ClamAV是一个unix系统平台上的开源反病毒工具，它是特地为在邮件网关上进行邮件扫描而设计的。整套软件提供了许多的实用工具，包括一个可伸缩和可升级的多线程守护进程、一个命令行扫描工具和病毒库自动升级工具。

SpamAssassin 是目前最好的、最流行的开源反垃圾邮件软件之一。它是一个邮件过滤器，使用了多种反垃圾邮件技术，如：文本分析、贝叶斯过滤、DNS黑名单和分布式协同过滤数据库等。

amavisd-new是一个连接MTA和内容检测工具（诸如病毒扫描工具和 SpamAssassin)的高性能接口程序，使用perl语言写成。它一般通过SMTP、ESMTP或者LMTP和MTA进行通讯，当然也可以借助于其它外部程序进行。同postfix（MTA）协同工作时表现尤佳。当它呼叫SpamAssassin进行内容过滤时，对于一封邮件只需要呼叫一次，而不管这封邮件将发往多少个收件人；同时，它亦会尽力保证实现每一位收件人的偏好设置，如接收/拒绝，检测/不检测，垃圾邮件级别等；它还会在邮件头部分插入 spam相关信息。

【安装ClamAV】
（1）升级安装ClamAV的支持
最新的clamav-0.96.1需要zlib-1.2.2以上的版本的支持，而centos5上的版本为zlib-1.2.3因此不需要升级，但是为了确保，最好还是确认下：

	#rpm  -qa | grep zlib
	zlib-1.2.3-3
	zlib-devel-1.2.3-3
	

如果不是最新的，请使用yum update zlib进行升级。
（2）安装ClamAV
添加ClamAV运行所需的组和用户：

	#groupadd clamav
	#useradd -g clamav -s /sbin/nologin -M clamav
    

添加配合amavisd-new使用的用户amavis

	#groupadd amavis
	#useradd -g amavis -s /sbin/nologin -M amavis

	#tar zxvf clamav-0.96.1.tar.gz
	#cd clamav-0.96.1
	#./configure --prefix=/usr/local/clamav --with-dbdir=/usr/local/clamav/share --sysconfdir=/etc/clamav
	#make
	#make check
	#make install
	

（3）配置Clam AntiVirus
编辑主配置文件：

	#vi /etc/clamav/clamd.conf

	注释掉第八行的Example,如下：
	# Example

	找到如下行
	#LogFile /tmp/clamd.log
	#PidFile /var/run/clamd.pid
	LocalSocket /tmp/clamd.socket
	#DatabaseDirectory /var/lib/clamav
	#User clamav
	修改为：
	LogFile /var/log/clamav/clamd.log
	PidFile /var/run/clamav/clamd.pid
	LocalSocket /var/run/clamav/clamd.socket
	DatabaseDirectory /usr/local/clamav/share
	User amavis

	启用以下选项
	LogSyslog yes
	LogFacility LOG_MAIL
	LogVerbose yes
	StreamMaxLength 20M   (后面的数值应该与邮件服务器允许的最大附件值相一致)

	编辑更新进程的配置文件
	#vi /etc/clamav/freshclam.conf

	注释掉Example，如下:
	# Example

	找到如下行
	#DatabaseDirectory /var/lib/clamav
	#UpdateLogFile /var/log/freshclam.log
	分别修改为：
	DatabaseDirectory /usr/local/clamav/share
	UpdateLogFile /var/log/clamav/freshclam.log

	启用以下选项：
	DatabaseMirror db.XY.clamav.net   (您可以去clamav官方网站查看升级服务器并添加至此处db.CN.clamav.net)
	LogSyslog yes
	LogFacility LOG_MAIL
	LogVerbose yes
	

（4）建立日志所在的目录、进程与socket所在的目录，并让它属于clamav用户：

	# mkdir -v /var/log/clamav
	# chown -R amavis.amavis /var/log/clamav
	# mkdir -v /var/run/clamav
	# chmod 700 /var/run/clamav
	# chown -R amavis.amavis /var/run/clamav

	建立日志文件
	#touch   /var/log/clamav/freshclam.log
	#chown   clamav.clamav   /var/log/clamav/freshclam.log
	

（5）配置crontab，让Clam AntiVirus每小时检测一次新的病毒库：

	# crontab -e
	添加：
	37 * * * * /usr/local/clamav/bin/freshclam
	

（6）配置库文件搜索路径：

	# echo "/usr/local/clamav/lib">> /etc/ld.so.conf
	# ldconfig
	

（7）配置clamav开机自动启动

	# echo /usr/local/clamav/sbin/clamd /etc/rc.local
	

【安装SpamAssassin-3.3.1】
（1）依赖关系的解决，安装Spamassassin需要很多perl模块的支持，以下是所需模块列表及安装方法；必须的软件包：
Digest::SHA1
HTML::Parser
Net::DNS
LWP (aka libwww-perl)
HTTP::Date
IO::Zlib
Archive::Tar

可选的软件包，其中有些后面的amavisd也有可能会用到:
MIME::Base64
DB_File
Net::SMTP
Mail::SPF
IP::Country::Fast
Net::Ident
IO::Socket::INET6
IO::Socket::SSL
Compress::Zlib
Time::HiRes
Mail::DKIM
Mail::DomainKeys
DBI *and* DBD driver/modules
Encode::Detect
Apache::Test
Razor2

推荐使用CPAN自动安装（你的主机要能连上Internet），它能够自动下载安装，并能解决安装过程中的依赖关系。您可以使用类同的以下的命令来进行安装:
#perl -MCPAN -e shell
cpan> install Digest::SHA1
………………

如果您的主机无法直接连接到Internet，您也可以到http://search.cpan.org上搜索下载所需要的软件包，而后使用类同的下列命令安装：

	#tar zxvf 软件包.tar.gz
	#cd 软件包
	#perl Makefile.PL
	#make
	#make test
	#make install
	

说明：某些软件包安装的过程中可能需要已经列出的其它软件包的支持（可以先尝试安装Spamassassin,然后按提示补充所需软件包），请安照提示自行调整安装顺序。另外，其中有个软件包安装过程中可能要求声明环境变量LC_ALL，此时，可输入如下命令，并重新进行软件包的编译安装即可。

#export LC_ALL=C

（2）安装Mail-SpamAssassin-3.3.1

	#tar jxvf Mail-SpamAssassin-3.3.1.tar.bz2
	#cd Mail-SpamAssassin-3.3.1
	#perl Makefile.PL
	#make
	#make check
	#make install

	编辑主配置文件/etc/mail/spamassassin/local.cf
	required_hits 10.0
	rewrite_subject 1
	required_score 5.0
	rewrite_header Subject *****SPAM*****
	report_safe     1
	use_bayes    1
	bayes_auto_learn        1
	skip_rbl_checks       1
	use_razor2    0
	use_pyzor    0
	ok_locales    all
	

在这部分安装的过程中可能会遇到一些问题，请使用perl -MCPAN -e shell之后>cpan install spamassassin.
注：笔者在安装的过程中也遇到了Mail::SPF这个模块儿无法安装的情况，这个需要更新CPAN的版本才可以解决。很简单，这里不再详述。
（3）测试spamassassin

	#spamassassin -t < sample-nonspam.txt > nonspam.out
	#spamassassin -t < sample-spam.txt > spam.out
	

（4）查看测试结果：

	#less nonspam.out
	#less spam.out
	

（5）检查配置文件

#spamassassin -d --lint

（6）启动进程，并将其加入到自动启动队列

	#/usr/bin/spamd -d
	#echo "/usr/bin/spamd -d" >> /etc/rc.local
	

【安装amavisd-new】
（1）依赖关系的解决
以下为官方声明所必须的软件包列表，使用perl -MCPAN -e shell进行安装
Archive::Zip
Compress::Zlib
Convert::TNEF
Convert::UUlib
MIME::Base64
MIME::Parser
Mail::Internet
Net::Server
Digest::MD5
IO::Stringy
Time::HiRes
Unix::Syslog
BerkeleyDB
有些可能在上面已经安装，但是为了保险起见，还是建议逐个验证一遍。
（2）创建运行时目录，并赋予amavis用户（前文中所建）

	# mkdir -pv /var/amavis/{tmp,var,db,home}
	# chown -R amavis:amavis /var/amavis
	#chmod -R 750 /var/amavis
	

（3）安装amavisd-new-2.6.4

	# tar -zxvf amavisd-new-2.6.4.tar.gz
	# cd amavisd-new-2.6.4
	拷贝服务端至$PATH中指定的目录，推荐拷贝至/usr/local/sbin：
	#cp amavisd /usr/local/sbin/
	#chown root /usr/local/sbin/amavisd
	#chmod 755 /usr/local/sbin/amavisd
	拷贝主配置文件至/etc，并修改相应的权限：
	#cp amavisd.conf /etc
	# chown root:amavis /etc/amavisd.conf
	# chmod 640 /etc/amavisd.conf
	创建amavisd运行中所需要的隔离区域：
	# mkdir -v /var/virusmails
	# chown amavis:amavis /var/virusmails/
	# chmod 750 /var/virusmails/
	

（4）编辑主配置文件

	#vi /etc/amavisd.conf

	确保您的如下选项的值如下文所示：
	$daemon_user   = 'amavis';
	$daemon_group = 'amavis';
	$mydomain = 'xxt.cn'; (此处可更改为自己的DNS域)

	$virus_admin             = "postmaster\@$mydomain";
	$mailfrom_notify_admin     = "postmaster\@$mydomain";
	$mailfrom_notify_recip     = "postmaster\@$mydomain";
	$mailfrom_notify_spamadmin = "postmaster\@$mydomain";
	$mailfrom_to_quarantine = '';

	virus_admin_maps => ["postmaster\@$mydomain"] (指定报告病毒和垃圾邮件时发送系统邮件的用户身份)
	spam_admin_maps   => ["postmaster\@$mydomain"]

	启用ClamAV,(大概在第363行)去掉如下行前的注释符:
	#['ClamAV-clamd',
	#     \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd"],
	# qr/\bOK$/, qr/\bFOUND$/,
	#    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
	#     ['Mail::ClamAV', \&ask_clamav, "*", [0], [1], qr/^INFECTED: (.+)/],---在375行

	并将如上行中的/var/run/clamav/clamd修改为:/var/run/clamav/clamd.socket
	

（5）测试启动

	#/usr/local/sbin/amavisd
	也可以按如下命令调试启动：
	#/usr/local/sbin/amavisd debug
	注意加到开机启动中
	echo “/usr/local/sbin/amavisd”>>etc/rc.d/rc.local

	可能会遇到下面的错误：
	fetch_modules: error loading optional module MIME/Decoder/BinHex.pm:
	  Can't locate Convert/BinHex.pm in @INC (@INC contains: /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.8/i386-linux-thread-multi /usr/lib/perl5/5.8.8) at /usr/lib/perl5/site_perl/5.8.8/MIME/Decoder/BinHex.pm line 43.
	  BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/MIME/Decoder/BinHex.pm line 43.
	  Compilation failed in require at /usr/local/sbin/amavisd line 197.
	这个时候就需要下载Convert-BinHex-1.119.tar.gz，安装后再启动。
	#tar -zxvf Convert-BinHex-1.119.tar.gz
	#cd Convert-BinHex-1.119
	#perl Makefile.PL
	#make
	#make install
	

【配置postfix，让它能调用amavisd，以实现病毒及垃圾邮件的过滤】
（1）配置/etc/postfix/master.cf

	#vi /etc/postfix/master.cf
	在文末添加如下内容：
	# ==========================================================================
	# service type   private unpriv   chroot   wakeup   maxproc command + args
	#             (yes) (yes) (yes) (never) (100)
	# ==========================================================================
	#
	amavisfeed unix -    -    n    -    2     smtp
	-o smtp_data_done_timeout=1200
	-o smtp_send_xforward_command=yes
	-o disable_dns_lookups=yes
	-o max_use=20
	#
	127.0.0.1:10025 inet n -    n    -    -     smtpd
	-o content_filter=
	-o smtpd_delay_reject=no
	-o smtpd_client_restrictions=permit_mynetworks,reject
	-o smtpd_helo_restrictions=
	-o smtpd_sender_restrictions=
	-o smtpd_recipient_restrictions=permit_mynetworks,reject
	-o smtpd_data_restrictions=reject_unauth_pipelining
	-o smtpd_end_of_data_restrictions=
	-o smtpd_restriction_classes=
	-o mynetworks=127.0.0.0/8,192.168.0.0/16
	-o smtpd_error_sleep_time=0
	-o smtpd_soft_error_limit=1001
	-o smtpd_hard_error_limit=1000
	-o smtpd_client_connection_count_limit=0
	-o smtpd_client_connection_rate_limit=0
	-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
	-o local_header_rewrite_clients=

	说明：注意每行“-o”前的空格
	

（2）修改/etc/postfix/main.cf

	#vi /etc/postfix/main.cf
	在文末添加如下行：
	content_filter=amavisfeed:[127.0.0.1]:10024
	

（3）让postfix重新加载主配置文件，并查看启动情况

# postfix reload && tail -f /var/log/maillog

（4）查看amavisd是否在监听10024端口，并测试服务启动情况：

	[root@mail postfix]# telnet localhost 10024
	Trying 127.0.0.1...
	Connected to localhost.localdomain (127.0.0.1).
	Escape character is '^]'.
	220 [127.0.0.1] ESMTP amavisd-new service ready
	ehlo localhost
	250-[127.0.0.1]
	250-VRFY
	250-PIPELINING
	250-SIZE
	250-ENHANCEDSTATUSCODES
	250-8BITMIME
	250-DSN
	250 XFORWARD NAME ADDR PORT PROTO HELO SOURCE
	quit
	221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel
	Connection closed by foreign host.
	

（5）postfix重新加载配置文件后将授权并激活”127.0.0.1:10025″端口，一个正常的服务连接应该类同下面所示：
[root@mail postfix]# telnet localhost 10025
Trying 127.0.0.1…
Connected to localhost.localdomain (127.0.0.1).
Escape character is ‘^]’.
220 Welcome to our mail.jiunile.com ESMTP,Warning: Version not Available!
EHLO localhost
250-mail.jiunile.com
250-PIPELINING
250-SIZE 52428800
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye
Connection closed by foreign host.
（6）通过amavisd测试发信
[root@mail ~]# telnet localhost 10024
Trying 127.0.0.1…
Connected to localhost.localdomain (127.0.0.1).
Escape character is ‘^]’.
220 [127.0.0.1] ESMTP amavisd-new service ready
HELO localhost
250 [127.0.0.1]
MAIL FROM:<>
250 2.1.0 Sender <> OK
RCPT TO:
250 2.1.5 Recipient OK
DATA
354 End data with .

From:Anti-Virus tester
To: MailServer Admin
Subject:amavisd test!
amavisd test!!
.
250 2.0.0 Ok, id=32278-01, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 3FE6A7488EB
quit
221 2.0.0 [127.0.0.1] amavisd-new closing transmission channel
Connection closed by foreign host.
（7）使用EXTmail登陆xp用户查看邮件的情况，如果收到则说明功能正常。

【测试使用反病毒及反垃圾模块】
（1）病毒邮件发送测试
登录extmail，发送带有病毒附件的邮件(病毒样本在一个压缩包中)，查看发送情况:
#tail –f /var/log/maillog
Aug 11 18:07:13 mail clamd[4821]: SelfCheck: Database status OK.
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p493: VGEN.6.0 FOUND
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p250: Jerusalem-USA FOUND
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p251: DOS.PS-MPC.432 FOUND
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p249: VGEN.6.0 FOUND
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p252: Albania-429.A FOUND
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p253: Albania.1 FOUND
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p254: Albania.1 FOUND
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p255: Small.130-gen FOUND
Aug 11 18:07:13 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p256: Vgen.1065 FOUND
Aug 11 18:07:14 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p258: Abraxas-1200 FOUND
Aug 11 18:07:14 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p259: Abraxas-1214 FOUND
Aug 11 18:07:14 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p260: Abraxas-15xx FOUND
Aug 11 18:07:14 mail clamd[4821]: /var/amavis/tmp/amavis-20100811T165819-32278/parts/p261: Abraxas-15xx FOUND
Aug 11 18:07:14 mail postfix/smtpd[350]: connect from localhost.localdomain[127.0.0.1]
Aug 11 18:07:14 mail postfix/smtpd[350]: AC4BD7488ED: client=localhost.localdomain[127.0.0.1]
Aug 11 18:07:14 mail postfix/cleanup[342]: AC4BD7488ED: message-id=
Aug 11 18:07:15 mail postfix/smtpd[350]: disconnect from localhost.localdomain[127.0.0.1]
Aug 11 18:07:15 mail postfix/qmgr[32702]: AC4BD7488ED: from=
, size=12833, nrcpt=1 (queue active)
Aug 11 18:07:15 mail amavis[32278]: (32278-06) Blocked INFECTED (VGEN.6.0, Jerusalem-USA, DOS.PS-MPC.432, Albania-429.A, Albania.1, Small.130-gen, Vgen.1065, Abraxas-1200, Abraxas-1214, Abraxas-15xx, _0523_0001_001, ARCV-Made-255, ARCV-330, ARCV.562, ARCV.570, Ice.2, ARCV.773, DOS.Arcv.839, DOS.PS-MPC.447, ARCV.Anna.742, DOS.ARCV.745, DOS.Arcv.1183, Arcv.Christmas, ICE-9.A, Arcv.Ice.250, Gen.1575.B, Acid-670, AvatarAcid-674, DOS.Johanna, ARCV.Joanna.912, DOS.ARCV.Gen, Clonewar-923.A, Gen.649, Fire.795, DOS.X-2.Gen, Arcv-1060, ADA, Adolph.3, Advent, VCL.Shirley, Tic-1, Agip, AIDSII, AIDS.1, Dropper.5, BootSectorDr, Aircop-c, Hydra.3, Dropper.1, Alabama-B, Yale, DOS.Eddie, Redx, BadTaste, Amoeba.1, Pixel-296, Amstrad-740, Amstrad.1, Amstrad.2, Pixel-852, Jerusalem.9, Plastique.3, Plastique.2, AntiCAD-4096, Plastique.5, Jerusalem.2.Nemesis, Jerusalem.1, Andryushka.1, Andromeda.1140, Ohlala, Anthrax-E, Anti-D.2, Civil_War.561, V-1L, Plastique.1, Anti-Faggot, ChristmasViolator, Antimit, Antimon, VLADAnt…
Aug 11 18:07:15 mail amavis[32278]: (32278-06) …ipode, DOS.Simulated.Virus, VGEN.10.0, VGEN.11.0, Anto-1, Pascal-400, Pascal-440, AntiPas-480, Pascal-529, AntiPas-605, Vgen.1334, V2000, April-1st.A, April-1st.E, Joke.Pani, Armageddon.C, Gen.742, DOS.Arara.1057, ARCV-4, VirTool.ARCV, Violator.1, Argentina, Ash.1, Ash-449, Ash.451, SillyC-737, ImpotentG, Ash-1602, Ash-1604, Asp, Astra-101, AT-133, AT-140.1, AT.144.B, AT.144.A, AT-149.B, VGEN.17.0, Atom-350, VCL.O.371, Atomic-480, Atomic, Attention.3, AT-II-114, ATII-118, AT-II-122, Atomic.2, Atom-Ant, Attitude.548, Attitude-724.825, Aurea.A, AustrPara.152, AustrPara.153.B, Austr.Para-155, Austr.Para-162, Austr.Para-187, Austr.Para-215, Austr.Parasite.3, Austr.Para-306, Austr.Para-338, Austr.Para-369, Austr.Para-377, AnkeHuber, DOS.Austr_Parasite.440, Austr.Para-482, DOS.Anke, Austr.Para-550, Austr.Para-588, Austr.Para-615, Austr.Para-784, Austr.Para-762, Gen.403.B, Clipper, DOS.AusTerm.3490, Austr.Para-VGADemo, DarkAvenger-1947), MYNETS LOCAL [127....
Aug 11 18:07:15 mail amavis[32278]: (32278-06) …0.0.1] [127.0.0.1] -> , quarantine: virus-YeO+kSgVIMCX, Message-ID: <20100811100712.768407488EC@mail.jiunile.com>, mail_id: YeO+kSgVIMCX, Hits: -, size: 403109, 2439 ms
（2）至此postfix的所有软件已经搭建完毕，就开始享受你自己的mail之旅吧！GOOD LUCK！

注：以上整个的配置过程均从互联网搜集并进行相关的整理与测试。供大家参考。