{"id":7154,"date":"2013-07-01T09:00:00","date_gmt":"2013-07-01T07:00:00","guid":{"rendered":"http:\/\/nolabnoparty.com\/?p=7154"},"modified":"2020-03-15T17:33:11","modified_gmt":"2020-03-15T16:33:11","slug":"secure-postfix-amavisd-clamav-spamassassin","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/secure-postfix-amavisd-clamav-spamassassin\/","title":{"rendered":"Secure Postfix with Amavisd, ClamAV, SpamAssassin"},"content":{"rendered":"<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 10px auto 5px; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix01\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix01.jpg\" alt=\"securepostfix01\" width=\"602\" height=\"202\" border=\"0\" \/><\/p>\n<p>To secure\u00a0<a href=\"https:\/\/nolabnoparty.com\/en\/setup-mail-server-postfix-dovecot-roundcube-centos\/\">Postfix mail server<\/a> from <strong>spam and viruses<\/strong>, software like Amavisd, ClamAV and SpamAssassin can be a good solution.<\/p>\n<p>The <strong>working concept<\/strong> is pretty easy: Amavisd accepts mail from Postfix (MTA), pass it to ClamAV and SpamAssassin to check for spam and viruses and then return the mail back to Postfix for delivery.<\/p>\n<p><!--more--><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix02\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix02.jpg\" alt=\"securepostfix02\" width=\"444\" height=\"369\" border=\"0\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Prerequisites<\/h2>\n<ul>\n<li>CentOS 6.x minimal<\/li>\n<li><a href=\"http:\/\/wiki.centos.org\/AdditionalResources\/Repositories\/RPMForge\" target=\"_blank\" rel=\"noopener noreferrer\">RPMforge<\/a> repository<\/li>\n<li>Postfix installed and configured<\/li>\n<li>Packages <a href=\"http:\/\/www.ijs.si\/software\/amavisd\/\" target=\"_blank\" rel=\"noopener noreferrer\">Amavisd<\/a>, <a href=\"http:\/\/www.clamav.net\/\" target=\"_blank\" rel=\"noopener noreferrer\">ClamAV<\/a>, <a href=\"http:\/\/spamassassin.apache.org\/\" target=\"_blank\" rel=\"noopener noreferrer\">Spamassassin<\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2>Install packages<\/h2>\n<p>Once configured the RPMforge repository in the system, install all the <strong>necessary packages<\/strong> using the <em>yum<\/em> command.<\/p>\n<p><span style=\"color: #0000a0;\"># yum install amavisd-new clamav clamav-devel clamd spamassassin<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix03\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix03.jpg\" alt=\"securepostfix03\" width=\"600\" height=\"240\" border=\"0\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Configure ClamAV<\/h2>\n<p>Edit the configuration file <em>\/etc\/clamd.conf<\/em> and set ClamAV to communicate with Amavisd-new using a <strong>local UNIX socket<\/strong> rather than <strong>TCPSocket<\/strong> by commenting the <span style=\"color: #ff0000;\"><strong>TCPSocket 3310<\/strong><\/span> parameter.<\/p>\n<p><span style=\"color: #0000a0;\"># vi \/etc\/clamd.conf<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix04\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix04.jpg\" alt=\"securepostfix04\" width=\"600\" height=\"54\" border=\"0\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Configure Amavisd-new<\/h2>\n<p>Edit the configuration file <em>\/etc\/amavisd\/amavisd.conf<\/em> and remove, if needed, the comment (#) to disable <strong>spam or virus checking<\/strong>.<\/p>\n<pre class=\"brush: shell; gutter: true\"># COMMONLY ADJUSTED SETTINGS:\r\n# @bypass_virus_checks_maps = (1); # controls running of anti-virus code\r\n # @bypass_spam_checks_maps = (1); # controls running of anti-spam code\r\n # $bypass_decode_parts = 1; # controls running of decoders&amp;dearchivers<\/pre>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix05\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix05.jpg\" alt=\"securepostfix05\" width=\"600\" height=\"104\" border=\"0\" \/><\/p>\n<p>Set the <strong>domain and hostname<\/strong> of the network environment.<\/p>\n<pre class=\"brush: shell; gutter: true\">$mydomain = 'domain.com';<\/pre>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix06\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix06.jpg\" alt=\"securepostfix06\" width=\"600\" height=\"38\" border=\"0\" \/><\/p>\n<pre class=\"brush: shell; gutter: true\">$myhostname = 'mail.domain.com';<\/pre>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix07\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix07.jpg\" alt=\"securepostfix07\" width=\"600\" height=\"43\" border=\"0\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Configure Postfix<\/h2>\n<p>Edit the configuration file <em>\/etc\/postfix\/master.cf<\/em>\u00a0 to tell Postfix to pass mail to Amasvid-new <strong>for filtering<\/strong>.<\/p>\n<pre class=\"brush: shell; gutter: true\">amavisfeed unix\u00a0\u00a0\u00a0 -\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -\u00a0\u00a0\u00a0\u00a0\u00a0 2\u00a0\u00a0\u00a0\u00a0 lmtp\r\n -o lmtp_data_done_timeout=1200\r\n -o lmtp_send_xforward_command=yes\r\n -o disable_dns_lookups=yes\r\n -o max_use=20\r\n127.0.0.1:10025 inet n\u00a0\u00a0\u00a0 -\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -\u00a0\u00a0\u00a0\u00a0 smtpd\r\n -o content_filter=\r\n -o smtpd_delay_reject=no\r\n -o smtpd_client_restrictions=permit_mynetworks,reject\r\n -o smtpd_helo_restrictions=\r\n -o smtpd_sender_restrictions=\r\n -o smtpd_recipient_restrictions=permit_mynetworks,reject\r\n -o smtpd_data_restrictions=reject_unauth_pipelining\r\n -o smtpd_end_of_data_restrictions=\r\n -o smtpd_restriction_classes=\r\n -o mynetworks=127.0.0.0\/8\r\n -o smtpd_error_sleep_time=0\r\n -o smtpd_soft_error_limit=1001\r\n -o smtpd_hard_error_limit=1000\r\n -o smtpd_client_connection_count_limit=0\r\n -o smtpd_client_connection_rate_limit=0\r\n -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,\r\n      no_milters,no_address_mappings\r\n -o local_header_rewrite_clients=\r\n -o smtpd_milters=\r\n -o local_recipient_maps=\r\n -o relay_recipient_maps=<\/pre>\n<p><span style=\"color: #0000a0;\"># vi \/etc\/postfix\/master.cf<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix08\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix08.jpg\" alt=\"securepostfix08\" width=\"600\" height=\"534\" border=\"0\" \/><\/p>\n<p>Edit the file <em>\/etc\/postfix\/main.cf<\/em> and <strong>enable message filtering<\/strong> in Postfix adding the line:<\/p>\n<pre class=\"brush: shell; gutter: true\"># use amavisd as filter on port 10024\r\ncontent_filter=amavisfeed:[127.0.0.1]:10024<\/pre>\n<p><span style=\"color: #0000a0;\"># vi \/etc\/postfix\/main.cf<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix09\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix09.jpg\" alt=\"securepostfix09\" width=\"600\" height=\"47\" border=\"0\" \/><\/p>\n<p><strong>Reload<\/strong> Postfix to get new parameters.<\/p>\n<p><span style=\"color: #0000a0;\"># service postfix reload<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix10\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix10.jpg\" alt=\"securepostfix10\" width=\"600\" height=\"54\" border=\"0\" \/><\/p>\n<p>Enable Amavisd and ClamAV services to start during <strong>system boot<\/strong>.<\/p>\n<p><span style=\"color: #0000a0;\"># chkconfig amavisd on<br \/>\n# chkconfig clamd on<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix11\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix11.jpg\" alt=\"securepostfix11\" width=\"600\" height=\"51\" border=\"0\" \/><\/p>\n<p>Start ClamAV and Amavisd <strong>services<\/strong>. The SpamAssassinservice, which starts spamd, can be set to off as Amavisd-new doesn't actually use the <strong>SpamAssassin daemon<\/strong> (spamd) but rather loads SpamAssassin as a module.<\/p>\n<p><span style=\"color: #0000a0;\"># service clamd start<br \/>\n# service amavisd start<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix12\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix12.jpg\" alt=\"securepostfix12\" width=\"600\" height=\"175\" border=\"0\" \/><\/p>\n<p>Because ClamAV database signature may be outdated, you can <strong>manually update<\/strong> by using the command <em>freshclam<\/em>.<\/p>\n<p><span style=\"color: #0000a0;\"># \/usr\/bin\/freshclam<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"margin: 0px auto; padding-left: 0px; padding-right: 0px; float: none; padding-top: 0px; border: 0px;\" title=\"securepostfix13\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/06\/securepostfix13.jpg\" alt=\"securepostfix13\" width=\"600\" height=\"322\" border=\"0\" \/><\/p>\n<p>The mail server is now <strong>protected<\/strong> against spam and viruses.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/images\/firma.jpg\" alt=\"\" title=\"\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>To secure\u00a0Postfix mail server from spam and viruses, software like Amavisd, ClamAV and SpamAssassin can be a good solution. The working concept is pretty easy: Amavisd accepts mail from Postfix (MTA), pass it to ClamAV and SpamAssassin to check for spam and viruses and then return the mail back to Postfix for delivery.<\/p>\n","protected":false},"author":3,"featured_media":7141,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[534],"tags":[615,616,619,642,2141],"class_list":["post-7154","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-messaging-en","tag-amavisd-en","tag-clamav-en","tag-postfix-en","tag-spam-en","tag-spamassassin-en","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/7154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=7154"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/7154\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/7141"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=7154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=7154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=7154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}