Debian10.13 : Antivirus , Mail Server

1.Anti-virus Clamav installed

1.1 Install

The clamav-related configuration files are installed in the /etc/clamav/ folder.

1.2 Virus definition updates

# systemctl stop clamav-freshclam 
# freshclam
Fri Feb 10 19:32:20 2023 -> ClamAV update process started at Fri Feb 10 19:32:20 2023
Fri Feb 10 19:32:20 2023 -> daily.cld database is up-to-date (version: 26808, sigs: 2020417, f-level: 90, builder: raynman)
Fri Feb 10 19:32:20 2023 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
Fri Feb 10 19:32:20 2023 -> bytecode.cvd database is up-to-date (version: 333, sigs: 92, f-level: 63, builder: awillia2)

If the virus definitions can be updated with the above command, but the following error occurs, change the log settings and run the command again.
ERROR: /var/log/clamav/freshclam.log is locked by another process
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

# rm /var/log/clamav/freshclam.log
# touch /var/log/clamav/freshclam.log
# chown clamav:clamav /var/log/clamav/freshclam.log

# systemctl start clamav-freshclam

⚫Change configuration file

1.3 Virus Check Confirmation

①Running manual virus checks

Infected files: 0　No virus.

②Virus detection by downloading test viruses
Download a harmless virus and test it for detection.
Log in as a general user and check

Thus, the virus is notified with the indication "FOUND" and "Infected files: 1".
Also, the "--remove" option was added, so the test virus was removed.

1.4 Create a script file to do a full scan

①Contents of clam-full.sh (new)

#!/bin/sh
echo =========================================
date
hostname
clamscan / \
--infected \
--recursive \
--log=/var/log/clamav/clamscan.log \
--move=/var/log/clamav/virus \
--exclude-dir=^/boot \
--exclude-dir=^/sys \
--exclude-dir=^/proc \
--exclude-dir=^/dev \
--exclude-dir=^/var/log/clamav/virus
if [ $? = 0 ]; then
echo "virus undetected."
else
echo "Virus detection!!"
fi

②execute authorization

③Create a folder for virus quarantine (if it already exists, it is OK, but if it does not, a runtime error will occur because it is specified as an excluded directory in the above script).

④Running it.

⑤Scheduled virus scan execution with cron

2. Email software installation

2.1 Postfix : Installation/Configuration

Install Postfix and build an SMTP server; SMTP uses 25/TCP.
To prevent unauthorized mail relay, use the SASL function of Dovecot, described below, and configure Postfix so that authentication is also required for sending mail.

①Install

Installation Status Screen
You will be asked to select a general configuration setting, select "No Configuration" to set it manually later.

②Configuration File Editing

Editorial content

③master.cf edit

Editorial content

④Reflection of settings

2.2 Dovecot : Installation/Configuration

Install Dovecot and build a POP/IMAP server, using 110/TCP for POP and 143/TCP for IMAP
①Configure Dovecot to provide SASL functionality for Postfix

②Setting Reflection

2.3 Email User Account Registration

Register a user account for e-mail.
This is a setting for when a user account on the OS is also used for e-mail.
If you want to use mail with a user account on the OS, no additional configuration is required, just register the OS user

①Mail client installation

②Mailboxes are set to refer to Maildir

2.4 Open ports

2.5 operation check　①

①Send test mail to yourself [mail (user name)@(host name)].
username : huong

Ctrl + D key to end a statement

Check incoming mail

2.6 operation check　②

Set up and confirm your account in Mozilla Thunderbird
①Start Thunderbird, and click "Tools", "Account Settings".

②「Account Actions」「Add Mail Account」

③Your full name : any name
Email addtess : huong@korodes.com
Password : Password for huong
Click on "Configure manually"

④Set "INCOMMING SERVER" and "OUTGOING SERVER" as shown below and click "Re-test".

⑤「The following settings were found by probinfg the given server」

After clicking "Done", the following "Warning" appears, but there is no problem, so click "Confirm".

⑥"Account syccessfuly created" is displayed and click "Finish".

3 Applied ClamAV to mail server Postfix

Set up Postfix and Clamav to work together to scan incoming and outgoing mail in real time.

①Install Amavisd and Clamav Daemon and start Clamav Daemon

If the server does not use a fully qualified domain name (FQDN) as the host name, Amavis may fail to start.
Also, since the OS hostname may change, set a valid hostname directly in the Amavis configuration file

②15-content_filter_mode edit

③Register your own domain name

④Main.cf edit

⑤master.cf edit

Editorial content
# Add all the following lines to the last line

smtp-amavis unix - - n - 2 smtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
127.0.0.1:10025 inet n - n - - smtpd
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=127.0.0.0/8
    -o strict_rfc821_envelopes=yes
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000

⑥Configuration Reflection

⑦When you send an e-mail to yourself on Thuderbird, etc., it is successful if you see the following message in the header of the incoming e-mail.

4 Applied spamassassin to mail server Postfix

4.1 Install spamassassin

①Install

②SpamAssassin Settings
The configuration file is "/etc/mail/spamassassin/local.cf".

Use default without additional settings
Create Maildir for storing spam mails
Create a directory in Maildir format to store spam emails
Create a directory ".Spam" in Maildir format for storing spam mails.
Creation is done by the target user.

4.2 Procmail Preparation

①Install Procmail

If installed, the following results are returned

②Procmail Settings
If you put it in "/etc/procmailrc", which is in charge of the entire mail filter, it will be applied to all users.
The filter will be applied only to that user if it is written in "/home/username/.procmailrc", which is a mail filter file for each user.
This time, to apply to all users, we will write in "/etc/procmailrc".

procmailrc description (newly created)

4.3 Postfix Configuration

①　Edit main.cf

②Reflecting and activating settings

4.4 Spam Email Learning

Allows all users to learn the entire contents of their ".Spam" directory as spam mail
①Spam Email Learning

②Normal mail learning

③Create a script and register it with Cron
Name the file "spam-learns.sh" and place it under /opt/script/.
After saving the script, give it executable access as "chmod 750 spam-learns.sh".

spam-learns.sh Contents

Once pam-learns.sh is created, create a definition file directly under /lib/systemd/system. The name should end in .service, such as spam-learns.service.
Type is defined by simple

Contents of spam-learns.service

④If you send an e-mail to yourself in Thunderbird with the following information in the body, the following will appear in the header.
「XJSC4JDBQADN1.NSBN32IDNENGTUBE-STANDARD-ANTI-UBE-TEST-EMAILC.34X」