Установка Maia-Mailguard на Free BSD?. Третья часть.

Примечание:
Эти приложение являются дополнительными. Настроенное ранее и без этого будет прекрасно работать.
Тем не менее, очень рекомендуется установить их для защиты от вирусов и спама.

1. Установка Razor, Spam Assassin?, Clamav и Pear.

#cd /usr/ports/mail/razor-agents #make all install clean (можно выбрать меню по умолчанию.)

Устанавливаем и настраиваем Spam Assassin?:
#cd /usr/ports/mail/p5-Mail-SpamAssassin #make all install clean (Пункты меню "AS_ROOT", "SSL", "MYSQL" и "RAZOR" должны быть выбраны)

Создаем и редактируем /usr/local/etc/mail/spamassassin/local.cf:
use_bayes 1 bayes_store_module Mail::SpamAssassin::BayesStore::MySQL bayes_sql_dsn DBI:mysql:maia bayes_sql_username vscan bayes_sql_password maia_password auto_whitelist_factory Mail::SpamAssassin::SQLBasedAddrList user_awl_dsn DBI:mysql:maia user_awl_sql_username vscan user_awl_sql_password maia_password bayes_auto_expire 0

Устанавливаем и настраиваем Clamav:
#cd /usr/ports/security/clamav #make all install clean (Выбираем меню по умолчанию. Можно выбрать еще "LIBUNRAR".) #echo '"clamav_freshclam_enable="YES"' >> /etc/rc.conf #echo '"clamav_clamd_enable="YES"' >> /etc/rc.conf

Редактируем /usr/local/etc/clamd.conf:
Строка 144, меняем пользователя с "clamav" на "vscan".
Остальное – по вкусу.

Редактируем /usr/local/etc/freshclam.conf:
Строка 40, меняем Database owner с "clamav" на "vscan".

Создаем пользователя “vscan”:
#pw groupadd vscan #pw useradd -n vscan -c Amavisd\ User -d /var/amavisd -g vscan #passwd vscan (Вводим пароль дважды)

Устанавливаем разрешения для Clam AV?:
#chown -R vscan:vscan /var/run/clamav /var/log/clamav /var/db/clamav

Запускаем демонов Fresh Clam? и Clam AV?:
#/usr/local/etc/rc.d/clamav-clamd start #/usr/local/etc/rc.d/clamav-freshclam start

Устанавливаем и настраиваем Pear:
#cd /usr/ports/devel/pear #make all install clean

Редактируем /usr/local/etc/php.ini:
Приблизительно строка 512: проверяем что "include_path" содержит "/usr/local/share/pear"

2. Установка Maia-Mailguard

Устанавливаем и настраиваем Maia-Mailguard:
#mkdir /usr/local/maia-mailguard #cd /usr/local/maia-mailguard #fetch http://www.maiamailguard.com/files/maia-1.0.1.tar.gz #tar -xvzf maia-1.0.1.tar.gz #cd maia-1.0.1/

Создаем базу Maia-Mailguard и заполняем ее:
#mysql -u root -p mysql (Enter MySQL root password) >CREATE DATABASE maia; >quit #mysql -u root -p maia < maia-mysql.sql #mysql -u root -p maia (Enter MySQL root password) >GRANT CREATE, DROP, ALTER, SELECT, INSERT, UPDATE, DELETE ON maia.* TO vscan@localhost IDENTIFIED BY 'vscan_password'; >FLUSH PRIVILEGES; >quit

Редактируем /var/db/mysql/my.cnf:
[mysql] max_allowed_packet=10M

Создаем домашний каталог Maia-Mailguard:
#mkdir /var/amavisd #mkdir /var/amavisd/tmp #mkdir /var/amavisd/db #mkdir /var/amavisd/maia #mkdir /var/amavisd/maia/scripts #mkdir /var/amavisd/maia/templates #cd /usr/local/maia-mailguard/maia-1.0.1 #cp scripts/* /var/amavisd/maia/scripts/ #cp templates/* /var/amavisd/maia/templates/ #chown -R vscan:vscan /var/amavisd #chmod 640 /var/amavisd/maia/templates/*.tpl #chmod 750 /var/amavisd/maia/scripts/*.pl #chmod 770 /var/amavisd/tmp

Создаем конфигурационный файл Maia-Mailguard:
#cp maia.conf.dist /etc/maia.conf #chown vscan:vscan /etc/maia.conf #chmod 640 /etc/maia.conf

Редактируем /usr/local/etc/maia.conf:
Строка 12: меняем пользователя на 'vscan': $username = "vscan"; Строка 15: меняем пароль доступа к базе Maia: $password = "maia_password"; Строка 32: меняем 'undef' на каталог SpamAssassin: $local_cf_dir = "/usr/local/etc/mail/spamassassin"; Строка 39, меняем системный каталог на: $system_rules_dir = "/usr/local/share/spamassassin"; Строка 44, меняем каталог для пользовательских правил на: $user_rules_dir = "/var/amavisd/.spamassassin"; Строка 57, раскомментируем: $key_file = "/var/amavisd/blowfish.key"; Строка 58, комментируем: #$key_file = undef; Строка 95, редактируем наш реальный URL: $base_url = "http://domain.tld/maia-mailguard/";

Запускаем configtest.pl:
#cd /var/amavisd/maia/scripts #./configtest.pl

Вы должны просмотреть и проверить весь вывод:
MAIA MAILGUARD CONFIGURATION TEST This script checks for the presence of applications and Perl modules required by amavisd-maia, SpamAssassin, and Maia Mailguard's maintenance scripts. Version numbers are also checked, and if a newer version of a component is recommended, you should consider upgrading to at least the minimum recommended version. If you have already configured your Maia Mailguard database, the script will also test the connection to that database. Remember also to run the configtest.php script on your web server to perform similar tests of your web, PHP, and PEAR environment. Application/Module Version Status ======================================================================== Perl : 5.8.8 : OK file(1) : 4.12 : OK Archive::Tar : 1.30 : OK Archive::Zip : N/A : NOT INSTALLED (required by Maia Mailguard) BerkeleyDB : N/A : NOT INSTALLED (Maia Mailguard's optional caching feature requires this) Compress::Zlib : 1.42 : OK Convert::TNEF : N/A : NOT INSTALLED (required by Maia Mailguard) Convert::UUlib : N/A : NOT INSTALLED (required by Maia Mailguard) Crypt::Blowfish : N/A : NOT INSTALLED (Maia Mailguard's optional encryption feature requires this) Crypt::CBC : N/A : NOT INSTALLED (Maia Mailguard's optional encryption feature requires this) Crypt::OpenSSL::RSA : N/A : NOT INSTALLED (SpamAssassin's optional DomainKeys plugin requires this) Data::UUID : N/A : NOT INSTALLED (required by Maia Mailguard) DB_File : 1.814 : OK DBD::mysql : 3.0006 : OK DBD::Pg : N/A : NOT INSTALLED (required if you use PostgreSQL as your Maia Mailguard database) DBI : 1.52 : OK Digest::MD5 : 2.36 : OK Digest::SHA1 : 2.11 : OK File::Spec : 3.19 : OK HTML::Parser : 3.55 : OK HTTP::Date : 1.47 : OK IO::Stringy : N/A : NOT INSTALLED (required by Maia Mailguard) IO::Zlib : 1.04 : OK IP::Country : N/A : NOT INSTALLED (SpamAssassin's optional RelayCountry plugin requires this) LWP::UserAgent : 2.033 : OK Mail::Address : 1.74 : OK Mail::DomainKeys : N/A : NOT INSTALLED (SpamAssassin's optional DomainKeys plugin requires this) Mail::Internet : 1.74 : OK Mail::SpamAssassin : 3.1.4 : OK Mail::SPF::Query : N/A : NOT INSTALLED (SpamAssassin's optional SPF plugin requires this) MIME::Base64 : 3.07 : OK MIME::Parser : N/A : NOT INSTALLED (required by Maia Mailguard) MIME::QuotedPrint : 3.07 : OK Net::CIDR::Lite : N/A : NOT INSTALLED (SpamAssassin's optional SPF plugin requires this) Net::DNS : 0.58 : OK Net::Server : N/A : NOT INSTALLED (required by Maia Mailguard) Net::SMTP : 2.29 : OK Pod::Usage : 1.33 : OK Template : N/A : NOT INSTALLED (required by Maia Mailguard) Time::HiRes : 1.86 : OK Unix::Syslog : N/A : NOT INSTALLED (required by Maia Mailguard) URI : 1.35 : OK Database DSN test : PASSED

Как видите некоторые необходимые порты не установлены – так и должно быть (особенно в том случае,
если Вы ставите свою Free BSD? по умолчанию или по-минимуму). Теперь мы их установим.

Установка Archive::Zip:
#cd /usr/ports/archivers/p5-Archive-Zip #make all install clean

Установка Convert::TNEF:
#cd /usr/ports/converters/p5-Convert-TNEF #make all install clean

Установка Convert::UUlib:
#cd /usr/ports/converters/p5-Convert-UUlib #make all install clean

Установка DATA::UUID:
#cd /usr/ports/devel/p5-Data-UUID #make all install clean

Установка Net::Server:
#cd /usr/ports/net/p5-Net-Server #make all install clean

Установка Template:
#cd /usr/ports/www/p5-Template-Toolkit #make all install clean

Установка Unix::Syslog:
#cd /usr/ports/sysutils/p5-Unix-Syslog #make all install clean

И так далее... Установите все необходимые по Вашему мнению порты (Отличные от "DBD::Pg" конечно). Но это на Ваше усмотрение.

Загружаем правила Spam Assassin?:
#cd /var/amavisd/maia/scripts #./load-sa-rules.pl --debug

Копируем PHP файлы Maia-Mailguard:
#mkdir /usr/local/www/maia-mailguard #cd /usr/local/maia-mailguard/maia-1.0.1 #cp -Rp php/* /usr/local/www/maia-mailguard/ #chown -R www:www /usr/local/www/maia-mailguard/themes

Устанавливаем Smarty Template Engine:
#cd /usr/ports/www/smarty #make all install clean

Редактируем /usr/local/etc/php.ini:
Строка 512: добавляем «:/usr/local/share/smarty» в include_path.

Связываем Smarty Templates:
#ln -s /usr/local/share/smarty /usr/local/www/maia-mailguard/libs/Smarty

Перегружаем конфигурационный файл Apache:
#apachectl graceful

Настраиваем Maia-Mailguard:
#cp /usr/local/www/maia-mailguard/config.php.dist /usr/local/www/maia-mailguard/config.php

Редактируем /usr/local/www/maia-mailguard/config.php file:
Строка 123: комментируем эту строку. Строка 124: раскомментируем и изменяем пользователя:пароль и сокет: $maia_sql_dsn = "mysql://vscan:password@unix(/tmp/mysql.sock)/maia"; Строка 152: Для 'высшего' уровня защиты меняем: 'high' => array ('N','N','N','N','N','N','N','N','N','N','N','N','Y','1','3','5') Строка 202: меняем : $address_rewriting_type = 4; Строка 218: меняем authentication type на 'pop3': $auth_method = "pop3";

Редактируем /usr/local/etc/apache/httpd.conf:
Приблизительно строка 681: добавляем наш алиас и его каталог: Alias /maia-mailguard/ "/usr/local/www/maia-mailguard/" <Directory "/usr/local/www/maia-mailguard"> AllowOverride None </Directory>

Перегружаем Apache.
#apachectl graceful

Тестируем:
Заходим на http://domain.tld/maia-mailguard/admin/configtest.php

Вы увидите что все еще пропущены некоторые модули PEAR. Итак, установим и их.
Конечно все «дополнительные» модули на Ваше усмотрение.

Устанавливаем PEAR::Mail_Mime:
#cd /usr/ports/mail/pear-Mail_Mime #make all install clean

Устанавливаем PEAR::DB:
#cd /usr/ports/databases/pear-DB #make all install clean

Устанавливаем PEAR::DB_Pager:
#cd /usr/ports/databases/pear-DB_Pager #make all install clean

Устанавливаем PEAR::Net_Socket:
#cd /usr/ports/net/pear-Net_Socket #make all install clean

Устанавливаем PEAR::Net_SMTP:
#cd /usr/ports/net/pear-Net_SMTP #make all install clean (Убедитесь, что пункт "PEAR_AUTH_SASL" выбран в меню)

Устанавливаем PEAR::Net_POP3:
#cd /usr/ports/net/pear-Net_POP3 #make all install clean

Устанавливаем PEAR::Log:
#cd /usr/ports/sysutils/pear-Log #make all install clean (Убедитесь, что пункт "Pear_DB" выбран в меню)

Заходим на http://domain.tld/maia-mailguard/admin/configtest.php опять. Если установлен php5, то напротив PEAR::Net_IMAP
появится строка:
SKIPPED: A bug exists in Net_IMAP 1.0.3 when run under PHP 5, see https://secure.renaissoft.com/maia/ticket/266 for more details.
Идем по ссылке и вникаем – перед установкой PEAR::Net_IMAP нужно положить следующий патч в каталог files порта:
IMAPProtocol.php.patch
*** IMAPProtocol-orig.php 2006-02-01 11:41:35.000000000 -0800 --- IMAPProtocol.php 2006-02-01 11:43:27.000000000 -0800 *************** *** 700,706 **** } ! return $args; ! // not for now ! //return $this->_genericImapResponseParser($args,$cmdid); } --- 700,704 ---- } ! return $this->_genericImapResponseParser($args,$cmdid); }

и затем стандартно:
#make all install clean

Если все еще остались пропущенные модули, заходим на http://domain.tld/maia-mailguard/admin/configtest.php
смотрим какие и устанавливаем их.

Перегружаем Apache:
#apachectl graceful

Примечание:
If even after you install _ALL_ PEAR modules and you still see something like this in the admin/configtest.php interface "PEAR::DB FAILED: DB.php installed in: but not in include path: .:/usr/local/share/pear:/usr/local/share/smarty", don't panic! The PEAR::DB is installed just fine... It's actually an inconsistency in the Maia-Mailguard configtest. So, don't worry about it and just move along.

Also, if you can't seem to figure out why Pager.php is coming up with errors in the Maia scripts, make sure that Pager.php is located in the base directory of /usr/local/share/pear. If it's not, go ahead and just create a symlink so Maia sees it properly.

Symlink Pager.php:
#ln -s /usr/local/share/pear/Pager.php /usr/local/share/pear/DB/Pager.php

Install and run Maia-Mailguard:
#cd /usr/local/maia-mailguard/maia-1.0.1 #cp amavisd-maia /usr/local/sbin #chown root /usr/local/sbin/amavisd-maia #chmod 755 /usr/local/sbin/amavisd-maia Executable link: #ln -s /usr/local/sbin/amavisd-maia /usr/local/sbin/amavisd

Generate encryption key:
#/var/amavisd/maia/scripts/generate-key.pl > /var/amavisd/blowfish.key

Important Note:
Be sure to keep a backup/copy of this key. If, for some reason, you happen to lose this key, you'll need a backup/copy of it to continue reading the encrypted mail that Maia-Mailguard has already processed.

Install the Maia-Mailguard configuration file:
#cd /usr/local/maia-mailguard/maia-1.0.1 #cp amavisd.conf.dist /etc/amavisd.conf #chown root:vscan /etc/amavisd.conf #chmod 640 /etc/amavisd.conf

Edit /etc/amavisd.conf file:
Line 5, I generally turn my servers up to somewhere between 3 and 5 depending on server load: $max_servers = 3; Line 6, change 'amavis' to 'vscan': $daemon_user = 'vscan'; Line 7, change 'amavis' to 'vscan': $daemon_group = 'vscan'; Line 9, change to your domain: $mydomain = 'domain.tld'; Line 17, change to location of your key file: $key_file = "$MYHOME/blowfish.key"; Line 30, change to 3 until you know things are working properly: $log_level = 3; Line 33, change to 1 so logs are less messy: $DO_SYSLOG = 1; Line 51, change username/password: @lookup_sql_dsn = ( ['DBI:mysql:maia:localhost', 'vscan', 'password'] ); Line 94, change to your machine's FQDN: $myhostname = 'host.domain.tld'; Line 105, take out the Maia-Mailguard version for security purposes: $X_HEADER_LINE = "Maia Mailguard"; Line 156, change location of ClamAV socket: \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd"],

Start Maia-Mailguard:
#echo "/usr/local/sbin/amavisd start" >> /etc/rc.local (Unless you're replacing a pre-installed Amavisd-New port. If so, just use the installed amavisd.sh script in /usr/local/etc/rc.d) #/usr/local/sbin/amavisd start

Test:
Visit http://domain.tld/maia-mailguard/. You should be greeted with a login screen. If so, great! Let's log in and acquire admin privileges.

Instead of http://domain.tld/maia-mailguard/login.php (The default), visit http://domain.tld/maia-mailguard/login.php?super=register
Log in with any user you currently have on your system. That user will now have admin privs via Maia (So, be careful which user you choose).

Now, that you're logged into Maia-Mailguard as an administrator, click the “Settings” link at the top of the page (Key-shaped icon).
From the “Administration Menu” click “System Configuration”.
Each mail server will want different settings for their setup. However, there are some things you should be aware of:
Code:

1. Make sure that *ANY* file name (With the exception of the logo image) listed for
any option is listed with it's *FULL PATH*. (IE: In “Paths & Ports”, be sure
“blowfish.key” is listed as «/var/amavisd/blowfish.key”.
2. The “Mail size limit” setting should not be higher than what you set your
My SQL's? packet_size_limit to (10M in my example).

And, for a few system settings I recommend...
1. In “System Configuration” I don't allow users to change their username.
This, as usual, is entirely up to you.

Edit /usr/local/etc/postfix/main.cf file:
(Just above “LOCAL PATHNAME INFORMATION”)
# Maia-Mailguard # content_filter=smtp-amavis:[127.0.0.1]:10024

Edit /usr/local/etc/postfix/master.cf file:
(At bottom of file)
smtp-amavis unix - - n - 2 smtp -o smtp_data_done_timeout=2400 -o smtp_send_xforward_command=yes -o disable_dns_lookups=yes -o max_use=20 127.0.0.1:10025 inet n - n - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_delay_reject=no -o smtpd_client_restrictions=permit_mynetworks,reject -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks_style=host -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 -o smtpd_client_connection_count_limit=0 -o smtpd_client_connection_rate_limit=0 -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks

Перегружаем Postfix:
#postfix reload

Now, send an email to yourself either via shell or external mail client. Everything should work swimmingly. Make sure you check the headers to ensure that Maia-Mailguard is scanning these files. There should be an “X-Virus-Scanned: Maia Mailguard” line.

Also be sure to check your /var/log/maillog to make sure mail is being piped over to amavis. You'll notice that there will be a fairly large amount of information from amavis in the log file, this is due to the log level of “3” being set in our /usr/local/etc/amavisd.conf file. If everything is running smoothly (And it should be) go ahead and change the log level back down to “0” or “1” to save the log from becoming overwhelmingly large.

Once you're sure Maia-Mailguard is running properly, adjust your settings however you see fit.

Important Note:
The following cron jobs are absolutely key for this setup. So, be very, VERY sure you install these properly.

Edit the “vscan” user's cron jobs.
#crontab -u vscan -e

Cron information:
#Load new rules and store into Maia database. 30 4 * * * /var/amavisd/maia/scripts/load-sa-rules.pl > /dev/null #Train Spam Assassin. 0 * * * * /var/amavisd/maia/scripts/process-quarantine.pl --learn --report > /dev/null #Take a snapshot of the stats at the start of every hour. 0 * * * * /var/amavisd/maia/scripts/stats-snapshot.pl > /dev/null #Purge mail that has not been confirmed. 0 23 * * * /var/amavisd/maia/scripts/expire-quarantine-cache.pl > /dev/null #Send quarantine reminders. 0 15 * * * /var/amavisd/maia/scripts/send-quarantine-reminders.pl > /dev/null #Send quarantine digests. 0 15 * * * /var/amavisd/maia/scripts/send-quarantine-digests.pl > /dev/null #Force bayesian auto-expiry during off-peak hours. 25 2 * * * /usr/local/bin/sa-learn --sync --force-expire > /dev/null

Besides what's covered in the next section, your mail setup should be completely finished. Enjoy and let me know how things turn out whether they be good or bad. Feedback is our friend...

Продолжение...