Debian13.6 : Clamav(アンチウイルス) , Mailサーバー

# apt -y install clamav clamav-daemon

# sed -i -e "s/^NotifyClamd/#NotifyClamd/g" /etc/clamav/freshclam.conf
# systemctl stop clamav-freshclam

# freshclam
Wed Jul 22 17:06:57 2026 -> ClamAV update process started at Wed Jul 22 17:06:57 2026
WARNING: Wed Jul 22 17:06:57 2026 -> Your ClamAV installation is OUTDATED!
WARNING: Wed Jul 22 17:06:57 2026 -> Local version: 1.4.3 Recommended version: 1.4.5
Wed Jul 22 17:06:57 2026 -> DON'T PANIC! Read https://docs.clamav.net/manual/Installing.html
Wed Jul 22 17:06:57 2026 -> daily.cvd database is up-to-date (version: 28068, sigs: 355521, f-level: 90, builder: svc.clamav-publisher)
Wed Jul 22 17:06:57 2026 -> main.cvd database is up-to-date (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
Wed Jul 22 17:06:57 2026 -> bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder: nrandolp)

# systemctl start clamav-freshclam

# vi /etc/logrotate.d/clamav-freshclam
7行目
create 640 clamav adm
↓
create 640 clamav clamav

# service clamav-freshclam status

次のように表示される
● clamav-freshclam.service - ClamAV virus database updater
     Loaded: loaded (/usr/lib/systemd/system/clamav-freshclam.service; disabled; preset: enabled)
     Active: active (running) since Wed 2026-07-22 17:07:37 JST; 46s ago
 Invocation: add96579f9ce461ebb6151ec94684577
       Docs: man:freshclam(1)
             man:freshclam.conf(5)
             https://docs.clamav.net/
   Main PID: 21807 (freshclam)
      Tasks: 1 (limit: 4562)
     Memory: 3M (peak: 3.6M)
        CPU: 15ms
     CGroup: /system.slice/clamav-freshclam.service
             └─21807 /usr/bin/freshclam -d --foreground=true

Jul 22 17:07:37 Lepard systemd[1]: Started clamav-freshclam.service - ClamAV virus database updater.
Jul 22 17:07:37 Lepard freshclam[21807]: Wed Jul 22 17:07:37 2026 -> ClamAV update process started at Wed Jul 22 17:07>
Jul 22 17:07:37 Lepard freshclam[21807]: WARNING: Wed Jul 22 17:07:37 2026 -> Your ClamAV installation is OUTDATED!    
Jul 22 17:07:37 Lepard freshclam[21807]: WARNING: Wed Jul 22 17:07:37 2026 -> Local version: 1.4.3 Recommended version>
Jul 22 17:07:37 Lepard freshclam[21807]: Wed Jul 22 17:07:37 2026 -> DON'T PANIC! Read https://docs.clamav.net/manual/>
Jul 22 17:07:37 Lepard freshclam[21807]: Wed Jul 22 17:07:37 2026 -> daily.cvd database is up-to-date (version: 28068,>
Jul 22 17:07:37 Lepard freshclam[21807]: Wed Jul 22 17:07:37 2026 -> main.cvd database is up-to-date (version: 63, sig>
Jul 22 17:07:37 Lepard freshclam[21807]: Wed Jul 22 17:07:37 2026 -> bytecode.cvd database is up-to-date (version: 339

# wget https://secure.eicar.org/eicar.com.txt

# clamscan --infected --remove --recursive
/root/eicar.com.txt: Eicar-Test-Signature FOUND
/root/eicar.com.txt: Removed.

----------- SCAN SUMMARY -----------
Known viruses: 3627927
Engine version: 1.4.3
Scanned directories: 2
Scanned files: 7
Infected files: 1
Data scanned: 0.02 MB
Data read: 0.01 MB (ratio 2.00:1)
Time: 12.013 sec (0 m 12 s)
Start Date: 2026:07:22 17:09:46
End Date:   2026:07:22 17:09:58

# mkdir /opt/script

# vi /opt/script/clam-full.sh

clam-full.sh の内容(新規作成)
#!/bin/sh

echo =========================================
date
hostname
clamscan / \
--infected \
--recursive \
--log=/var/log/clamav/clamscan.log \
--move=/var/log/clamav/virus \
--exclude-dir=^/boot \
--exclude-dir=^/sys \
--exclude-dir=^/proc \
--exclude-dir=^/dev \
--exclude-dir=^/var/log/clamav/virus
if [ $? = 0 ]; then
echo “virus undetected.”
else
echo “virus detection!!”
fi

# chmod +x /opt/script/clam-full.sh

# mkdir /var/log/clamav/virus

# /opt/script/clam-full.sh

=========================================
Wed Jul 22 05:11:35 PM JST 2026
Lepard

----------- SCAN SUMMARY -----------
Known viruses: 3627927
Engine version: 1.4.3
Scanned directories: 5285
Scanned files: 39676
Infected files: 0
Data scanned: 3409.69 MB
Data read: 1390.76 MB (ratio 2.45:1)
Time: 457.100 sec (7 m 37 s)
Start Date: 2026:07:22 17:11:35
End Date:   2026:07:22 17:19:12
“virus undetected.”

# crontab -e
0 2 * * mon /opt/script/clam-full.sh >> /var/log/clamav/clamascan.log

# apt -y install postfix sasl2-bin

# cp /usr/share/postfix/main.cf.dist /etc/postfix/main.cf
# vi /etc/postfix/main.cf

82行目：コメント解除
mail_owner = postfix

108行目：ホスト名指定追加
myhostname = mail.<domain>

115行目：ドメイン名指定追加
mydomain = <domain>

133行目 : コメント
#myorigin = /etc/mailname

135行目：コメント解除
myorigin = $mydomain

149行目：コメント解除
inet_interfaces = all

197行目：コメント解除
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

240行目：コメント解除
local_recipient_maps = unix:passwd.byname $alias_maps

285行目：コメント解除
mynetworks_style = subnet

299行目：コメント解除し、自ネットワークに変更
mynetworks = 192.168.11.0/24, 127.0.0.0/8

423行目：コメント解除
alias_maps = hash:/etc/aliases

434行目：コメント解除
alias_database = hash:/etc/aliases

456行目：コメント解除
home_mailbox = Maildir/

592行目：コメントにしてその下に追記
#smtpd_banner = $myhostname ESMTP $mail_name (Debian)
smtpd_banner = $myhostname ESMTP

666行目：追加
sendmail_path = /usr/sbin/postfix

670行目：コメント解除
newaliases_path = /usr/bin/newaliases

675行目：コメント解除
mailq_path = /usr/bin/mailq

681行目：コメント解除
setgid_group = postdrop

最終行へ追記
SMTP VRFY コマンドは無効にする
disable_vrfy_command = yes
クライアントに対して HELO コマンドを要求する
smtpd_helo_required = yes
送受信メールサイズを10Mに制限
message_size_limit = 10485760
メールボックスサイズを1Gに制限
mailbox_size_limit = 1073741824
SMTP-Auth 設定
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_mynetworks, permit_auth_destination, permit_sasl_authenticated, reject

# vi /etc/postfix/master.cf

19,23行目 : コメント解除
submission inet n - y - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
　-o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes

# vi /etc/aliases

下記内容を記述
postmaster:    root
huong:         huong

# newaliases
# systemctl restart postfix

# apt -y install dovecot-core dovecot-pop3d dovecot-imapd

# vi /etc/dovecot/dovecot.conf

24行目 : 追加
protocols = imap pop3
31行目：コメント解除
listen = *, ::

# vi /etc/dovecot/conf.d/10-auth.conf

10行目 : コメント解除
auth_allow_cleartext = yes

93行目 : コメント解除
auth_mechanisms = plain login

# vi /etc/dovecot/conf.d/10-mail.conf

26-27行目 : コメント解除
mail_driver = maildir
mail_path = ~/Maildir

36-39行目 : コメントにする
#mail_driver = mbox
#mail_home = /home/%{user|username}
#mail_path = %{home}/mail
#mail_inbox_path = /var/mail/%{user}

# vi /etc/dovecot/conf.d/10-master.conf
110-112行目：コメント解除し追記
# Postfix smtp-authi
unix_listener /var/spool/postfix/private/auth {
　mode = 0666
　user = postfix
　group = postfix
}

# systemctl restart dovecot

# apt -y install mailutils

# echo 'export MAIL=$HOME/Maildir/' >> /etc/profile.d/mail.sh

# ufw allow pop3
# ufw allow imap
# ufw allow smtp
# ufw reload

# su - huong
$ mail huong@localhost
Cc:
(件名)
Subject: Test Mail
(本文)
This is the first mail.

$ mail
"/home/huong/Maildir/": 1 message 1 new
>N   1 huong              Wed Jul 22 09:58  13/427   Test Mail
? 1
Return-Path: <huong@Lepard>
X-Original-To: huong@localhost
Delivered-To: huong@localhost
Received: by mail.korodes.com (Postfix, from userid 1000)
        id 458D520BFC; Wed, 22 Jul 2026 18:58:27 +0900 (JST)
To: <huong@localhost>
Subject: Test Mail
User-Agent: mail (GNU Mailutils 3.19)
Date: Wed, 22 Jul 2026 18:58:27 +0900
Message-Id: <20260722095827.458D520BFC@mail.korodes.com>
From: huong <huong@Lepard>

This is the first mail.
? q
Saved 1 message in /home/huong/mbox
Held 0 messages in /home/huong/Maildir/

# apt -y install clamav-daemon amavisd-new

# vi /etc/amavis/conf.d/05-node_id

 12行目に追加
use strict;
# $myhostname is used by amavisd-new for node identification, and it is
# important to get it right (e.g. for ESMTP EHLO, loop detection, and so on) .

chomp($myhostname = `hostname --fqdn`);

# To manually set $myhostname, edit the following line with the correct Full y
# Qualified Domain Name (FQDN) and remove the # at the beginning of the line .
#
#$myhostname = "mail.example.com";
$myhostname = "mail.<domain>"; 
1; # ensure a defined return

# vi /etc/amavis/conf.d/15-content_filter_mode

13-14行目　: コメント解除してウィルススキャン有効化
@bypass_virus_checks_maps = (
\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);

# echo '<yourDomain>' > /etc/mailname

# vi /etc/postfix/main.cf

最終行へ追記
content_filter=smtp-amavis:[127.0.0.1]:10024

# vi /etc/postfix/master.cf

# 最終行へ以下全行追記
smtp-amavis unix - - n - 2 smtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
127.0.0.1:10025 inet n - n - - smtpd
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=127.0.0.0/8
    -o strict_rfc821_envelopes=yes
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000

# usermod -G clamav amavis
# usermod -G amavis clamav
# systemctl restart clamav-daemon amavis postfix

# apt -y install procmail spamassassin

# vi /etc/procmailrc

下記内容を記述(procmailrcの内容)
SHELL=/bin/bash
PATH=/usr/bin:/bin:/usr/local/bin
DROPPRIVS=yes
MAILDIR=$HOME/Maildir
DEFAULT=$MAILDIR/
SPAM=$MAILDIR/.Spam/
LOGFILE=$HOME/.procmail.log # ログ出力先
VERBOSE=ON # 詳細ログ出力
 
## メールヘッダー中に「 X-Spam-*** 」の記述がなければ spamassassin を起動します
:0fw
*!^X-Spam.*
|spamassassin
 
## メールヘッダー中に「 X-Spam-Status: Yes 」の記述があれば、「 .Spam 」ディレクトリにメールを格納します
:0
* ^X-Spam-Status: Yes
$SPAM

# su - <user>
$ mkdir Maildir/.Spam 

# vi /etc/postfix/main.cf

485行目あたり　コメント解除
mailbox_command = /usr/bin/procmail -a "$EXTENSION"

# systemctl restart postfix spamd

# systemctl enable spamassassin-maintenance.timer
Created symlink '/etc/systemd/system/timers.target.wants/spamassassin-maintenance.timer' → '/usr/lib/systemd/system/spamassassin-maintenance.timer'.

# /usr/bin/sa-learn --spam /home/*/Maildir/.Spam/cur
Learned tokens from 0 message(s) (0 message(s) examined)

# /usr/bin/sa-learn --ham /home/*/Maildir/cur
Learned tokens from 7 message(s) (7 message(s) examined)

# vi /opt/script/spam-learns.sh

下記内容を記述
#! /bin/sh
#スパムメールの学習
/usr/bin/sa-learn --spam /home/*/Maildir/.Spam/cur
#通常のメールを学習
/usr/bin/sa-learn --ham /home/*/Maildir/cur

#スパムメール保存ディレクトリの中身を強制的に消去してよいのなら以下の記述を追加
/bin/rm -f /home/*/Maildir/.Spam/cur

 # chmod 750 /opt/script/spam-learns.sh

# systemctl enable spamd
Synchronizing state of spamd.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable spamd