Clamav Integration to Email Server

carlosinfl · 08-12-2008, 02:45 PM

I have recently installed amavisd-new on an email server (Debian / Postfix) and now I am to the point of installing and configuring the av filter which I selected clamav. I installed this on my machine and read the documentation however I don't see how I am to have amavisd-new and clamav holding hands. I have to uid/gid for both applications:

Code:

email:/# id amavis
uid=103(amavis) gid=107(amavis) groups=107(amavis)
email:/# id clamav
uid=104(clamav) gid=108(clamav) groups=108(clamav)

Both daemons are running however I don't know how to integrate the newly installed Clamav scanner with Postfix / Amavisd-new.

I tried the clamav mailing list & had not had any luck as of yet. Posting here because I always get great help here!

Thanks so much for any assistance.

Mr. C. · 08-12-2008, 04:12 PM

http://www200.pair.com/mecham/spam/c...avisd-new.html

carlosinfl · 08-12-2008, 08:11 PM

Quote:

Originally Posted by Mr. C.

http://www200.pair.com/mecham/spam/c...avisd-new.html

Mr. C, again you come to my rescue! Thanks for that link. It was easy to follow however the first step is not matching up.

Quote:

One requirement for a successful installation is 'AllowSupplementaryGroups yes' must be included in clamd.conf.

In my systems clamd.conf, I have what looks to be similar but has "true" and the end and is not commented out. Does this mean I am good?

Code:

AllowSupplementaryGroups true

Quote:

Another requirement is the value after CONTSCAN in amavisd.conf must match the LocalSocket parameter in clamd.conf (change amavisd.conf if it does not)

Since I am using Debian and their version of amavisd-new is split into many files. I checked /etc/amavis/conf.d/50-user and I have nothing in my config which specifies "CONTSCAN" in either Clam or Amavis so I don't know what is required here.

Mr. C. · 08-12-2008, 08:18 PM

In the clamd.conf man page, we see:

Quote:

BOOL Boolean value (yes/no or true/false or 1/0).

So you can use any of the yes/true/1 values.

Look for the lines that look like:

Code:

# ### http://www.clamav.net/
  ['ClamAV-clamd',
    \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd"],

This is the configuration that specifies how to call clamd. The value in bold should match your clamd.conf socket setting. Check all the debian files. In the default amavisd.conf file, there are numerous entries for various scanners.

billymayday · 08-12-2008, 08:19 PM

Here's the relevant section form mine

Quote:

# Initialize supplementary group access (clamd must be started by root).
# Default: disabled
AllowSupplementaryGroups True

clamd.conf

Quote:

# Path to a local socket file the daemon will listen on.
# Default: disabled
#LocalSocket /tmp/clamd
LocalSocket /var/run/clamav/clamd.socket

amavisd.conf (mine's in 1 bit)

Quote:

# ### http://www.clamav.net/
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.socket"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
# # NOTE: run clamd under the same user as amavisd, or run it under its own
# # uid such as clamav, add user clamav to the amavis group, and then add
# # AllowSupplementaryGroups to clamd.conf;
# # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
# # this entry; when running chrooted one may prefer socket "$MYHOME/clamd".

carlosinfl · 08-12-2008, 08:39 PM

Thank you both!

With that additional info added to the mix, I added these lines to my amavisd.conf (/etc/amavis/conf.d/50-user)

Code:

['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.socket"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],

Now it appears that I don't need to make any changes to my clamd.conf file.

However my clamd.conf shows LocalSocket = /var/run/clamav/clamd.ctl

Do I need to make that exact path change in my amavis config file? My amavis config file is what you have listed BillyMayDay.

Mr. C. · 08-12-2008, 08:40 PM

Make them the same. Clamd creates the socket, amavisd connects to it. If clamd already runs correctly, change the amavis.conf version.

carlosinfl · 08-13-2008, 07:38 AM

This part of the guide makes no sense to me:

Quote:

The group that your amavisd-new user belongs to must also have write privileges to the amavisd-new user's home directory and subdirectories. This step should have been done during the installation of amavisd-new, and would consist of doing something similar to chmod -R 750 /var/amavis or chmod -R 750 /var/lib/amavis (adjust path as needed)

Now with a fresh amavis installation on my Debian system the permissions are as follows:

Code:

email:/var/lib# ls -l
total 64
drwxr-xr-x 6 amavis  amavis  4096 2008-08-04 18:18 amavis

I don't understand why they use "chmod -R 750" to the amavis directory if the group amavis needs to be able to write to /var/lib/amavis/. 750 gives group R+X only, no?

As it stands now, I have the following config files for Clamav and Amavisd-New.

amavis config.

Code:

$sa_tag_level_deflt  = -5;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 4; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 10000; # triggers spam evasive actions
$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent

$forward_method = 'smtp:[127.0.0.1]:10025';
$notify_method = $forward_method;

$virus_admin = 'formorer@formorer.de'; # due to D_DISCARD default

#inform recipients about a blocked mail
$warnbannedrecip = 1;
$warnvirusrecip = 1;

$final_banned_destiny     = D_PASS;

$log_level = 2;            # (defaults to 0), -d

$DO_SYSLOG = 1; # log via syslogd (preferred)

# ### http://www.clamav.net/
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
# # NOTE: run clamd under the same user as amavisd, or run it under its own
# # uid such as clamav, add user clamav to the amavis group, and then add
# # AllowSupplementaryGroups to clamd.conf;
# # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
# # this entry; when running chrooted one may prefer socket "$MYHOME/clamd".

Here is my clamd.conf

Code:

#Automatically Generated by clamav-base postinst
#To reconfigure clamd run #dpkg-reconfigure clamav-base
#Please read /usr/share/doc/clamav-base/README.Debian.gz for details
LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
User clamav
AllowSupplementaryGroups true
ScanMail true
ScanArchive true
ArchiveLimitMemoryUsage false
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
StreamMaxLength 10M
LogSyslog false
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav
TemporaryDirectory /tmp
SelfCheck 3600
Foreground false
Debug false
ScanPE true
ScanOLE2 true
ScanHTML true
DetectBrokenExecutables false
MailFollowURLs false
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
PhishingSignatures true
PhishingScanURLs true
PhishingRestrictedScan true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
DetectPUA false
LogFile /var/log/clamav/clamav.log
LogTime true
LogFileUnlock false
LogFileMaxSize 0

Anyone see any problems?

Mr. C. · 08-13-2008, 08:42 AM

750 is fine. Here's mine:

Code:

$ ls -ld /var/spool/amavis/ /var/spool/amavis/*
drwxr-x---  8 amavis  amavis  512 Aug 13 05:31 /var/spool/amavis/
-rw-r-----  1 amavis  amavis    0 Aug 13 05:31 /var/spool/amavis/amavisd.lock
-rw-r-----  1 amavis  amavis    3 Aug 13 05:31 /var/spool/amavis/amavisd.pid
srwxr-x---  1 amavis  amavis    0 Aug 13 05:31 /var/spool/amavis/amavisd.sock=
drwxr-x---  2 amavis  amavis  512 Aug 13 05:31 /var/spool/amavis/db/
drwxrwx---  7 amavis  amavis  512 Aug 13 05:48 /var/spool/amavis/quarantine/
drwxr-x---  8 amavis  amavis  512 Aug 13 06:39 /var/spool/amavis/tmp/
drwxr-x---  2 amavis  amavis  512 Sep 30  2007 /var/spool/amavis/var/

Grab amavis-logwatch for stats reporting.