Jump to content

# Amavis

1 language

- 日本語

From ArchWiki

Related articles

- ClamAV
- Postfix
- Dovecot

From Amavis's site:

  amavisd-new is a high-performance interface between mailer (MTA) and content checkers: virus scanners, and/or SpamAssassin. It is written in Perl for maintainability, without paying a significant price for speed. It talks to MTA via (E)SMTP or LMTP, or by using helper programs. Best with Postfix, fine with dual-sendmail setup and Exim v4, works with sendmail/milter, or with any MTA as a SMTP relay.

## Installation and setup

In this setup it is assumed that you are using ClamAV as anti-virus scanner.

- Install amavisd-new. You would be wise to also install optdepends such as 7zip and unrar so your filters can actually see inside compressed files.
- Install clamav.

### Basic configuration

If your hostname is not a FQDN, you must set `$myhostname` and `$mydomain` accordingly in `/etc/amavisd/amavisd.conf`.

You can enable ClamAV support by commenting out the following lines (do not forget to put the same `clamd.sock` as in `/etc/clamav/clamd.conf`):

    /etc/amavisd/amavisd.conf

    # ### http://www.clamav.net/
    ['ClamAV-clamd',
       \&ask_daemon, ["CONTSCAN {}\n", "/var/lib/clamav/clamd.sock"],
       qr/\bOK$/m, qr/\bFOUND$/m,
       qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
    # # NOTE: run clamd under the same user as amavisd - or run it under its own
    # #   uid such as clamav, add user clamav to the amavis group, and then add
    # # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
    # #   this entry; when running chrooted one may prefer a socket under $MYHOME.

Add a comment to this line to enable anti-virus scan:

    # @bypass_virus_check_maps = (1);  # controls running of anti-virus code

After that, add the `clamav` user to the `amavis` user group to avoid permission problems.

Finally restart the services:

- restart `clamav-daemon.service`.
- start `amavisd.service` and possibly enable it.

Check for errors with these commands:

    # systemctl status amavisd
    # journalctl -u amavisd

### Testing

To test the new configuration just telnet to the amavisd default listening port:

    $ telnet 127.0.0.1 10024

You should see something like:

    Trying 127.0.0.1...
    Connected to 127.0.0.1.
    Escape character is '^]'
    220 [127.0.0.1] ESMTP amavisd-new service ready

Type `ehlo 127.0.0.1`:

    EHLO localhost
    250-[127.0.0.1]
    250-VRFY
    250-PIPELINING
    250-SIZE
    250-ENHANCEDSTATUSCODES
    250-8BITMIME
    250-DSN
    250 XFORWARD NAME ADDR PORT PROTO HELO IDENT SOURCE

Now just type `quit` to exit.

## Integration with Postfix

### Quick start

To configure amavis for Postfix add the following to `/etc/postfix/master.cf`:

    #
    # anti spam & anti virus section
    #
    amavisfeed      unix  -    -       n       -       2       smtp
     -o smtp_data_done_timeout=1200
     -o smtp_send_xforward_command=yes
     -o disable_dns_lookups=yes
     -o max_use=20
    127.0.0.1:10025 inet n  -       y       -       -       smtpd
     -o content_filter=
     -o smtpd_delay_reject=no
     -o smtpd_client_restrictions=permit_mynetworks,reject
     -o smtpd_helo_restrictions=
     -o smtpd_sender_restrictions=
     -o smtpd_recipient_restrictions=permit_mynetworks,reject
     -o smtpd_data_restrictions=reject_unauth_pipelining
     -o smtpd_end_of_data_restrictions=
     -o smtpd_restriction_classes=
     -o mynetworks=127.0.0.0/8
     -o smtpd_error_sleep_time=0
     -o smtpd_soft_error_limit=1001
     -o smtpd_hard_error_limit=1000
     -o smtpd_client_connection_count_limit=0
     -o smtpd_client_connection_rate_limit=0
     -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
     -o local_header_rewrite_clients=

In this configuration we assume that postfix and Amavis are running on the same machine (i.e. `127.0.0.1`). If that is not the case edit `/etc/amavisd/amavisd.conf` and the prevous Postfix entry accordingly.

Postfix will listen to port `10025` so that Amavis can send back checked emails to that port.

You also have to add another other configuration in your `smtp` or `submission` sections:

    -o content_filter=amavisfeed:[127.0.0.1]:10024

Using this options implies that Postfix will send emails to Amavis on port `10024`, so that these can be checked. If mail passes the control then these are sent to port `10025`, as explained before.

We can now restart `postfix.service` and `amavisd.service`.

To check that Postfix is listening on port `10025` do the same operations as the port `10024` case.

## SpamAssassin support

This article or section needs expansion.

Reason: todo (Discuss in Talk:Amavis)

Install spamassassin

Spamassassin is integrated in Amavis so you do not have to start `spamassassin.service`. To enable support for Spamassassin comment the following line in `/etc/amavis/amavis.conf` like this:

    # @bypass_spam_checks_maps = (1);  # controls running of anti-spam code

Edit the SpamAssassin configuration based on your needs:

    $sa_tag_level_deflt  = 1.0;  # add spam info headers if at, or above that level
    $sa_tag2_level_deflt = 1.0;  # add 'spam detected' headers at that level
    $sa_kill_level_deflt = 5.0;  # triggers spam evasive actions (e.g. blocks mail)
    $sa_dsn_cutoff_level = 8;   # spam level beyond which a DSN is not sent
    # $sa_quarantine_cutoff_level = 25; # spam level beyond which quarantine is off
    $penpals_threshold_high = $sa_kill_level_deflt;  # do not waste time on hi spam
    $bounce_killer_score = 100;  # spam score points to add for joe-jobbed bounces

Before you restart the `amavisd` service, run `sa-update`.

## Final test

This article or section needs expansion.

Reason: todo (Discuss in Talk:Amavis)

To check that everything is working as intended:

- Send a normal email.
- Send an email with an EICAR test file as attachment.
- Send an email that would result as spam.
- Check both Postfix and Amavis logs.

## See also

- Amavis official documentation
- Gentoo:Complete Virtual Mail Server/amavisd spamassassin clamav

Category:

- Mail server

Hidden category:

- Pages or sections flagged with Template:Expansion