If you will recall, when we compiled qmail earlier in this installation, we applied a patch to qmail called "qmailqueue.patch". This patch allows qmail to be configured to run with a substitute queuing mechanism. That's exactly what were about to do here. We're going to tell qmail to use Qmail-Scanner as the queuing mechanism. Qmail-scanner is going to allow us to integrate Clam Antivirus and SpamAssassin into our qmail server's mail queue. Once qmail-scanner is installed, there will be a master script that is filled with configuration options that help you to tailor the functionality of Clam Antivirus and SpamAssassin to your needs. To expand the number of configuration options, we are also going to apply a patch to qmail-scanner. For this patch, we will be using Mark Teel's qms-analog patch. Qms-analog incorporated the widely used qmail-scanner-st patch but it also adds some cool reporting functionality as well which we will utilize later in this installation guide. So let's get on it!

cd /downloads/qmailrocks

Unpack qmail-scanner...

tar zxvf qmail-scanner-1.24.tgz

Now unpack qms-analog...

tar zxvf qms-analog-0.4.1.tar.gz

Install qms-analog itself. This will come in handy in the next step when we install Qmailanalog.

cd qms-analog-0.4.1

gmake all

Next, we copy needed qms-analog files to the qmail-scanner source directory...

cp qmail-scanner-1.24-st-qms-YYYYMMDD.patch /downloads/qmailrocks/qmail-scanner-1.24/

Now, let's apply the qms-analog patch...

cd /downloads/qmailrocks/qmail-scanner-1.24

patch -p1 < qmail-scanner-1.24-st-qms-YYYYMMDD.patch

Now we will configure qmail-scanner and install it. Ordinarily, you would run the ./configure script to configure and install qmail-scanner. However, Mark Teel has donated a handy little config script that does most of the work for you.This script is called "qms-config-script" and, if you look above, you should have already copied this config script into the qmail-scanner source directory.

How you go about configuring and installing qmail-scanner from this point on depends on how you server's installation of Perl is configured. For the purposes of this installation, there are 2 Perl setups.

1. Perl is configured to allow for setuid functions.

2. Perl is not configured for setuid functionality and, in fact, does not permit it.

We'll start off with the configuration step for a server that allows setuid. However, if you run into setuid errors, you can jump to a set of instructions for servers that do not allow setuid functionality.

So let's do it...

First, you need to configure the script for your needs...

cd /downloads/qmailrocks/qmail-scanner-1.24

vi qms-config

You will notice several fields that need to be customized to fit your needs. Let's have a look. I've highlighted the fields you should customize in RED

#!/bin/sh

if [ "$1" != "install" ]; then
INSTALL=
else
INSTALL="--install"
fi

./configure --domain yourdomain.com \
--admin postmaster \
--local-domains "yourdomain.com,yourotherdomain.com" \
--add-dscr-hdrs yes \
--dscr-hdrs-text "X-Antivirus-MYDOMAIN" \
--ignore-eol-check yes \
--sa-quarantine 0 \
--sa-delete 0 \
--sa-reject no \
--sa-subject ":SPAM:" \
--sa-delta 0 \
--sa-alt yes \
--sa-debug no \
--notify admin \
"$INSTALL"

Now save and exit out of the config file. That was easy, wasn't it.

And now we will run a test config for qmail-scanner...

chmod 755 qms-config

./qms-config

Answer YES to all questions. If you get no errors, you can then run the script in "install" mode and this will install qmail-scanner on your server.

If you didn't get any errors on the test run above, then you should be ok to run the "real" installation script below. So let's do it...

./qms-config install

Again, answer YES to all questions. If you get no errors, you can then run the script in "install" mode and this will install qmail-scanner on your server. If you do get errors, check out these troubleshooting tips.

And now all that's left for qmail-scanner is to initiate the version file and the perlscanner database...

First, we'll initialize the version file. This command also helps to keep your server's /var/spool/qmailscan folder clear of rogue files that can develop when SMTP sessions are dropped. You may want to stick this command into your server's crontab and run it once a day. You'll see more on this in the "maintaining your qmail server" step near the end of this tutorial.. So let's run it...

setuidgid qscand /var/qmail/bin/qmail-scanner-queue.pl -z

And now we will generate a new perlscanner database for qmailp-scanner. For future reference, it's a good idea to run this next command whenever you upgrade qmail-scanner. You'll see more on this in the "maintaining your qmail server" step near the end of this tutorial. So let's do i t...

setuidgid qscand /var/qmail/bin/qmail-scanner-queue.pl -g

A successful database build should produce the following output:

perlscanner: generate new DB file from /var/spool/qmailscan/quarantine-attachments.txt
perlscanner: total of 9 entries.

And now one final ownership check...

chown -R qscand:qscand /var/spool/qmailscan

Woohoo, qmail-scanner is installed! Now it's time to tie qmail-scanner into qmail itself.

vi /var/qmail/supervise/qmail-smtpd/run

To instruct Qmail to use Qmail-Scanner as the alternative queuing mechanism, we add the following line to the SMTP "run" script right under the first line (#!/bin/sh):

QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" export QMAILQUEUE

..and we change the "softlimit" in that same script...

change softlimit to 40000000

Note: It is absolutely vital that you change the "Softlimit" setting in this script. If you don't, qmail may fail to deliver mail!!!

So now the qmail-smtp/run file should look like this:

#!/bin/sh
QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" export QMAILQUEUE
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
LOCAL=`head -1 /var/qmail/control/me`
if [ -z "$QMAILDUID" -o -z "$NOFILESGID" -o -z "$MAXSMTPD" -o -z "$LOCAL" ]; then
echo QMAILDUID, NOFILESGID, MAXSMTPD, or LOCAL is unset in
echo /var/qmail/supervise/qmail-smtpd/run
exit 1
fi
if [ ! -f /var/qmail/control/rcpthosts ]; then
echo "No /var/qmail/control/rcpthosts!"
echo "Refusing to start SMTP listener because it'll create an open relay"
exit 1
fi
exec /usr/local/bin/softlimit -m 40000000 \
/usr/local/bin/tcpserver -v -R -l "$LOCAL" -x /etc/tcp.smtp.cdb -c "$MAXSMTPD" \
-u "$QMAILDUID" -g "$NOFILESGID" 0 smtp \
/var/qmail/bin/qmail-smtpd your_domain.com \
/home/vpopmail/bin/vchkpw /usr/bin/true 2>&1

Once you've got the qmail-smtpd file modified, save the changes and exit from the file. Now we will finalize the qmail-scanner installation by going over some post-install configuration options. After that, we'll fire everything up and take qmail-scanner for a test drive!

Click Here to continue

Now that we've fully integrated qmail-scanner, we'll restart qmail so ensure that the changes to the qmail-smtpd run files take effect...

qmailctl restart

Now it's time to test the whole damn thing to see if Qmail-Scanner, Spamassassin and Clam AV are all working correctly. Fortunately, Qmail-Scanner comes with it's own testing script that does a fantastic job. So let's test it!

cd /downloads/qmailrocks/qmail-scanner-1.24/contrib

chmod 755 test_installation.sh

./test_installation.sh -doit

A successful test should produce the following output and should send 4 new messages to whatever mailbox you specified in the Qmail-scanner configuration script above.

setting QMAILQUEUE to /var/qmail/bin/qmail-scanner-queue.pl for this test...

Sending standard test message - no viruses...
done!

Sending eicar test virus - should be caught by perlscanner module...
done!

Sending eicar test virus with altered filename - should only be caught by commercial anti-virus modules (if you have any)...

Sending bad spam message for anti-spam testing - In case you are using SpamAssassin...
Done!

Finished test. Now go and check Email for postmaster@mydomain.com

When you check the mailbox to which the tests were sent, you should see 1 Qmail-scanner test messagem, 1 Spamassassin test message, 2 Clam AntiVirus virus detection messages. If the test script above does not produce any errors and if you get all 4 test messages in your administrative mailbox, you can pop open a beer and have a little celebration! You've successfully installed all 3 packages! Woohoo!

Finally, let's go over some of the post-install configuration options for qmail-scanner...

Summary of functionality:

If you've gotten to this point, you should have Clam Anti-Virus, Spamassassin and Qmail-Scanner all working together. When a messages comes into the server, Qmail-Scanner takes the message and pipes it out to both Clam Anti-Virus and Spamassassin. If the message contains a virus, Clam AV quarantines it a /var/spool/qmailscan/quarantine and then send a notification e-mail to whoever you specified in the Qmail-Scanner installation. If the message does not contain a virus, it is then scanned by Spamassassin. Depending on the score that Spamassassin assigns to the message and whether or not that score breaks the SPAM threshold set by you in the /var/qmail/.spamassassin/user_prefs file, Spamassassin will either let the message go unaltered to its destination or it will tag the message as SPAM. If the message is tagged as SPAM, it will still arrive at its destination, but with an altered "subject" that will signal to the recipient that this was tagged as SPAM. The text that gets appended to the "subject" of the e-mail is set in the /var/qmail/bin/qmail-scanner.pl file. (For example: If you set qmail-scanner.pl to tag all SPAM with "HI, I'M SPAM!", mail tagged as such will be delivered to the recipient with "HI, I'M SPAM" added to the subject. Once the message is tagged, the recipient can then configure his/her mail client to deal with those tagged message in whatever manner he/she sees fit.

Proceed to Part 16