ppl++

[debienna.git] / Archive / RerunClamavSpamassGreylistd / index.mdwn

## Exim Konfiguration:


### Main

zuerst:
[[!format txt """
sudo aptitude install clamav spamassassin spamc greylistd

adduser clamav Debian-exim
adduser Debian-exim clamav
"""]]
/etc/clamav/clamd.conf
[[!format txt """
#Automatically Generated by clamav-base postinst
#To reconfigure clamd run #dpkg-reconfigure clamav-base
#Please read /usr/share/doc/clamav-base/README.Debian.gz for details
LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket
User clamav
AllowSupplementaryGroups
ScanMail
ScanArchive
ArchiveMaxRecursion 5
ArchiveMaxFiles 1000
ArchiveMaxFileSize 10M
ArchiveMaxCompressionRatio 250
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
LogFile /var/log/clamav/clamav.log
LogTime
LogFileMaxSize 0
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav
SelfCheck 3600
ScanOLE2
ScanPE
DetectBrokenExecutables
ScanHTML
ArchiveBlockMax
"""]]
/etc/exim4/conf.d/main/02_exim4-config_options
[[!format txt """
### main/02_exim4-config_options
#################################

av_scanner = clamd:/var/run/clamav/clamd.ctl
spamd_address = 127.0.0.1 783

...
"""]]
/etc/exim4/conf.d/acl/30_exim4-config_check_rcpt
[[!format txt """
# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.
#
acl_check_rcpt:

  # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  # testing for an empty sending host field.
  accept hosts = :

  # Add missing Date and Message-ID header for relayed messages
  warn hosts = +relay_from_hosts
       control = submission/sender_retain

  # The following section of the ACL is concerned with local parts that contain
  # @ or % or ! or / or | or dots in unusual places.
  #
  # The characters other than dots are rarely found in genuine local parts, but
  # are often tried by people looking to circumvent relaying restrictions.
  # Therefore, although they are valid in local parts, these rules lock them
  # out, as a precaution.
  #
  # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  # allows them because they have been encountered. (Consider local parts
  # constructed as "firstinitial.secondinitial.familyname" when applied to
  # someone like me, who has no second initial.) However, a local part starting
  # with a dot or containing /../ can cause trouble if it is used as part of a
  # file name (e.g. for a mailing list). This is also true for local parts that
  # contain slashes. A pipe symbol can also be troublesome if the local part is
  # incorporated unthinkingly into a shell command line.
  #
  # Two different rules are used. The first one is stricter, and is applied to
  # messages that are addressed to one of the local domains handled by this
  # host. It blocks local parts that begin with a dot or contain @ % ! / or |.
  # If you have local accounts that include these characters, you will have to
  # modify this rule.
  deny    domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|\'`#&?]
          message       = restricted characters in address

  # The second rule applies to all other domains, and is less strict. This
  # allows your own users to send outgoing messages to sites that use slashes
  # and vertical bars in their local parts. It blocks local parts that begin
  # with a dot, slash, or vertical bar, but allows these characters within the
  # local part. However, the sequence /../ is barred. The use of @ % and ! is
  # blocked, as before. The motivation here is to prevent your users (or
  # your users' viruses) from mounting certain kinds of attack on remote sites.

  deny    domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!\'`#&?] : ^.*/\\.\\./
          message       = restricted characters in address

  # Accept mail to postmaster in any local domain, regardless of the source,
  # and without verifying the sender.
  #
  accept local_parts = postmaster
         domains = +local_domains

  # deny bad senders (envelope sender)
  # CONFDIR/local_sender_blacklist holds a list of envelope senders that
  # should have their access denied to the local host. Incoming messages
  # with one of these senders are rejected at RCPT time.
  #
  # The explicit white lists are honored as well as negative items in
  # the black list. See /usr/share/doc/exim4-config/default_acl for details.
  deny message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
       !acl = acl_whitelist_local_deny
       senders = ${if exists{CONFDIR/local_sender_blacklist}\
                             {CONFDIR/local_sender_blacklist}\
                             {}}

  # deny bad sites (IP address)
  # CONFDIR/local_host_blacklist holds a list of host names, IP addresses
  # and networks (CIDR notation)  that should have their access denied to
  # The local host. Messages coming in from a listed host will have all
  # RCPT statements rejected.
  #
  # The explicit white lists are honored as well as negative items in
  # the black list. See /usr/share/doc/exim4-config/default_acl for details.
  deny message = sender IP address $sender_host_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
       !acl = acl_whitelist_local_deny
       hosts = ${if exists{CONFDIR/local_host_blacklist}\
                             {CONFDIR/local_host_blacklist}\
                             {}}



  # Deny unless the sender address can be verified.
  #
  # This is disabled by default so that DNSless systems don't break. If
  # your system can do DNS lookups without delay or cost, you might want
  # to enable the following line.
  #deny message = Sender verification failed
  #     !acl = acl_whitelist_local_deny
  #     !verify = sender

  # Warn if the sender host does not have valid reverse DNS.
  #
  # This is disabled by default so that DNSless systems don't break. If
  # your system can do DNS lookups without delay or cost, you might want
  # to enable the following lines.
  # If sender_host_address is defined, it's a remote call.  If
  # sender_host_name is not defined, then reverse lookup failed.  Use
  # this instead of !verify = reverse_host_lookup to catch deferrals
  # as well as outright failures.
  warn message = X-Host-Lookup-Failed: Reverse DNS lookup failed for $sender_host_address (${if eq{$host_lookup_failed}{1}{failed}{deferred}})
         condition = ${if and{{def:sender_host_address}{!def:sender_host_name}}\
                       {yes}{no}}

  #############################################################################
  # There are no checks on DNS "black" lists because the domains that contain
  # these lists are changing all the time. You can find examples of
  # how to use dnslists in /usr/share/doc/exim4-config/examples/acl
  #############################################################################


  # Perform greylisting on incoming messages from remote hosts.
  # We do NOT greylist messages with no envelope sender, because that
  # would conflict with remote hosts doing callback verifications, and we
  # might not be able to send mail to such hosts for a while (until the
  # callback attempt is no longer greylisted, and then some).
  #
  # We also check the local whitelist to avoid greylisting mail from
  # hosts that are expected to forward mail here (such as backup MX hosts,
  # list servers, etc).
  #
  # Because the recipient address has not yet been verified, we do so
  # now and skip this statement for non-existing recipients.  This is
  # in order to allow for a 550 (reject) response below.  If the delivery
  # happens over a remote transport (such as "smtp"), recipient callout
  # verification is performed, with the original sender intact.
  #
  defer
    message        = $sender_host_address is not yet authorized to deliver. \
                     Please try later.
    log_message    = greylisted.
    !senders       = :
    !hosts         = : +relay_from_hosts : \
                     ${if exists {/etc/greylistd/whitelist-hosts}\
                                 {/etc/greylistd/whitelist-hosts}{}} : \
                     ${if exists {/var/lib/greylistd/whitelist-hosts}\
                                 {/var/lib/greylistd/whitelist-hosts}{}}
    !authenticated = *
    !acl           = acl_whitelist_local_deny
    domains        = +local_domains : +relay_to_domains : dsearch;/etc/exim4/virtual
    verify         = recipient/callout=20s,use_sender,defer_ok
    condition      = ${readsocket{/var/run/greylistd/socket}\
                                 {--grey \
                                  ${mask:$sender_host_address/24}} \
#                                  $sender_address \
#                                  $local_part@$domain}\
                                 {5s}{}{false}}



  # Accept if the address is in a local domain, but only if the recipient can
  # be verified. Otherwise deny. The "endpass" line is the border between
  # passing on to the next ACL statement (if tests above it fail) or denying
  # access (if tests below it fail).
  #
  accept domains = +local_domains
         endpass
         message = unknown user
         verify = recipient

  accept domains = dsearch;/etc/exim4/virtual
         endpass
         message = unknown user
         verify = recipient

  # Accept if the address is in a domain for which we are relaying, but again,
  # only if the recipient can be verified.
  #
  accept domains = +relay_to_domains
         endpass
         message = unrouteable address
         verify = recipient

  # If control reaches this point, the domain is neither in +local_domains
  # nor in +relay_to_domains.

  # Accept if the message comes from one of the hosts for which we are an
  # outgoing relay. Recipient verification is omitted here, because in many
  # cases the clients are dumb MUAs that don't cope well with SMTP error
  # responses. If you are actually relaying out from MTAs, you should probably
  # add recipient verification here.
  #
  accept hosts = +relay_from_hosts

  # Accept if the message arrived over an authenticated connection, from
  # any host. Again, these messages are usually from MUAs, so recipient
  # verification is omitted.
  #
  accept authenticated = *

  # Reaching the end of the ACL causes a "deny", but we might as well give
  # an explicit message.
  #
  deny message = relay not permitted


"""]]
/etc/exim4/conf.d/acl/40_exim4-config_check_data
[[!format txt """
# 40_exim4-config_check_data

acl_check_data:
  # greylistd(8) configuration follows.
  # This statement has been added by "greylistd-setup-exim4",
  # and can be removed by running "greylistd-setup-exim4 remove".
  # Any changes you make here will then be lost.
  #
  # Perform greylisting on incoming messages with no envelope sender here.
  # We did not subject these to greylisting after RCPT TO:, because that
  # would interfere with remote hosts doing sender callout verifications.
  #
  # Because there is no sender address, we supply only two data items:
  #  - The remote host address
  #  - The recipient address (normally, bounces have only one recipient)
  #
  # We also check the local whitelist to avoid greylisting mail from
  # hosts that are expected to forward mail here (such as backup MX hosts,
  # list servers, etc).
  #
  defer
    message        = $sender_host_address is not yet authorized to deliver. \
                     Please try later.
    log_message    = greylisted.
    senders        = :
    !hosts         = : +relay_from_hosts : \
                     ${if exists {/etc/greylistd/whitelist-hosts}\
                                 {/etc/greylistd/whitelist-hosts}{}} : \
                     ${if exists {/var/lib/greylistd/whitelist-hosts}\
                                 {/var/lib/greylistd/whitelist-hosts}{}}
    !authenticated = *
    !acl           = acl_whitelist_local_deny
    condition      = ${readsocket{/var/run/greylistd/socket}\
                                 {--grey \
                                  ${mask:$sender_host_address/24}} \
#                                  $recipients}\
                                  {5s}{}{false}}


   # Deny unless the address list headers are syntactically correct.
   #
   # This is disabled by default because it might reject legitimate mail.
   # If you want your system to insist on syntactically valid address
   # headers, you might want to enable the following lines.
   # deny message = Message headers fail syntax check
   #    !acl = acl_whitelist_local_deny
   #    !verify = header_syntax

   # require that there is a verifiable sender address in at least
   # one of the "Sender:", "Reply-To:", or "From:" header lines.
   # deny message = No verifiable sender address in message headers
   #    !acl = acl_whitelist_local_deny
   #    !verify = header_sender


deny  message = Serious MIME defect detected ($demime_reason)
      demime = *
      condition = ${if >{$demime_errorlevel}{2}{1}{0}}

deny   message   = Blacklisted file extension detected
       condition = ${if match \
                        {${lc:$mime_filename}} \
                        {\N(\.bat|\.com|\.exe|\.pif|\.prf|\.scr|\.vbs)$\N} \
                     {1}{0}}

deny message = This message contains malware ($malware_name)
     malware = *
  

# Always put X-Spam-Score header in the message.
# It looks like this:
# X-Spam-Score: 6.6 (++++++)
# When a MUA cannot match numbers, it can match for an
# equivalent number of '+' signs.
# The 'true' makes sure that the header is always put
# in, no matter what the score.
warn message = X-Spam-Score: $spam_score ($spam_bar)
     condition = ${if <{$message_size}{300k}{1}{0}}
     spam = spamassassin:true

# Always put X-Spam-Report header in the message.
# This is a multiline header that informs the user
# which tests a message has "hit", and how much a
# test has contributed to the score.
warn message = X-Spam-Flag: YES
     condition = ${if <{$message_size}{300k}{1}{0}}
     spam = spamassassin:true
     condition = ${if >{$spam_score_int}{30}{1}{0}}


deny message = Spam score too high ($spam_score)
     condition = ${if <{$message_size}{300k}{1}{0}}
     spam = spamassassin:true
     condition = ${if >{$spam_score_int}{100}{1}{0}}


   # accept otherwise
   accept
"""]]


 [[!tag CategoryCodeSnippets]] [[!tag CategoryTipsAndTricks]]