1. Software Install

yum install postfix spamassassin amavisd-new clamav
chkconfig postfix on
chkconfig clamd on
chkconfig freshclam on
chkconfig amavisd on

2. Anti-Virus Configuration

['ClamAV-clamd',
  \&ask_daemon, ["CONTSCAN {}\n", "127.0.0.1:3310"],
  qr/\bOK$/, qr/\bFOUND$/,
  qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],

<?php
/etc/init.d/clamd start
service amavisd start
service clamd start
# If you are behind a proxy, you need adjust /etc/freshclam.conf
freshclam
service freshclam start
?>

amavis unix - - - - 2 smtp
        -o smtp_data_done_timeout=1200
        -o smtp_send_xforward_command=yes
        -o disable_dns_lookups=yes
127.0.0.1:10025 inet n - - - - smtpd
        -o content_filter=
        -o local_recipient_maps=
        -o relay_recipient_maps=
        -o smtpd_restriction_classes=
        -o smtpd_client_restrictions=
        -o smtpd_helo_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o mynetworks=127.0.0.0/8
        -o strict_rfc821_envelopes=yes
        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
        -o smtpd_bind_address=127.0.0.1

3. Test Setup

4. IP Address Spam Prevention

RBLDNSD

1. Install the rbldns RPM (available in Fedora Extras, or source)
2. Edit your named.conf and add:

   
   zone "clients.blocked.rbl" IN {
           type forward;
           forward first;
           forwarders { 127.0.0.1 port 530; };
   };
   zone "hosts.blocked.rbl" IN {
           type forward;
           forward first;
           forwarders { 127.0.0.1 port 530; };
   };
   
   

3. Edit /etc/sysconfig/rbldnsd and add the following lines:

   
   RBLDNSD="dsbl -r/var/lib/rbldnsd -b 127.0.0.1/530 \
   clients.blocked.rbl:ip4set:clients,dynamic \
   hosts.blocked.rbl:dnset:hosts \
   "
   
   

4. Get the latest RBLDNS databases and move database files to /var/lib/rbldnsd
5. Gentlepeople, start your daemons: "service restart named; service restart rbldnsd;" Test with telnet localhost 53; and telnet locahost 530;
6. Preform a test lookup:

   
   $dig @localhost 223.61.83.162.clients.blocked.rbl -t txt
   ;; ANSWER SECTION:
   223.61.83.162.clients.blocked.rbl. 2048 IN TXT "DNSBL. 162.83.61.223 is a known spam source. Mail from 162.83.61.223 is NOT accepted on this server!"
   
   

7. Update the following line of your /etc/postfix/main.cf

   
   smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,reject_rbl_client clients.blocked.rbl,reject_rhsbl_client hosts.blocked.rbl,reject_rhsbl_sender hosts.blocked.rbl
   
   

5. DNS Spam Prevention

DomainKeys

1. Install necessary perl modules (make sure you have openssl-devel installed):

   
   cpan -i Crypt::OpenSSL::RSA Mail::Address MIME::Base64 Net::DNS Net::Server Test::More
   
   

2. download source, extract tarball, cd into directory, and compile source with ./configure --prefix=/usr/local/dkfilter ; make install
3. For outbound mail signing, you will need a public/private key combo.

   
   openssl genrsa -out private_domainkey.key 1024
   openssl rsa -in private.key -pubout -out public_domainkey.key
   
   

4. Tweak sample-dkfilter-init-script.sh and copy to /etc/init.d/dkfilter - Either make a dkfilter user or change DKFILTERUSER and DKFILTERGROUP to postfix. The following are line changes made, adjust to your liking...

   
   *snip*
   DKFILTERUSER=postfix
   DKFILTERGROUP=postfix
   *snip*
   DKFILTER_IN_ARGS="
           --hostname=$HOSTNAME
           127.0.0.1:10026 127.0.0.1:10027"
   DKFILTER_OUT_ARGS="
           --keyfile=/etc/pki/domainkeys/private.key
           --selector=selector1
           --domain=$DOMAIN
           --method=nofws
           --headers
           127.0.0.1:10028 127.0.0.1:10029"
   
   

5. start dkfilter with service dkfilter start. Test ports are up and running with telnet localhost 10026 and telnet localhost 10027
6. Add inbound dkfilter postfix configuration to /etc/postfix/master.cf

   
   #
   # Before-filter SMTP server. Receive mail from the network and
   # pass it to the content filter on localhost port 10026.
   #
   smtp      inet  n       -       n       -       -       smtpd
       -o smtpd_proxy_filter=127.0.0.1:10026
       -o smtpd_client_connection_count_limit=10
   #
   # After-filter SMTP server. Receive mail from the content filter on
   # localhost port 10027.
   #
   127.0.0.1:10027 inet n  -       n       -        -      smtpd
       -o smtpd_authorized_xforward_hosts=127.0.0.0/8
       -o smtpd_client_restrictions=
       -o smtpd_helo_restrictions=
       -o smtpd_sender_restrictions=
       -o smtpd_recipient_restrictions=permit_mynetworks,reject
       -o smtpd_data_restrictions=
       -o mynetworks=127.0.0.0/8
       -o receive_override_options=no_unknown_recipient_checks
   
   

7. Add outbound filter to sign outgoing messages in postfix configuration /etc/postfix/master.cf

   
   <?php
   #
   # modify the default submission service to specify a DomainKeys content filter
   # and restrict it to local clients and SASL authenticated clients only
   #
   submission  inet  n     -       n       -       -       smtpd
       -o smtpd_etrn_restrictions=reject
       -o smtpd_sasl_auth_enable=yes
       -o content_filter=dksign:[127.0.0.1]:10028
       -o receive_override_options=no_address_mappings
       -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
   #
   # specify the location of the DomainKeys signing filter
   #
   dksign    unix  -       -       n       -       10      smtp
       -o smtp_send_xforward_command=yes
       -o smtp_discard_ehlo_keywords=8bitmime
   #
   # service for accepting messages FROM the DomainKeys signing filter
   #
   127.0.0.1:10029 inet  n  -      n       -       10      smtpd
       -o content_filter=
       -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
       -o smtpd_helo_restrictions=
       -o smtpd_client_restrictions=
       -o smtpd_sender_restrictions=
       -o smtpd_recipient_restrictions=permit_mynetworks,reject
       -o mynetworks=127.0.0.0/8
       -o smtpd_authorized_xforward_hosts=127.0.0.0/8
   ?>
   
   

SenderID (and SPF)

Troubleshooting

• Be sure to watch your logs, such as: tail -f /var/log/maillog
• Config tinkering can lead to one of the services being down..
• On SLES 10, it seems clamd can take up to 10 minutes to begin accepting connections. Reason currenly unknown. Please chime in if you have any ideas.
• Check your open ports with netstat -lp and you should see somthing like:

  
  # netstat -lp
  Active Internet connections (only servers)
  Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
  tcp        0      0 localhost:10024         *:*                     LISTEN      2011/amavisd (maste
  tcp        0      0 localhost:10025         *:*                     LISTEN      16463/master
  tcp        0      0 localhost:10026         *:*                     LISTEN      15545/perl
  tcp        0      0 *:submission            *:*                     LISTEN      16463/master
  tcp        0      0 localhost:10027         *:*                     LISTEN      16463/master
  tcp        0      0 localhost:10028         *:*                     LISTEN      15554/perl
  tcp        0      0 localhost:10029         *:*                     LISTEN      16463/master
  tcp        0      0 localhost:dyna-access   *:*                     LISTEN      1803/clamd
  tcp        0      0 localhost:domain        *:*                     LISTEN      1875/named
  tcp        0      0 *:smtp                  *:*                     LISTEN      16463/master
  
  

References and Other tutorails