构建邮件服务器病毒防护系统

迩来宏病毒比拟猖狂，只好给公司的邮件效劳器加个宏病毒扫描，归纳商量了几种计划，贯串本人的现有体例商量，觉得qmail-scanner+clamav(主假如由于免费)比拟符合，这种计划的便宜即是即使你的qmailqueue-patch在安置时就打好了（不会没打吧），原体例基础不动。所需软硬件（假设你有qmail体例，且能平常运转） ：1）maildrop-1.5.2.20030423.tar.gz 2）perl-time-hires-1.38-3.i386.rpm 3）clamav-0.65.tar.gz 4）qmail-scanner-1.20.tgz 一、maildrop安置 tar zxvf maildrop-1.5.2.20030423.tar.gz ./configure [options] make make install-strip make install-man 二、安置 perl-time-hires-1.38-3.i386.rpm rpm -ivh perl-time-hires-1.38-3.i386.rpm 三、安置clamav-0.65.tar.gz grouadd clamav useradd –g clamav –s /bin/false clamav tar zxvf clamav-0.65.tar.gz cd clamav-0.65 ./configure make check make install 革新宏病毒库，freshclam 把freshclam介入crontab 准时革新宏病毒库；窜改/usr/local/etc/clamav.conf；example前加# 或删掉；实行clamscan 尝试； 实行clamd；而后实行clamdscan。四、安置qmail-scanner-1.20.tgzgroupadd qscand useradd –g qscand –s /bin/false qscand tar zxvfqmail-scanner-1.20.tgz cd qmail-scanner-1.20 ./configure --qmail-queue-binary /var /qmail/bin/qmail-queue--admin postmaster \ --domain abc.com.cn --notify sender,admin --local-domains abc.com.cn --lang en_gb\ --debug yes --unzip yes --scanners clamscan查看有无缺点， 而后安置./configure --qmail-queue-binary /var /qmail/bin/qmail-queue--admin postmaster \ --domain abc.com.cn --notify sender,admin --local-domains abc.com.cn --lang en_gb\ --debug yes --unzip yes --scanners clamscan --install 看看能否在/var/qmail/bin/qmail-scanner-queue.pl能否生存：chown qscand:qscand /var/qmail/bin/qmail-scanner-queue.pl chmod 4755 /var/qmail/bin/qmail-scanner-queue.pl 而后用一个普遍用户登岸，实行/var/qmail/bin/qmail-scanner-queue.pl -z 即使没有can't do setuid展示，祝贺你，即使有回到安置文献目次，有个contrib目次。makemake install 附加办法：chown qscand:qscand /var/qmail/bin/qmail-scanner-queue chmod 4755 /var/qmail/bin/qmail-scanner-queue chmod 0755 /var/qmail/bin/qmail-scanner-queue.pl 而后用一个普遍用户登岸，实行/var/qmail/bin/qmail-scanner-queue -z /var/qmail/bin/qmail-scanner-queue –g 窜改情况变量： 1、在你的qmail启用剧本介入 qmailqueue=/var/qmail/bin/qmail-scanner-queue.pl即使作了附加办法用底下的： qmailqueue=/var/qmail/bin/qmail-scanner-queue export qmailqueue 2、再有一种本领：请参考faq.php instead set it under the tcpserver smtp rules file (you're using qmail - so you already know what that is - right? :-). that way you can even setup qmail-scanner to only scan mail from particular smtp client ip address ranges/etc. this is now the only officially supported mechanism. set it something like this: #/etc/tcpserver/smtp.rules # # no qmail-scanner at all for mail from 127.0.0.1 127.:allow,relayclient="",rblsmtpd="",qmailqueue="/var/qmail/bin/qmail-queue" # use qmail-scanner without spamassassin on any mail from the local network # [it triggers spamassassin via the presence of the relayclient var] 10.:allow,relayclient="",rblsmtpd="",qmailqueue="/var/qmail/bin/qmail-scanner-queue.pl" # # use qmail-scanner with spamassassin on any mail from the rest of the world :allow,qmailqueue="/var/qmail/bin/qmail-scanner-queue.pl" then run "maketcprules" or something like "tcprules /etc/tcp.smtp.cdb /etc/tcp.smtp.tmp < /etc/tcp.smtp" to rebuild the database 重起qmail 尝试，这边有尝试步调：/youdir/software/qmail-scanner-1.20 test_installation.sh 不知什么因为，我的clamscan 扫描不到宏病毒，过程尝试，创造了因为，精确处置本领：窜改qmail-scanner-queue.pl中的my $clamscan_options="-r --disable-summary --max-recursion=10 --max-space=1000000";为my $clamscan_options="-r --mbox --disable-summary --max-recursion=10 --max-space=1000000";就不妨ok了。重要的排错监测日记 /var/spool/qmailscan/quarantine.log /var/spool/qmailscan/qmail-queue.log /var/log/clamd.log /var/qmail/maillog