|
|
|
| Daemon News Ezine | BSD News | BSD Mall | BSD Support Forum | BSD Advocacy | BSD Updates |
Postfix and SpamAssassinGrzegorz Czapliñski <gregory@prioris.mini.pw.edu.pl>A few months ago I wrote an article titled "Setting Up Sophos + Amavis for Postfix". In that article I described how to implement an effective anti-virus protection for your site. In the configuration details presented there, I was relaying on Sophos anti-virus, Postfix, amavis-perl and amavisd. This time I would like to introduce a more advanced configuration - Sophos anti-virus, Postfix and Amavisd-new with SpamAssassin. Why such a configuration?Because I am fed up with spammers and their spam, I am fed up with viruses which travel all around the Internet. With this configuration I am able to stop spam and protect my site against viruses. What is amavisd-new?Amavisd-new is a high-performance interface between mailer (MTA) and content checkers: virus scanners, and/or SpamAssassin. It is written in Perl for maintainability, without paying a significant price for speed. It talks to MTA via (E)SMTP or LMTP, or by using helper programs. Best with Postfix, fine with dual-sendmail setup and Exim v4, works with sendmail/milter, or with any MTA as a SMTP relay. The best thing in Amavisd-new is that it has SpamAssassin integrated. In the case of Postfix you can only have one additional transport method defined. If you used this method only for anti-virus filtering with amavisd (or amavis-perl) you could implement anti-spam filtering as "Simple content filtering" described in FILTER_README file. From a performance standpoint this is a rather poor approach as Postfix pipes every message sent to it through Anomy Sanitizer, then through SpamAssassin. At the end, Postfix queues filtered messages for final delivery. Having Amavisd-new integrated with SpamAssasin we use it as Postfix's single transport method and we gain on performance. What is SpamAssassin?SpamAssassin(tm) is a mail filter to identify spam. The spam-identification tactics used include:
The very nice thing in this config is that in the case of viruses all mail is checked by Sophos. By "all" I mean: incoming, outgoing and in transit - relayed. Postfix installationStart with postfix installation. This topic has been covered by me and many others. You may want to have a look at one of my previous articles "Postfix with SASL Authentication over TLS" or simply go to www.postfix.org for further information. Amavisd-new installationAfter postfix installation and proper configuration go to: /usr/ports/security/amavisd-new/; type "make" and then "make install". The installation will take some time so sit back and relax or go help your mum. The Amavisd-new port installs a lot of perl modules, SpamAssassin and Razor-Agents. Distributed Checksum Clearinghouse installation# cd /usr/ports/mail/dcc-dccd # make all install To check DCC if it's working: # /usr/local/bin/cdcc 'info' You will see DCC connecting to its servers. Sophos installationInstall Sophos, or any other anti-virus software you have a license for. Sophos installation has been covered in "Setting Up Sophos + Amavis for Postfix". ConfigurationPostfix configurationBefore configuring additional transport make sure your configuration is working fine - your mail is going out and incoming mail is accepted. This will save you problems with our anti-(spam,virus) configuration. Edit /usr/local/etc/postfix/master.cf file, go to the very end and add: smtp-amavis unix - - - - 2 smtp -o smtp_data_done_timeout=1200 -o disable_dns_lookups=yes 127.0.0.1:10025 inet n - - - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes Now we have to tell Postfix to use this transport. Edit /usr/local/etc/postfix/main.cf and add only this line: content_filter = smtp-amavis:[127.0.0.1]:10024 For the configuration time, you may comment it out. We will take care of it later on. Issue these commands: # postfix reload # sockstat -l4 | grep 25 root master 24727 11 tcp4 *:25 *:* root master 24727 75 tcp4 127.0.0.1:10025 *:* Postfix should be listening on two ports now - 25 and 10025. Check to ensure it's connecting to those ports: # telnet localhost 25 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 idealan.pl ESMTP Postfix ^] telnet> quit Connection closed. # telnet localhost 10025 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 idealan.pl ESMTP Postfix ^] telnet> quit Connection closed. Fine, all is fine now. Edit your Postfix aliases file and add: virusalert: root and then issue a command newaliases(1). Amavisd-new configurationAmavisd-new installs its sample configuration file amavisd.conf-dist in /usr/local/etc. Rename it to amavisd.conf: # mv /usr/local/etc/amavisd.conf-dist /usr/local/etc/amavisd.conf or # cp -p /usr/local/etc/amavisd.conf-dist /usr/local/etc/amavisd.conf to preserve a copy of the original file. Now edit /usr/local/etc/amavisd.conf. The file is divided into seven sections. Section I - Essential daemon and MTA settings.What you want to change or set is: $mydomain = 'your.domain.here'; $TEMPBASE = "$MYHOME/tmp"; which will default to /var/amavis/tmp . Must be: $forward_method = 'smtp:127.0.0.1:10025'; # where to forward checked mail $notify_method = $forward_method; # where to submit notifications $max_servers = 2; This should match the width of your MTA pipe feeding amavisd. In other words, it must match the maxproc parameter defined in the master.cf file. Default is 2: smtp-amavis unix - - - - 2 smtp I would suggest setting it to at least 10 on busy servers. Beware of these: @bypass_virus_checks_acl = qw( . ); @bypass_spam_checks_acl = qw( . ); They are commented out by default. Uncomment to DISABLE anti-virus or anti-spam code respectively. Also check @local_domains_acl, it's well documented. Section II - MTA specific (defaults should be ok)Must be: $inet_socket_port = 10024; Check @inet_acl, it's well documented. Section III - Logging.Nothing to change. Section IV - Notifications/DSN, BOUNCE/REJECT/DROP/PASS destiny, quarantine.You may want to set these variables: $notify_sender_templ $notify_virus_sender_templ $notify_virus_admin_templ $notify_virus_recips_templ $notify_spam_sender_templ $notify_spam_admin_templ A very nice notify_spam_sender_templ can be found at http://lawmonkey.org/anti-spam.html. Check values of: $final_virus_destiny = D_BOUNCE; # (defaults to D_BOUNCE) $final_banned_destiny = D_BOUNCE; # (defaults to D_BOUNCE) $final_spam_destiny = D_BOUNCE; # (defaults to D_REJECT) If $final_spam_destiny = D_BOUNCE, then a sender will receive a $notify_spam_sender_templ notice. There is a variable called $QUARANTINEDIR and is defined as: $QUARANTINEDIR = '/var/virusmails'; This is the place where all the viruses will be quarantined. If you are under very heavy load of viruses, your /var may get full. In such case remove all the viruses quaranteened in /var/virusmails and set the $QUARANTINEDIR to empty string, undef - $QUARANTINEDIR = ' '; Check: $X_HEADER_TAG = 'X-Virus-Scanned'; $X_HEADER_LINE = "by amavisd-new at $mydomain"; You may change "by amavisd-new at $mydomain" to anything you like. Section V - Per-recipient and per-sender handling, whitelisting, etc.In this section the following three lines are important: read_hash(\%whitelist_sender, '/var/amavis/whitelist'); read_hash(\%blacklist_sender, '/var/amavis/blacklist'); read_hash(\%spam_lovers, '/var/amavis/spam_lovers'); With %whitelist_sender hash you whitelist good senders, and with %blacklist_sender hash you blacklist bad senders. %spam_lovers hash hold all who like receiving spam. If you or other users are subscribed to mailing lists, you can specify mailing list addresses between "map { $whitelist_sender{lc($_)}=1 } (qw(" and "));". Must look like:
map { $whitelist_sender{lc($_)}=1 } (qw(
freebsd-questions@freebsd.org
cert-advisory-owner@cert.org
bugtraq@securityfocus.com
owner-postfix-users@postfix.org
));
Section VI - Resource limitsNothing to change here. Section VII - External programs, virus scannersAs we will user Razor, set $sa_local_tests_only to 0. $sa_local_tests_only = 0; $sa_auto_whitelist = 1; I use Sophos as my only anti-virus software so I commented out the code referencing other anti-virus software.
@av_scanners = (
# ### http://www.sophos.com/
['Sophos Anti Virus (sweep)', 'sweep',
'-nb -f -all -rec -ss -sc -archive {}',
[0,2], qr/Virus .*? found/,
qr/^>>> Virus(?:(?: fragment)? '?(.+?)'? found)/,
sub {$ENV{SAV_IDE}='/usr/local/sav'},
],
);
Now do: # su - vscan $ touch blacklist whitelist spam_lovers $ mkdir tmp SpamAssassin configurationSpamAssassin has its configuration file in /usr/local/etc/mail/spamassassin/. In this directory you will find a file called local.cf. Don't bother too much with it, just create a new one. Here is the one I use from http://lawmonkey.org/anti-spam.html: rewrite_subject 1 # Tells SpamAssassin to change the subject on SPAM messages to include # The subject_tag (valuses 0 or 1). report_safe 0 # Setting it to 0 tells SpamAssassin to put the report into the headers. # 1 puts the report in main email and the original one goes as an attachemnt. # 2 is as 1 + attachment is converted into text. use_terse_report 0 # 0 gives terse report; 1 gives even shorter one. use_bayes 1 # This turns Bayesean Learning on. 0 turns it off. bayes_path /var/amavis/.spamassassin/bayes # Bayesean database location. #timelog_path /var/amavis/.spamassassin/assassin.log # Timelog path (commented out). auto_learn 1 # Auto learning lets SpamAssassin classify spam as SPAM. skip_rbl_checks 1 # By default SpamAssassin runs the Realtime Blackhole List checks. # It's better to turn this option off. use_razor2 1 # Tells SA that we want to use Razor version 2 use_dcc 1 # In case you want DCC. use_pyzor 0 # Tells SA that we don't want to use Pyzor dcc_add_header 1 # DCC header in case you want it. dns_available yes # If you are sure you have DNS access set it to "yes". header LOCAL_RCVD Received =~ /\S+\.domain\.com\s+\(.*\[.*\]\)/ score LOCAL_RCVD -50 # This checks "Received: from...." lines in the message header. # Set .domain.com to your domain so outgoing mail will not be tagged as # spam. Unless you are a spammer of course. In case you are I strongly urge # you to use this option. ## Optional Score Increases score DCC_CHECK 4.000 score RAZOR2_CHECK 2.500 score BAYES_99 4.300 score BAYES_90 3.500 score BAYES_80 3.000 # For scores have a look at /usr/local/share/spamassassin/50_scores.cf # file. At the end create this file: $ touch /var/amavis/.spamassassin/user_prefs If you don't create user_prefs SpamaSsassin will complain - must be there. Razor configurationThis is simple and fast, just follow the commands: # su - vscan $ razor-admin -create $ $ razor-admin -register -user postmaster@example.com Register successful. Identity stored in /var/amavis/.razor/identity-postmaster@example.com Just change example.com to your domain name. You may now view Razor's log file: # more /var/amavis/.razor/razor-agent.log ... Bayesian LearningYou may want to set up an auto-learning system for SpamAssassin. This way SpamAssassin will tag and add messages as SPAM and NOT-SPAM to the Bayesian database. In this mode, SPAM will not be blocked! The first thing is to create two accounts - spam and notspam. # pw useradd -c "Spam Account" -d /home/spam -m -s /bin/sh -h - -n spam # pw useradd -c "NOT-Spam Account" -d /home/notspam -m -s /bin/sh -h - -n notspam If your users get a message which in fact is spam ask them to forward it to "spam@domain.com". In case they get a message tagged as spam which is not spam ask them to forward it to "notspam@domain.com". This is very important to forward messages with full headers! Add spam@domain.com and notspam@domain.com to /var/amavis/spam_lovers file - one by line. Use this script for Bayesian Learning:
#!/bin/sh -
/usr/local/bin/sa-learn --spam -p /var/amavis/.spamassassin/user_prefs --dir ~spam/Maildir/new/
rm `ls -l ~spam/Maildir/new/ | awk '{ print $9}' | xargs` 2> /dev/null
echo -n "spam done."
/usr/local/bin/sa-learn --ham -p /var/amavis/.spamassassin/user_prefs --dir ~nospam/Maildir/new/
rm `ls -l ~nospam/Maildir/new/ | awk '{ print $9}' | xargs` 2> /dev/null
echo -n "nospam done."
/usr/local/bin/sa-learn --rebuild -p /var/amavis/.spamassassin/user_prefs
From my previous articles, you may know that I use Maildirs. If you use mbox format, change the lines where you call sa-learn to: /usr/bin/sa-learn --spam -p /var/amavisd/.spamassassin/user_prefs --mbox /var/mail/spam /usr/bin/sa-learn --ham -p /var/amavisd/.spamassassin/user_prefs --mbox /var/mail/notspam then simply remove /var/mail/spam and /var/mail/notspam files Run this script manually or from cron. Anytime you run this script, it will connect to the Razor servers - check /var/amavis/.razor/razor-agent.log. If the logs are getting too big, change: debuglevel = 3 to debuglevel = 0 which is defined in /var/amavis/.razor/razor-agent.conf file. If you want to turn off Bayesian Learning, edit /usr/local/etc/mail/spamassassin/local.cf and change: use_bayes 1 to read use_bayes 0 Now the SPAM will be blocked! Whenever you run the sa-learn script you will notice that the size of /var/amavis/.spamassassin/bayes_msgcount file increases by one whenever it processes a new email-file (Maildir) or mail (mbox). Bayesian Learning will never learn from the same message twice. Ready to go?In case you have commented the content_filter line out in main.cf file, uncomment it and issue the postfix reload command. Start amavis in debug mode: # /usr/local/sbin/amavisd debug See if everything is fine and no errors are reported. In /usr/ports/security/amavisd-new/work/amavisd-new-20030616/test-messages/ directory you can find sample messages. While in debug mode, try to send sample-spam.txt, or sample-virus-simple.txt from a remote host: remote-host$ cat sample-spam.txt | mail user@doman.com remote-host$ cat sample-virus-simple.txt | mail user@doman.com Addidtional notes
I must admit, this setup is very difficult and time consuming although when you fully understand the mechanisms behind Amavisd-new and SpamAssassin you will only benefit. The EU is just working on the suitable law to protect people against spammers and their junk mail. Remember that spammers don't pay for the distribution. The only one who pays for this is your ISP, you and your users. Don't let spammers spam you - apply anti-spam and UCE controls! Links: |