Contents
1. Clamav
1.1 Clam AntiVirus Install
|
1 |
# dnf -y install clamav clamd clamav-update |
1.2 Edit Clam AntiVirus configuration file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
# vi /etc/clamd.d/scan.conf ●Line 14 # Default: disabled LogFile /var/log/clamd.scan ← Uncomment ●Line 77 # Default: disabled PidFile /run/clamd.scan/clamd.pid ← Uncomment ●Line 96 # Path to a local socket file the daemon will listen on. # Default: disabled (must be specified by a user) LocalSocket /run/clamd.scan/clamd.sock ← Uncomment ●Line 219 # Run as another user (clamd must be started by root for this option to work) # Default: don't drop privileges #User clamscan ← Add # at the beginning of the line and comment it out (to make it work with root privileges) |
1.3 Virus definition file update settings
|
1 2 3 4 5 6 7 8 |
# vi /etc/freshclam.conf ●Line 75 : Comment out and add under it #DatabaseMirror database.clamav.net DatabaseMirror db.jp.clamav.net ●Per line 151 Add "NotifyClamd /etc/clamd.d/scan.conf" #NotifyClamd /path/to/clamd.conf NotifyClamd /etc/clamd.d/scan.conf |
1.4 Update virus definition files
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
# freshclam ClamAV update process started at Wed Feb 22 21:42:35 2023 daily database available for download (remote version: 26820) Time: 1.8s, ETA: 0.0s [========================>] 57.94MiB/57.94MiB Testing database: '/var/lib/clamav/tmp.6ab3ed4968/clamav-f7fd793173cc4f64b95923bce9bc3e9c.tmp-daily.cvd' ... Database test passed. daily.cvd updated (version: 26820, sigs: 2021349, f-level: 90, builder: raynman) main database available for download (remote version: 62) Time: 2.8s, ETA: 0.0s [========================>] 162.58MiB/162.58MiB Testing database: '/var/lib/clamav/tmp.6ab3ed4968/clamav-66b5411c3d65d8af84115d5561ee0e10.tmp-main.cvd' ... Database test passed. main.cvd updated (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) bytecode database available for download (remote version: 333) Time: 0.2s, ETA: 0.0s [========================>] 286.79KiB/286.79KiB Testing database: '/var/lib/clamav/tmp.6ab3ed4968/clamav-0684500d198d615a63827dc859ac75ce.tmp-bytecode.cvd' ... Database test passed. bytecode.cvd updated (version: 333, sigs: 92, f-level: 63, builder: awillia2) |
1.5 Start Clam AntiVirus
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
# systemctl start clamd@scan ← clamd start # systemctl enable clamd@scan ← Automatic clamd startup configuration Created symlink /etc/systemd/system/multi-user.target.wants/clamd@scan.service → /usr/lib/systemd/system/clamd@.service. # systemctl is-enabled clamd@scan enabled # systemctl status clamd@scan ← operation check ● clamd@scan.service - clamd scanner (scan) daemon Loaded: loaded (/usr/lib/systemd/system/clamd@.service; enabled; preset: d> Active: active (running) since Wed 2023-02-22 21:49:17 JST; 42s ago Docs: man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/ Main PID: 4764 (clamd) Tasks: 2 (limit: 10948) Memory: 1.2G CPU: 13.481s CGroup: /system.slice/system-clamd.slice/clamd@scan.service mq4764 /usr/sbin/clamd -c /etc/clamd.d/scan.conf Feb 22 21:49:17 Lepard clamd[4764]: ELF support enabled. Feb 22 21:49:17 Lepard clamd[4764]: Mail files support enabled. Feb 22 21:49:17 Lepard clamd[4764]: OLE2 support enabled. Feb 22 21:49:17 Lepard clamd[4764]: PDF support enabled. Feb 22 21:49:17 Lepard clamd[4764]: SWF support enabled. Feb 22 21:49:17 Lepard clamd[4764]: HTML support enabled. Feb 22 21:49:17 Lepard clamd[4764]: XMLDOCS support enabled. Feb 22 21:49:17 Lepard clamd[4764]: HWP3 support enabled. Feb 22 21:49:17 Lepard clamd[4764]: Self checking every 600 seconds. Feb 22 21:49:17 Lepard systemd[1]: Started clamd scanner (scan) daemon. |
1.6 Conducted virus scan
Download a test virus and perform a virus scan
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
# wget http://www.eicar.org/download/eicar.com # clamscan --infected --remove --recursive /root/eicar.com: Win.Test.EICAR_HDB-1 FOUND /root/eicar.com: Removed. ----------- SCAN SUMMARY ----------- Known viruses: 8653279 Engine version: 0.103.8 Scanned directories: 2 Scanned files: 11 Infected files: 1 Data scanned: 0.02 MB Data read: 0.01 MB (ratio 2.00:1) Time: 65.321 sec (1 m 5 s) Start Date: 2023:02:22 21:52:01 End Date: 2023:02:22 21:53:07 |
1.7 Deployment of virus scan auto-execution scripts
|
1 2 |
# mkdir -p /var/www/system # cd /var/www/system |
clamscan.sh Create in /var/www/system with the following contents
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# vi /var/www/system/clamscan.sh #!/bin/bash PATH=/usr/bin:/bin # excludeopt setup excludelist=/var/www/system/clamscan.exclude if [ -s $excludelist ]; then for i in `cat $excludelist` do if [ $(echo "$i"|grep \/$) ]; then i=`echo $i|sed -e 's/^\([^ ]*\)\/$/\1/p' -e d` excludeopt="${excludeopt} --exclude-dir=$i" else excludeopt="${excludeopt} --exclude=$i" fi done fi # signature update freshclam # virus scan clamscan --recursive --remove ${excludeopt} / |
1.8 Virus scan exclusion directory settings
sExclude sys and proc directories.
|
1 2 3 |
# chmod 700 clamscan.sh # echo "/sys/" >> /var/www/system/clamscan.exclude # echo "/proc/" >> /var/www/system/clamscan.exclude |
1.9 Scheduled virus scan execution
|
1 2 |
# crontab -e 0 1 * * * /var/www/system/clamscan.sh > /dev/null 2>&1 |
2. Mail Server Installation
1. Postfix Install
1.1 Install
Install Postfix and build an SMTP server
|
1 |
# dnf -y install postfix |
Check if Postfix is installed
|
1 2 3 4 |
# rpm -qa | grep postfix postfix-3.5.9-19.el9.x86_64 postfix-perl-scripts-3.5.9-19.el9.x86_64 pcp-pmda-postfix-6.0.1-4.el9.x86_64 |
1.2 Register Postfix to the service
|
1 2 3 4 |
# systemctl enable postfix.service Created symlink /etc/systemd/system/multi-user.target.wants/postfix.service → /usr/lib/systemd/system/postfix.service. # systemctl is-enabled postfix.service enabled |
1.3 Backup postfix configuration files, main.cf and master.cf files
|
1 2 |
# cp -p /etc/postfix/main.cf `date '+/etc/postfix/main.cf.%Y%m%d'` # cp -p /etc/postfix/master.cf `date '+/etc/postfix/master.cf.%Y%m%d'` |
1.4 Edit postfix configuration file
To prevent unauthorized mail relay, configure Postfix to require authentication for outgoing mail as well, using Dovecot's SASL function.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 |
# vi /etc/postfix/main.cf ●Per line 96 : Add #myhostname = virtual.domain.tld myhostname = mail.<Domain name> ●Per line 103 : Add your domain name #mydomain = domain.tld mydomain = <Domain name> ●Per line 118 : Uncomment myorigin = $mydomain ●Per line 135 : Change inet_interfaces = all ●Per line 183 : Add Comment out around line 183 and add to line 184. #mydestination = $myhostname, localhost.$mydomain, localhost mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain ●Per line 287 : Add #mynetworks = 168.100.189.0/28, 127.0.0.0/8 #mynetworks = $config_directory/mynetworks #mynetworks = hash:/etc/postfix/network_table mynetworks = 192.168.11.0/24, 127.0.0.0/8 ←192.168.11.0/24 to suit your environment ●Per line 440 : Uncomment Set the mail storage format. #home_mailbox = Mailbox home_mailbox = Maildir/ ●Per line 447 : Add #mail_spool_directory = /var/mail mail_spool_directory = /var/spool/mail ●Per line 593 : Add #smtpd_banner = $myhostname ESMTP $mail_name #smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) smtpd_banner = $myhostname ESMTP unknown ●Add the following to the last line # Limit send/receive mail size to 10M message_size_limit = 10485760 # Limit mailbox size to 1G mailbox_size_limit = 1073741824 # SMTP-Auth smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $mydomain smtpd_recipient_restrictions = permit_mynetworks, permit_auth_destination, permit_sasl_authenticated, reject |
Release SMTP port (port 25)
|
1 2 3 4 |
# firewall-cmd --add-service=smtp --permanent success # firewall-cmd --reload success |
1.5 Postfix restart
|
1 |
# systemctl restart --now postfix |
2.Dovecot Install
2.1 Install
|
1 |
# dnf -y install dovecot |
2.2 Edit dovecot.conf file
|
1 2 3 4 5 6 7 8 |
# cp -p /etc/dovecot/dovecot.conf `date '+ /etc/dovecot/dovecot.conf.%Y%m%d'` # vi /etc/dovecot/dovecot.conf ●Per line 25 : Add # protocols = imap pop3 lmtp protocols = imap pop3 ●Line 30 : Uncomment # Remove [::] if listening for IPv4 only listen = * |
2.3 Edit 10-auth.conf file
|
1 2 3 4 5 6 |
# vi /etc/dovecot/conf.d/10-auth.conf ●Line 10 : Uncomment and change If plain text authentication is also allowed disable_plaintext_auth = no ●Line 100 : Add auth_mechanisms = plain login |
2.4 Edit 10-mail.conf file
|
1 2 3 |
# vi /etc/dovecot/conf.d/10-mail.conf ●Line 31 : Add mail_location = maildir:~/Maildir |
2.5 Edit 10-master.conf file
|
1 2 3 4 5 6 7 8 |
# vi /etc/dovecot/conf.d/10-master.conf ●Line 107-109 : Uncomment and add # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix group = postfix } |
2.6 Edit 10-ssl.conf file
|
1 2 3 |
# vi /etc/dovecot/conf.d/10-ssl.conf ●Per line8 : Change ssl = yes |
2.7 Register dovecot as a service and start it
|
1 2 3 4 5 |
# systemctl enable dovecot.service Created symlink /etc/systemd/system/multi-user.target.wants/dovecot.service → /usr/lib/systemd/system/dovecot.service. # systemctl is-enabled dovecot.service Enabled # systemctl start dovecot.service |
2.8 Permission port opening for POP/IMAP service with firewalld
POP : [110/TCP], IMAP : [143/TCP]
|
1 2 3 |
# firewall-cmd --permanent --add-service=pop3 # firewall-cmd --permanent --add-service=imap # firewall-cmd --reload |
3.Create mail user and check operation
3.1 advance preparation
①Pretreatment for new users
When a new user is added, set up the system to automatically send and receive e-mail.
|
1 2 3 4 |
# mkdir -p /etc/skel/Maildir/{new,cur,tmp} # chmod -R 700 /etc/skel/Maildir/ # echo "~/Maildir/"> /etc/skel/.forward # chmod 600 /etc/skel/.forward |
②Mail environment pre-processing for existing users
Configure the already created users to be able to send and receive e-mail.
|
1 2 3 4 |
# mkdir -p /home/huong/Maildir/{new,cur,tmp} # chown -R huong:huong /home/huong/Maildir/ # chmod 700 /home/huong/Maildir # chmod 700 /home/huong/Maildir/{new,cur,tmp} |
3.2 User Account Creation
Mail client installation
|
1 2 |
# dnf -y install s-nail # echo 'export MAIL=$HOME/Maildir' >> /etc/profile.d/mail.sh |
Add user [linux]
|
1 2 3 4 5 6 |
# useradd linux # passwd linux Changing password for user linux. New password: Retype new password: passwd: all authentication tokens updated successfully. |
3.3 Operation check ①
①Log in as an email user and send a test email.
|
1 2 3 4 5 6 7 8 9 10 11 |
# su - linux $ mail linux@localhost Subject: Test Mail To: linux@localhost mail test ^D ------- (Preliminary) Envelope contains: To: linux@localhost Subject: Test Mail Send this message [yes/no, empty: recompose]? y |
②Email Confirmation
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
$ mail s-nail version v14.9.22. Type `?' for help /home/linux/Maildir: 1 message 1 new ?N 1 linux@korodes.com 2023-02-22 22:30 14/406 "Test Mail " & 1 [-- Message 1 -- 14 lines, 406 bytes --]: Date: Wed, 22 Feb 2023 22:30:53 +0900 To: linux@localhost Subject: Test Mail Message-Id: <20230222133053.52B611120EE@mail.korodes.com> From: linux@korodes.com mail test & |
3.4 Operation check ②
Set up and confirm your account in Mozilla Thunderbird (for OS user huong as mail user)
①Start Thunderbird
Your full name : Any name
Email addtess : huong@korodes.com
Password : Password for huong
Click on "Configure manually"
➁Set "INCOMMING SERVER" and "OUTGOING SERVER" as shown below and click "Re-test".
➂"The following settings were found by probinfg the given server" Displayed
After clicking "Done," the following "Warning" appears, but there is no problem, so click "Confirm."
④Click "Finish" when "Account syccessfuly created" is displayed.
4.Mail server : Postfix + Clamav + Amavisd+SpamAssassin
4.1 Real-time scanning of e-mails
①Amavisd ,Clamav Server Install
If you have not yet installed the epel repository, install and activate it in the following
|
1 2 3 4 |
# dnf config-manager --set-enabled crb # dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm # dnf config-manager --set-enabled epel # dnf -y install amavisd-new clamd perl-Digest-SHA1 perl-IO-stringy |
➁Configuration File Editing
|
1 2 3 4 5 6 7 |
# vi /etc/clamd.d/scan.conf ●Line 77：Change PidFile /var/run/clamd.scan/clamd.pid ●Line 81：Uncomment TemporaryDirectory /var/tmp ●Line 96：Change LocalSocket /var/run/clamd.scan/clamd.sock |
Create log directory, activate and auto-start clamd@scan
|
1 2 3 |
# touch /var/log/clamd.scan # chown clamscan. /var/log/clamd.scan # systemctl enable clamd@scan |
➂Setup and start Amavisd
|
1 2 3 4 5 6 7 8 9 10 11 |
# vi /etc/amavisd/amavisd.conf ●Per line 13 : Delete # at the beginning of the line @bypass_spam_checks_maps = (1); # controls running of anti-spam code ●Line 23：Change to your domain name $mydomain = 'Domain name'; ●Per line 28 : comment-out #$QUARANTINEDIR = undef; # -Q ●Per line 125 : comment-out # $virus_admin = undef; # notifications recip ●Line 170：Uncomment and change to own host name $myhostname = 'mail.Domain name'; |
|
1 2 3 |
# systemctl start amavisd # systemctl enable amavisd Created symlink /etc/systemd/system/multi-user.target.wants/amavisd.service → /usr/lib/systemd/system/amavisd.service |
④Postfix Configuration
|
1 2 3 |
# vi /etc/postfix/main.cf # Add to the last line content_filter=smtp-amavis:[127.0.0.1]:10024 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
# vi /etc/postfix/master.cf # Add to the last line smtp-amavis unix - - n - 2 smtp -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -o disable_dns_lookups=yes 127.0.0.1:10025 inet n - n - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 |
|
1 |
# systemctl restart postfix |
⑤Check with Thunderbird
I sent a test email to myself in Thunderbird, and the following appears in the header display of the received email
X-Virus-Scanned: amavisd-new at korodes.com
4.2 Email spam protection
①SpamAssassin installed to prevent spam
|
1 2 3 4 |
# dnf -y install spamassassin spamass-milter-postfix # systemctl start spamassassin # systemctl enable spamassassin Created symlink /etc/systemd/system/multi-user.target.wants/spamassassin.service → /usr/lib/systemd/system/spamassassin.service. |
②SpamAssassin Settings
|
1 2 3 |
# vi /etc/mail/spamassassin/v310.pre ●Per line 24 : Remove # at the beginning of the line loadplugin Mail::SpamAssassin::Plugin::DCC |
③SpamAssassin configuration file modernization script
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
# cd /var/www/system # vi /var/www/system/spamassassin-update.sh #!/bin/bash cd /etc/mail/spamassassin wget -q https://github.com/kittyfreak/spamassassin_user_prefs/archive/refs/heads/main.zip [ $? -ne 0 ] && exit unzip main.zip >/dev/null 2>&1 [ $? -ne 0 ] && exit rm -f main.zip mv spamassassin_user_prefs-main/user_prefs . rm -rf spamassassin_user_prefs-main diff user_prefs user_prefs.org > /dev/null 2>&1 if [ $? -ne 0 ]; then cp user_prefs local.cf echo "report_safe 0" >> local.cf echo "rewrite_header Subject ***SPAM***" >> local.cf # SpamAssassin restart if [ -f /etc/rc.d/init.d/spamassassin ]; then /etc/rc.d/init.d/spamassassin restart > /dev/null else systemctl restart spamassassin > /dev/null fi fi cp user_prefs user_prefs.org |
Grant execute permission to the spamassassin-update script and run it
|
1 2 |
# chmod 700 /var/www/system/spamassassin-update.sh # /var/www/system/spamassassin-update.sh |
Check that the SpamAssassin configuration file in the /etc/mail/spamassassin directory has been created as of today.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
# ls -l /etc/mail/spamassassin total 1612 drwxr-xr-x 2 root root 40 Feb 23 09:27 channel.d -rw-r--r-- 1 root root 1194 Jan 17 2022 init.pre -rw-r--r-- 1 root root 499337 Feb 23 10:41 local.cf drwx------ 2 root root 6 Jan 17 2022 sa-update-keys -rw-r--r-- 1 root root 62 Jan 17 2022 spamassassin-default.rc -rwxr-xr-x 1 root root 39 Jan 17 2022 spamassassin-helper.sh -rw-r--r-- 1 root root 55 Jan 17 2022 spamassassin-spamc.rc -rw-r--r-- 1 root root 499289 Dec 29 2021 user_prefs -rw-r--r-- 1 root root 499289 Feb 23 10:41 user_prefs.org -rw-r--r-- 1 root root 2523 Feb 23 10:38 v310.pre -rw-r--r-- 1 root root 1194 Jan 17 2022 v312.pre -rw-r--r-- 1 root root 2416 Jan 17 2022 v320.pre -rw-r--r-- 1 root root 1237 Jan 17 2022 v330.pre -rw-r--r-- 1 root root 1020 Jan 17 2022 v340.pre -rw-r--r-- 1 root root 1309 Jan 17 2022 v341.pre -rw-r--r-- 1 root root 1469 Jan 17 2022 v342.pre -rw-r--r-- 1 root root 1264 Jan 17 2022 v343.pre |
Set up cron to automatically run a script daily that updates the SpamAssassin configuration file
|
1 2 |
# crontab -e 0 2 * * * /var/www/system/spamassassin-update.sh > /dev/null 2>&1 |
④Integrate SpamAssassin into Postfix
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
# vi /etc/postfix/master.cf ●Line 12 : Add "#" to the beginning of the line and add SpamAssassin setting to line 13 # smtp inet n - n - - smtpd smtp inet n - n - - smtpd -o content_filter=spamassassin ●Add to last line smtp-amavis unix - - n - 2 smtp -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -o disable_dns_lookups=yes 127.0.0.1:10025 inet n - n - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 spamassassin unix - n n - - pipe user=nobody argv=/usr/bin/spamc -e /usr/sbin/sendmail.postfix -oi -f ${sender} ${recipient} |
⑤Restart postfix
|
1 |
# systemctl restart postfix |
⑥If you send an e-mail to yourself in Thunderbird with the following information in the body, the following will appear in the header.
「XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X」
