Защита от вирусов шифровальщиков

На базе почтового шлюза Postfix. Данная статья пойдет и для обычного рядового сервера на базе Postfix.

Для этой задачи прекрасно справляется фильтр Amavisd-new. Ставим его yum install amavisd-new. Его конфигурационный файл:

use strict;

# COMMONLY ADJUSTED SETTINGS:

@bypass_virus_checks_maps = (1); # controls running of anti-virus code
@bypass_spam_checks_maps = (1); # controls running of anti-spam code
#$bypass_decode_parts = 1; # controls running of decoders&dearchivers

$max_servers = 2; # num of pre-forked children (2..30 is common), -m
$daemon_user = ‘amavis’; # (no default; customary: vscan or amavis), -u
$daemon_group = ‘amavis’; # (no default; customary: vscan or amavis), -g

$mydomain = ‘domain.ru’; # a convenient default for other settings

$MYHOME = ‘/var/spool/amavisd’; # a convenient default for other settings, -H
$TEMPBASE = «$MYHOME/tmp»; # working directory, needs to exist, -T
$ENV{TMPDIR} = $TEMPBASE; # environment variable TMPDIR, used by SA, etc.
$QUARANTINEDIR = undef; # -Q
# $quarantine_subdir_levels = 1; # add level of subdirs to disperse quarantine
# $release_format = ‘resend’; # ‘attach’, ‘plain’, ‘resend’
# $report_format = ‘arf’; # ‘attach’, ‘plain’, ‘resend’, ‘arf’

# $daemon_chroot_dir = $MYHOME; # chroot directory or undef, -R

$db_home = «$MYHOME/db»; # dir for bdb nanny/cache/snmp databases, -D
# $helpers_home = «$MYHOME/var»; # working directory for SpamAssassin, -S
$lock_file = «/var/run/amavisd/amavisd.lock»; # -L
$pid_file = «/var/run/amavisd/amavisd.pid»; # -P
#NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually

$log_level = 0; # verbosity 0..5, -d
$log_recip_templ = undef; # disable by-recipient level-0 log entries
$DO_SYSLOG = 1; # log via syslogd (preferred)
$syslog_facility = ‘mail’; # Syslog facility as a string
# e.g.: mail, daemon, user, local0, … local7
$syslog_priority = ‘debug’; # Syslog base (minimal) priority as a string,
# choose from: emerg, alert, crit, err, warning, notice, info, debug

$enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny)
$enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1
$nanny_details_level = 2; # nanny verbosity: 1: traditional, 2: detailed
$enable_dkim_verification = 1; # enable DKIM signatures verification
$enable_dkim_signing = 1; # load DKIM signing code, keys defined by dkim_key

@local_domains_maps = ( [«.$mydomain»] ); # list of all local domains

@mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 );

$unix_socketname = «$MYHOME/amavisd.sock»; # amavisd-release or amavis-milter
# option(s) -p overrides $inet_socket_port and $unix_socketname

$inet_socket_bind = ‘127.0.0.1’;
$inet_socket_port = 10024; # listen on this local TCP port(s)
# $inet_socket_port = [10024,10026]; # listen on multiple TCP ports

$policy_bank{‘MYNETS’} = { # mail originating from @mynetworks
originating => 1, # is true in MYNETS by default, but let’s make it explicit
os_fingerprint_method => undef, # don’t query p0f for internal clients
};

# it is up to MTA to re-route mail from authenticated roaming users or
# from internal hosts to a dedicated TCP port (such as 10026) for filtering
$interface_policy{‘10026’} = ‘ORIGINATING’;

$policy_bank{‘ORIGINATING’} = { # mail supposedly originating from our users
originating => 1, # declare that mail was submitted by our smtp client
allow_disclaimers => 1, # enables disclaimer insertion if available
# notify administrator of locally originating malware
virus_admin_maps => [«virusalert\@$mydomain»],
spam_admin_maps => [«virusalert\@$mydomain»],
warnbadhsender => 1,
# forward to a smtpd service providing DKIM signing service
# forward_method => ‘smtp:[127.0.0.1]:10027’,
# force MTA conversion to 7-bit (e.g. before DKIM signing)
smtpd_discard_ehlo_keywords => [‘8BITMIME’],
bypass_banned_checks_maps => [1], # allow sending any file names and types
terminate_dsn_on_notify_success => 0, # don’t remove NOTIFY=SUCCESS option
};

$interface_policy{‘SOCK’} = ‘AM.PDP-SOCK’; # only applies with $unix_socketname

# Use with amavis-release over a socket or with Petr Rehor’s amavis-milter.c
# (with amavis-milter.c from this package or old amavis.c client use ‘AM.CL’):
$policy_bank{‘AM.PDP-SOCK’} = {
protocol => ‘AM.PDP’,
auth_required_release => 0, # do not require secret_id for amavisd-release
};

$sa_tag_level_deflt = -999; # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 5.0; # add ‘spam detected’ headers at that level
$sa_kill_level_deflt = -999; # triggers spam evasive actions (e.g. blocks mail)
$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
$sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From
# $sa_quarantine_cutoff_level = 25; # spam level beyond which quarantine is off
$penpals_bonus_score = 8; # (no effect without a @storage_sql_dsn database)
$penpals_threshold_high = $sa_kill_level_deflt; # don’t waste time on hi spam
$bounce_killer_score = 100; # spam score points to add for joe-jobbed bounces

$sa_mail_body_size_limit = 400*1024; # don’t waste time on SA if mail is larger
$sa_local_tests_only = 0; # only tests which do not require internet access?

# @lookup_sql_dsn =
# ( [‘DBI:mysql:database=mail;host=127.0.0.1;port=3306’, ‘user1’, ‘passwd1’],
# [‘DBI:mysql:database=mail;host=host2’, ‘username2’, ‘password2’],
# [«DBI:SQLite:dbname=$MYHOME/sql/mail_prefs.sqlite», », »] );
# @storage_sql_dsn = @lookup_sql_dsn; # none, same, or separate database

# $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP;
# defaults to 0, which is good for non-MySQL or if msgs.time_iso is CHAR(16)

$virus_admin = undef; # notifications recip.

$mailfrom_notify_admin = undef; # notifications sender
$mailfrom_notify_recip = undef; # notifications sender
$mailfrom_notify_spamadmin = undef; # notifications sender
$mailfrom_to_quarantine = »; # null return path; uses original sender if undef

@addr_extension_virus_maps = (‘virus’);
@addr_extension_banned_maps = (‘banned’);
@addr_extension_spam_maps = (‘spam’);
@addr_extension_bad_header_maps = (‘badh’);
# $recipient_delimiter = ‘+’; # undef disables address extensions altogether
# when enabling addr extensions do also Postfix/main.cf: recipient_delimiter=+

$path = ‘/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin’;
# $dspam = ‘dspam’;

$MAXLEVELS = 14;
$MAXFILES = 1500;
$MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not enforced)
$MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes (default undef, not enforced)

$undecipherable_subject_tag = undef;

$sa_spam_subject_tag = ‘***SPAM***’;
$defang_virus = 1; # MIME-wrap passed infected mail
$defang_banned = 1; # MIME-wrap passed mail containing banned name
# for defanging bad headers only turn on certain minor contents categories:
$defang_by_ccat{+CC_BADH.»,3″} = 1; # NUL or CR character in header
$defang_by_ccat{+CC_BADH.»,5″} = 1; # header line longer than 998 characters
$defang_by_ccat{+CC_BADH.»,6″} = 1; # header field syntax error
# OTHER MORE COMMON SETTINGS (defaults may suffice):

$myhostname = ‘mail.energokab.ru’; # must be a fully-qualified domain name!

$notify_method = ‘smtp:[127.0.0.1]:10025’;
$forward_method = ‘smtp:[127.0.0.1]:10025′; # set to undef with milter!

$final_virus_destiny = D_BOUNCE;
$final_banned_destiny = D_BOUNCE;
$final_spam_destiny = D_PASS;
$final_bad_header_destiny = D_PASS;
# $bad_header_quarantine_method = undef;

#$hdrfrom_notify_sender = «\»You tried to send the forbidden investment! Thank you.\» «;

$mailfrom_to_quarantine = »;
# SOME OTHER VARIABLES WORTH CONSIDERING (see amavisd.conf-default for all)

# $warnbadhsender,
# $warnvirusrecip, $warnbannedrecip, $warnbadhrecip, (or @warn*recip_maps)
#
# @bypass_virus_checks_maps, @bypass_spam_checks_maps,
# @bypass_banned_checks_maps, @bypass_header_checks_maps,
#
# @virus_lovers_maps, @spam_lovers_maps,
# @banned_files_lovers_maps, @bad_header_lovers_maps,
#
# @blacklist_sender_maps, @score_sender_maps,
#
# $clean_quarantine_method, $virus_quarantine_to, $banned_quarantine_to,
# $bad_header_quarantine_to, $spam_quarantine_to,
#
# $defang_bad_header, $defang_undecipherable, $defang_spam

@bypass_virus_checks_maps = (
\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);

#$warnvirussender = 1;
#$warnspamsender = 1;
$warnbannedsender = 1;
$warnbadhsender = 1;

$warnvirusrecip = 1;
$warnbannedrecip = 1;

# REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS

@keep_decoded_original_maps = (new_RE(
qr’^MAIL$’, # retain full original message for virus checking
qr’^MAIL-UNDECIPHERABLE$’, # recheck full mail if it contains undecipherables
qr’^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)’i,
# qr’^Zip archive data’, # don’t trust Archive::Zip
));
# for $banned_namepath_re (a new-style of banned table) see amavisd.conf-sample

$banned_filename_re = new_RE(

### BLOCKED ANYWHERE
# qr’^UNDECIPHERABLE$’, # is or contains any undecipherable components
qr’^\.(exe-ms|dll)$’, # banned file(1) types, rudimentary
# qr’^\.(exe|lha|cab|dll)$’, # banned file(1) types

### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
# [ qr’^\.(gz|bz2)$’ => 0 ], # allow any in gzip or bzip2
[ qr’^\.(rpm|cpio|tar)$’ => 0 ], # allow any in Unix-type archives

qr’.\.(pif|scr)$’i, # banned extensions — rudimentary
# qr’^\.zip$’, # block zip type

### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES:
# [ qr’^\.(zip|rar|arc|arj|zoo)$’=> 0 ], # allow any within these archives

qr’^application/x-msdownload$’i, # block these MIME types
qr’^application/x-msdos-program$’i,
qr’^application/hta$’i,

# qr’^message/partial$’i, # rfc2046 MIME type
# qr’^message/external-body$’i, # rfc2046 MIME type

# qr’^(application/x-msmetafile|image/x-wmf)$’i, # Windows Metafile MIME type
# qr’^\.wmf$’, # Windows Metafile file(1) type

# block certain double extensions in filenames
qr’^(?!cid:).*\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$’i,

qr’.\.(exe|vbs|pif|scr|cpl)$’i, # banned extension — basic
qr’.\.(exe|vbs|pif|scr|cpl|bat|cmd|com)$’i, # banned extension — basic+cmd
qr’.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|exe|fxp|grp|hlp|hta|inf|ins|isp|js|jse|

lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi

|msp|mst|ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|wsc|wsf|wsh)$’ix, # banned ext — long разрешил wmf, emf
qr’.\.(ani|cur|ico)$’i, # banned cursors and icons filename
qr’^\.ani$’, # banned animated cursor file(1) type

qr’.\.(mim|b64|bhx|hqx|xxe|uu|uue)$’i, # banned extension — WinZip vulnerab.
);
# See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
# and http://www.cknow.com/vtutor/vtextensions.htm
# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING

@score_sender_maps = ({ # a by-recipient hash lookup table,
# results from all matching recipient tables are summed

# ## per-recipient personal tables (NOTE: positive: black, negative: white)
# ‘user1@example.com’ => [{‘bla-mobile.press@example.com’ => 10.0}],
# ‘user3@example.com’ => [{‘.ebay.com’ => -3.0}],
# ‘user4@example.com’ => [{‘cleargreen@cleargreen.com’ => -7.0,
# ‘.cleargreen.com’ => -5.0}],

## site-wide opinions about senders (the ‘.’ matches any recipient)
‘.’ => [ # the _first_ matching sender determines the score boost

new_RE( # regexp-type lookup table, just happens to be all soft-blacklist
[qr’^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@’i => 5.0],
[qr’^(greatcasino|investments|lose_weight_today|market\.alert)@’i=> 5.0],
[qr’^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@’i=> 5.0],
[qr’^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@’i => 5.0],
[qr’^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@’i => 5.0],
[qr’^(your_friend|greatoffers)@’i => 5.0],
[qr’^(inkjetplanet|marketopt|MakeMoney)\d*@’i => 5.0],
),

# read_hash(«/var/amavis/sender_scores_sitewide»),

{ # a hash-type lookup table (associative array)
‘nobody@cert.org’ => -3.0,
‘cert-advisory@us-cert.gov’ => -3.0,
‘owner-alert@iss.net’ => -3.0,
‘slashdot@slashdot.org’ => -3.0,
‘securityfocus.com’ => -3.0,
‘ntbugtraq@listserv.ntbugtraq.com’ => -3.0,
‘security-alerts@linuxsecurity.com’ => -3.0,
‘mailman-announce-admin@python.org’ => -3.0,
‘amavis-user-admin@lists.sourceforge.net’=> -3.0,
‘amavis-user-bounces@lists.sourceforge.net’ => -3.0,
‘spamassassin.apache.org’ => -3.0,
‘notification-return@lists.sophos.com’ => -3.0,
‘owner-postfix-users@postfix.org’ => -3.0,
‘owner-postfix-announce@postfix.org’ => -3.0,
‘owner-sendmail-announce@lists.sendmail.org’ => -3.0,
‘sendmail-announce-request@lists.sendmail.org’ => -3.0,
‘donotreply@sendmail.org’ => -3.0,
‘ca+envelope@sendmail.org’ => -3.0,
‘noreply@freshmeat.net’ => -3.0,
‘owner-technews@postel.acm.org’ => -3.0,
‘ietf-123-owner@loki.ietf.org’ => -3.0,
‘cvs-commits-list-admin@gnome.org’ => -3.0,
‘rt-users-admin@lists.fsck.com’ => -3.0,
‘clp-request@comp.nus.edu.sg’ => -3.0,
‘surveys-errors@lists.nua.ie’ => -3.0,
’emailnews@genomeweb.com’ => -5.0,
‘yahoo-dev-null@yahoo-inc.com’ => -3.0,
‘returns.groups.yahoo.com’ => -3.0,
‘clusternews@linuxnetworx.com’ => -3.0,
lc(‘lvs-users-admin@LinuxVirtualServer.org’) => -3.0,
lc(‘owner-textbreakingnews@CNNIMAIL12.CNN.COM’) => -5.0,

# soft-blacklisting (positive score)
‘sender@example.net’ => 3.0,
‘.example.net’ => 1.0,

},
], # end of site-wide tables
});
@decoders = (
[‘mail’, \&do_mime_decode],
[‘asc’, \&do_ascii],
[‘uue’, \&do_ascii],
[‘hqx’, \&do_ascii],
[‘ync’, \&do_ascii],
[‘F’, \&do_uncompress, [‘unfreeze’,’freeze -d’,’melt’,’fcat’] ],
[‘Z’, \&do_uncompress, [‘uncompress’,’gzip -d’,’zcat’] ],
[‘gz’, \&do_uncompress, ‘gzip -d’],
[‘gz’, \&do_gunzip],
[‘bz2’, \&do_uncompress, ‘bzip2 -d’],
[‘lzo’, \&do_uncompress, ‘lzop -d’],
[‘rpm’, \&do_uncompress, [‘rpm2cpio.pl’,’rpm2cpio’] ],
[‘cpio’, \&do_pax_cpio, [‘pax’,’gcpio’,’cpio’] ],
[‘tar’, \&do_pax_cpio, [‘pax’,’gcpio’,’cpio’] ],
[‘deb’, \&do_ar, ‘ar’],
# [‘a’, \&do_ar, ‘ar’], # unpacking .a seems an overkill
[‘zip’, \&do_unzip],
[‘7z’, \&do_7zip, [‘7zr’,’7za’,’7z’] ],
[‘rar’, \&do_unrar, [‘rar’,’unrar’] ],
[‘arj’, \&do_unarj, [‘arj’,’unarj’] ],
[‘arc’, \&do_arc, [‘nomarch’,’arc’] ],
[‘zoo’, \&do_zoo, [‘zoo’,’unzoo’] ],
[‘lha’, \&do_lha, ‘lha’],
# [‘doc’, \&do_ole, ‘ripole’],
[‘cab’, \&do_cabextract, ‘cabextract’],
[‘tnef’, \&do_tnef_ext, ‘tnef’],
[‘tnef’, \&do_tnef],
# [‘sit’, \&do_unstuff, ‘unstuff’], # broken/unsafe decoder
[‘exe’, \&do_executable, [‘rar’,’unrar’], ‘lha’, [‘arj’,’unarj’] ],
);
@av_scanners = (

);
@av_scanners_backup = (

);

#@av_scanners = (

# [‘AVG Anti-Virus’,
# \&ask_daemon, [«SCAN {}\n», ‘127.0.0.1:54322’],
# qr/^200 [oO][kK]/m, qr/^403/m, qr/^403 .*?: ([^\r\n]+)/m ],

# );
1; # insure a defined return value

Весь фокус в том, что в конфигурации стоит запрет на определенные разрешения файлов вложений, а также что самое главное  на двойное расширение.

И дешево и сердито.

Поделиться ссылкой:

Защита от вирусов шифровальщиков: 1 комментарий

  1. Сергей

    Как отключить этот антивирус если он стал в связке с iRedMail ? Он блокирует исходящую почту если в ней есть прикрепленный архив или ехе файл. Помогите пожалуйста. Заранее спасибо.

Добавить комментарий

Ваш адрес email не будет опубликован.

Этот сайт использует Akismet для борьбы со спамом. Узнайте, как обрабатываются ваши данные комментариев.