Ubuntu Server24.04 ; Anti-Virus(Clamav) , Mail Server

1.Anti-virus software Clamav installed

1.1 Install

The clamav-related configuration files are installed in the "/etc/clamav/" folder.

1.2 Virus definition updates

Change configuration file

1.3  Virus Check Confirmation

①Running manual virus checks

Infected files: 0, so no virus

②Download a test virus to detect viruses
Download a trial harmless virus to test detection

The virus is notified with the message "FOUND" and "Infected files: 1". Also, since the "--remove" option is attached, the test virus has been removed.

1.4 Create a script file to do a full scan

①Contents of clam-full.sh (new)

②grant execution authority

③Create a folder for virus quarantine (if it already exists, it is OK, but if it does not, a runtime error will occur because it is specified as an excluded directory in the above script).

④try and run it.

LibClamAV Warning: cli_scanxz: decompress file size exceeds limits - only scanning 27262976 bytes
If the above message is displayed, run with the "--max-filesize=200M" and "--max-scansize=200M" options.

⑤Scheduled virus scan execution with cron

2. Email software installation

2.1 Postfix : Installation/Configuration

Install Postfix and build an SMTP server. 25/TCP is used for SMTP.
To prevent unauthorized mail relay, use the SASL function of Dovecot (see below), and configure Postfix so that authentication is required even for outgoing mail.

①Install

Installation Status Screen
You will be asked to select a general configuration setting, select "No Configuration" to set it manually later.

②Configuration File Edit

Editing Contents

③master.cf edit

Editing Contents

④Reflecting settings

2.2 Dovecot : Installation/Configuration

Install Dovecot and build a POP/IMAP server, using 110/TCP for POP and 143/TCP for IMAP

①Configure Dovecot to provide SASL functionality for Postfix

②Configuration Reflection

2.3  Port Open

2.4 Email User Account Registration

Register a user account for e-mail.
This setting is for when a user account on the OS is also used for e-mail.
If you want to use mail with a user account on the OS, you do not need to make any additional settings, only register an OS user.

①Mail Client Install

②Mailboxes are set to refer to Maildir

2.5 operation check ①

①Test sending mail
Send test mail to yourself [mail (user name)@(host name)].

Ctrl + D key to exit the main text

➁Check incoming mail

2.6 operation check ②

Set up and confirm your account in Mozilla Thunderbird

①Start Thunderbird, and click "Tools", "Account Settings".

②「Account Actions」「Add Mail Account」

③Your full name : any name
Email addtess : huong@korodes.com" that I just added.
Password : Password for user huong
Click on "Configure manually"

④Set "INCOMMING SERVER" and "OUTGOING SERVER" as shown below and click "Re-test".

⑤"The following settings were found by probinfg the given server" Displayed

After clicking "Done," the following "Warning" appears, but there is no problem, so click "Confirm.

⑥Click "Finish" when "Account syccessfuly created" is displayed.

2.7 Applied ClamAV to mail server Postfix

Set up Postfix and Clamav to work together to scan incoming and outgoing mail in real time.

①Install Amavisd and Clamav Daemon and start Clamav Daemon

If the server is not using a fully qualified domain name (FQDN) as the hostname, Amavis may fail to start.
Also, since the OS hostname may change, set a valid hostname directly in the Amavis configuration file

②"15-content_filter_mode" editing

③Register your own domain name

④"main.cf" editing

⑤"master.cf" editing

⑥Configuration Reflection

⑦When you send an e-mail to yourself on Thuderbird, etc., it is successful if you see the following message in the header of the incoming e-mail.

Try sending yourself an email with the body of the email "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" and confirm that the email is discarded and never received

2.8 Applied spamassassin to mail server Postfix

2.5.1 spamassassin install

①Install

②SpamAssassin Settings

➂SpamAssassin configuration file modernization script

Grant execute permission to the spamassassin-update script and run it

Check that the SpamAssassin configuration file (local.cf) is created in the /etc/mail/spamassassin directory with the date of the day

Set up cron to automatically run a script daily that updates the SpamAssassin configuration file

spamass-milter startup and automatic startup settings

  • Create a directory ".Spam" in Maildir format for storing spam mails.
  • Creation is done by the target user.

2.5.2 Procmail

①Procmail Install

If installed, the following results are returned

②Procmail Settings
If you put the filter in "/etc/procmailrc", which is in charge of the entire mail filter, the filter will be applied to all users.
If you put it in "/home/username/.procmailrc", which is the mail filter file for each user, the filter will be applied only to that user.
In this case, to apply the filter to all users, we will put it in "/etc/procmailrc".

procmailrc description (newly created)

2.5.3 Postfix Configuration

① "main.cf" editing

②Reflecting and activating settings

2.5.4 Spam Email Learning

Learning all the contents of all users' ".Spam" directories as spam mail
①Learning of spam mail

②Normal mail learning

③Create a script and register it with Cron
Name the file "spam-learns.sh" and place it under /opt/script/.
After saving the script, give it executable access as "chmod 750 spam-learns.sh".

spam-learns.sh Contents

After spam-learns.sh is created, create a definition file directly under /lib/systemd/system.
The name should end in .service, like spam-learns.service.
Define the Type as simple.

Contents of spam-learns.service

④Send a blank email to yourself in Thunderbird, etc., and if you see the following message in the header of the received email, you have succeeded.

⑤Spam check confirmation
Send yourself an email with the body of the email "XJSC4JDBQADN1.NSBN32IDNENGTUBE-STANDARD-ANTI-UBE-TEST-EMAILC.34X" and make sure the email is not delivered and is sorted into the Spam folder
The header shows the following
Check mail under /home/[user]/Maildir/.Spam/new/.

X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on Lepard
X-Spam-Flag: YES
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=1002.4 required=13.0 tests=ALL_TRUSTED,
CONTENT_TYPE_PRESENT,GTUBE,HTML_MESSAGE,MIMEQENC,MPART_ALT_DIFF,
MULTIPART_ALTERNATIVE,QENCPTR1,QENCPTR2 autolearn=no
autolearn_force=no version=4.0.0
X-Spam-Report:
* 0.1 ALL_TRUSTED Passed through trusted hosts only via SMTP
* 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
* -0.1 CONTENT_TYPE_PRESENT exists:Content-Type
* 0.1 MULTIPART_ALTERNATIVE Multipart/alternative
* 1.0 HTML_MESSAGE BODY: HTML included in message
* 0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
* 0.2 MIMEQENC FULL: Quoted-Printable mime definition
* 0.2 QENCPTR1 FULL: Quoted-Printable mime pattern
* 0.2 QENCPTR2 FULL: Quoted-Printable mime pattern
Copied title and URL