Du kannst nicht mehr als 25 Themen auswählen Themen müssen mit entweder einem Buchstaben oder einer Ziffer beginnen. Sie können Bindestriche („-“) enthalten und bis zu 35 Zeichen lang sein.

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568
  1. SNFServer Installation and Configuration
  2. Copyright (C) 2008 ARM Research Labs, LLC.
  3. See www.armresearch.com for the copyright terms.
  4. Installing SNFServer to filter email involves the following steps:
  5. 1) Check prerequisites.
  6. 2) Create the snfuser user and group.
  7. 3) Build and install the SNFServer package (using a tarball or a
  8. package).
  9. 4) Configure the SNFServer package.
  10. 5) Interface with the MTA (postfix or sendmail).
  11. 6) Configure the OS to start and stop SNFServer on bootup and
  12. shutdown.
  13. The following sections describes each of these steps for a default
  14. installation. Any OS-specific issues are described at the end of each
  15. section.
  16. Prerequisites
  17. *************
  18. Before installing SNFServer, make sure that:
  19. 1) The program curl must be installed.
  20. Creating the snfuser user and group
  21. ***********************************
  22. Before installing, the snfuser user and group must be created. For
  23. increased security, snfuser user has no shell.
  24. OS-specific issues--
  25. The commands to create the snfuser user and group are OS dependent.
  26. For your convenience, the commands for creating the user and group for
  27. varous OSes are listed here. However, no guarantee is made that these
  28. commands will work on your system; please refer to your system
  29. documentation.
  30. 1) OpenBSD:
  31. a) 'useradd -g =uid -m -c "Sniffer Account" -s /bin/false snfuser'.
  32. 2) Ubuntu:
  33. a) 'adduser --gecos "Sniffer Account" --no-create-home --shell /bin/false snfuser'.
  34. 3) RedHat (and variants such as Fedora and CentOS):
  35. a) 'adduser --comment "Sniffer Account" -M --shell /bin/false snfuser'
  36. 4) Suse:
  37. a) 'groupadd snfuser'
  38. b) 'useradd -c "Sniffer Account" -s /bin/false -g snfuser snfuser'
  39. 5) FreeBSD:
  40. a) 'pw user add -c "Sniffer Account" -n snfuser -w no -s /bin/false'
  41. Building and installing SNFServer
  42. *********************************
  43. For some operating systems, configuration files are normally installed
  44. in /etc, and the installation of the remaining files are in /usr
  45. (i.e. /usr/sbin, /usr/share/snf-server, etc). In other operating
  46. systems, the files are installed in /usr/local/etc or /usr/local.
  47. The directories to install are specified by the '--prefix' and
  48. '--sysconfdir' options to the configure script (see below).
  49. To build and install from the tarball--
  50. 1) Extract the distribution from the tarball: 'tar xvzf
  51. snf-server-X.Y.Z.tar.gz', where X.Y.Z is the version of the
  52. distribution.
  53. 1) 'cd' to the source directory.
  54. 2) Run the configure script. See the section on OS-specific issues
  55. for the options to specify. This configures the package.
  56. 3) Type 'make'. This builds the package.
  57. 4) Type 'make install'. This installs the package in the default
  58. directories.
  59. The following files are installed:
  60. Executables and scripts in sbin:
  61. SNFServer
  62. SNFClient
  63. SNF2Check
  64. getRulebase.sample
  65. snfSniffer.sample
  66. snfSnifferFilter.sample
  67. snfscan-standalone.sample
  68. snfServerControl.sample
  69. Sample configuration files in etc/snf-server:
  70. SNFServer.xml.sample
  71. identity.xml.sample
  72. In share/snf-server
  73. GBUdbIgnoreList.txt.sample
  74. During operation of SNFServer, the following files are created:
  75. In share/snf-server:
  76. *.snf
  77. Log files
  78. UpdateReady.txt
  79. Temporary files
  80. OS-specific options for ./configure:
  81. 1) OpenBSD:
  82. ./configure --enable-os-type=OpenBSD --sysconfdir=/etc
  83. 2) FreeBSD:
  84. ./configure --enable-os-type=FreeBSD
  85. 3) Ubuntu:
  86. ./configure --enable-os-type=Ubuntu --sysconfdir=/etc --prefix=/usr
  87. 4) RedHat (and variants such as Fedora and CentOS):
  88. ./configure --enable-os-type=RedHat --sysconfdir=/etc --prefix=/usr
  89. 5) Suse:
  90. ./configure --enable-os-type=Suse --sysconfdir=/etc --prefix=/usr
  91. Configuration
  92. *************
  93. Configuration consists of creating the configuration files used by
  94. SNFServer from the sample configuration files of the distribution.
  95. There are three configuration files. The location of the files
  96. described in this section are for the installation in /usr and /etc.
  97. Two of the files are in /etc/snf-server:
  98. 1) SNFServer.xml (sample configuration file is
  99. SNFServer.xml.sample).
  100. 2) identity.xml (sample configuration file is identity.xml.sample).
  101. and one in /usr/share/snf-server:
  102. 1) GBUdbIngoreList.txt (sample configuration file is
  103. GBUdbIgnoreList.txt.sample).
  104. To configure SNFServer, do the following:
  105. 1) Copy SNFServer.xml.sample to SNFServer.xml, and edit as follows:
  106. a) Specify the directories. The default directories are:
  107. <node identity='/etc/snf-server/identity.xml'>
  108. <log path='/var/log/snf-server/'/>
  109. <rulebase path='/usr/share/snf-server/'/>
  110. <workspace path='/usr/share/snf-server/'/>
  111. <update-script on-off='on' call='/usr/sbin/getRulebase'
  112. guard-time='180'/>
  113. The paths need to be changed only if the default directories are
  114. not used.
  115. If desired for security purposes, restrict the permissions of
  116. SNFServer.xml. For example, to make SNFServer.xml readonly by
  117. only the snfuser user and snfuser group, enter the following:
  118. chmod 440 SNFServer.xml
  119. 2) Copy identity.xml.sample to identity.xml, and edit to include the
  120. license ID and authentication attributes of the <identity> element.
  121. If desired for security purposes, restrict the permissions of
  122. identity.xml. For example, to make identity.xml readonly by only
  123. snfuser, enter the following:
  124. chmod 400 identity.xml
  125. 3) Copy GBUdbIngoreList.txt.sample to GBUdbIgnoreList.txt, and edit
  126. as appropriate (the file format is described in the comments in the
  127. file). See README for more information on this file.
  128. 4) In the directory for the update script specified in the
  129. configuration file (default: /usr/sbin):
  130. a) Copy getRulebase.sample to getRulebase, and edit as follows:
  131. i) In the line
  132. AUTHENTICATION=authenticationxx
  133. replace authenticationxx with the authentication for the
  134. SNFServer license.
  135. ii) In the line
  136. LICENSE_ID=licenseid
  137. replace licenseid with the license ID of the SNFServer
  138. license.
  139. iii) Any other changes as necessary if the default directories
  140. are not used.
  141. b) Ensure that getRulebase is executable by the snfuser user.
  142. This can be done with the command:
  143. chmod +x getRulebase
  144. 5) Ensure that the snfuser user has read/write access to the files
  145. in workspace (default: /usr/share/snf-server or
  146. /usr/local/share/snf-server) and configuration directory (default:
  147. /etc/snf-server). To grant this access, enter the following
  148. command, as the root user:
  149. chown -R snfuser:snfuser /usr/share/snf-server
  150. chown -R snfuser:snfuser /etc/snf-server
  151. As you modify files in these directories, please ensure that the
  152. read/write permissions for snfuser is maintained.
  153. 6) Create the logfile directory, and ensure the snfuser user has
  154. read/write access to it:
  155. mkdir /var/log/snf-server
  156. chown snfuser:snfuser /var/log/snf-server
  157. chmod 755 /var/log/snf-server
  158. 7) Download the rulebase file:
  159. a) 'cd /usr/share/snf-server'. If the workspace specified in the
  160. configuration file is not the default, this command should be
  161. changed accordingly.
  162. b) 'touch UpdateReady.txt'.
  163. c) 'chown snfuser UpdateReady.txt'.
  164. d) 'su -m snfuser -c "/usr/sbin/getRulebase"'. If getRulebase is
  165. in a different directory, this command should be changed
  166. accordingly.
  167. OS-specific issues--
  168. None.
  169. Configuring the OS
  170. ******************
  171. The OS can be configured to automatically start and stop SNFServer on
  172. system startup and shutdown. The following gives the procedure for
  173. each OS:
  174. OpenBSD:
  175. 1) Add the following line to /etc/rc.local:
  176. /usr/local/sbin/snf-server start
  177. 2) Add the following line to /etc/rc.shutdown:
  178. /usr/local/sbin/snf-server stop
  179. 3) Run '/usr/local/sbin/snf-server start' to start the server.
  180. FreeBSD:
  181. 1) Create the directory /etc/rc.conf.d (if it doesn't exist).
  182. 2) Create the file /etc/rc.conf.d/snfserver with the contents:
  183. snfserver_enable="YES"
  184. 3) Run '/usr/local/etc/rc.d/snf-server start' to start the server.
  185. Ubuntu:
  186. 1) Set the VERBOSE variable in /etc/default/rcS to control the
  187. script output.
  188. 2) Configure the system to run the script. With sysv-rc-conf:
  189. sysv-rc-conf -level 2345 snf-server on
  190. will start the server for runlevels 2, 3, 4, and 5.
  191. And
  192. sysv-rc-conf --list snf-server
  193. will list the runlevels for which the server is started.
  194. 3) Run '/etc/init.d/snf-server start' to start the server.
  195. RedHat (and variants such as Fedora) and Suse:
  196. 1) Run 'chkconfig --add snf-server'. This sonfigures the system to
  197. run the script on startup and shutdown.
  198. 2) Run 'chkconfig --list snf-server' to display the runlevels
  199. 3) Run 'service snf-server start' to start the SNFServer.
  200. Integration with MTAs
  201. *********************
  202. The section assumes you will be using SNFServer with an MTA and simply
  203. injecting headers that will be used later to remove, quarantine, or
  204. otherwise redirect messages detected as spam. There are as many ways
  205. to use SNFServer as there are systems using it -- so the following is
  206. just a good starting point.
  207. It is presumed that SNFServer is configured with x-header injection
  208. turned on and that the x-headers have been customized to suit your
  209. needs. Check the <xheaders/> section of your
  210. /etc/snf-server/SNFServer.xml file to verify that SNFServer is
  211. configured to do what you want.
  212. Integration with postfix
  213. ------------------------
  214. One way to integrate with postfix is to configure postfix to use the
  215. snfSniffer script (described below) as a content filter. The
  216. snfSniffer script passes the message through SNFServer, and then
  217. reinjects the message into the mail system.
  218. 1) In /usr/sbin (or /usr/local/sbin), copy the script
  219. snfSniffer.sample to snfSniffer set the correct access rights:
  220. cp snfSniffer.sample snfSniffer
  221. chown snfuser snfSniffer
  222. chmod 550 snfSniffer
  223. The default snfSniffer script creates a temporary copy of the message,
  224. scans it with SNFServer, and then reinjects the message.
  225. 2) Change /etc/postfix/master.cf as follows (LEADING WHITE SPACES
  226. ARE IMPORTANT WHEN MAKING THIS CHANGE):
  227. change (each line is enclosed in single quotes; add only the text
  228. between the single quotes):
  229. 'smtp inet n - n - - smtpd'
  230. to:
  231. 'smtp inet n - n - - smtpd'
  232. ' -o content_filter=snfilter:dummy'
  233. also add:
  234. 'snfilter unix - n n - 10 pipe'
  235. ' flags=Rq user=snfuser argv=/usr/sbin/snfSniffer'
  236. ' -f ${sender} -- ${recipient}'
  237. to master.cf. Specify the directory snfSniffer is in if not
  238. /usr/sbin.
  239. At this point you could just restart postfix, and hope nothing goes
  240. wrong. Instead, it would be smarter to first test the installation
  241. from the command line by injecting a message directly into the filter
  242. script "snfSniffer". We can issue a command like (in directory
  243. /usr/share/snf-server):
  244. /usr/sbin/snfSniffer -f sender recipient < junkmsg.txt
  245. Where junkmsg.txt is a spam test message. We should also test
  246. a clean message to make sure that this script is working as we
  247. expect it to. In this case we would issue a command like
  248. /usr/sbin/snfSniffer -f sender recipient < cleanmsg.txt
  249. If you've done everything correctly then all you have to do is reload
  250. postfix to start the content_filter working.
  251. 4) 'postfix reload'. Restart postfix.
  252. 5) To stop using the snfSniffer filter:
  253. i) Comment out or remove the '-o content_filter=snfilter:dummy'
  254. line in the /etc/postfix/master.cf file.
  255. ii) 'postsuper -r ALL' to remove content filter request records
  256. from existing queue files.
  257. iii) 'postfix reload' to reload the postfix configuration.
  258. OS-specific issues--
  259. 1) OpenBSD: In the default postfix configuration for OpenBSD, the
  260. postfix programs run chrooted in /var/spool/postfix. For that
  261. configuration, the /etc/pwd.db file needs to be made available to
  262. the postfix programs. This can be done by copying pwd.db:
  263. cp /etc/pwd.db /var/spool/postfix/etc
  264. If the /etc/pwd.db file is modified after copying, the postfix
  265. system issues a warning. To avoid this warning, copy the
  266. /etc/pwd.db file to /var/spool/postfix/etc directory whenever
  267. /etc/pwd.db is modified.
  268. Integration with sendmail
  269. -------------------------
  270. One way to integrate with send is to configure sendmail to use the
  271. snfSnifferFilter script (described below) as a filter. The snfSniffer
  272. script passes the message through SNFServer, and then sends the
  273. message to stdout. The integration is done by having sendmail use
  274. procmail to filter all mail (which is normally the default), and
  275. configuring procmail to use snfSnifferFilter as a filter.
  276. 1) In /usr/sbin (or /usr/local/sbin), copy the script
  277. snfSnifferFilter.sample to snfSnifferFilter set the correct access
  278. rights:
  279. cp snfSnifferFilter.sample snfSnifferFilter
  280. chown snfuser snfSnifferFilter
  281. chmod 550 snfSnifferFilter
  282. The default snfSnifferFilter script creates a temporary copy of the
  283. message, scans it with SNFServer, and then send the message to
  284. stdout.
  285. 2) Verify that sendmail is configured to use procmail to deliver
  286. mail. Please see the sendmail and procmail documentation for how
  287. to do this.
  288. 3) Create the file /etc/procmailrc (or whatever the system procmail
  289. rcfile is; see the procmail documentation for the path on your
  290. system) to contain the following lines:
  291. ':0 fw'
  292. '| /usr/sbin/snfSnifferFilter'
  293. where the single quotes are not to be included.
  294. At this point mail should be filtered by SNFServer. To check this,
  295. issue a command like (in directory /usr/share/snf-server):
  296. /usr/sbin/snfSnifferFilter < junkmsg.txt
  297. Where junkmsg.txt is a spam test message. We should also test a clean
  298. message to make sure that this script is working as we expect it to.
  299. In this case we would issue a command like
  300. /usr/sbin/snfSnifferFilter < cleanmsg.txt
  301. In either case you should see the message with the headers added by
  302. SNFServer.
  303. 4) To stop using the snfSnifferFilter:
  304. i) Comment out or remove the two lines you added to /etc/procmailrc.
  305. OS-specific issues--
  306. 1) OpenBSD: The default sendmail confiugration might not use
  307. procmail. To configure sendmail to use procmail, please ensure that
  308. procmail is installed and see the procmail documentation
  309. (/usr/local/share/examples/procmail/advanced) for the procedure to
  310. integrate procmail as an integrated local mail delivery agent.
  311. By default, procmail is installed in /usr/local/bin, and the system
  312. procmail rcfile is /etc/procmailrc.
  313. After you make the changes, stop sendmail with 'pkill sendmail', and
  314. start it with 'sendmail -bd'.
  315. 2) FreeBSD: The default sendmail confiugration might not use
  316. procmail. To configure sendmail to use procmail, please ensure that
  317. procmail is installed and see the procmail documentation
  318. (/usr/local/share/examples/procmail/advanced) for the procedure to
  319. integrate procmail as an integrated local mail delivery agent.
  320. By default, procmail is installed in /usr/local/bin, and the system
  321. procmail rcfile is /usr/local/etc/procmailrc.
  322. After you make the changes, restart sendmail with
  323. '/etc/rc.d/sendmail restart'.
  324. 3) RedHat, Fedora, Centos, Suse, and Ubuntu: Restart sendmail with
  325. '/etc/init.d/sendmail restart'.
  326. Debugging
  327. ---------
  328. To obtain additional information for debugging, SNFServer can be run
  329. in debug mode. In debug mode, additional messages are output to a
  330. file, and core dumps are enabled. Debug mode is enabled and disabled
  331. using the snf-server startup script. Please see the section
  332. "Configuring the OS" the the location of the startup script for each
  333. OS.
  334. To enable debug mode, run:
  335. snf-server debug_mode
  336. Note: Running this command creates a file
  337. /usr/share/snf-server/debug_mode that indicates to the snf-server
  338. startup script to start SNFServer in debug mode. This file contains
  339. brief documentation about running in debug mode.
  340. To enable production mode (non-debug mode), run:
  341. snf-server production_mode
  342. Note: Running this command creates a file
  343. /usr/share/snf-server/production_mode that indicates to the snf-server
  344. startup script to start SNFServer in production mode. This file has
  345. the same content as /usr/share/snf-server/debug_mode.
  346. After the desired mode is enabled, you can start or restart SNFServer
  347. using the standard procedure.
  348. In debug mode for all OSes except OpenBSD, SNFDebugServer is run with
  349. strace (with the '-r -tt -v' options), and all the output is written
  350. to /var/log/snf-server/debug.log. Also, any core dumps are written to
  351. /usr/share/snf-server.
  352. In debug mode for OpenBSD, SNFDebugServer is run with ktrace. The
  353. output of SNFDebugServer is written to /var/log/snf-server/debug.log,
  354. and the output of strace is written to /var/log/snf-server/ktrace.out.
  355. OS-specific issues--
  356. 1) FreeBSD: You'll need to ensure that core dumps are enabled. On
  357. FreeBSD 7.0, the command to do this is:
  358. sysctl kern.coredump=1
  359. You'll also need to ensure that /proc is mounted. You can mount
  360. /proc with the following command:
  361. mount -t procfs proc /proc
  362. When running in debug mode, 'snf-server start' displays the PID of
  363. the strace process instead of the SNFDebugServer process.
  364. 'snf-server status' displays the PID values correctly.
  365. 2) OpenBSD: Use kdump to view the kernal trace file:
  366. kdump /var/log/snf-server/ktrace.out