邮件防毒 - 王朝网络

邮件防毒

linux 上的邮件网关（杀病毒）AntiVir MailGate ，它有两种方法：

1. 直接作 mail 网关，然后利用“ 管道 ”调用 smtp 程序。支持标准的 smtp 程序： sendmail、postfix、qmail。

2. 也是作 mail 网关，在 /etc/sendmail.cf 里添加 avgatemail 选项（这样 sendmail 在 825 端口监听），然后再利用 825 端口转发邮件。意思是：25 即是 avmailgate 的 smtp 端口，然后它再利用 825（sendmail）端口转发邮件！

请注意：但是人家还是可以利用你的 825 端口（就是利用原来的 senmail 来给你发送病毒邮件！但是，这种情况很少的。）。这时你可以用防火墙来阻止来自外部的对本机的 825 端口的连接。

在 /etc/services 里面增加：

smtp-backdoor 825/tcp

修改 sendmail.cf 成：

# SMTP daemon options

#O DaemonPortOptions=Port=smtp,Addr=127.0.0.1, Name=MTA

# 原来的。

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

# 红帽子 V7.x V8.0 所建立的本文件默认 “只” 对 localhost 即 127.0.0.1

# 提供服务,根据以往本文件的内容，修改为：

# SMTP daemon options

O DaemonPortOptions=Name=MTA, Port=smtp-backdoor

O DaemonPortOptions=Port=587, Name=MSA, M=E

# 若不需要 avgatemail ，则应该是：

#O DaemonPortOptions=Name=MTA

#O DaemonPortOptions=Port=587, Name=MSA, M=E

# 在端口 587 提供 submission 服务（MSA）。

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

请看：

邮件网关杀除病毒后返回的报告：

一、

*********************************************************************

AntiVir Virus Alert

*********************************************************************

This version of AntiVir MailGate is licensed for private and non-commercial use.

*********************************************************************

AntiVir found these viruses in the following mail:

Worm/Klez.E

The mail was not delivered.

You may force the delivery without further checking the mail using:

avq --deliver=04347-536A3823

but we would not advise to do so. You should delete it with:

avq --remove=04347-536A3823

For more information, please read the manual page avmailgate(icon_cool.gif.

----------Mail-Info----------

From: winson246 <winson246@sohu.com>

To: webmaster@fruitron.com.cn

Subject: Marginheight

Mail-From: suscono@pub.dgnet.gd.cn

Rcpt: webmaster@fruitron.com.cn

Queue-Id: 04347-536A3823

Status: The mail was not delivered!

-----------------------------

-----------Log-File----------

info: extracting attachment 1 to /var/tmp/av-06051-U43SFi/av-0

(encoding="quoted-printable", name="(no name)", filename="(no name)")

info: extracting attachment 2 to /var/tmp/av-06051-U43SFi/av-1

(encoding="base64", name="Vebnq.pif", filename="(no name)")

info: extracting attachment 3 to /var/tmp/av-06051-U43SFi/av-2

(encoding="base64", name="frame", filename="(no name)")

checking file "/var/tmp/av-06051-U43SFi/av-0"

checking file "/var/tmp/av-06051-U43SFi/av-1"

checking file "/var/tmp/av-06051-U43SFi/av-2"

-----------------------------

*********************************************************************

For more information on AntiVir please visit our web site

http://www.antivir.de or http://www.hbedv.com

mailto: info@antivir.de

AntiVir is a registered trademark of

H+BEDV Datentechnik GmbH

*********************************************************************

二、

*********************************************************************

AntiVir Virus Alert

*********************************************************************

This version of AntiVir MailGate is licensed for private and non-commercial use.

*********************************************************************

AntiVir found these viruses in a mail for you from winson246 <winson246@sohu.com>:

Worm/Klez.E

The mail was not delivered.

AntiVir MailGate prevented a virus delivery. But if you need to

receive further email from winson246 <winson246@sohu.com>,

you should ask him/her to buy a professional antivirus software such

as AntiVir from H+BEDV Datentechnik GmbH. He/She can contact

mailto:sales@hbedv.com for further information.

----------Mail-Info----------

From: winson246 <winson246@sohu.com>

To: webmaster@fruitron.com.cn

Subject: Marginheight

-----------------------------

*********************************************************************

For more information on AntiVir please visit our web site

http://www.antivir.de or http://www.hbedv.com

mailto: info@antivir.de

AntiVir is a registered trademark of

H+BEDV Datentechnik GmbH

*********************************************************************

自动升级病毒库后的报告：

AntiVir has successfully updated itself.

--> /usr/lib/AntiVir/antivir.vdf

Machine: gugonghcs.fruitron.com.cn

Date: 09 May 2002

Time: 10:39:18

-----------------------------

For private (non-commercial) use only.

请到：

http://www.hbedv.com

下载 linux 版本，并注册，Linux 的版本可是免费的哟。

由于附件的后缀名限制，附加的文档的 .txt 结尾是我增加附加档案时添加上去的。

avmailgate.conf

[php]

#######################################################################

## avmailgate.conf ##

#######################################################################

# This file lists all the available parameters. Lines beginning with '#'

# are comments and are ignored. When a parameter is not specified, some

# default value is used. The default values are the values shown here,

# unless otherwise indicated.

###################################

# Parameters used by both daemons #

###################################

# ------------------------------------------------------------------------

# Avgated and avgatefwd will switch to this user and group

# as soon as possible. Avgated will do this after opening

# the SMTP port and avgatefwd will do it immediatelly.

# User uucp

# Group uucp

# ------------------------------------------------------------------------

# Who will get errors, virus alerts and information about automatic updates.

Postmaster postmaster

# ------------------------------------------------------------------------

# MyHostName: FQDN of the local host.

# The default value, if not set in configuration file, is that

# obtained by gethostname(2), or if this fails, "localhost".

# MyHostName localhost

# ------------------------------------------------------------------------

# The spooldir must be owned by User:Group (as specified above)

# and must be accessible by only this user (mode = 0700).

# Both programs will yell and refuse to run if something is wrong.

# SpoolDir /var/spool/avmailgate

# ------------------------------------------------------------------------

# AntiVirDir: The antivir 'library' directory, where the VDF,

# the key, and some other files are stored.

# AntiVirDir /usr/lib/AntiVir

# ------------------------------------------------------------------------

# TemporaryDir: Where the temporary files are stored

# (for example, attachments while virus checking them).

# It needs enough space to hold uncompressed attachments

# for each forwarder, and some more.

# Default: "/var/tmp" or else "/tmp".

# TemporaryDir /var/tmp

# ------------------------------------------------------------------------

# You can set this option to RECIPIENT, SENDER or BOTH to allow matching of

# domain name of the recipient and/or sender mail address, to check if it's

# to be considered local.

# If MatchMailAddressForLocal is RECIPIENT, and the recipient address matches

# the domain given in "local:", mail will be accepted.

# If MatchMailAddressForLocal is SENDER, and the sender address matches the

# domain given in "local:", mail will be accepted.

# If MatchMailAdressForLocal is BOTH, and the recipient or the sender adresses

# matches the domain given in "local:" mail will be accepted.

# MatchMailAddressForLocal RECIPIENT

# ------------------------------------------------------------------------

# SMTP greeting message.

SMTPBanner "AntiVir MailGate"

##############################

# Parameters used by avgated #

##############################

# ------------------------------------------------------------------------

# The pid file of the SMTP daemon

PidFile_avgated /var/run/avmailgate_d.pid

# ------------------------------------------------------------------------

# Select the interface, the smtp daemon will listen on.

# The default listen address of 0.0.0.0 means all interfaces.

# IF YOU ARE UNSURE JUST LEAVE IT AS IS!

ListenAddress 0.0.0.0 port 25

# ------------------------------------------------------------------------

# Limit the number of simultanous connections from remote sites.

# A limit of 0 disables this feature.

MaxIncomingConnections 0

# ------------------------------------------------------------------------

# Number of seconds until a timeout occures in SMTP conversation.

# SmtpTimeout 300

# ------------------------------------------------------------------------

# Larger mails will be rejected.

# A limit of 0 means "no limit".

MaxMessageSize 5000000

# ------------------------------------------------------------------------

# Refuse incoming connections if less free blocks are available

# on the filesystem containing the spool directory.

# MinFreeBlocks 100

# ------------------------------------------------------------------------

# So many recipients can be accepted at once.

MaxRecipientsPerMessage 100

# ------------------------------------------------------------------------

# Refuse 'MAIL FROM:<>'.

# Actually, RFC2821, RFC821 and RFC2505 explicitely note that 'MAIL FROM: <>'

# MUST be accepted. It is strongly recommended not to change the

# default setting.

RefuseEmptyMailFrom YES

# ------------------------------------------------------------------------

# When AllowSourceRouting is NO, if source routing is present in the

# given recipient address path, it's removed.

# When AllowSourceRouting is YES, then source routing is honored, and

# the messages is forwared to the first host specified in the route..

# AllowSourceRouting NO

# ------------------------------------------------------------------------

# When InEnvelopAddressesBangIs is REFUSED, the presence of an unquoted

# "!" in the recipient envelop address implies that the message will be

# refused.

# When InEnvelopAddressesBangIs is IGNORED, any unquoted "!" will be

# processed as any other non-special character of the address.

# When InEnvelopAddressesBangIs is INTERPRETED, then the address is

# rewritten in RFC821 standard form. An address such as:

# hostA!hostB!hostC!user

# is rewritten as:

# @hostA,@hostB:user@hostC

# Then, if source routing is allowed, the message is transmited to

# hostA, otherwise it's directly sent to hostC.

# Thus, this rewritting allow us to discover the recipient host, in the

# case where all the UUCP gateways on the route would have interpreted

# the address the same way as us. (If that were not the case, then this

# parameters should be set to IGNORED).

# InEnvelopAddressesBangIs REFUSED

# ------------------------------------------------------------------------

# When InEnvelopAddressesPercentIs is REFUSED, the presence of an

# unquoted "%" in the recipient envelop address implies that the message

# will be refused.

# When InEnvelopAddressesPercentIs is IGNORED, any unquoted "%" will be

# processed as any other non-special character of the address.

# When InEnvelopAddressesPercentIs is INTERPRETED, then the address is

# rewritten in RFC821 standard form. An address such as:

# user%hostC%hostB@hostA

# is rewritten as:

# @hostA,@hostB:user@hostC

# Then, if source routing is allowed, the message is transmited to

# hostA, otherwise it's directly sent to hostC.

# Thus, this rewritting allow us to discover the recipient host, in the

# case where all the gateways on the route would have interpreted the

# address the same way as us. (If that were not the case, then this

# parameters should be set to IGNORED).

# InEnvelopAddressesPercentIs REFUSED

# ------------------------------------------------------------------------

# When AcceptLooseDomainName is NO, if the name of the domain selected

# for delivery (depending on source routing) does not strictly conform

# it the domain name syntax,then it's refused.

# When AcceptLooseDomainName is YES, then no check is done on the domain

# name, apart of interpretting the domain name syntax for numerical IP

# addresses.

# AcceptLooseDomainName NO

################################

# Parameters used by avgatefwd #

################################

# ------------------------------------------------------------------------

# The pid file of the forwarder

PidFile_avgatefwd /var/run/avmailgate_fwd.pid

# ------------------------------------------------------------------------

# Number of forwarders running simultanously.

# (All the forwarders are of the same class, as specified by

# the following option).

# MaxForwarders 10

# ------------------------------------------------------------------------

# Select how mail should be forwarded.

# Send mail by piping it thru sendmail (this is the default):

# ForwardTo /usr/lib/sendmail -oem -oi

# Or if you want the mail to be sent by SMTP:

ForwardTo SMTP: localhost port 825

# ------------------------------------------------------------------------

# Stop delivery of suspicious MIME mails, that is

# a MIME nesting level > 20 or more than 100 attachments.

BlockSuspiciousMime YES

# ------------------------------------------------------------------------

# Send virus alerts to receipients outside your domain if

# the sender is a user local to your domain.

# ExposeAlerts NO

# ------------------------------------------------------------------------

# Send virus alerts to sender if the sender address is not local.

# This option is only available in commercial mode.

# ExposeSenderAlerts NO

# ------------------------------------------------------------------------

# User name of sender of virus alerts, if virus was found in a mail.

VirusAlertsUser AvMailGate

# ------------------------------------------------------------------------

# When AddStatusInBody is NO, no not status notification is inserted in

# the body of the emails.

# When AddStatusInBody is YES:

# For plain rfc822 email (non MIME), just insert the notification

# paragraph in the begining of the body.

# For MIME email, transmit the checked email as a new MIME

# multipart/mixed email, with a first text/plain section containing the

# status notification paragraph, and with a second message/rfc822

# section containgin the whole original message. Most headers from the

# orginal are copied to the transmited message.

# AddStatusInBody NO

# ------------------------------------------------------------------------

# When ForwardAllEmailAsMIME is NO, incoming emails that are not MIME

# emails get out as they came, non-MIME.

# When ForwardAllEmailAsMIME is YES:

# The behaviour does not change for MIME emails.

# However, plain rfc822 emails are encapsulated into a MIME

# message/rfc822 section of a multipart/mixed email that will inherit

# all the headers of the user email. If AddStatusInBody is YES too,

# then our text is added into a text/plain entity inserted before the

# message/rfc822 entity.

# ForwardAllEmailAsMIME NO

# ------------------------------------------------------------------------

# If ScanInArchive is NO, no files in an archive will be scanned.

# If ScanInArchives is YES, all files in archives are going to be extracted

# and scanned, depending on the resctrictions given with

# MaxFilesizeInArchive and MaxRecursionDepthInArchive.

ScanInArchive YES

# ------------------------------------------------------------------------

# If MaxFilesizeInArchive is 0, all files in an archive will be extracted,

# don't care of their unpacked size.

# If MaxFilesizeInArchive is >0, all files up to the adjusted size will be

# extracted.

# MaxFilesizeInArchive 0

# ------------------------------------------------------------------------

# If MaxRecursionDepthInArchive is 0, recursive archives are going to be

# unpacked with an unlimited recursion depth.

# If MaxRecursionDepthInArchive is >0, recursive archives are going to be

# unpacked up to the adjusted recursion depth.

# MaxRecursionDepthInArchive 5

# ------------------------------------------------------------------------

# If BlockSuspiciousArchive is NO, don't stop delivery of mails

# containing archives with a suspicious recursion depth.

# If BlockSuspiciousArchive is YES, stop delivery of mails

# containing archives if MaxRecursionDepthInArchive has been reached.

# BlockSuspiciousArchive NO

# ------------------------------------------------------------------------

# If BlockEncryptedArchive is NO, don't stop delivery of mails

# containing encrypted files in archives.

# If BlockEncryptedArchive is YES, stop delivery of mails

# containing encrypted files in an archive.

# BlockEncryptedArchive NO

# ------------------------------------------------------------------------

# PollPeriod specifies the periodicity, in seconds, of the queue

# scanning done by avgatefwd.

# PollPeriod 20

# ------------------------------------------------------------------------

# User name of sender of error messages, if a mail couldn't be delivered via

# MTA (bounce messages).

BounceMessageUser MAILER-DAEMON

# ------------------------------------------------------------------------

# If AddXHeaderInfo is YES, information about scanning status is added

# to the header of checked mail. E.g.: "X-AntiVirus: Checked by ..."

# This option is only available in commercial mode.

AddXHeader YES

# ------------------------------------------------------------------------

# If AddReceivedByHeaderInfo is YES, a "Received by:" stamp is added to

# the header of mail.

# This option is only available in commercial mode.

AddReceivedByHeader YES

# ------------------------------------------------------------------------

# ScanTimeout specifies the scan time of mail, in seconds, when to stop

# scanning of mails.

# ScanTimeout 300

# ------------------------------------------------------------------------

# Call external program or script if virus was found. The argument is the id of

# rejected message.

# ExternalProgram /dir/my_own_script

#########################

## That's all folks! ##

#########################

[/php]

avmailgate.acl

[php]

# Access lists for AvMailGate

# These hosts and/or domains are local.

local: localhost

local: fruitron.com.cn mail.fruitron.com.cn

# These hosts and networks are allowed to relay.

relay: 127.0.0.1/8 192.168.0.0/24 211.148.130.128/28

[/php]

sendmail.cf

[php]

# By using this file, you agree to the terms and conditions set

# forth in the LICENSE file which can be found at the top level of

# the sendmail distribution.

######################################################################

#####

##### SENDMAIL CONFIGURATION FILE

#####

######################################################################

##### $Id: cfhead.m4,v 8.76.4.16 2001/03/06 22:56:36 ca Exp $ #####

##### $Id: cf.m4,v 8.32 1999/02/07 07:26:14 gshapiro Exp $ #####

##### linux setup for Red Hat linux #####

##### $Id: linux.m4,v 8.11.16.2 2000/09/17 17:04:22 gshapiro Exp $ #####

##### $Id: local_procmail.m4,v 8.21 1999/11/18 05:06:23 ca Exp $ #####

##### $Id: no_default_msa.m4,v 8.1.10.1 2000/09/17 17:04:22 gshapiro Exp $ #####

##### $Id: smrsh.m4,v 8.14 1999/11/18 05:06:23 ca Exp $ #####

##### $Id: mailertable.m4,v 8.18 1999/07/22 17:55:35 gshapiro Exp $ #####

##### $Id: virtusertable.m4,v 8.16 1999/07/22 17:55:36 gshapiro Exp $ #####

##### $Id: redirect.m4,v 8.15 1999/08/06 01:47:36 gshapiro Exp $ #####

##### $Id: always_add_domain.m4,v 8.9 1999/02/07 07:26:08 gshapiro Exp $ #####

##### $Id: use_cw_file.m4,v 8.9 1999/02/07 07:26:13 gshapiro Exp $ #####

##### $Id: use_ct_file.m4,v 8.9 1999/02/07 07:26:13 gshapiro Exp $ #####

##### $Id: local_procmail.m4,v 8.21 1999/11/18 05:06:23 ca Exp $ #####

##### $Id: access_db.m4,v 8.15 1999/07/22 17:55:34 gshapiro Exp $ #####

##### $Id: blacklist_recipients.m4,v 8.13 1999/04/02 02:25:13 gshapiro Exp $ #####

##### $Id: accept_unresolvable_domains.m4,v 8.10 1999/02/07 07:26:07 gshapiro Exp $ #####

Cwlocalhost.localdomain

##### $Id: proto.m4,v 8.446.2.5.2.44 2001/07/31 22:25:49 gshapiro Exp $ #####

# level 9 config file format

V9/Berkeley

# override file safeties - setting this option compromises system security,

# addressing the actual file configuration problem is preferred

# need to set this before any file actions are encountered in the cf file

#O DontBlameSendmail=safe

# default LDAP map specification

# need to set this now before any LDAP maps are defined

#O LDAPDefaultSpec=-h localhost

##################

# local info #

##################

Cwlocalhost

# file containing names of hosts for which we receive email

Fw/etc/mail/local-host-names

# my official domain name

# ... define this only if sendmail cannot automatically determine your domain

#Dj$w.Foo.COM

CP.

# "Smart" relay host (may be null)

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

#DSmail.fruitron.com.cn

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

# operators that cannot be in local usernames (i.e., network indicators)

CO @ % !

# a class with just dot (for identifying canonical names)

C..

# a class with just a left bracket (for identifying domain literals)

C[[

# access_db acceptance class

C{Accept}OK RELAY

# Hosts for which relaying is permitted ($=R)

FR-o /etc/mail/relay-domains

# arithmetic map

Karith arith

# possible values for tls_connect in access map

C{tls}VERIFY ENCR

# who I send unqualified names to (null means deliver locally)

#DR

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

DRmail.fruitron.com.cn

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

# who gets all local email traffic ($R has precedence for unqualified names)

#DH

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

DHmail.fruitron.com.cn

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

# dequoting map

Kdequote dequote

# class E: names that should be exposed as from this host, even if we masquerade

# class L: names that should be delivered locally, even if we have a relay

# class M: domains that should be converted to $M

# class N: domains that should not be converted to $M

#CL root

C{E}root

# who I masquerade as (null for no masquerading) (see also $=M)

#DM

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

DMfruitron.com.cn

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

# my name for error messages

DnMAILER-DAEMON

# Mailer table (overriding domains)

Kmailertable hash -o /etc/mail/mailertable.db

# Virtual user table (maps incoming users)

Kvirtuser hash -o /etc/mail/virtusertable.db

CPREDIRECT

# Access list database (for spam stomping)

Kaccess hash -o /etc/mail/access.db

# Configuration version number

DZ8.11.6

###############

# Options #

###############

# strip message body to 7 bits on input?

O SevenBitInput=False

# 8-bit data handling

#O EightBitMode=pass8

# wait for alias file rebuild (default units: minutes)

O AliasWait=10

# location of alias file

O AliasFile=/etc/aliases

# minimum number of free blocks on filesystem

O MinFreeBlocks=100

# maximum message size

#O MaxMessageSize=1000000

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

O MaxMessageSize=5000000

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

# substitution for space (blank) characters

O BlankSub=.

# avoid connecting to "expensive" mailers on initial submission?

O HoldExpensive=False

# checkpoint queue runs after every N successful deliveries

#O CheckpointInterval=10

# default delivery mode

O DeliveryMode=background

# automatically rebuild the alias database?

# NOTE: There is a potential for a denial of service attack if this is set.

# This option is deprecated and will be removed from a future version.

O AutoRebuildAliases

# error message header/file

#O ErrorHeader=/etc/mail/error-header

# error mode

#O ErrorMode=print

# save Unix-style "From_" lines at top of header?

#O SaveFromLine=False

# temporary file mode

O TempFileMode=0600

# match recipients against GECOS field?

#O MatchGECOS=False

# maximum hop count

#O MaxHopCount=17

# location of help file

O HelpFile=/etc/mail/helpfile

# ignore dots as terminators in incoming messages?

#O IgnoreDots=False

# name resolver options

#O ResolverOptions=+AAONLY

# deliver MIME-encapsulated error messages?

O SendMimeErrors=True

# Forward file search path

O ForwardPath=$z/.forward.$w:$z/.forward

# open connection cache size

O ConnectionCacheSize=2

# open connection cache timeout

O ConnectionCacheTimeout=5m

# persistent host status directory

#O HostStatusDirectory=.hoststat

# single thread deliveries (requires HostStatusDirectory)?

#O SingleThreadDelivery=False

# use Errors-To: header?

O UseErrorsTo=False

# log level

O LogLevel=9

# send to me too, even in an alias expansion?

#O MeToo=True

# verify RHS in newaliases?

O CheckAliases=False

# default messages to old style headers if no special punctuation?

O OldStyleHeaders=True

# SMTP daemon options

#O DaemonPortOptions=Port=smtp,Addr=127.0.0.1, Name=MTA

# -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- gugong -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

# &ì?0