Contents
1. clamav ( anti-virus software )
1.1 Clamav install
|
1 |
# zypper -n install clamav |
1.2 virus definition file update
①Configuration File Editing
|
1 2 3 4 5 6 |
# vi /etc/freshclam.conf ■Line 71 Insert a "#" at the beginning of the line "DatabaseMirror database.clamav.net" and Add "DatabaseMirror db.jp.clamav.net" #DatabaseMirror database.clamav.net DatabaseMirror db.jp.clamav.net |
②virus definition file update
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# freshclam ClamAV update process started at Fri Jan 7 12:57:13 2022 daily database available for download (remote version: 26414) Time: 0.8s, ETA: 0.0s [========================>] 54.80MiB/54.80MiB Testing database: '/var/lib/clamav/tmp.30881f985c/clamav-53eb2ff94f8ff97aee1ef1931e2bfb93.tmp-daily.cvd' ... Database test passed. daily.cvd updated (version: 26414, sigs: 1969520, f-level: 90, builder: raynman) main database available for download (remote version: 62) Time: 1.8s, ETA: 0.0s [========================>] 162.58MiB/162.58MiB Testing database: '/var/lib/clamav/tmp.30881f985c/clamav-d7a663194ed38ed1910f2b29641e9b05.tmp-main.cvd' ... Database test passed. main.cvd updated (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) bytecode database available for download (remote version: 333) Time: 0.0s, ETA: 0.0s [========================>] 286.79KiB/286.79KiB Testing database: '/var/lib/clamav/tmp.30881f985c/clamav-c959fafa36ee9ae598991e3821d1ad6e.tmp-bytecode.cvd' ... Database test passed. bytecode.cvd updated (version: 333, sigs: 92, f-level: 63, builder: awillia2) WARNING: Clamd was NOT notified: Can't connect to clamd through /run/clamav/clamd-socket: No such file or directory |
1.3 operation check
①Scan entire system
■If no virus is detected
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# cd # clamscan --infected --remove --recursive ----------- SCAN SUMMARY ----------- Known viruses: 8633494 Engine version: 0.103.6 Scanned directories: 7 Scanned files: 7 Infected files: 0 Data scanned: 0.05 MB Data read: 0.03 MB (ratio 1.86:1) Time: 23.445 sec (0 m 23 s) Start Date: 2022:09:11 15:56:59 End Date: 2022:09:11 15:57:22 |
■If a virus is detected
Download and scan for test viruses
Download and scan for test viruses
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
# wget http://www.eicar.org/download/eicar.com # clamscan --infected --remove --recursive /root/eicar.com: Win.Test.EICAR_HDB-1 FOUND ← Virus detection /root/eicar.com: Removed. ← virus removal ----------- SCAN SUMMARY ----------- Known viruses: 8633494 Engine version: 0.103.6 Scanned directories: 7 Scanned files: 8 Infected files: 1 Data scanned: 0.05 MB Data read: 0.03 MB (ratio 1.86:1) Time: 23.004 sec (0 m 23 s) Start Date: 2022:09:11 15:58:58 End Date: 2022:09:11 15:59:21 |
1.4 Deployment of virus scan auto-execution scripts
①Create script storage directory
|
1 |
# mkdir -p /srv/www/system |
②Creation of auto-execution scripts
|
1 |
# cd /srv/www/system |
Create clamscan.sh in /srv/www/system with the following contents
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# vi /srv/www/system/clamscan.sh #!/bin/bash PATH=/usr/bin:/bin # excludeopt setup excludelist=/srv/www/system/clamscan.exclude if [ -s $excludelist ]; then for i in `cat $excludelist` do if [ $(echo "$i"|grep \/$) ]; then i=`echo $i|sed -e 's/^\([^ ]*\)\/$/\1/p' -e d` excludeopt="${excludeopt} --exclude-dir=$i" else excludeopt="${excludeopt} --exclude=$i" fi done fi # signature update freshclam # virus scan clamscan --recursive --remove ${excludeopt} / |
Grant execute permissions to scripts
|
1 |
# chmod 700 clamscan.sh |
The sys and proc directories are excluded from the scan because they cannot be scanned due to the specification.
OpenSUSE creates a large number of snapshots, so if necessary, set them in non-target directories.
OpenSUSE creates a large number of snapshots, so if necessary, set them in non-target directories.
|
1 2 3 |
# echo "/sys/" >> /srv/www/system/clamscan.exclude # echo "/proc/" >> /srv/www/system/clamscan.exclude # echo "/.snapshots/" >> /srv/www/system/clamscan.exclude |
Set up periodic virus scan
|
1 2 |
# crontab -e 0 1 * * * /srv/www/system/clamscan.sh > /dev/null 2>& |
Execute "/srv/www/system/clamscan.sh" to scan the entire system
|
1 |
# /srv/www/system/clamscan.sh |
2. Mail server Install
2.1 Postfix install
①Install Postfix and build an SMTP server
|
1 |
# zypper -n install postfix |
②Postfix Settings
To prevent unauthorized mail relay, use the SASL function of Dovecot, described below, and configure Postfix to require authentication for sending as well.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 |
# vi /etc/postfix/main.cf # Line 114：Uncomment and specify domain name mydomain = korodes.com ←own domain name # Line 130：Uncomment myorigin = $mydomain # Line 294：Uncommented and added to my network. mynetworks = 127.0.0.0/8, 192.168.11.0/24 ←own network # Line 451：Uncomment and set Maildir format home_mailbox = Maildir/ # Line 705：Change inet_interfaces = all # Line 719：add mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain # Line 201：host name specification myhostname = mail.korodes.com ←own host name # Line 734,735 # Limit mailbox size as needed (example below is 1G) mailbox_size_limit = 1073741824 # Limit send/receive mail size as needed (10M in the example below) message_size_limit = 10485760 # Line 747：add smtpd_recipient_restrictions = permit_mynetworks, permit_auth_destination, permit_sasl_authenticated, reject # Line 756：change smtpd_sasl_auth_enable = yes # Per lines 761,762 : Comment out and add under it #smtpd_sasl_type = cyrus #smtpd_sasl_path = smtpd smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname |
|
1 2 |
# systemctl start postfix # systemctl enable postfix |
③SMTP service permission is required if Firewalld is enabled; SMTP uses 25/TCP
|
1 2 3 4 |
# firewall-cmd --add-service=smtp --permanent success # firewall-cmd --reload success |
2.3 Dovecot install
①Install
|
1 |
# zypper -n install dovecot |
②Dovecot Settings
Configure Dovecot to provide SASL functionality for Postfix.
|
1 2 3 |
# vi /etc/dovecot/dovecot.conf # Line 30：Uncomment (remove ", ::" if not listening for IPv6) listen = * |
|
1 2 3 4 5 6 |
# vi /etc/dovecot/conf.d/10-auth.conf # Line 10：Uncomment and change (also allow plain text authentication) disable_plaintext_auth = no # Line 100：add auth_mechanisms = plain login |
|
1 2 3 |
# vi /etc/dovecot/conf.d/10-mail.conf # Line 30：Uncommented and added mail_location = maildir:~/Maildir |
|
1 2 3 4 5 6 7 8 |
# vi /etc/dovecot/conf.d/10-master.conf # Line 106-108：Uncomment and add # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix group = postfix } |
③Dovecot startup and automatic execution
|
1 2 3 |
# systemctl start dovecot # systemctl enable dovecot Created symlink /etc/systemd/system/multi-user.target.wants/dovecot.service → /usr/lib/systemd/system/dovecot.service. |
④POP/IMAP service permission required if Firewalld is enabled
POP uses 110/TCP, IMAP uses 143/TCP
POP uses 110/TCP, IMAP uses 143/TCP
|
1 2 3 4 |
# firewall-cmd --add-service={pop3,imap} --permanent success # firewall-cmd --reload success |
2.4 User Account Registration
In this case, we will register the OS user "suse".
①Mail client installation
|
1 |
# zypper -n install mailx |
②Mailboxes are set to refer to Maildir
|
1 |
# echo 'export MAIL=$HOME/Maildir' >> /etc/profile.d/mail.sh |
2.5 Confirmation of operation
Set up an account in Thunderbird, a free email client, to check its operation.
However, depending on your provider, port 587 may be used for the outgoing server.
Please free up port 587 in your firewall settings.
However, depending on your provider, port 587 may be used for the outgoing server.
Please free up port 587 in your firewall settings.
|
1 2 |
# firewall-cmd --add-port=587/tcp --permanent # firewall-cmd --reload |
Start Thunderbird and select "Account Settings" from the "Tools" menu.
"Add Mail Account..." in "Account Actions" Select
Fill in each field as follows and click "Configure manually"
Your full name : Any name
Email address : <Mail server user name>@<Domain name>
Password : Password for the mail server user
Set as shown below, but if your provider allows port 25 for outbound servers, you may use "25" instead of "587". Click "Re-test"
Click "Done" when you see "Mail server found, account is valid.
A warning screen will appear. Check the box as shown below and click "Confirm.
If the next screen appears, success!
3. Mail Server: Postfix + Clamav + Amavisd
Set up Postfix and Clamav to work together to scan incoming and outgoing mail in real time.
3.1 Amavisd & Clamav Server Install
|
1 2 3 4 |
# zypper -n install amavisd-new spamassassin # systemctl start clamd # systemctl enable clamd Created symlink /etc/systemd/system/multi-user.target.wants/clamd.service → /usr/lib/systemd/system/clamd.service. |
If you get the above error, install with the following command
|
1 |
# zypper install https://download.opensuse.org/repositories/server:/mail/15.4/x86_64/libmilter1_0-8.17.1-lp154.330.3.x86_64.rpm |
3.2 Configure Amavisd
①Configuration File Editing
|
1 2 3 4 5 6 7 8 |
# vi /etc/amavisd.conf # Line 23：Change to your domain name $mydomain = 'korodes.com'; # Line 155：Uncomment and change to own host name $myhostname = 'mail.korodes.com'; # Line 157,158：Uncomment $notify_method = 'smtp:[127.0.0.1]:10025'; $forward_method = 'smtp:[127.0.0.1]:10025'; |
②Startup and Auto-Run Settings
|
1 2 3 4 5 |
# sa-update # systemctl start amavis spamd # systemctl enable amavis spamd Created symlink /etc/systemd/system/multi-user.target.wants/amavis.service → /usr/lib/systemd/system/amavis.service. Created symlink /etc/systemd/system/multi-user.target.wants/spamd.service → /usr/lib/systemd/system/spamd.service. |
3.3 Postfix Configuration
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# vi /etc/postfix/master.cf # Add the following to the last line smtp-amavis unix - - n - 2 smtp -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -o disable_dns_lookups=yes 127.0.0.1:10025 inet n - n - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 |
|
1 2 3 |
# vi /etc/postfix/main.cf # Add the following to the last line content_filter=smtp-amavis:[127.0.0.1]:10024 |
|
1 |
# systemctl restart postfix |
3.4 Check with Thunderbird
Send an email to yourself, and if the header of the email displays the following, success!
4.virus scan script substitution
Set up a notification to a specified e-mail address after virus check scan.
① Create virus scan exclusion directory list
|
1 2 3 4 5 |
# cd /srv/www/system/ # vi clamscan.exclude /sys/ /proc/ /.snapshots ← openSUSE is configured to take a large number of snapshots, so if you don't need them, set |
②Disable existing script and create new virus scan script
|
1 2 3 |
# cd /srv/www/system/ # mv clamscan.sh clamscan.sh_bak # vi clamscan.sh |
Contents of new "clamscan.sh
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
#!/bin/bash PATH=/usr/bin:/bin MAILTO="<Any email address>" # excludeopt setup excludelist=/srv/www/system/clamscan.exclude if [ -s $excludelist ]; then for i in `cat $excludelist` do if [ $(echo "$i"|grep \/$) ]; then i=`echo $i|sed -e 's/^\([^ ]*\)\/$/\1/p' -e d` excludeopt="${excludeopt} --exclude-dir=^$i" else excludeopt="${excludeopt} --exclude=^$i" fi done fi # signature update freshclam 2>&1 > /dev/null # virus scan CLAMSCANTMP=`mktemp` #clamscan --recursive --remove ${excludeopt} / > $CLAMSCANTMP 2>&1 clamscan --recursive ${excludeopt} / > $CLAMSCANTMP 2>&1 [ ! -z "$(grep FOUND$ $CLAMSCANTMP)" ] && \ # report mail send grep FOUND$ $CLAMSCANTMP | mail -s "Virus Found in `hostname`" $MAILTO rm -f $CLAMSCANTMP |
|
1 |
# chmod 700 clamscan.sh |
You will now be notified by email if there is a virus. If there is no virus, you will not be notified.