ClamAV 설치 ( 큐잉서버 ) serverb

Transcription

1 ClamAV 설치 ( 큐잉서버 ) serverb 2009 년 10 월 23 일금요일 오전 10:42 Server B 의기존 dovecot 삭제 ( 큐잉서버로사용 ) Sendmail-cf sendmail-devel 설치 Sendmail SMTP AUTH 및 Daemon 리스닝주소변경 Sendmail.cf 수정 Sendmail milter 기능제공여부파악 Clamav 설치 Freshclam.conf 설정 Clamd.conf 및 clamav-milter.conf 설정 Clamd 서비스스크립트작성및등록 [root@ruffy&13:14& init.d]# mkdir /usr/local/src/clamav [root@ruffy&13:19& init.d]# cd /usr/local/src/clamav/ [root@ruffy&13:19& clamav]# wget amav/files/clamav/0.95.2/clamav tar.gz/download Length: (24M) [application/x-tar] Saving to: `clamav tar.gz' 100%[===========================================================>] 25,137, K/s in 16s 13:19:46 (1.47 MB/s) - `clamav tar.gz' saved [ / ] [root@ruffy&13:19& clamav]# tar xvzf clamav tar.gz [root@ruffy&13:20& clamav]# sendmail -d0.10 < /dev/null grep MILTER MATCHGECOS MILTER MIME7TO8 MIME8TO7 NAMED_BIND NETINET NETINET6 // 밀터기능동작가능여부 [root@ruffy&13:21& clamav]# useradd -s /bin/false -M -c "Clam AntiVirus" clamav [root@ruffy&13:21& clamav]# cat /etc/passwd grep clamav clamav:x:507:507:clam AntiVirus:/home/clamav:/bin/false [root@ruffy&13:21& clamav]# cat /etc/shadow grep clamav clamav:!!:14538:0:99999:7::: [root@ruffy&13:21& clamav]# cd clamav [root@ruffy&13:21& clamav ]#./configure --enable-milter --prefix=/usr/local/clamav make && make install [root@ruffy&13:28& clamav ]# cd /etc/mail/ 10_23 페이지 1

2 mail]# vi sendmail.cf clamav-milter 는 sendmail 을위해개발된빠른속도의 scanner. mail]# mkdir /var/run/clamav mail]# chown clamav.clamav /var/run/clamav mail]# cd /usr/local/clamav/etc/ etc]# ls -l total 40 -rw-r--r-- 1 root root 7156 Oct 21 13:24 clamav-milter.conf -rw-r--r-- 1 root root Oct 21 13:24 clamd.conf -rw-r--r-- 1 root root 5960 Oct 21 13:24 freshclam.conf 자동업데이트설정 clamav에서는바이러스에대한정보를업데이트하기위해 freshclam이라는것을제공하고있는데, 이프로그램은정해진시각에 database.clamav.net에접속하여서버에설치된정보와비교하여업데이트여부를체크하게된다. 업데이트에대한기본정보는 /var/log/clam-update.log 파일에남도록한다. [root@ruffy&13:44& etc]# vi freshclam.conf 업데이트받을주소. [root@ruffy&13:44& etc]# ln -s /usr/local/lib/libiconv.so.2 /usr/lib/ [root@ruffy&13:49& etc]# /usr/local/clamav/bin/freshclam ClamAV update process started at Wed Oct 21 13:49: main.cvd is up to date (version: 51, sigs: , f-level: 42, builder: sven) WARNING: getfile: daily-9451.cdiff not found on remote server (IP: ) WARNING: getpatch: Can't download daily-9451.cdiff from db.kr.clamav.net WARNING: getpatch: Can't download daily-9451.cdiff from db.kr.clamav.net WARNING: getfile: daily-9451.cdiff not found on remote server (IP: ) WARNING: getpatch: Can't download daily-9451.cdiff from db.kr.clamav.net WARNING: Incremental update failed, trying to download daily.cvd Downloading daily.cvd [100%] daily.cvd updated (version: 9921, sigs: 88957, f-level: 43, builder: ccordes) 10_23 페이지 2

3 Database updated ( signatures) from db.kr.clamav.net (IP: ) etc]# ls -l /usr/local/clamav/share/clamav/ total rw-r--r-- 1 clamav clamav Oct 21 13:49 daily.cvd -rw-rw-r-- 1 clamav clamav Oct 21 13:24 main.cvd -rw clamav clamav 52 Oct 21 13:49 mirrors.dat [root@ruffy&13:50& etc]# cd /etc/cron.daily/ [root@ruffy&13:51& cron.daily]# pwd /etc/cron.daily [root@ruffy&13:51& cron.daily]# vi av-update 매일업데이트실행후업데이트정보를로그에남긴다. [root@ruffy&13:53& cron.daily]# chmod 755 av-update [root@ruffy2&11:19& cron.daily]# ls -l -rwxr-xr-x 1 root root 73 Oct 23 11:18 av-update [root@ruffy&13:53& cron.daily]# touch /var/log/clam-update.log [root@ruffy&13:53& cron.daily]# chmod 600 /var/log/clam-update.log [root@ruffy&13:53& cron.daily]# chown clamav.clamav /var/log/clam-update.log [root@ruffy&13:53& cron.daily]# dig current.cvd.clamav.net txt ; <<>> DiG P1 <<>> current.cvd.clamav.net txt ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 7, ADDITIONAL: 2 ;; QUESTION SECTION: ;current.cvd.clamav.net. IN TXT ;; ANSWER SECTION: current.cvd.clamav.net. 217 IN TXT "0.95.2:51:9921: :1:43:10753" 이곳을참조하여업데이트여부를결정한다. ;; AUTHORITY SECTION: cvd.clamav.net IN NS ns6.clamav.net. cvd.clamav.net IN NS ns1.clamav.net. cvd.clamav.net IN NS ns3.clamav.net. cvd.clamav.net IN NS ns2.clamav.net. cvd.clamav.net IN NS ns4.clamav.net. cvd.clamav.net IN NS ns7.clamav.net. cvd.clamav.net IN NS ns5.clamav.net. ;; ADDITIONAL SECTION: ns1.clamav.net IN A ns5.clamav.net IN AAAA 2001:4b78:2000::1 10_23 페이지 3

4 ;; Query time: 2 msec ;; SERVER: #53( ) ;; WHEN: Wed Oct 21 13:54: ;; MSG SIZE rcvd: 259 [root@ruffy&13:54& cron.daily]# cd /usr/local/clamav/bin/ 백싞리스트 6만여개이상의바이러스를인식가능 [root@ruffy&13:54& bin]#./sigtool --list-sigs more PUA.PwTool.Messen PUA.PwTool.Messen-1 [root@ruffy&14:02& bin]# cd../etc/ [root@ruffy&14:02& etc]# pwd /usr/local/clamav/etc [root@ruffy&14:02& etc]# vi clamd.conf 10_23 페이지 4

5 etc]# mkdir -p /var/mail/quarantine etc]# chown clamav.clamav /var/mail/quarantine/ etc]# chmod 700 /var/mail/quarantine/ etc]# touch /var/log/clamd.log etc]# chmod 600 /var/log/clamd.log etc]# chown clamav.clamav /var/log/clamd.log etc]# /usr/local/clamav/sbin/clamd etc]# ls -l /var/run/clamav/ total 12 -rw-rw clamav clamav 5 Oct 21 14:16 clamd.pid srwxrwxrwx 1 clamav clamav 0 Oct 21 14:16 clamd.sock [root@ruffy&14:20& etc]# ps -ef grep clam clamav :16? 00:00:00 /usr/local/clamav/sbin/ clamd [root@ruffy&14:20& etc]# vi clamav-milter.conf 10_23 페이지 5

6 10_23 페이지 6

7 etc]# touch /var/log/clmilter.log etc]# chmod 600 /var/log/clmilter.log etc]# chown clamav.clamav /var/log/clmilter.log etc]# /usr/local/clamav/sbin/clamav-milter etc]# ps -ef grep clam clamav :20? 00:00:00 /usr/local/clamav/sbin/clamd clamav :22? 00:00:00 /usr/local/clamav/sbin/clamav -milter [root@ruffy&14:22& etc]# ls -l /var/run/clamav/ total 24 srwxr-xr-x 1 clamav clamav 0 Oct 21 14:22 clamav-milter.sock -rw-rw clamav clamav 5 Oct 21 14:20 clamd.pid srwxrwxrwx 1 clamav clamav 0 Oct 21 14:20 clamd.sock -rw-rw clamav clamav 5 Oct 21 14:22 clmilter.pid [root@ruffy2&12:40& etc]# service sendmail restart Shutting down sm-client: [ OK ] Shutting down sendmail: [ OK ] Starting sendmail: [ OK ] Starting sm-client: [ OK ] Clamd 스크립트를만들고 chkconfig 에등록. [root@ruffy2&12:46& etc]# cd /etc/init.d/ [root@ruffy2&12:48& init.d]# vi clamd clamd_shell 스크립트수정본 10_23 페이지 7

8 /////////////////////////////////////////// #!/bin/sh # clamav Script to start/stop clamd. # # chkconfig: # description: clamav antivirus daemon. # # processname: clamd # pidfile: /var/run/clamav/clamd.pid # # Source function library. /etc/rc.d/init.d/functions # Get network config. /etc/sysconfig/network ########################################################################### # CONFIGURATION # Most configuration options are found in the clamd.conf file # The location of configuration file config=/usr/local/clamav/etc/clamd.conf # The prefix clamd was installed to prefix=/usr/local/clamav ########################################################################### # SCRIPT RETVAL=0 start() { echo -n $"Starting ClamAV: " daemon $prefix/sbin/clamd daemon $prefix/sbin/clamav-milter RETVAL1=$? echo [ $RETVAL1 -eq 0 ] && touch /var/lock/subsys/clamd return $RETVAL1 } stop() { echo -n $"Stopping Clamav: " killproc clamd killproc clamav-milter RETVAL=$? 10_23 페이지 8

9 } echo [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/clamd return $RETVAL restart() { stop start } case "$1" in start) start ;; stop) stop ;; status) status clamd ;; restart) restart ;; *) echo $"Usage: $0 {start stop status restart}" exit 1 esac exit $? ////////////////////////////////////////////////// [root@ruffy2&12:48& init.d]# chmod 755 clamd [root@ruffy2&12:51& init.d]# chkconfig --add clamd [root@ruffy2&12:52& init.d]# chkconfig clamd on [root@ruffy2&12:52& init.d]# service clamd stop Stopping Clamav: [ OK ] [root@ruffy2&12:52& init.d]# service clamd start Starting ClamAV: [ OK ] [root@ruffy2&12:52& init.d]# ps -ef grep clam clamav :52? 00:00:00 /usr/local/clamav/sbin/clamd clamav :52? 00:00:00 /usr/local/clamav/sbin/clamav -milter root :52 pts/1 00:00:00 grep --color clam 메일을보내기전에새세션에서로그를확인해본다. [root@ruffy2&12:52& init.d]# mail -v usera@eun.iss Subject: ttt2 10_23 페이지 9

10 ttt2. Cc: Connecting to [ ] via relay ruffy2.eun.iss ESMTP Exchange; Fri, 23 Oct :54: >>> EHLO ruffy2.eun.iss 250-ruffy2.eun.iss Hello ruffy2.eun.iss [ ], pleased to meet you 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE DSN 250-ETRN 250-DELIVERBY 250 HELP >>> MAIL SIZE= Sender ok >>> RCPT >>> DATA User unknown Need RCPT (recipient) >>> RSET Reset state >>> RSET Reset state root... Using cached ESMTP connection to [ ] via relay... >>> MAIL From:<> SIZE= <>... Sender ok >>> RCPT >>> DATA Recipient ok 354 Enter mail, end with "." on a line by itself >>> n9n3s06e Message accepted for delivery root... Sent (n9n3s06e Message accepted for delivery) Closing connection to [ ] >>> QUIT ruffy2.eun.iss closing connection [root@ruffy2&12:54& init.d]# 새탭에서.. 로그확인 [root@ruffy2&12:44& ~]# tail -f /var/log/maillog Oct 23 12:53:59 ruffy2 sendmail[20090]: n9n3rx1s020090: from=root, size=38, class=0, nrcpts=1, 10_23 페이지 10

11 Oct 23 12:54:00 ruffy2 sendmail[20091]: n9n3s06c020091: User unknown Oct 23 12:54:00 ruffy2 sendmail[20090]: n9n3rx1s020090: ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:00, mailer=relay, pri=30038, relay=[ ] [ ], dsn=5.1.1, stat=user unknown Oct 23 12:54:00 ruffy2 sendmail[20091]: n9n3s06c020091: size=38, class=0, nrcpts=0, proto=esmtp, daemon=mta, relay=ruffy2.eun.iss [ ] Oct 23 12:54:00 ruffy2 sendmail[20090]: n9n3rx1s020090: n9n3rx1t020090: DSN: User unknown Oct 23 12:54:00 ruffy2 sendmail[20091]: n9n3s06e020091: from=<>, size=1903, class=0, nrcpts=1, proto=esmtp, daemon=mta, relay=ruffy2.eun.iss [ ] Oct 23 12:54:00 ruffy2 sendmail[20091]: n9n3s06e020091: Milter add: header: X-Virus-Scanned: clamav-milter at ruffy2.eun.iss Oct 23 12:54:00 ruffy2 sendmail[20091]: n9n3s06e020091: Milter add: header: X-Virus-Status: Clean Oct 23 12:54:00 ruffy2 sendmail[20090]: n9n3rx1t020090: to=root, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=31062, relay=[ ] [ ], dsn=2.0.0, stat=sent (n9n3s06e Message accepted for delivery) Oct 23 12:54:00 ruffy2 sendmail[20094]: n9n3s06e020091: delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32168, dsn=2.0.0, stat=sent 10_23 페이지 11