DigiMoon 맘대로 닦고 조이고 기름치는 재미가 있는 DigiMoon만의 기억 저장소

Posted
Filed under 컴퓨터 탐구/리눅스
 작성자: 주인장 디지문
(http://www.digimoon.net/)


 이 블로그를 운영하고 있는 qmail 서버에 적용한 스팸필터링 시스템 메뉴얼입니다.
 Simscan + Ripmime + Clam Antivirus + Spamassassin 조합입니다. 또 다른 qmail 스팸필터링 시스템으로 널리 소개된 Qmail-scanner + Maildrop + Clam Antivirus + Spamassassin 조합보다는 처리 속도 면에서 약간 낫다고 하죠.
 Qmail-scanner가 perl로 작성되어 있어 기능성/확장성 면에서 장점을 가진다면 Simscan은 C로 작성되어 처리 속도가 빠르다는 장점이 있습니다.
 
 CentOS 구축 관리 실무 같은 책을 비롯하여 여타 한글 설치문서들이 대부분 소스 설치 기준으로 설명하고 있는데 개인적으로 소스컴파일 설치보다는 rpm 설치를 선호하기에 rpm 기준으로 작성해 보았습니다.
 
OS : CentOS 5.4 32bit


Ripmime 설치
[root@localhost ~]# wget ftp://195.220.108.108/linux/epel/5/SRPMS/ripmime-1.4.0.9-2.el5.src.rpm
[root@localhost ~]# rpm -ivh ripmime-1.4.0.9-2.el5.src.rpm
[root@localhost ~]# cd /usr/src/redhat/SPECS
[root@localhost SPECS]# rpmbuild -ba ripmime.spec
[root@localhost SPECS]# cd /usr/src/redhat/RPMS/i386
[root@localhost i386]# rpm -Uvh ripmime*

ClamAV 설치
[root@localhost ~]# rpm -Uvh http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
[root@localhost ~]# yum -y install clamav clamav-devel clamav-db clamav-milter
[root@localhost ~]# yum -y install clamd
[root@localhost ~]# cp -arp /etc/clamd.conf /etc/clamd.conf.orig
[root@digimoon ~]# cat /etc/clamd.conf
LogFile /var/log/clamav/clamd.log
LogTime yes
LogSyslog yes
LogVerbose yes
PidFile /var/run/clamav/clamd.pid
TemporaryDirectory /var/tmp
DatabaseDirectory /var/clamav
LocalSocket /tmp/clamd.socket
FixStaleSocket yes
ScanMail yes
[root@localhost ~]# cp -arp /etc/freshclam.conf /etc/freshclam.conf.orig
[root@localhost ~]# cat /etc/freshclam.conf
DatabaseDirectory /var/clamav
UpdateLogFile /var/log/clamav/freshclam.log
LogSyslog yes
PidFile /var/run/freshclam.pid
DatabaseOwner clamav
DatabaseMirror db.kr.clamav.net
DatabaseMirror db.local.clamav.net
NotifyClamd /etc/clamd.conf
[root@localhost ~]# freshclam
[root@localhost ~]# /etc/init.d/clamd start


Spamassassin 설치 (CentOS의 경우 spamassassin이 대개 기본 설치되어 있으므로 버전이 업데이트될 것입니다. 업데이트 후 스크립트를 구동하면 에러가 나는데 sa-update -D 커맨드를 한 번 실행해주면 됩니다)
[root@localhost ~]# yum -y install spamassassin
[root@localhost ~]# sa-update -D
[root@localhost ~]# /etc/init.d/spamassassin start

※ 필터링 룰을 담당하는 /etc/mail/spamassassin/local.cf 파일은 인터넷에 나도는 샘플을 적용해보고 자신에게 맞게 커스터마이징해서 관리하면 됩니다.

vpopmail과 연동된 qmail 시스템에 적용하기 위해서는 실행 스크립트인 /etc/rc.d/init.d/spamassassin 파일에서
SPAMDOPTIONS="-d -c -m5 -H" <- 이 부분을
SPAMDOPTIONS="-d -v -m10 -x -u vpopmail" <- 이렇게 고쳐준다

Simscan 설치 (http://qmail.kldp.net/phpbb/viewtopic.php?t=7884)
[root@localhost ~]# wget http://downloads.sourceforge.net/project/simscan/simscan/simscan-1.4.0/simscan-1.4.0.tar.gz?use_mirror=cdnetworks-kr-2
[root@localhost ~]# wget http://ejlabs.net/txt/patch/simscan-1.4.0.patch
[root@localhost ~]# tar xvfz simscan-1.4.0.tar.gz
[root@localhost ~]# cd simscan-1.4.0
[root@localhost simscan-1.4.0]# patch -p1 < ../simscan-1.4.0.patch
[root@localhost simscan-1.4.0]# useradd -r -g clamav -s /bin/false -c "Simscan - a qmail-queue substitute" simscan
[root@localhost simscan-1.4.0]# ./configure --prefix=/usr --sysconfdir=/etc --mandir=/usr/share/man --enable-user=simscan --enable-clamav=y --enable-attach=y --enable-dropmsg=y --enable-per-domain=y --enable-spam=y --enable-spamc-user=y --enable-spamc=/usr/bin/spamc --enable-spam-hits=30.0 --enable-qmaildir=/var/qmail --enable-workdir=/var/qmail/simscan --enable-controldir=/var/qmail/control --enable-quarantinedir=/var/qmail/quarantine --enable-qmail-queue=/var/qmail/bin/qmail-queue --enable-ripmime=/usr/bin/ripmime --enable-received=y --enable-spamassassin-path=/usr/bin/spamassassin --enable-clamavdb-path=/var/clamav --enable-clamdscan=/usr/bin/clamdscan --enable-sigtool-path=/usr/bin/sigtool --enable-spam-passthru=y
[root@localhost simscan-1.4.0]# make
[root@localhost simscan-1.4.0]# make install-strip
[root@localhost simscan-1.4.0]# mkdir /var/qmail/quarantine
[root@localhost simscan-1.4.0]# chown simscan:clamav /var/qmail/quarantine/
[root@localhost simscan-1.4.0]# chmod 770 /var/qmail/quarantine/
[root@localhost simscan-1.4.0]# cat /var/qmail/control/simcontrol
:clam=yes,spam=yes,attach=.scr:.bat:.com:.pif:.exe:.mp3:.avi:.mpeg:.wmv
[root@digimoon simscan-1.4.0]# /var/qmail/bin/simscanmk -g
simscan versions cdb file built. /var/qmail/control/simversions.cdb
[root@digimoon simscan-1.4.0]# /var/qmail/bin/simscanmk
simscan cdb file built. /var/qmail/control/simcontrol.cdb
[root@digimoon simscan-1.4.0]#

Simscan이 잘 작동하는지 테스트
[root@localhost ~]# echo "hi~" > mailtest.txt
[root@localhost ~]# env QMAILQUEUE=/var/qmail/bin/simscan SIMSCAN_DEBUG=2 /var/qmail/bin/qmail-inject master@foobar.com < mailtest.txt
simscan: cdb looking up
simscan: cdb for  found clam=yes,spam=yes,attach=.scr:.bat:.com:.pif:.exe:.mp3:.avi:.mpeg:.wmv
simscan: pelookup clam = yes
simscan: pelookup spam = yes
simscan: pelookup attach = .scr:.bat:.com:.pif:.exe:.mp3:.avi:.mpeg:.wmv
simscan: attachment flag attach = .scr:.bat:.com:.pif:.exe:.mp3:.avi:.mpeg:.wmv
simscan: .scr is attachment number 0
simscan: .bat is attachment number 1
simscan: .com is attachment number 2
simscan: .pif is attachment number 3
simscan: .exe is attachment number 4
simscan: .mp3 is attachment number 5
simscan: .avi is attachment number 6
simscan: .mpeg is attachment number 7
simscan: .wmv is attachment number 8
simscan: starting: work dir: /var/qmail/simscan/1270400451.777157.17309
simscan: pelookup: called with master@foobar.com
simscan: pelookup: domain is digimoon.net
simscan: cdb looking up digimoon.net
simscan: pelookup: local part is root
simscan: cdb looking up master@foobar.com
simscan: pelookup: called with master@foobar.com
simscan: pelookup: domain is digimoon.net
simscan: cdb looking up digimoon.net
simscan: pelookup: local part is admin
simscan: cdb looking up master@foobar.com
simscan: cdb looking up version attach
simscan: calling clamdscan
simscan: cdb looking up version clamav
simscan: normal clamdscan return code: 0
simscan: calling spamc
simscan: calling /usr/bin/spamc  spamc -u master@foobar.com
simscan: cdb looking up version spam
simscan:[17308]:CLEAN (3.00/10.00):5.0506s::(null):root@foobar.com:master@foobar.com
simscan: done, execing qmail-queue
simscan: qmail-queue exited 0
[root@localhost ~]#


qmail 스크립트 수정
[root@localhost ~]# cat /var/qmail/supervise/qmail-smtpd/run
#!/bin/sh
QMAILQUEUE="/var/qmail/bin/simscan"
export QMAILQUEUE

Q_UID=`id -u vpopmail`
Q_GID=`id -g vpopmail`
exec /usr/local/bin/softlimit -m 20000000 \
/usr/local/bin/tcpserver -vRHl 0 -x /etc/tcp.smtp.cdb \
-u $Q_UID -g $Q_GID 0 25 \
/usr/local/bin/rblsmtpd -b -r bl.spamcop.net \
/var/qmail/bin/qmail-smtpd /home/vpopmail/bin/vchkpw /bin/true 2>&1
[root@localhost ~]#


받은 메일의 헤더 상단부에 아래와 같은 내용이 출력되면 잘 연동된 상태
Received: by simscan 1.4.0 ppid: 6201, pid: 6202, t: 5.0931s
         scanners: attach: 1.4.0 clamav: 0.96/m:52/d:10699 spam: 3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on foobar.com
Creative Commons License
2010/04/05 12:56 2010/04/05 12:56