Install ClamAV on FreeBSD 15.1 and link it with Amavis against Postfix.
ClamAV is anti-virus software.
We will proceed on the assumption that you have already implemented Postfix.
Before proceeding, update the Ports Collection.
1. ClamAV
1.1 Install
# pkg install -y clamav
clamav version check
# pkg version -v | grep clamav
clamav-1.5.2_1,1 < needs updating (index has 1.5.2_3,1)
1.2 Configuration File Editing
①Edit clamd.conf
Run ClamAV as root user
# chmod 640 /usr/local/etc/clamd.conf
# vi /usr/local/etc/clamd.conf
Line 35 : Uncomment
LogTime yes
Line 269 : Comment out
#User clamav
➁Edit freshclam.conf
Settings about virus pattern files
# chmod 640 /usr/local/etc/freshclam.conf
# vi /usr/local/etc/freshclam.conf
Line 76 : Change
DatabaseOwner clamav
↓
DatabaseOwner root
Line 92 : Post it as a comment, then add the following below it (change mirror site)
#DatabaseMirror database.clamav.net
DatabaseMirror db.jp.clamav.net
Line 135 : Uncomment
#Checks 24
Checks 24
1.3 Virus database update
# freshclam
ClamAV update process started at Thu Jun 18 09:55:12 2026
daily database available for download (remote version: 28034)
Time: 0.8s, ETA: 0.0s [========================>] 22.33MiB/22.33MiB
Time: 0.8s, ETA: 0.0s [========================>] 8.87KiB/8.87KiB
Testing database: '/var/db/clamav/tmp.afb911d585/daily.cvd' ...
Database test passed.
daily.cvd updated (version: 28034, sigs: 355467, f-level: 90, builder: svc.clamav-publisher)
main database available for download (remote version: 63)
Time: 2.5s, ETA: 0.0s [========================>] 84.95MiB/84.95MiB
Time: 0.4s, ETA: 0.0s [========================>] 8.87KiB/8.87KiB
Testing database: '/var/db/clamav/tmp.afb911d585/main.cvd' ...
Database test passed.
main.cvd updated (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
bytecode database available for download (remote version: 339)
Time: 0.1s, ETA: 0.0s [========================>] 275.10KiB/275.10KiB
Time: 0.1s, ETA: 0.0s [========================>] 8.87KiB/8.87KiB
Testing database: '/var/db/clamav/tmp.afb911d585/bytecode.cvd' ...
Database test passed.
bytecode.cvd updated (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.sock: No such file or directory
1.4 ClamAV start
ClamAV auto-start configuration
# vi /etc/rc.conf
Add the following
clamav_clamd_enable="YES"
clamav_freshclam_enable="YES"
start
# /usr/local/etc/rc.d/clamav_clamd start
Starting clamav_clamd.
# /usr/local/etc/rc.d/clamav_freshclam start
Starting clamav_freshclam.
1.5 manual virus check
To manually check for viruses, do the following(Scanning range is /home/)
# clamscan --infected --remove --recursive -r /home
----------- SCAN SUMMARY -----------
Known viruses: 3627875
Engine version: 1.5.2
Scanned directories: 16
Scanned files: 26
Infected files: 0
Data scanned: 21.23 KiB
Data read: 11.21 KiB (ratio 1.89:1)
Time: 18.769 sec (0 m 18 s)
Start Date: 2026:06:18 09:57:58
End Date: 2026:06:18 09:58:17
1.6 automatic virus scanning
• Scanning range is /home/.
• Output scan results to /var/log/clamav.log
• Automatic deletion of detected viruses
• Executed daily
Create an execution script with the above conditions
①Creation of virus storage directory
# mkdir -p /var/lib/clamav/virus
➁Shell Script Creation
# vi /etc/clamscan.sh
Please describe the following content.
#!/bin/sh
# clamscan script
CLAMSCAN='/usr/local/bin/clamscan'
echo "clamscan start "`date '+%Y%m%d'`
$CLAMSCAN --log=/var/log/clamav/clamav.log -i --move=/var/lib/clamav/virus/ -r /home
Grant execution permissions to scripts
# chmod 755 /etc/clamscan.sh
Register in cron to be executed at 0:00 AM
# crontab -e
The following content description
0 0 * * * /etc/clamscan.sh > /dev/null 2>&1
Run the following as a test
# /etc/clamscan.sh
clamscan start 20251206
----------- SCAN SUMMARY -----------
Known viruses: 3627875
Engine version: 1.5.2
Scanned directories: 16
Scanned files: 26
Infected files: 0
Data scanned: 21.23 KiB
Data read: 11.21 KiB (ratio 1.89:1)
Time: 11.727 sec (0 m 11 s)
Start Date: 2026:06:18 10:01:39
End Date: 2026:06:18 10:01:51
If you look at /var/log/clamav/clamav.log, you will see the same log as above
# cat /var/log/clamav/clamav.log
2. Amavis
Install Amavis, which links ClamAV and Postfix
2.1 Install
# pkg install amavisd-new
2.2 Configuration File Editing
Edit amavisd.conf
# vi /usr/local/etc/amavisd.conf
Line 13: Uncomment
@bypass_spam_checks_maps = (1); # controls running of anti-spam code
Line 23: Change to your own domain name
$mydomain = '<domain name>'; # a convenient default for other settings
Line 169: Append your hostname
$myhostname = 'mail.<domain name>';
Lines 170-171: Uncomment
$notify_method = 'smtp:[127.0.0.1]:10025';
$forward_method = 'smtp:[127.0.0.1]:10025';
Lines 824-827: Uncomment
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.sock"],
qr/\bOK$/m, qr/\bFOUND$/m,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
2.3 Amavis Auto-Startup Configuration
# vi /etc/rc.conf
Add the following description
amavisd_enable="YES"
Amavis start
# /usr/local/etc/rc.d/amavisd start
2.4 Postfix Configuration
①Edit main.cf
# vi /usr/local/etc/postfix/main.cf
Add to the last line
# Filter configuration
content_filter = smtp-amavis:[127.0.0.1]:10024
➁Edit master.cf
# vi /usr/local/etc/postfix/master.cf
Add the following to the last line:
# Amavis configuration
smtp-amavis unix - - n - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o smtp_dns_support_level=disabled
-o max_use=20
127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
3. Anti-Spam with SpamAssassin
3.1 SpamAssassin Install
If you did not select spamassassin as an option when you installed Amavis, install it as follows
# pkg install spamassassin
# chmod 644 /usr/local/etc/mail/spamassassin/v310.pre
3.2 Configuration File Editing
# vi /usr/local/etc/mail/spamassassin/v310.pre
Line 24 : Uncomment (enable TextCat)
loadplugin Mail::SpamAssassin::Plugin::DCC
3.3 Spamassassin start
# vi /etc/rc.conf
Additional description below
spamd_enable="YES"
# sa-update
# /usr/local/etc/rc.d/sa-spamd start
Starting spamd.
3.4 SpamassAssin Update
Create an update script
# vi /etc/periodic/daily/620.spamassassin
Please fill in the following information
#!/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
cd /usr/local/etc/mail/spamassassin
wget -q https://github.com/kittyfreak/spamassassin_user_prefs/archive/refs/heads/main.zip
[ $? -ne 0 ] && exit
unzip main.zip >/dev/null 2>&1
[ $? -ne 0 ] && exit
rm -f main.zip
mv spamassassin_user_prefs-main/user_prefs .
rm -rf spamassassin_user_prefs-main
cp user_prefs local.cf
cat << EOF >> local.cf
report_safe 0
rewrite_header Subject ***SPAM***
EOF
/usr/local/etc/rc.d/sa-spamd restart > /dev/null
Grant execution rights to scripts
# chmod 755 /etc/periodic/daily/620.spamassassin
When the script is executed, a local.cf is created for the date and time of execution
If wget is not installed, install it.
# pkg install wget
# /etc/periodic/daily/620.spamassassin
# ls -l /usr/local/etc/mail/spamassassin
total 546
-rw-r--r-- 1 root wheel 1649 Jun 11 13:13 init.pre
-rw-r--r-- 1 root wheel 1649 Jun 11 13:13 init.pre.sample
-rw-r--r-- 1 root wheel 500636 Jun 18 10:22 local.cf
-rw-r--r-- 1 root wheel 3218 Jun 11 13:13 local.cf.sample
drwx------ 3 root wheel 11 Jun 18 10:20 sa-update-keys
-rw-r--r-- 1 root wheel 500588 Apr 30 2023 user_prefs
-rw-r--r-- 1 root wheel 2266 Jun 18 10:15 v310.pre
-rw-r--r-- 1 root wheel 2267 Jun 11 13:13 v310.pre.sample
-rw-r--r-- 1 root wheel 1168 Jun 11 13:13 v312.pre
-rw-r--r-- 1 root wheel 1168 Jun 11 13:13 v312.pre.sample
-rw-r--r-- 1 root wheel 2416 Jun 11 13:13 v320.pre
-rw-r--r-- 1 root wheel 2416 Jun 11 13:13 v320.pre.sample
-rw-r--r-- 1 root wheel 1237 Jun 11 13:13 v330.pre
-rw-r--r-- 1 root wheel 1237 Jun 11 13:13 v330.pre.sample
-rw-r--r-- 1 root wheel 1020 Jun 11 13:13 v340.pre
-rw-r--r-- 1 root wheel 1020 Jun 11 13:13 v340.pre.sample
-rw-r--r-- 1 root wheel 1315 Jun 11 13:13 v341.pre
-rw-r--r-- 1 root wheel 1315 Jun 11 13:13 v341.pre.sample
-rw-r--r-- 1 root wheel 1519 Jun 11 13:13 v342.pre
-rw-r--r-- 1 root wheel 1519 Jun 11 13:13 v342.pre.sample
-rw-r--r-- 1 root wheel 1266 Jun 11 13:13 v343.pre
-rw-r--r-- 1 root wheel 1266 Jun 11 13:13 v343.pre.sample
-rw-r--r-- 1 root wheel 1484 Jun 11 13:13 v400.pre
-rw-r--r-- 1 root wheel 1484 Jun 11 13:13 v400.pre.sample
-rw-r--r-- 1 root wheel 1118 Jun 11 13:13 v401.pre
-rw-r--r-- 1 root wheel 1118 Jun 11 13:13 v401.pre.sample
-rw-r--r-- 1 root wheel 1145 Jun 11 13:13 v402.pre
-rw-r--r-- 1 root wheel 1145 Jun 11 13:13 v402.pre.sample
3.5 postfix restart
# /usr/local/etc/rc.d/postfix restart
3.6 Spam mailbox creation
When using IMAP in this case
①Create spam mailboxes for existing users
Let's assume the existing user is huong
# bash
# mkdir -p /home/huong/Maildir/.spam/{cur,new,tmp}
# chmod -R 700 /home/huong/Maildir/.spam
# chown -R huong:huong /home/huong/Maildir/.spam
➁Create spam mailboxes for additional users
# mkdir -p /usr/share/skel/Maildir/.spam/{cur,new,tmp}
# chmod -R 700 /usr/share/skel/Maildir/.spam
# sh
3.7 Edit procmailrc (for IMAP)
# mv /usr/local/etc/procmailrc /usr/local/etc/procmailrc.old
# vi /usr/local/etc/procmailrc
Fill in the following
SHELL=/bin/sh
PATH=/bin:/usr/bin:/usr/local/bin
DROPPRIVS=yes
MAILDIR=$HOME/Maildir
DEFAULT=$MAILDIR/
SPAM=$MAILDIR/.spam/
#LOGFILE=$MAILDIR/procmail.log
:0
* ^Subject:.*=\?[Ii][Ss][Oo]-2022-[Jj][Pp]\?[Bb]\?GyRCTCQ\+NUJ6OS05cCIo
/dev/null
# Start spamassassin if "X-Spam-***" is not in the header
:0fw
*!^X-Spam.*
|spamassassin
# If the header has "X-Spam-Status: Yes", it is stored in the ".spam" directory.
:0
*^X-Spam-Status: Yes
$SPAM
3.8 Spam Mail Learning
Create spam email learning scripts
# vi /etc/periodic/daily/620.sa-learn
Fill in the following
#!/bin/sh
# Learning spam folder as spam
/usr/local/bin/sa-learn --spam /home/*/Maildir/.spam/cur
# Maildir folder learned as normal mail
/usr/local/bin/sa-learn --ham /home/*/Maildir/cur
# Uncomment the following to delete the spam folder
#/bin/rm -f /home/*/Maildir/.spam/cur/*
3.9 Virus and Spam Email Transmission Test
When I send a blank email to myself in Thunderbird, the following message appears in the header of the received email
X-Mozilla-Status2: 00000000
Return-Path: <xxxxx@xxxxxxx.com>
X-Spam-Checker-Version: SpamAssassin 4.0.2 (2025-08-27) on Lepard
X-Spam-Level: **
X-Spam-Status: No, score=2.3 required=13.0 tests=ALL_TRUSTED,
CONTENT_TYPE_PRESENT,EMPTY_MESSAGE,PDS_TONAME_EQ_TOLOCAL_VSHORT
autolearn=no autolearn_force=no version=4.0.2
X-Original-To: xxxxx@xxxxxxx.com
Delivered-To: xxxxx@xxxxxxx.com
Received: from localhost (localhost [127.0.0.1])
by mail.xxxxxxx.com (Postfix) with ESMTP id 4E7FB35E2C
for <xxxxx@xxxxxxx.com>; Thu, 18 Jun 2026 10:33:01 +0900 (JST)
X-Virus-Scanned: amavis at korodes.com
Received: from mail.xxxxxxx.com ([127.0.0.1])
by localhost (mail.xxxxxxx.com [127.0.0.1]) (amavis, port 10024) with ESMTP
id 1vBGTvIDwA6S for <xxxxx@xxxxxxx.com>;
Thu, 18 Jun 2026 10:32:43 +0900 (JST)
Received: from [192.168.11.14] (buffalo.setup [192.168.11.1])
by mail.xxxxxxx.com (Postfix) with ESMTPSA id 997C735EED
for <xxxxx@xxxxxxx.com>; Thu, 18 Jun 2026 10:32:43 +0900 (JST)
------------------------------------
------------------------------------
Fill in the following in the body of the message in Thunderbird and send it to yourself.
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
The email was not delivered and was quarantined in the .spam directory (.spam/new/xxxxxxxxx). The following message appears in the header of the received email:
X-Spam-Checker-Version: SpamAssassin 4.0.2 (2025-08-27) on Lepard
X-Spam-Flag: YES
X-Spam-Level: ********************************************
X-Spam-Status: Yes, score=1001.8 required=13.0 tests=ALL_TRUSTED,
CONTENT_TYPE_PRESENT,GTUBE,HTML_MESSAGE,MPART_ALT_DIFF,
MULTIPART_ALTERNATIVE autolearn=no autolearn_force=no version=4.0.2
X-Spam-Report:
* 0.1 ALL_TRUSTED Passed through trusted hosts only via SMTP
* -0.1 CONTENT_TYPE_PRESENT exists:Content-Type
* 0.1 MULTIPART_ALTERNATIVE Multipart/alternative
* 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
* 1.0 HTML_MESSAGE BODY: HTML included in message
* 0.7 MPART_ALT_DIFF BODY: HTML and text parts are different