.cf

19,23行目 : コメント解除
submission inet n - y - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
　-o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes

# touch /etc/aliases

# vi /etc/aliases
postmaster:    root
huong:         huong

# newaliases
# systemctl restart postfix

# apt -y install dovecot-core dovecot-pop3d dovecot-imapd

# vi /etc/dovecot/dovecot.conf

24行目 : 追加
protocols = imap pop3
31行目：コメント解除
listen = *, ::

# vi /etc/dovecot/conf.d/10-auth.conf
10行目 : コメント解除
auth_allow_cleartext = yes

93行目 : コメント解除
auth_mechanisms = plain login

# vi /etc/dovecot/conf.d/10-mail.conf
26-27行目 : コメント解除
mail_driver = maildir
mail_path = ~/Maildir

36-39行目 : コメントにする
#mail_driver = mbox
#mail_home = /home/%{user|username}
#mail_path = %{home}/mail
#mail_inbox_path = /var/mail/%{user}

# vi /etc/dovecot/conf.d/10-master.conf
110-112行目：コメント解除し追記
# Postfix smtp-authi
unix_listener /var/spool/postfix/private/auth {
　mode = 0666
　user = postfix
　group = postfix
}

# systemctl restart dovecot

# apt -y install mailutils

# echo 'export MAIL=$HOME/Maildir/' >> /etc/profile.d/mail.sh

# ufw allow pop3
# ufw allow imap
# ufw allow smtp
# ufw reload

# su - huong
$ mail huong@localhost
Cc:
(件名)
Subject: Test Mail
(本文)
This is the first mail.

$ mail
"/home/huong/Maildir/": 1 message 1 new
>N   1 huong              Tue May 19 04:31  13/429   Test Mail
? 1
Return-Path: <huong@Lepard>
X-Original-To: huong@localhost
Delivered-To: huong@localhost
Received: by mail.korodes.com (Postfix, from userid 1000)
        id A41321DFB8F; Tue, 19 May 2026 13:31:52 +0900 (JST)
To: <huong@localhost>
Subject: Test Mail
User-Agent: mail (GNU Mailutils 3.19)
Date: Tue, 19 May 2026 13:31:52 +0900
Message-Id: <20260519043152.A41321DFB8F@mail.korodes.com>
From: huong <huong@Lepard>

This is the first mail.
? q
Saved 1 message in /home/huong/mbox
Held 0 messages in /home/huong/Maildir/

# apt -y install clamav-daemon amavisd-new

# vi /etc/amavis/conf.d/05-node_id

use strict;
# $myhostname is used by amavisd-new for node identification, and it is
# important to get it right (e.g. for ESMTP EHLO, loop detection, and so on) .

chomp($myhostname = `hostname --fqdn`);

# To manually set $myhostname, edit the following line with the correct Full y
# Qualified Domain Name (FQDN) and remove the # at the beginning of the line .
#
$myhostname = "mail.<domain name>";  ←12行目に追加
1; # ensure a defined return

# vi /etc/amavis/conf.d/15-content_filter_mode

13-14行目　: コメント解除してウィルススキャン有効化
@bypass_virus_checks_maps = (
\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);

# echo '<yourDomain>' > /etc/mailname

# vi /etc/postfix/main.cf

最終行へ追記
content_filter=smtp-amavis:[127.0.0.1]:10024

# vi /etc/postfix/master.cf

# 最終行へ以下全行追記
smtp-amavis unix - - n - 2 smtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
127.0.0.1:10025 inet n - n - - smtpd
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=127.0.0.0/8
    -o strict_rfc821_envelopes=yes
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000

# usermod -G clamav amavis
# usermod -G amavis clamav
# systemctl restart clamav-daemon amavis postfix

# apt -y install procmail spamassassin

# vi /etc/procmailrc

(procmailrcの内容)
SHELL=/bin/bash
PATH=/usr/bin:/bin:/usr/local/bin
DROPPRIVS=yes
MAILDIR=$HOME/Maildir
DEFAULT=$MAILDIR/
SPAM=$MAILDIR/.Spam/
LOGFILE=$HOME/.procmail.log # ログ出力先
VERBOSE=ON # 詳細ログ出力
 
## メールヘッダー中に「 X-Spam-*** 」の記述がなければ spamassassin を起動します
:0fw
*!^X-Spam.*
|spamassassin
 
## メールヘッダー中に「 X-Spam-Status: Yes 」の記述があれば、「 .Spam 」ディレクトリにメールを格納します
:0
* ^X-Spam-Status: Yes
$SPAM

# su - <user>
$ mkdir Maildir/.Spam 

# vi /etc/postfix/main.cf

485行目あたり　コメント解除
mailbox_command = /usr/bin/procmail -a "$EXTENSION"

# systemctl restart postfix spamd

# systemctl enable spamassassin-maintenance.timer
Created symlink '/etc/systemd/system/timers.target.wants/spamassassin-maintenance.timer' → '/usr/lib/systemd/system/spamassassin-maintenance.timer'.

# /usr/bin/sa-learn --spam /home/*/Maildir/.Spam/cur
Learned tokens from 0 message(s) (0 message(s) examined)

# /usr/bin/sa-learn --ham /home/*/Maildir/cur
Learned tokens from 7 message(s) (7 message(s) examined)

# vi /opt/script/spam-learns.sh

(下記内容を記述)
#! /bin/sh
スパムメールの学習
/usr/bin/sa-learn --spam /home/*/Maildir/.Spam/cur
通常のメールを学習
/usr/bin/sa-learn --ham /home/*/Maildir/cur

スパムメール保存ディレクトリの中身を強制的に消去してよいのなら以下の記述を追加
/bin/rm -f /home/*/Maildir/.Spam/cur

 # chmod 750 /opt/script/spam-learns.sh

# systemctl enable spamd
Synchronizing state of spamd.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable spamd