postfix Postfix主程序使用的用户和组 uid:1000,gid:1000 clamav clamav clamav 杀毒软件用户 无 amavis amavis 邮件扫描用户 无 ---------------------------------------------------------- useradd -g 1000 -u 1000 -s /sbin/nologin -M postfix [root@mail ~]# useradd clamav [root@mail ~]# useradd amavis vmail.vmail /tmp/extman clamav临时目录 [root@mail ~]# mkdir -p /dev/shm/clamav/tmp [root@mail ~]# chown -R amavis.amavis [root@mail ~]# echo " mkdir -p /dev/shm/clamav/tmp" >>/etc/rc.local [root@mail ~]# echo " chown -R amavis.amavis
1RSPAMD_CHECK_AUTHENTICATED=0RSPAMD_GREYLISTING=1RSPAMD_HFILTER=1RSPAMD_HFILTER_HOSTNAME_UNKNOWN_SCORE=6RSPAMD_NEURAL=0ENABLE_AMAVIS =1AMAVIS_LOGLEVEL=0ENABLE_DNSBL=0ENABLE_FAIL2BAN=0FAIL2BAN_BLOCKTYPE=dropENABLE_MANAGESIEVE=POSTSCREEN_ACTION
spamd 24913 root 6u IPv6 25208449 0t0 TCP [::1]:783 (LISTEN) /usr/sbin 24919 amavis 5u IPv4 25208583 0t0 TCP 11:10024 (LISTEN) /usr/sbin 24919 amavis 6u IPv6 25208584
关闭10024端口 进入容器修改配置 docker exec -it mail bash vi /etc/postfix/main.cf 注释以下行: # content_filter = smtp-amavis
关闭10024端口 进入容器修改配置 docker exec -it mail bash vi /etc/postfix/main.cf 注释以下行: # content_filter = smtp-amavis
可通过Postfix+Amavis规则实现:# /etc/amavis/conf.d/50-user@banned_files = (qr'\.desktop$'i,qr'\.elf$'i,qr'\.sh
可常行为识别结合以下行为特征触发报警或自动封禁:短时间内登录多个国家IP(GeoIP分析)-同账号多个终端并发发信发信量突然激增群发邮件主题/正文包含黑词(如成人内容、钓鱼链接、赌博广告)可结合Rspamd,Amavis
directories: mkdir /var/run/amavisd /var/spool/amavisd /var/spool/amavisd/tmp /var/spool/amavisd/db chown amavis
complete - press return to exit 查看服务是否正常运行 su – zimbra zmcontrol status Host mail.cd-hst.com amavis
监控与日志分析:通过SMTP日志监控邮件的发送情况,并结合邮件安全分析工具(如Rspamd、Amavis)进行垃圾邮件识别与拦截。
- SSL_CERT_PATH=/ssl/fullchain.pem - SSL_KEY_PATH=/ssl/privkey.pem - ENABLE_AMAVIS # # 默认: 6 RSPAMD_HFILTER_HOSTNAME_UNKNOWN_SCORE=6 # Amavis 内容过滤器(用于 ClamAV 和 SpamAssassin) # 0 => 禁用 # 1 => 启用 ENABLE_AMAVIS=1 # -1/-2/-3 => 仅显示错误 # **0** => 显示警告 # 1/2 => 显示默认信息输出 # 3/4/5 => 记录调试信息(非常详细) AMAVIS_LOGLEVEL=0 # 在 Postscreen 中启用 DNS 阻止列表。
bin/false\n', '_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false\n', '_amavisd:*:83:83:AMaViS
port, hoople.org 10017 AIX,NeXT, HPUX - rexd daemon control port 10024/tcp Zimbra - smtp [mta] - to amavis from postfix 10025/tcp Ximbra - smtp [mta] - back to postfix from amavis 10050/tcp Zabbix-Agent 10051
111 将它和 /etc/passwd 去掉头部注释后的排序内容做个比较: > paste -d':' users.txt passwd.txt _amavisd:_amavisd:*:83:83:AMaViS