8. Configurando o clamav, greylist, SPF e spamassassin.
/etc/clamd:
LogFile /var/log/clamav/clamd.log
LogFileMaxSize 0
LogTime yes
LogSyslog yes
PidFile /var/run/clamav/clamd.pid
TemporaryDirectory /var/tmp
DatabaseDirectory /var/clamav
LocalSocket /tmp/clamd.socket
FixStaleSocket yes
TCPSocket 3310
TCPAddr 127.0.0.1
MaxConnectionQueueLength 30
MaxThreads 50
ReadTimeout 300
User clamav
AllowSupplementaryGroups yes
ScanPE yes
ScanELF yes
DetectBrokenExecutables yes
ScanOLE2 yes
ScanMail yes
#ScanHTML yes
ScanArchive yes
Baixe o arquivo:
e coloque dentro de /usr/libexec/postfix/.
# gzip -d clamav-filter.sh.bz2
# chmod 0755 clamav-filter.sh
# mkdir -p /var/spool/filter
# chown clamav:clamav /var/spool/filter
Integrando spamassassin ao clamav-filter.
Edite o arquivo com vim /usr/libexec/posffix/clamav-filter.sh e altere a seguinte linha:
SENDMAIL="/usr/sbin/sendmail -i "
Para:
SENDMAIL="/usr/bin/spamc -f -e /usr/sbin/sendmail -i "
Configurando o spamassassin:
Entre no diretório /etc/mail/spamassassin e edite o arquivo local.cf e deixe como abaixo, lembrando que está em um nível baixo de segurança, podendo aumentar.
Obs.: Pode entrar
nesse site e gerar a própria configuração do spamassassin:
# How many hits before a message is considered spam.
required_score 7.0
# Change the subject of suspected spam
rewrite_header subject *****NOME - POSSÍVEL SPAM*****
# Encapsulate spam in an attachment (0=no, 1=yes, 2=safe)
report_safe 1
# Enable the Bayes system
use_bayes 1
# Enable Bayes auto-learning
bayes_auto_learn 1
# Enable or disable network checks
skip_rbl_checks 0
use_razor2 1
#use_dcc 1
use_pyzor 1
# Mail using languages used in these country codes will not be marked
# as being possibly spam in a foreign language.
# - portuguese
#ok_languages pt
# Mail using locales used in these country codes will not be marked
# as being possibly spam in a foreign language.
ok_locales all
Configurando o Greylist:
Instale o postgrey, edite o rc.local e acrescente a seguinte linha para iniciar o serviço: a linha abaixo já se encontra com todas as opções necessárias.
Dentro do main.cf acrescente a seguinte linha: sempre colocar a linha depois do reject_unauth_destination.
smtpd_recipient_restrictions = ...
reject_unauth_destination,
....
check_policy_service inet:127.0.0.1:60000,
....
postgrey --inet=127.0.0.1:60000 --delay=60 --retry-window=1 --auto-whitelist-clients=1 --dbdir=/var/spool/postfix/postgre -d
Configurando o SPF:
Dentro do master.cf acrescente a seguinte linha:
policy unix - n n - - spawn
user=nobody argv=/usr/bin/perl /usr/libexec/postfix/postfix-policyd-spf-perl
Dentro o main.cf acrescente a seguinte linha: sempre colocar a linha depois do reject_unauth_destination.
smtpd_recipient_restrictions = ...
reject_unauth_destination,
....
check_policy_service unix:private/policy,
....
8.1. Configurando conexões TLS pelo smtpd
# cd /etc/postfix
Criando as chaves:
# openssl req -new -outform PEM -out postfix.cert -newkey rsa:2048 -nodes -keyout postfix.key -keyform PEM -days 999 -x509
Preencha os campos que vão aparecer:
Country Name (2 letter code) [AU]:
BR
State or Province Name (full name) [Some-State]:
MS
Locality Name (eg, city) []:
CGR
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
empresa dominio.com.br
Organizational Unit Name (eg, section) []:nocc, network operation command center
Common Name (eg, YOUR name) []:
admin
Email Address []:
admin@dominio.com.br
Configuração no main.cf:
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/postfix/postfix.cert
smtpd_tls_key_file = /etc/postfix/postfix.key
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
Configuração no master.cf:
tlsmgr unix - - n 300 1 tlsmgr
submission inet n - n - 15 smtpd
-o smtpd_enforce_tls=yes
-o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
smtps inet n - n - 15 smtpd
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,rejects