色々日記（ざ・めも）

# chmod 4711 /usr/bin/suidperl

# chmod 755 /usr/bin/suidperl

# contrib/test_installation.sh -doit

Sending eicar test virus - should be caught by perlscanner module...
qmail-inject: fatal: qq temporary problem (#4.3.0)
Bad error. qmail-inject died

/var/spool/qmailscan/tmp/debian111060900649323497: Access denied. ERROR

User clamav

User qscand

# /etc/init.d/clamav-daemon restart

Sat Mar 12 18:05:27 2005 -> ERROR: Socket file /var/run/clamav/clamd.ctl could n
ot be bound: Permission denied

# chgrp qscand /var/run/clamav
# chmod 775 /var/run/clamav

# /etc/init.d/clamav-daemon restart

# contrib/test_installation.sh -doit

QMAILQUEUE="/var/qmail/bin/qmail-queue"
export QMAILQUEUE

Mar 14 01:38:51 debian X-Qmail-Scanner-1.25: [debian11107319314933436] cannot
 open  /var/spool/qmailscan/quarantine-attachments.db - No such file or directory

53c53
<       ulimit -v 8192
---
>       ulimit -v 10240

$ which unzip
/usr/bin/unzip

$ perl -v

This is perl, v5.8.3 built for i386-linux-thread-multi

$ perl -mTime::HiRes

$ perl -mDB_File

$ perl -mSys::Syslog

# apt-get install perl-suid

$ which suidperl
/usr/bin/suidperl

# apt-get install maildrop

$ which reformime
/usr/bin/reformime

# apt-get install tnef

$ which tnef
/usr/bin/tnef

# cd /usr/src/qmail-src/
# wget    <a HREF="http://www.qmail.org/qmailqueue-patch" TARGET=_top>http://www.qmail.org/qmailqueue-patch</a>
# tar -xvzf qmail_1.03.orig.tar.gz
# cd qmail-1.03/
# patch -p1 <../qmail-date-localtime.patch
# patch -p1 <../qmailqueue-patch
# zcat ../qmail_1.03-36.diff.gz | patch -p1

Reversed (or previously applied) patch detected!  Assume -R? [n]

# zcat ../qmail_1.03-36.diff.gz | grep MAILQUEUE
++    binqqargs[0] = env_get("QMAILQUEUE");
++                variable QMAILQUEUE. Also known as qmailqueue patch.
++QMAILQUEUE
++  if (env_get("QMAILQUEUE")) {
++    logstring(2,env_get("QMAILQUEUE"));
+    binqqargs[0] = env_get("QMAILQUEUE");

qmail (1.03-21) testing unstable; urgency=low

  * Added QMAIL-QUEUE patch

# groupadd qscand
# useradd -g qscand -s /bin/false qscand

$ tar -xvzf qmail-scanner-1.25.tgz
$ cd qmail-scanner-1.25
# ./configure

/usr/bin/reformime contains bugs. Please upgrade to a release
that post-dates Mar 22 2002 (e.g. 1.3.8)

# apt-show-versions -a -p maildrop
maildrop        1.3.7-2 install ok installed
maildrop        1.3.7-2 stable
maildrop        1.5.3-1.1       testing
maildrop        1.5.3-1.1       unstable
maildrop/stable uptodate 1.3.7-2

# apt-get install maildrop/testing
# ./configure

# ./configure --lang ja_JP.EUC --admin root --notify recips,admin --domain dt8.jp --install

• langは通知メールの言語、--adminと--domainは合わせて管理者メルアドだと思ってよい。--notifyは通知のポリシー決めで、recipsは受信者、adminは管理者へそれぞれ通知する。ウイルスメールの場合詐称があるので、送信元アドレスは当てにならずsenderは使いづらい。Stray Penguinにlsndr（ローカルの送信者）に通知するパッチがあるが、きちんと動くなら不用意にウイルスに感染した自ドメインのユーザへの自動通知が出来る？　今後の課題だろうか。adminの代わりにml宛先を除いたnmladmが使われることも多い。自分にはml宛先ウイルスを通知することによる不利益が今ひとつぴんと来ないので、当面adminで使う。その他の通知先は[参考サイト]を参照。

35a36,38
> QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl"
> export QMAILQUEUE
>

53c53
<       ulimit -v 8192
---
>       ulimit -v 10240

1876c1876
<   open(SM,"|$qmailinject -h -f ''")||&error_condition("cannot open $qmailinject for sending
 quarantine report - $!");
---
>   open(SM,"|/usb/bin/nkf -j|$qmailinject -h -f ''")||&error_condition("cannot open
 $qmailinject for sending quarantine report - $!");
2003c2003
<   open(SM,"|$qmailinject -h -f ''")||&error_condition("cannot open $qmailinject for sending
 quarantine report - $!");
---
>   open(SM,"|/usr/bin/nkf -j|$qmailinject -h -f ''")||&error_condition("cannot open
 $qmailinject for sending quarantine report - $!");

# /etc/init.d/qmail restart

# contrib/test_installation.sh -doit

# apt-get clamav/unstable

# ps -e | grep clam
19213 ?        00:00:00 freshclam
24801 ?        00:00:03 clamd

User clamav

User qscand

# /etc/init.d/clamav-daemon restart

# chgrp qscand /var/run/clamav
# chmod 775 /var/run/clamav

#!/bin/sh
if [ `ps -ef| grep /usr/bin/freshclam| grep -v grep| wc -l` != 1 ]; then
  message="freshclam stopped!"
  echo $message | mail -s "daemon Caution! : freshclam" urara@dt8.jp
fi

if [ `ps -ef| grep /usr/sbin/clamd| grep -v grep| wc -l` != 1 ]; then
  message="clamd stopped!"
  echo $message | mail -s "daemon Caution! : clamd" urara@dt8.jp
fi