Debian13.5 : Anti-virus(Clamav) , Mail Server

# apt -y install clamav clamav-daemon

# sed -i -e "s/^NotifyClamd/#NotifyClamd/g" /etc/clamav/freshclam.conf
# systemctl stop clamav-freshclam

# freshclam
Tue May 19 11:46:50 2026 -> ClamAV update process started at Tue May 19 11:46:50 2026
Tue May 19 11:46:50 2026 -> daily.cvd database is up-to-date (version: 28004, sigs: 355454, f-level: 90, builder: svc.clamav-publisher)
Tue May 19 11:46:50 2026 -> main.cvd database is up-to-date (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
Tue May 19 11:46:50 2026 -> bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder: nrandolp)

# systemctl start clamav-freshclam

# vi /etc/logrotate.d/clamav-freshclam
Line 7 : change
create 640 clamav adm
↓
create 640 clamav clamav

# service clamav-freshclam status

It appears as follows
● clamav-freshclam.service - ClamAV virus database updater
     Loaded: loaded (/usr/lib/systemd/system/clamav-freshclam.service; disabled; preset: enabled)
     Active: active (running) since Tue 2026-05-19 11:47:42 JST; 2min 7s ago
 Invocation: fc38cbce18734375a9a3db2dbf8a1226
       Docs: man:freshclam(1)
             man:freshclam.conf(5)
             https://docs.clamav.net/
   Main PID: 17732 (freshclam)
      Tasks: 1 (limit: 4593)
     Memory: 3M (peak: 3.3M)
        CPU: 15ms
     CGroup: /system.slice/clamav-freshclam.service
             └─17732 /usr/bin/freshclam -d --foreground=true

May 19 11:47:42 Lepard systemd[1]: Started clamav-freshclam.service - ClamAV virus database updater.
May 19 11:47:42 Lepard freshclam[17732]: Tue May 19 11:47:42 2026 -> ClamAV update process started at Tue May 19 11:47:42 2026
May 19 11:47:42 Lepard freshclam[17732]: Tue May 19 11:47:42 2026 -> daily.cvd database is up-to-date (version: 28004, sigs: 355454, f-level: 90, buil>
May 19 11:47:42 Lepard freshclam[17732]: Tue May 19 11:47:42 2026 -> main.cvd database is up-to-date (version: 63, sigs: 3287027, f-level: 90, builder>
May 19 11:47:42 Lepard freshclam[17732]: Tue May 19 11:47:42 2026 -> bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder>

# clamscan --infected --remove --recursive /home

----------- SCAN SUMMARY -----------
Known viruses: 3627862
Engine version: 1.4.3
Scanned directories: 3
Scanned files: 7
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 11.211 sec (0 m 11 s)
Start Date: 2026:05:19 11:50:52
End Date:   2026:05:19 11:51:03

# wget https://secure.eicar.org/eicar.com.txt

# clamscan --infected --remove --recursive
/root/eicar.com.txt: Eicar-Test-Signature FOUND
/root/eicar.com.txt: Removed.

----------- SCAN SUMMARY -----------
Known viruses: 3627862
Engine version: 1.4.3
Scanned directories: 2
Scanned files: 7
Infected files: 1
Data scanned: 0.02 MB
Data read: 0.01 MB (ratio 2.00:1)
Time: 8.982 sec (0 m 8 s)
Start Date: 2026:05:19 11:52:17
End Date:   2026:05:19 11:52:26

# mkdir /opt/script

# vi /opt/script/clam-full.sh

Contents of clam-full.sh (new)
#!/bin/sh

echo =========================================
date
hostname
clamscan / \
--infected \
--recursive \
--log=/var/log/clamav/clamscan.log \
--move=/var/log/clamav/virus \
--exclude-dir=^/boot \
--exclude-dir=^/sys \
--exclude-dir=^/proc \
--exclude-dir=^/dev \
--exclude-dir=^/var/log/clamav/virus
if [ $? = 0 ]; then
echo “virus undetected.”
else
echo “virus detection!!”
fi

# chmod +x /opt/script/clam-full.sh

# mkdir /var/log/clamav/virus

# /opt/script/clam-full.sh

Tue May 19 11:56:55 AM JST 2026
Lepard

----------- SCAN SUMMARY -----------
Known viruses: 3627862
Engine version: 1.4.3
Scanned directories: 4880
Scanned files: 35613
Infected files: 0
Data scanned: 3159.49 MB
Data read: 1211.31 MB (ratio 2.61:1)
Time: 499.014 sec (8 m 19 s)
Start Date: 2026:05:19 11:56:55
End Date:   2026:05:19 12:05:14
“virus undetected.”

# crontab -e
0 2 * * mon /opt/script/clam-full.sh >> /var/log/clamav/clamascan.log

# apt -y install postfix sasl2-bin

# cp /usr/share/postfix/main.cf.dist /etc/postfix/main.cf
# vi /etc/postfix/main.cf

Line 82：Uncomment
mail_owner = postfix

Line 108：Add Host Name
myhostname = mail.<domain name>

Line 115：Add a Domain Name
mydomain = <domain name>

Line 133 : Comments
#myorigin = /etc/mailname

Line 135：Uncomment
myorigin = $mydomain

Line 149：Uncomment
inet_interfaces = all

Line 197：Uncomment
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

Line 240：Uncomment
local_recipient_maps = unix:passwd.byname $alias_maps

Line 285：Uncomment
mynetworks_style = subnet

Line 299：Uncomment and change to your own network
mynetworks = 192.168.11.0/24, 127.0.0.0/8

Line 423：Uncomment
alias_maps = hash:/etc/aliases

Line 434：Uncomment
alias_database = hash:/etc/aliases

Line 456：Uncomment
home_mailbox = Maildir/

Line 592：comment and add a note below it
#smtpd_banner = $myhostname ESMTP $mail_name (Debian)
smtpd_banner = $myhostname ESMTP

Line 666：Add
sendmail_path = /usr/sbin/postfix

Line 670：Uncomment
newaliases_path = /usr/bin/newaliases

Line 675：Uncomment
mailq_path = /usr/bin/mailq

Line 681：Uncomment
setgid_group = postdrop

Append to the last line
Disable the SMTP VRFY command
disable_vrfy_command = yes
Request the HELO command from the client
smtpd_helo_required = yes
Limit the size of sent and received emails to 10 MB
message_size_limit = 10485760
Limit mailbox size to 1 GB
mailbox_size_limit = 1073741824
SMTP Authentication Settings
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_mynetworks, permit_auth_destination, permit_sasl_authenticated, reject

# vi /etc/postfix/master.cf

Line 19,23 : Uncomment
submission inet n - y - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
　-o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes

# touch /etc/aliases

# vi /etc/aliases
postmaster:    root
huong:         huong

# newaliases
# systemctl restart postfix

# apt -y install dovecot-core dovecot-pop3d dovecot-imapd

# vi /etc/dovecot/dovecot.conf

Line 24 : Add
protocols = imap pop3
Line 31：Uncomment
listen = *, ::

# vi /etc/dovecot/conf.d/10-auth.conf
Line 10: Uncomment
auth_allow_cleartext = yes

Line 93: Uncomment
auth_mechanisms = plain login

# vi /etc/dovecot/conf.d/10-mail.conf
Line 26-27 : Uncomment
mail_driver = maildir
mail_path = ~/Maildir

Line 36-39 : Comment
#mail_driver = mbox
#mail_home = /home/%{user|username}
#mail_path = %{home}/mail
#mail_inbox_path = /var/mail/%{user}

# vi /etc/dovecot/conf.d/10-master.conf
Line 110-112：Uncomment and Add
# Postfix smtp-authi
unix_listener /var/spool/postfix/private/auth {
　mode = 0666
　user = postfix
　group = postfix
}

# systemctl restart dovecot

# apt -y install mailutils

# echo 'export MAIL=$HOME/Maildir/' >> /etc/profile.d/mail.sh

# ufw allow pop3
# ufw allow imap
# ufw allow smtp
# ufw reload

# su - huong
$ mail huong@localhost
Cc:
Subject: Test Mail
This is the first mail.

$ mail
"/home/huong/Maildir/": 1 message 1 new
>N   1 huong              Tue May 19 04:31  13/429   Test Mail
? 1
Return-Path: <huong@Lepard>
X-Original-To: huong@localhost
Delivered-To: huong@localhost
Received: by mail.korodes.com (Postfix, from userid 1000)
        id A41321DFB8F; Tue, 19 May 2026 13:31:52 +0900 (JST)
To: <huong@localhost>
Subject: Test Mail
User-Agent: mail (GNU Mailutils 3.19)
Date: Tue, 19 May 2026 13:31:52 +0900
Message-Id: <20260519043152.A41321DFB8F@mail.korodes.com>
From: huong <huong@Lepard>

This is the first mail.
? q
Saved 1 message in /home/huong/mbox
Held 0 messages in /home/huong/Maildir/

# apt -y install clamav-daemon amavisd-new

# vi /etc/amavis/conf.d/05-node_id

use strict;
# $myhostname is used by amavisd-new for node identification, and it is
# important to get it right (e.g. for ESMTP EHLO, loop detection, and so on) .

chomp($myhostname = `hostname --fqdn`);

# To manually set $myhostname, edit the following line with the correct Full y
# Qualified Domain Name (FQDN) and remove the # at the beginning of the line .
#
$myhostname = "mail.<domain name>";  ←Add to line 12
1; # ensure a defined return

# vi /etc/amavis/conf.d/15-content_filter_mode

Line 13-14　: Uncomment and enable virus scan
@bypass_virus_checks_maps = (
\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);

# echo '<yourDomain>' > /etc/mailname

# vi /etc/postfix/main.cf

Add to last line
content_filter=smtp-amavis:[127.0.0.1]:10024

# vi /etc/postfix/master.cf

Append all lines below to the end of the file.
smtp-amavis unix - - n - 2 smtp
     -o smtp_data_done_timeout=1200
     -o smtp_send_xforward_command=yes
     -o disable_dns_lookups=yes
127.0.0.1:10025 inet n - n - - smtpd
     -o content_filter=
     -o local_recipient_maps=
     -o relay_recipient_maps=
     -o smtpd_restriction_classes=
     -o smtpd_client_restrictions=
     -o smtpd_helo_restrictions=
     -o smtpd_sender_restrictions=
     -o smtpd_recipient_restrictions=permit_mynetworks,reject
     -o mynetworks=127.0.0.0/8
     -o strict_rfc821_envelopes=yes
     -o smtpd_error_sleep_time=0
     -o smtpd_soft_error_limit=1001
     -o smtpd_hard_error_limit=1000

# usermod -G clamav amavis
# usermod -G amavis clamav
# systemctl restart clamav-daemon amavis postfix

# apt -y install procmail spamassassin

# vi /etc/procmailrc

(Contents of procmailrc)
SHELL=/bin/bash
PATH=/usr/bin:/bin:/usr/local/bin
DROPPRIVS=yes
MAILDIR=$HOME/Maildir
DEFAULT=$MAILDIR/
SPAM=$MAILDIR/.Spam/
LOGFILE=$HOME/.procmail.log # Log output destination
VERBOSE=ON # Detailed log output
 
## If there is no "X-Spam-***" in the mail header, spamassassassin will be started.
:0fw
*!^X-Spam.*
|spamassassin
 
## If there is an "X-Spam-Status: Yes" in the mail header, the mail is stored in the ".
:0
* ^X-Spam-Status: Yes
$SPAM

# su - <user>
$ mkdir Maildir/.Spam 

# vi /etc/postfix/main.cf

Per Line 485 : Uncomment
mailbox_command = /usr/bin/procmail -a "$EXTENSION"

# systemctl restart postfix spamd

# systemctl enable spamassassin-maintenance.timer
Created symlink '/etc/systemd/system/timers.target.wants/spamassassin-maintenance.timer' → '/usr/lib/systemd/system/spamassassin-maintenance.timer'.

# /usr/bin/sa-learn --spam /home/*/Maildir/.Spam/cur
Learned tokens from 0 message(s) (0 message(s) examined)

# /usr/bin/sa-learn --ham /home/*/Maildir/cur
Learned tokens from 7 message(s) (7 message(s) examined)

# vi /opt/script/spam-learns.sh

(Please describe the following)
#! /bin/sh
Spam Email Learning
/usr/bin/sa-learn --spam /home/*/Maildir/.Spam/cur
Learning normal mail
/usr/bin/sa-learn --ham /home/*/Maildir/cur

If you want to force the deletion of the contents of the spam mail storage directory, add the following statement
/bin/rm -f /home/*/Maildir/.Spam/cur

 # chmod 750 /opt/script/spam-learns.sh

# systemctl enable spamd
Synchronizing state of spamd.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable spamd