qmail + spamassassin + clamav reference guide

qmail + spamassassin + clamav quick reference

Last modified June 09, 2009. 22200. Questions, comments? Email mark at rauros. Like this guide? Link to it!

I'm currently seeking anyone willing to translate this document into anything other than English. Is that person you? Anyone who translates this document will be paid with an endless supply of my thanks.

Author: Mark (mark at rauros dot net)
Special Thanks: Carlos (rockwithme.org)
Special Thanks: Mike (atomos13.com)

This document is meant to help people get qmail up and running with spamassassin set to tag messages and clam antivirus to kill viruses. Hopefully, it will address the little quirks of setup that occur but are for some reason left out of guides.

Install qmail: Life with qmail has great instructions. Don't deviate. As Dave Sill, author of lwq, says, "...frankly, if you're reading this, you probably don't know what you're doing. :-)"

Install Perl: This usually comes preinstalled with a distribution of Linux.

Install SpamAssassin using either:

CPAN:
- perl -MCPAN -e shell
- o conf prerequisites_policy ask
- install Mail::SpamAssassin
- quit
Or, install from source. Just download the latest tar file, extract it, change to the new directory, and then:
- perl Makefile.PL
- make
- make install

Now, use your favorite text editor to configure the spam daemon. Edit /etc/mail/spamassassin/local.cf. If you're not sure of what options you need (or what the options are), feel free to skip making changes to the config file. Just use the defaults. Otherwise, use the following for documentation on the SpamAssassin config file:

perldoc Mail::SpamAssassin::Conf

Put the following line in your init (i.e. bootup) script:

/usr/local/bin/spamd -d -r /var/run/spamd.pid

On my system, which runs Slackware, I typically put that line in /etc/rc.d/rc.local. Google how your flavor of *nix handles commands executed at boot.

If you're not going to be restarting any time soon, execute it manually as root. You may also be interested in my simple script for controlling spamd. It's a hacked-up, simplified version of qmailctl which I uncreatively named spamdctl.

Installing ClamAV

Be sure to create the user clamav and group clamav before you ./configure ClamAV:
- groupadd clamav
- useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav
Get ClamAV from SourceForge. Their homepage is clamav.net. Uncompress it and install it; it's your standard ./configure && make && make install.
Now you have to set up the conf files for ClamAV. You'll need to configure both clamd, the ClamAV daemon (/usr/local/etc/clamd.conf) and freshclam, the daemon which updates ClamAV's definitions (/usr/local/etc/freshclam.conf). All you really have to do is comment out the "Example" line in each conf file, but I would read through the entire conf. There are lots of options for ClamAV that will probably be a big help. If you don't comment out the "Example" line, both clamd and freshclam will squawk and not start.
Now let's set up the ClamAV virus definition auto-updater, freshclam:
- touch /var/log/clam-update.log
- chmod 600 /var/log/clam-update.log
- chown clamav:clamav /var/log/clam-update.log
Now add the following to your init script:
/usr/local/bin/freshclam -d -c 2 -l /var/log/clam-update.log
The last line executes freshclam as a daemon and tells it to update the ClamAV virus definitions twice daily. If you don't plan on rebooting anytime soon, execute this line manually now as root, as well.
Put the following entry into your init script:
/usr/local/sbin/clamd
If you don't plan on restarting anytime soon, execute it manually as root, as well. I also have a script almost identical to my spamdctl script which I call (surprise, surprise) clamdctl, but it will only work if you set the PidFile directive in clamd.conf equal to /var/run/clamd.pid. Or, you can alter the script and set it to whatever you like. You'll figure it out, I'm sure.

Install qmail-scanner (st patch)

This is a patched version of the original qmail-scanner that allows for quarantining and deleting/rejecting spam. You can go with the standard qmail-scanner if you don't require those options, but understand that from this point forward, this guide will assume you're using qmail-scanner (st patch). If you don't use qmail-scanner (st patch), remove the options --sa-quarantine, --sa-delete, and --sa-reject from the configuration line ahead, otherwise your configuration will fail.

First, create the user and group qmail-scanner will run as:

groupadd qscand
useradd -g qscand -s /bin/false -c "Qmail-Scanner Account" qscand

Now use the following configuration options (making sure to change "yourdomain.com" to whatever your domain is):

./configure --admin postmaster --domain yourdomain.com --notify psender,admin --local-domains yourdomain.com --silent-viruses auto --unzip 1 --add-dscr-hdrs 1 --archive 0 --redundant no --log-details yes --log-crypto 0 --fix-mime 1 --sa-quarantine 0.1 --sa-delete 5.0 --sa-reject 0 --sa-subject "SPAM:: " --scanners "fast_spamassassin,clamdscan" --skip-setuid-test --install 1

Note: qmail-scanner (st patch) quarantines both spam and viruses - you should check the qmail-scanner (st patch) configure options page for details on how it all works.

Making qmail-scanner-queue.pl work

Things get a little hairy making qmail-scanner work correctly. Due to setuid issues with Perl (though only on some distributions, notoriously Redhat), you'll need to use a C program to wrap qmail-scanner-queue.pl. This program is included with qmail-scanner - it's in the contrib directory of the unpacked source. Change your directory (i.e. cd) to qmail-scanner's unpacked source and execute the following:
- cd contrib
- make
- cp qmail-scanner-queue /var/qmail/bin/
Now you'll have two new executables in /var/qmail/bin/ - qmail-scanner-queue.pl and qmail-scanner-queue. Execute the following commands:
- cd /var/qmail/bin
- chmod 6755 qmail-scanner-queue
- chmod 0755 qmail-scanner-queue.pl
- chown qscand:qscand qmail-scanner-queue*
Check the mode and permissions on your files. I got feedback that changing the mode to 6755 on qmail-scanner-queue does not successfully set the sticky bit on Cent OS (and possibly on other operating systems). Check to make sure that the permissions on the file are correct:
[/var/qmail/bin]$ ls -al qmail-scanner-queue
-rwsr-sr-x qscand qscand qmail-scanner-queue

Note the octal permissions above - yours should look the same. If changing the mode to 6755 did not work, the alternative is to instead use:
- chmod +s qmail-scanner-queue
Test the new qmail-scanner-queue binary by executing the command
- ./qmail-scanner-queue -z
- ./qmail-scanner-queue -v
If this outputs version information for qmail-scanner, you know the wrapper is working (plus you can confirm qmail-scanner picked up all of the right scanners).
Provided the last step was successful, we have just a few more steps to take:
- chown -R qscand:qscand /var/spool/qscan/
Check in /var/spool/qscan/ and make sure all the files are owned by the user qscand and group qscand. If they aren't, ensure that they are. qmail-scanner will not work if any of the files it accesses are not owned by qscand, and all of your e-mail will remain in limbo.
Now you need to tell qmail to use the scanner to process incoming mail. There are many possibilities as to how you may configure your tcp rules file. The example here simply instructs qmail to process all mail, local and remote. Do this by editing your /etc/tcp.smtp file and change the file to read
127.:allow,RELAYCLIENT=""
:allow,QS_SPAMASSASSIN="yes",QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue"
This will scan all mail going through the server, with the exception of any mail directly originating from the local machine. You may have your own needs to meet in regards to qmail's setup - it's up to you. Explaining the syntax of the qmail's tcp rules file is well outside the scope of this document (read: I don't understand it either, plus I'm too lazy to figure it out), so if you're interested, it's up to you!
Reload the qmail rules file:
- qmailctl cdb

Restart qmail

qmailctl restart

I found that I needed to crank up the softlimit in /var/qmail/supervise/qmail-smtpd/run to 30MB (30000000). You'll need to adjust yours to handle the extra memory requirements of ClamAV and SpamAssassin and then restart tcpserver:

killall tcpserver
tcpserver

Cranking the softlimit too high will open you up to other vulnerabilities, however, so it's important to not just turn it up to the maximum system limit and just leave it there. I recently had several mail servers start to exhibit bizarre behaviors because updates coming down from freshclam made my previous softlimit, 15MB, too low. If the server starts acting up, the first thing I would check is whether or not it's has enough memory and then making sure everything has the right permissions.

Extra qmail goodies:

qmail-autoresponder by Bruce Guenter: for vacation messages
qmHandle by Christopher Chan: a tool for managing your queue
Training your SpamAssassin bayesian filter with IMAP!
How to check the mail in your quarantine:
This one is easy. You already have the user "qscand" since you needed it for qmail-scanner to work. Now, you're just going to make it easy to check the quarantine from any mail reader.
- mkdir /home/qscand/
- ln -s /var/spool/qscan/quarantine /home/qscand/Maildir
- chown -R qscand:qscand /home/qscand
- passwd qscand
Now, you'll be able to log in with the username qscand and check the quarantined mails.
How to make qmail a virus and spam scrubbing SMTP-route for multiple domains!
Updating the qmail users/assign file easily - add the following to your /var/qmail/bin/qmailctl script:
  usr)
    /var/qmail/bin/qmail-pw2u < /etc/passwd > /var/qmail/users/assign
    echo "Getting user listing from /etc/passwd ..."
    /var/qmail/bin/qmail-newu
    echo "New user(s) added to qmail."
    ;;
If you're feeling particularly fancy, go further down and add the update to the help output. (or, download my modified version)