Scanning e-mail for virusses with ClamAV and Sendmail

Sendmail configuration

I realize that without explaining the Sendmail configuration a bit, the packages I provide for scanning mail with ClamAV are of little use.

The ClamAV package I provide starts 3 daemons:

• clamd - the virussanning workhorse

• freshclam - the "live update" engine

• clamav-milter - the daemon which communicates with sendmail

Allthough important for the working of the package, freshclam is not important in this discussion. It updates the virus definitions

The clamd daemon is more important. It is the scanning engine. It creates a socket through which helper applications - like clamav-milter - communicate with it. My package comes pre-configured to make this socket in /var/run/clamav an is named clamd.sock

The clamav-milter daemon uses the socket which clamd makes to actually do the scanning. To communicate with sendmail it makes its own socket in /var/run/clamav named clmilter.sock.

All this - and more - is configured in my ClamAV package. The Sendmail package offers a Sendmail executable with milter support. Configuring Sendmail to use the socket clamav-milter supplies is left to the sysop.

This sounds worst than it is. Configuring Sendmail for clamav-milter is easy using m4 macro's.

The file /usr/doc/clamav-0.68/clamav-milter/INSTALL explain this configuration in detail. It gives some good pointers on how to configure Sendmail when using multiple - ie clamav and spamassassin - filters. I would suggest you read it!

For now to get ClamAV and Sendmail working..... bear with me:

The thing that has to be done it to tell sendmail to use the socket clamav-milter made . You could edit /etc/mail/sendmail.cf by hand, but using the m4 macro's would be wise. To do this you will have to edit /usr/share/sendmail/cf/cf/sendmail-slackware.mc and add the following section:

INPUT_MAIL_FILTER(`clmilter', `S=local:/var/run/clamav/clmilter.sock, F=, T=S:4m;R:4m')dnl
define(`confINPUT_MAIL_FILTERS', `clmilter')

• S=local:/var/run/clamav/clmilter.sock offcourse is the socket created by clamav-milter

• F= tells Sendmail what to do if the filter fail, blank means act as if there is no filter. You could use "R" for reject or "T" for temporary fail.

• T= determens timeouts:

  • S:4m a timeout of 4 minutes for sending to the filter

  • R:4m a timeout of 4 minutes for receiving from the filter

Perhaps you will have to make other changes to this file for your site - that is the reason it is not included in the package - but that is beyond the scope of this little help file

After you have made your own hacks all that is left is making a sendmail.cf from this file

m4 sendmail-slackware.mc > my-sendmail.cf