Mail Server : Postfix + Clamav + Amavisd2021/07/30

	Configure Virus-Scanning for E-Mails with Postfix + Clamav.
[1]	Install Clamav, refer to here.
[2]	Install Amavisd and Clamav Server.

# install from EPEL and PowerTools (disabled by default)

[root@mail ~]#

dnf --enablerepo=epel,powertools -y install amavisd-new clamd perl-Digest-SHA1 perl-IO-stringy

[root@mail ~]#

vi /etc/clamd.d/scan.conf

# line 8 : comment out

Example

# line 14 : uncomment

LogFile /var/log/clamd.scan

# line 77 : uncomment

PidFile /var/run/clamd.scan/clamd.pid

# line 81 : uncomment

TemporaryDirectory /var/tmp

# line 96 : uncomment

LocalSocket /var/run/clamd.scan/clamd.sock

[root@mail ~]#

touch /var/log/clamd.scan

[root@mail ~]#

chown clamscan. /var/log/clamd.scan

[root@mail ~]#

systemctl enable --now clamd@scan

[3]	If SELinux is enabled, add rules to start Clamav Server like follows.

[root@mail ~]#

restorecon -v /var/log/clamd.scan

[root@mail ~]#

setsebool -P antivirus_can_scan_system on

[4]	Configure Amavisd.

[root@mail ~]#

vi /etc/amavisd/amavisd.conf

# line 23 : change to the own domain name

$mydomain = '

srv.world

# line 158 : uncomment and change to the own hostname

$myhostname = '

mail.srv.world

[root@mail ~]#

systemctl enable --now amavisd

[5]	Configure Postfix.

[root@mail ~]#

vi /etc/postfix/main.cf

# add follows to the end

content_filter=smtp-amavis:[127.0.0.1]:10024

[root@mail ~]#

vi /etc/postfix/master.cf

# add follows to the end

smtp-amavis unix -    -    n    -    2 smtp
    -o smtp_data_done_timeout=1200
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
127.0.0.1:10025 inet n    -    n    -    - smtpd
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=127.0.0.0/8
    -o strict_rfc821_envelopes=yes
    -o smtpd_error_sleep_time=0
    -o smtpd_soft_error_limit=1001
    -o smtpd_hard_error_limit=1000

[root@mail ~]#

systemctl restart postfix

[6]	That' OK all. [X-Virus-Scanned: ***] lines are added in the header section of emails after this configuration and emails with known Virus will not sent to Clients like following email logs.

Jul 16 02:21:40 mail postfix/pickup[10864]: 1600610339EA: uid=1000 from=<rocky>
Jul 16 02:21:40 mail postfix/cleanup[11049]: 1600610339EA: message-id=<20210316082140.1600610339EA@mail.srv.world>
Jul 16 02:21:40 mail postfix/qmgr[10865]: 1600610339EA: from=<rocky@srv.world>, size=544, nrcpt=1 (queue active)
Jul 16 02:21:40 mail clamd[7483]: /var/spool/amavisd/tmp/amavis-20210316T005725-07487-oc30rJKw/parts/p001: Win.Test.EICAR_HDB-1 FOUND
Jul 16 02:21:40 mail clamd[7483]: /var/spool/amavisd/tmp/amavis-20210316T005725-07487-oc30rJKw/parts/p003: Win.Test.EICAR_HDB-1 FOUND
Jul 16 02:21:40 mail amavis[7487]: (07487-03) Blocked INFECTED (Win.Test.EICAR_HDB-1) {DiscardedInbound,Quarantined}, [127.0.0.1] <rocky@srv.world> -> <redhat@srv.world>, Message-ID: <20210316082140.1600610339EA@mail.srv.world>, mail_id: ysd0VMxHXIX9, Hits: -, size: 544, 21 ms
Jul 16 02:21:40 mail postfix/smtp[11051]: 1600610339EA: to=<redhat@srv.world>, orig_to=<rocky@mail.virtual.host>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.15, delays=0.1/0.02/0/0.02, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, id=07487-03 - INFECTED: Win.Test.EICAR_HDB-1)
Jul 16 02:21:40 mail postfix/qmgr[10865]: 1600610339EA: removed

Matched Content