Rspamd Einrichten: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 1: | Zeile 1: | ||
| − | =Rspamd und ClamAV installieren= | + | =Rspamd und ClamAV installieren= |
| − | ==Debian/Ubuntu== | + | ==Debian/Ubuntu== |
| − | + | * apt install rspamd clamav-daemon clamav-freshclam redis-server postfix swaks | |
| − | ==RHEL/CentOS== | + | ==RHEL/CentOS== |
| − | + | * dnf install rspamd clamav clamav-update redis postfix swaks | |
| − | =Enablen und | + | |
| − | + | =Enablen und Starten der Dienste= | |
| − | + | * systemctl enable rspamd --now | |
| + | * systemctl enable clamav-daemon --now | ||
| + | * systemctl enable redis-server --now | ||
=== Redis-Anbindung (Das Gedächtnis von Rspamd) === | === Redis-Anbindung (Das Gedächtnis von Rspamd) === | ||
| − | + | * Rspamd nutzt Redis für Bayes, Cache und Greylisting. | |
| − | + | * Ohne Redis ist das System funktional eingeschränkt. | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
==== Konfiguration in Rspamd ==== | ==== Konfiguration in Rspamd ==== | ||
| − | + | * Datei: /etc/rspamd/local.d/redis.conf | |
| − | |||
| − | |||
| − | Datei: /etc/rspamd/local.d/redis.conf | ||
| − | |||
<pre> | <pre> | ||
| − | |||
servers = "127.0.0.1:6379"; | servers = "127.0.0.1:6379"; | ||
</pre> | </pre> | ||
| − | |||
| − | |||
==== Prüfung der Anbindung ==== | ==== Prüfung der Anbindung ==== | ||
| − | + | * rspamadm control stat | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
==== Warum das für ClamAV wichtig ist ==== | ==== Warum das für ClamAV wichtig ist ==== | ||
| + | * Scan-Ergebnisse werden gecached. | ||
| + | * Identische Anhänge werden nicht mehrfach gescannt. | ||
| − | + | =Zustand prüfen= | |
| + | * systemctl status rspamd | ||
| + | * systemctl status clamav-daemon | ||
| + | * systemctl status redis-server | ||
| − | + | =Rspamd Dienste und Ports= | |
| − | + | ==Rspamd Milter== | |
| − | + | * Schnittstelle zu Postfix | |
| − | + | <pre> | |
| − | + | Port: 11332/tcp | |
| − | |||
| − | |||
| − | |||
| − | =Dienste und Ports | ||
| − | ==Rspamd | ||
| − | * | ||
| − | <pre> | ||
| − | Port: 11332/tcp | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
</pre> | </pre> | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| + | ==Rspamd Worker== | ||
<pre> | <pre> | ||
| − | + | Port: 11333/tcp | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
</pre> | </pre> | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| + | ==Rspamd Controller== | ||
<pre> | <pre> | ||
| − | + | Port: 11334/tcp | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
</pre> | </pre> | ||
| − | = | + | =Passwort für den Rspamd Controller= |
| + | * rspamadm pw | ||
| − | + | * Datei: /etc/rspamd/override.d/worker-controller.inc | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
<pre> | <pre> | ||
| − | + | password = "HASH"; | |
| − | + | bind_socket ="*:11334"; | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
</pre> | </pre> | ||
| − | == | + | =Postfix Anbindung (Milter)= |
| − | + | * postconf -e "smtpd_milters=inet:127.0.0.1:11332" | |
| − | + | * postconf -e "non_smtpd_milters=inet:127.0.0.1:11332" | |
| − | + | * postfix reload | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | == | + | =Spam Test (GTUBE)= |
| + | * swaks --to root@localhost --server 127.0.0.1 --data "Subject: GTUBE XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X" | ||
| − | + | =ClamAV Integration (UNIX Socket)= | |
| + | * Kommunikation erfolgt lokal über Socket (kein TCP notwendig) | ||
| − | === /etc/clamav/clamd.conf | + | ==ClamAV Konfiguration== |
| + | * Datei: /etc/clamav/clamd.conf | ||
<pre> | <pre> | ||
| − | + | LocalSocket /run/clamav/clamd.ctl | |
| − | + | LocalSocketMode 666 | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
</pre> | </pre> | ||
| − | + | * Wichtig: | |
| + | * TCPSocket und TCPAddr müssen deaktiviert sein | ||
| − | Rspamd | + | ==Rspamd Konfiguration== |
| − | + | * Datei: /etc/rspamd/override.d/antivirus.conf | |
| − | |||
| − | |||
<pre> | <pre> | ||
enabled = true; | enabled = true; | ||
| Zeile 308: | Zeile 87: | ||
type = "clamav"; | type = "clamav"; | ||
symbol = "CLAM_VIRUS"; | symbol = "CLAM_VIRUS"; | ||
| − | servers = " | + | servers = "/run/clamav/clamd.ctl"; |
| − | |||
scan_text_mime = true; | scan_text_mime = true; | ||
scan_mime_parts = true; | scan_mime_parts = true; | ||
| − | |||
min_size = 0; | min_size = 0; | ||
| − | |||
scan_unauthenticated = true; | scan_unauthenticated = true; | ||
| − | |||
stream = true; | stream = true; | ||
| − | + | action = "reject"; | |
| − | |||
} | } | ||
</pre> | </pre> | ||
| − | == | + | =Virus Test (EICAR)= |
| − | + | * Datei erstellen: | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
<pre> | <pre> | ||
| − | + | From: test@test.local | |
| − | + | To: root@localhost | |
| − | + | Subject: EICAR | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | From: | ||
| − | To: | ||
| − | Subject: EICAR | ||
MIME-Version: 1.0 | MIME-Version: 1.0 | ||
| − | Content-Type: multipart/mixed; boundary=" | + | Content-Type: multipart/mixed; boundary="abc" |
| − | -- | + | --abc |
| − | Content-Type: text/plain | + | Content-Type: text/plain |
| − | + | Test | |
| − | -- | + | --abc |
| − | Content-Type: application/ | + | Content-Type: application/octet-stream |
Content-Disposition: attachment; filename="eicar.com" | Content-Disposition: attachment; filename="eicar.com" | ||
| − | |||
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* | X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* | ||
| − | -- | + | --abc-- |
</pre> | </pre> | ||
| − | + | * Test: | |
| − | + | * rspamc /tmp/test.eml | |
| − | rspamc | ||
| − | |||
| − | |||
| − | = | + | =Rspamd Schwellenwerte= |
| − | + | {| class="wikitable" | |
| − | + | ! Aktion !! Score !! Bedeutung | |
| − | + | |- | |
| − | + | | reject | |
| − | + | | 15.0 | |
| − | + | | Mail wird abgelehnt | |
| − | + | |- | |
| − | + | | add_header | |
| − | + | | 6.0 | |
| − | + | | Spam-Header wird gesetzt | |
| − | + | |- | |
| − | + | | greylist | |
| − | + | | 4.0 | |
| − | + | | temporäre Ablehnung | |
| − | + | |- | |
| − | + | | no action | |
| − | + | | < 4.0 | |
| − | + | | Mail ist sauber | |
| − | + | |} | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | < | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | === | + | =Fehlerdiagnose= |
| − | + | ==Logs== | |
| + | * /var/log/rspamd/rspamd.log | ||
| + | * /var/log/clamav/clamav.log | ||
| − | + | ==Live Analyse== | |
| − | + | * tail -f /var/log/rspamd/rspamd.log | grep -E "clamav|virus" | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | ==Kommunikation prüfen== | |
| − | + | * redis-cli flushall | |
| − | + | * systemctl restart rspamd | |
| − | + | ==UNIX Socket Debug== | |
| − | + | * apt install strace | |
| − | + | * strace -p $(pidof clamd) -e trace=network | |
| − | + | ==TCP Debug (optional)== | |
| − | + | * apt install tcpdump | |
| − | + | * tcpdump -ni lo port 3310 | |
Version vom 22. März 2026, 09:07 Uhr
Rspamd und ClamAV installieren
Debian/Ubuntu
- apt install rspamd clamav-daemon clamav-freshclam redis-server postfix swaks
RHEL/CentOS
- dnf install rspamd clamav clamav-update redis postfix swaks
Enablen und Starten der Dienste
- systemctl enable rspamd --now
- systemctl enable clamav-daemon --now
- systemctl enable redis-server --now
Redis-Anbindung (Das Gedächtnis von Rspamd)
- Rspamd nutzt Redis für Bayes, Cache und Greylisting.
- Ohne Redis ist das System funktional eingeschränkt.
Konfiguration in Rspamd
- Datei: /etc/rspamd/local.d/redis.conf
servers = "127.0.0.1:6379";
Prüfung der Anbindung
- rspamadm control stat
Warum das für ClamAV wichtig ist
- Scan-Ergebnisse werden gecached.
- Identische Anhänge werden nicht mehrfach gescannt.
Zustand prüfen
- systemctl status rspamd
- systemctl status clamav-daemon
- systemctl status redis-server
Rspamd Dienste und Ports
Rspamd Milter
- Schnittstelle zu Postfix
Port: 11332/tcp
Rspamd Worker
Port: 11333/tcp
Rspamd Controller
Port: 11334/tcp
Passwort für den Rspamd Controller
- rspamadm pw
- Datei: /etc/rspamd/override.d/worker-controller.inc
password = "HASH"; bind_socket ="*:11334";
Postfix Anbindung (Milter)
- postconf -e "smtpd_milters=inet:127.0.0.1:11332"
- postconf -e "non_smtpd_milters=inet:127.0.0.1:11332"
- postfix reload
Spam Test (GTUBE)
- swaks --to root@localhost --server 127.0.0.1 --data "Subject: GTUBE XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X"
ClamAV Integration (UNIX Socket)
- Kommunikation erfolgt lokal über Socket (kein TCP notwendig)
ClamAV Konfiguration
- Datei: /etc/clamav/clamd.conf
LocalSocket /run/clamav/clamd.ctl LocalSocketMode 666
- Wichtig:
- TCPSocket und TCPAddr müssen deaktiviert sein
Rspamd Konfiguration
- Datei: /etc/rspamd/override.d/antivirus.conf
enabled = true;
clamav {
type = "clamav";
symbol = "CLAM_VIRUS";
servers = "/run/clamav/clamd.ctl";
scan_text_mime = true;
scan_mime_parts = true;
min_size = 0;
scan_unauthenticated = true;
stream = true;
action = "reject";
}
Virus Test (EICAR)
- Datei erstellen:
From: test@test.local To: root@localhost Subject: EICAR MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="abc" --abc Content-Type: text/plain Test --abc Content-Type: application/octet-stream Content-Disposition: attachment; filename="eicar.com" X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* --abc--
- Test:
- rspamc /tmp/test.eml
Rspamd Schwellenwerte
| Aktion | Score | Bedeutung |
|---|---|---|
| reject | 15.0 | Mail wird abgelehnt |
| add_header | 6.0 | Spam-Header wird gesetzt |
| greylist | 4.0 | temporäre Ablehnung |
| no action | < 4.0 | Mail ist sauber |
Fehlerdiagnose
Logs
- /var/log/rspamd/rspamd.log
- /var/log/clamav/clamav.log
Live Analyse
- tail -f /var/log/rspamd/rspamd.log | grep -E "clamav|virus"
Kommunikation prüfen
- redis-cli flushall
- systemctl restart rspamd
UNIX Socket Debug
- apt install strace
- strace -p $(pidof clamd) -e trace=network
TCP Debug (optional)
- apt install tcpdump
- tcpdump -ni lo port 3310