(6) [Mail]RHEL4上安装基于postfix的全功能邮件服务器

4、测试启动

#/usr/local/sbin/amavisd

您也可以按如下命令调试启动

#/usr/local/sbin/amavisd debug

5、修改postfix的配置，让它能调用amavisd，以实现病毒及垃圾邮件的过滤

#vi /etc/postfix/master.cf

在文末添加如下内容：

# ==========================================================================

# service type private unpriv chroot wakeup maxproc command + args

# (yes) (yes) (yes) (never) (100)

# ==========================================================================

#

amavisfeed unix - - n - 2 smtp

-o smtp_data_done_timeout=1200

-o smtp_send_xforward_command=yes

-o disable_dns_lookups=yes

-o max_use=20

#

127.0.0.1:10025 inet n - n - - smtpd

-o content_filter=

-o smtpd_delay_reject=no

-o smtpd_client_restrictions=permit_mynetworks,reject

-o smtpd_helo_restrictions=

-o smtpd_sender_restrictions=

-o smtpd_recipient_restrictions=permit_mynetworks,reject

-o smtpd_data_restrictions=reject_unauth_pipelining

-o smtpd_end_of_data_restrictions=

-o smtpd_restriction_classes=

-o mynetworks=127.0.0.0/8

-o smtpd_error_sleep_time=0

-o smtpd_soft_error_limit=1001

-o smtpd_hard_error_limit=1000

-o smtpd_client_connection_count_limit=0

-o smtpd_client_connection_rate_limit=0

-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters

-o local_header_rewrite_clients=

说明：注意每行“-o”前的空格；

#vi /etc/postifx/main.cf

在文末添加如下行：

content_filter=amavisfeed:[127.0.0.1]:10024

4、让postfix重新加载主配置文件，并查看启动情况

# postfix reload && tail -f /var/log/maillog

5、查看amavisd是否在监听10024端口，并测试服务启动情况：

# telnet localhost 10024

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

220 [127.0.0.1] ESMTP amavisd-new service ready

EHLO localhost

250-[127.0.0.1]

250-VRFY

250-PIPELINING

250-SIZE

250-ENHANCEDSTATUSCODES

250-8BITMIME

250-DSN

250 XFORWARD NAME ADDR PROTO HELO

Quit

221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel

Connection closed by foreign host.

6、postfix重新加载配置文件后将授权并激活"127.0.0.1:10025"端口，一个正常的服务连接应该类同下面所示：

# telnet localhost 10025

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

220 Welcome to our mail.benet.org ESMTP,Warning: Version not Available

EHLO localhost

250-mail.benet.org

250-PIPELINING

250-SIZE 14336000

250-VRFY

250-ETRN

250-AUTH PLAIN LOGIN

250-AUTH=PLAIN LOGIN

250-ENHANCEDSTATUSCODES

250-8BITMIME

250 DSN

QUIT

221 2.0.0 Bye

Connection closed by foreign host.

7、通过amavisd测试发信

]# telnet localhost 10024

Trying 127.0.0.1...

Connected to localhost.localdomain (127.0.0.1).

Escape character is '^]'.

220 [127.0.0.1] ESMTP amavisd-new service ready

HELO localhost

250 [127.0.0.1]

MAIL FROM:<>

250 2.1.0 Sender <> OK

RCPT TO:<postmaster>

250 2.1.5 Recipient <postmaster> OK

DATA

354 End data with <CR><LF>.<CR><LF>

From:Anti-Virus tester

To: MailServer Admin

Subject:amavisd test!

amavisd test!!

.

250 2.0.0 Ok: queued as 263FC1A609

quit

221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel

Connection closed by foreign host.

接下来使用root用户测试收信

# mail

Mail version 8.1 6/6/93. Type ? for help.

"/var/spool/mail/root": 1 message 1 new

>N 1 Anti-Virus tester Wed Sep 19 01:19 23/798 "amavisd test!"

& 1

Message 1:

From MAILER-DAEMON Wed Sep 19 01:19:16 2007

X-Original-To: postmaster

Delivered-To: postmaster@benet.org

X-Quarantine-ID: <3gmvpc8RxPtn>

X-Virus-Scanned: amavisd-new at benet.org

X-Amavis-Alert: BAD HEADER, MIME error: error: unexpected end of header

From:Anti-Virus tester

To: MailServer Admin

Subject:amavisd test!

Date: Wed, 19 Sep 2007 01:19:15 +0800 (CST)

amavisd test!!

&

十八、测试使用反病毒及反垃圾模块

1、病毒邮件发送测试

登录extmail，发送带有病毒附件的邮件(病毒样本文件后文附有)，查看发送情况:

# tail -3 /var/log/clamav/clamd.log

Reading databases from /usr/local/clamav/share

Database correctly reloaded (148100 signatures)

/var/amavis/tmp/amavis-20070918T225935-28502/parts/p002: Trojan.Downloader.Delf-747 FOUN

复制代码

#tail -15 /var/log/maillog

Sep 18 23:36:40 mail postfix/pickup[28925]: 8C1681A609: uid=1001 from=<marion@test.com>

Sep 18 23:36:40 mail postfix/cleanup[29002]: 8C1681A609: message-id=<20070918153640.8C1681A609@mail.benet.org>

Sep 18 23:36:40 mail postfix/qmgr[28924]: 8C1681A609: from=<marion@test.com>, size=83658, nrcpt=1 (queue active)

Sep 18 23:36:43 mail clamd[28473]: /var/amavis/tmp/amavis-20070918T225935-28502/parts/p002: Trojan.Downloader.Delf-747 FOUND

Sep 18 23:36:44 mail postfix/smtpd[29011]: connect from mail[127.0.0.1]

Sep 18 23:36:44 mail postfix/smtpd[29011]: CDF9B1A602: client=mail[127.0.0.1]

Sep 18 23:36:44 mail postfix/cleanup[29002]: CDF9B1A602: message-id=<VA7mnx1DHavOWC@mail.benet.org>

Sep 18 23:36:44 mail postfix/smtpd[29011]: disconnect from mail[127.0.0.1]

Sep 18 23:36:44 mail postfix/qmgr[28924]: CDF9B1A602: from=<postmaster@benet.org>, size=2230, nrcpt=1 (queue active)

Sep 18 23:36:44 mail amavis[28502]: (28502-05) Blocked INFECTED (Trojan.Downloader.Delf-747), <marion@test.com> -> <marion@test.com>, quarantine: virus-7mnx1DHavOWC, Message-ID: <20070918153640.8C1681A609@mail.benet.org>, mail_id: 7mnx1DHavOWC, Hits: -, size: 83658, 4203 ms

Sep 18 23:36:45 mail postfix/smtp[29006]: 8C1681A609: to=<marion@test.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=4.7, delays=0.42/0.05/0.12/4.1, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, id=28502-05 - VIRUS: Trojan.Downloader.Delf-747)

Sep 18 23:36:45 mail postfix/qmgr[28924]: 8C1681A609: removed

Sep 18 23:36:45 mail postfix/local[29014]: CDF9B1A602: to=<root@benet.org>, orig_to=<postmaster@benet.org>, relay=local, delay=0.28, delays=0.12/0.09/0/0.07, dsn=2.0.0, status=sent (delivered to mailbox)

Sep 18 23:36:45 mail postfix/qmgr[28924]: CDF9B1A602: removed

复制代码

说明：此附件中带有特洛伊病毒，请不要作为危害别人之用，而对于您的操作不慎而给您带来的后果，作者不负任何责任；病毒样本如下：


soe.rar (58.95 KB)

2、垃圾邮件测试

登录extmail，新建一封邮件，拷贝以下内容作为邮件正文，并查看发送情况:

This is the GTUBE, the

Generic

Test for

Unsolicited

Bulk

Email

If your spam filter supports it, the GTUBE provides a test by which you

can verify that the filter is installed correctly and is detecting incoming

spam. You can send yourself a test mail containing the following string of

characters (in upper case and with no white spaces and line breaks):

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

查看发送结果：

#tail -15 /var/log/maillog

Sep 19 00:04:07 mail spamd[29060]: logger: removing stderr method

Sep 19 00:04:11 mail spamd[29062]: rules: meta test FM_DDDD_TIMES_2 has dependency 'FH_HOST_EQ_D_D_D_D' with a zero score

Sep 19 00:04:11 mail spamd[29062]: rules: meta test FM_SEX_HOSTDDDD has dependency 'FH_HOST_EQ_D_D_D_D' with a zero score

Sep 19 00:04:11 mail spamd[29062]: rules: meta test HS_PHARMA_1 has dependency 'HS_SUBJ_ONLINE_PHARMACEUTICAL' with a zero score

Sep 19 00:04:11 mail spamd[29062]: spamd: server started on port 783/tcp (running version 3.2.3)

Sep 19 00:04:12 mail spamd[29062]: spamd: server pid: 29062

Sep 19 00:04:12 mail spamd[29062]: spamd: server successfully spawned child process, pid 29064

Sep 19 00:04:12 mail spamd[29062]: spamd: server successfully spawned child process, pid 29065

Sep 19 00:04:12 mail spamd[29062]: prefork: child states: II

Sep 19 00:06:44 mail postfix/pickup[28925]: E37651A60E: uid=1001 from=<marion@test.com>

Sep 19 00:06:44 mail postfix/cleanup[29073]: E37651A60E: message-id=<20070918160643.E37651A60E@mail.benet.org>

Sep 19 00:06:45 mail postfix/qmgr[28924]: E37651A60E: from=<marion@test.com>, size=1041, nrcpt=1 (queue active)

Sep 19 00:07:01 mail amavis[28502]: (28502-06) Blocked SPAM, <marion@test.com> -> <marion@test.com>, quarantine: spam-7ui+Zpn7-M00.gz, Message-ID: <20070918160643.E37651A60E@mail.benet.org>, mail_id: 7ui+Zpn7-M00, Hits: 1004.576, size: 1040, 12805 ms

Sep 19 00:07:01 mail postfix/smtp[29079]: E37651A60E: to=<marion@test.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=18, delays=1.8/1.5/4.9/9.9, dsn=2.5.0, status=sent (250 2.5.0 Ok, id=28502-06, DISCARD(bounce.suppressed))

Sep 19 00:07:01 mail postfix/qmgr[28924]: E37651A60E: removed

复制代码