AVG Linux E-mail Server User manual

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
AVG 7.1 for Linux E-mail Server
User Manual
Document revision 71.7 (15.6.2006)
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
This product uses RSA Data Security, Inc. MD5 Message-Digest Algorithm, Copyright (C) 1991-2, RSA
Data Security, Inc. Created 1991.
This product uses code from C-SaCzech library, Copyright (c) 1996-2001 Jaromir Dolecek
<[email protected]>
This product uses compression library zlib, Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler
This product uses libtar library, Copyright (c) 1998-2003 University of Illinois Board of Trustees,
Copyright (c) 1998-2003 Mark D. Roth
This product uses compression library libbzip2, Copyright (C) 1996-2002 Julian R Seward
This product uses XML parser library expat, Copyright (C) 1998, 1999 James Clark
This product uses library libcurl, Copyright (c) 1996 - 2003, Daniel Stenberg, <[email protected]>
This product includes Flex software developed by the University of California, Berkeley and its
contributors, Copyright (c) 1993 The Regents of the University of California
All other trademarks are property of their respective owners.

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
2
Contents
1. Introduction........................................................................................... 3
2. Before Installation................................................................................. 4
2.1. Prerequisites .................................................................................... 4
2.2. Installation Package .......................................................................... 5
3. Installation and Launch ......................................................................... 6
4. Third Party Products ............................................................................ 10
4.1. AVG Anti-Virus Vendor Patches ..........................................................10
4.2. AMaViS...........................................................................................11
4.3. Qmail-Scanner.................................................................................13
4.4. Testing the Installation .....................................................................18
5. E-mail Scanning ................................................................................... 19
5.1. General Principles ............................................................................19
5.2. Performance and Resource Usage.......................................................19
5.3. Using Unix Socket for an Extra Security...............................................20
6. Commercial E-mail Servers .................................................................. 21
6.1. AVG for Lotus Notes/Domino Server Installation and Maintenance...........21
6.2. AVG for Kerio MailServer Maintenance.................................................29
7. Standalone Command Line Modules..................................................... 33
7.1. AVGSCAN Command.........................................................................33
7.2. AVGUPDATE Command .....................................................................36
7.3. On-access Scanner...........................................................................40
7.4. Service Signals ................................................................................42
8. Configuration File................................................................................. 43
8.1. AvgCommon....................................................................................43
8.2. OnAccessScanner.............................................................................44
8.3. AvgDaemon ....................................................................................44
8.4. AvgUpdate ......................................................................................45
9. FAQ and Technical Support .................................................................. 47

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
3
1. Introduction
This User Manual is the full documentation describing AVG for Linux E-mail
Server.
a) AVG for Linux E-mail Server Kernel Features
AVG for Linux E-mail Server is a product based on the AVG for Linux
scanning kernel. The AVG for Linux kernel provides comprehensive and
reliable protection against viruses for Linux powered machines. It offers many
features, such as scheduled and on-demand scanning of folders, files, and
common archive types for possible virus infection. You can also perform a
scheduled or on-demand update of your AVG Anti-Virus either from the
Internet or from local update sources.
b) AVG for Linux E-mail Server E-mail Scanning Features
The incoming and outgoing e-mail messages processed by the supported mail
transport agents (MTA) are watched by constantly running AVG Anti-Virus
process (memory resident scanning daemon). This means the e-mail spooling
queues are protected and scanned regularly by AVG for Linux E-mail
Server. The AVG Anti-Virus e-mail scanning performance can be easily
controlled and configured using AVG for Linux daemon signals and
comprehensive configuration file parameters.
c) AVG for Linux E-mail Server – Command Line Modules
Powerful standalone command line modules are also included in the AVG for
Linux E-mail Server installation. You can perform all possible on-demand file
system tests and updates using these modules. They can be also utilized
within for example the cron utility in order to schedule a regular automatic
test or update.

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
4
2. Before Installation
2.1. Prerequisites
Before installing AVG for Linux E-mail Server you must verify that your system
meets the following requirements:
a) Libraries
The following libraries are required in order to ensure the AVG for Linux
kernel can be installed and run properly:
olibc.so.6
b) Open Source E-mail Servers Supported
osendmail
The traditional sendmail mail transport agent (MTA, Linux synonym
for lightweight e-mail server) is included in most modern Linux
distributions. The latest version is also available for free at
http://www.sendmail.org.
oqmail
The latest version is available for free at http://cr.yp.to/qmail.html;
an extensive description of download, installation, and maintenance
issues related to qmail is also provided at http://www.lifewithqmail.org.
opostfix
The postfix MTA is a popular alternative to the widely used sendmail
e-mail server; the latest version is available for free at
http://www.postfix.org/.
oexim
This MTA can be also used as replacement for the common
sendmail e-mail server, although its configuration and maintenance
principles differ; the latest version of the exim e-mail server is available
for free at http://www.exim.org.
c) Commercial E-mail Servers Supported
oLotus Notes/Domino Server for Linux
oKerio MailServer for Linux
d) AMaViS – A Mail Virus Scanner
One of the varieties of AMaViS (amavis, amavisd, amavisd-new or
amavis-ng) is needed for the sendmail, postfix,exim and qmail mail
transport agents in order to enable e-mail scanning with the use of AVG for
Linux E-mail Server. AMaViS is available for free at http://www.amavis.org.
Note: We recommend using the amavisd-new scanner which offers the best
compatibility with AVG for Linux E-mail Server and better overall
performance for all supported mail transport agents.

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
5
Refer to chapter 4.2 Third Party Products/AMaViS to see how to install the
AMaViS scanner, and how to integrate it with AVG for Linux E-mail Server.
e) Qmail-Scanner
If you use the qmail MTA, an alternative solution to AMaVis mail virus
scanner is
Qmail-Scanner – the e-mail content scanner designed to be used exclusively
with qmail. Qmail-Scanner is available for free at http://qmail-
scanner.sourceforge.net/.
Refer to section 4.3 Third Party Products/Qmail-Scanner to see how to install
the Qmail-Scanner mail virus scanner and how to integrate it with AVG for
Linux E-mail Server.
f) DAZUKO Kernel Module
The DAZUKO kernel module is necessary for the proper function of the AVG
for Linux E-mail Server on-access scanner. DAZUKO is available for free at
http://www.dazuko.org.
Refer to section 7.3 Standalone Command Line Modules/On-access Scanner
for detailed information on this topic.
2.2. Installation Package
AVG for Linux E-mail Server installation packages are available on the installation
CD in the form of RPM packages for various Linux distributions, or in the form of a
precompiled .tar.gz package. You can also download the latest appropriate package
version from http://www.grisoft.com,Download/Programs section.

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
6
3. Installation and Launch
AVG for Linux E-mail Server installation packages are provided as RPM files or
.tar.gz package.
zFor the installation from the RPM file, use the
$ rpm -i avg71{edition}-r{version}-a{version of avi}.i386.rpm
command in your shell (accessible for example using the xterm application
within your X window system).
For the installation from the .tar.gz package, use the
z$ tar -xvzf avg71{edition}-r{version}-a{version of avi}.i386.tar.gz
command in the directory where the package is located to unpack its content.
Switch to the unpacked avg7-linux directory then and run the
$ ./install.sh
installation script.
Note: The program files of the AVG for Linux E-mail Server versions 11 and older
are installed into the /usr/local/lib/avg7 directory. Even if you perform the full
update of older version of your AVG Anti-Virus, the directory structure remains the
same (ensuring the backwards compatibility). However, all essential components of
AVG for Linux E-mail Server are always updated properly to offer you the
maximum security and reliability.
The versions 12 and newer are comprehensively installed into the /opt/grisoft
directory. Symbolic links are created in various system directories, leading to the
/opt/grisoft directory subtree. If you want to upgrade the old directory structure,
you must completely reinstall your AVG for Linux E-mail Server. Note that in this
documentation is always described the preferred newer location of AVG for Linux
E-mail Server installation!
In the installation packages' names:
zthe version stands for the minor version number of AVG for Linux E-mail
Server,
zthe distribution string stands for the specification of Linux distribution (if
necessary to distinguish it) which is the package intended for,
zthe specification string stands for the AVG Anti-Virus internal virus
database specification number.
Installation of GUI from a Specific Package:
Graphical user interface (GUI) can be installed from specific packages, found at
http://www.grisoft.com,Download/Programs section.
zYou can install GUI from a .tar.gz package as follows (for distributions that do
not support RPM installation):
Download latest .tar.gz and unpack it:

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
7
# tar xzvf avggui-1.0-{release}.i386.tar.gz
Change directory to avggui:
# cd avggui1
Run the installation script as root then:
$ ./install.sh
zIf your distribution supports it, you can install GUI from RPM package:
Download latest rpm and install it:
# rpm -i avggui-1.0-{release}.i386.rpm
Launch the /opt/grisoft/avggui/bin/avggui_update_licinfo.sh script as root
for updating license information after installation.
Note: You can configure PAM authentication (used in avggui run by a non-root user
when changing license information) in the file /etc/pam.d/avggui.
a) Distributions Currently Supported
Distribution Installation package
Mandrake Linux, Red
Hat, Red Flag, Fedora
Core and other
systems supporting
the RPM packager
utility
avg71{edition}-r{version}-a{version of
avi}.i386.rpm
Any other Linux
distribution (e. g.
Debian, Slackware,
Gentoo etc.)
avg71{edition}-r{version}-a{version of
avi}.i386.tar.gz
b) The Installation Process
The installation process will automatically determine all features of your
system and will perform the proper installation of AVG for Linux E-mail
Server on your computer. Perform installation from the packages mentioned
in the table above to also install the AVG for Linux E-mail Server command
line modules (besides the e-mail scanning daemons).
(See chapter 7. Standalone Command Line Modules for detailed information on
this topic).

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
8
c) Product Registration
After the installation process you need to register your AVG for Linux E-mail
Server unless it has been registered already during the installation process;
this applies to special packages for AVG Anti-Virus vendor partners.
The registration can be performed by launching the
$ avgscan -register
command in your shell.
(See chapter 7.1 Standalone Command Line Modules/AVGSCAN Command for
details).
d) Launching the E-mail Scanning Daemon
Having installed and registered your AVG for Linux E-mail Server you must
start the AVG for Linux services. These services completely cover both e-mail
and on-access scanning modules that run as memory resident daemons. The
daemons can be controlled using the signal mechanism and AVG for Linux E-
mail Server configuration file.
(See chapters 7.4 Standalone Command Line Modules/Service Signals and 8.
Configuration File for detailed information).
Launch the services as root (only root can send signals to daemons):
# /etc/init.d/avgd start
If you are not logged in as root, the command responds with respective
warning.
You can use the
$ su
command and apply the superuser password to change your identity to the
root.
Note: The fact you are logged in as root is usually indicated by the '#'
character at the beginning of your prompt. The normal user identity is
indicated by the '$' character.
See chapter 5. E-mail Scanning for detailed information on the e-mail
scanning daemon.
Note: The e-mail scanning daemon serves its purpose only when a mail
transport agent and possibly the necessary third party software are present
and properly configured! See chapter 4. Third Party Products for basic
information on how to install and setup additional tools needed to enable the
e-mail anti-virus protection with AVG for Linux E-mail Server.

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
9
For proper function of the on-access scanning daemon the DAZUKO kernel
module is required. Refer to section 7.3 Standalone Command Line
Modules/On-access Scanner for detailed information on this topic.
The included command line modules can be operated as described in chapter
7. Standalone Command Line Modules.

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
10
4. Third Party Products
Third party software is needed to preprocess incoming and outgoing e-mail
messages content before they can be scanned by AVG for Linux E-mail Server.
Two solutions are available for particular e-mail servers – the AMaViS and the
Qmail-Scanner security packages.
Both of these packages require AVG for Linux E-mail Server and optionally some
AVG Anti-Virus vendor patches to be installed before attempting to install and
configure them properly on your system. The AMaViS e-mail content scanner can
be used with the sendmail, postfix, qmail and exim mail transport agents; the
Qmail-Scanner can be used with qmail only.
Supported commercial e-mail servers (Lotus Notes/Domino and Kerio
MailServer) do not require such tools. See chapter 6. Commercial E-mail Servers
for more information on this topic.
4.1. AVG Anti-Virus Vendor Patches
Before installing the AMaViS package amavis (various versions supported) you
must apply the AVG Anti-Virus patch. Supposing you have unpacked the
installation file, switch to the unpacked directory, copy the amavis-{version}-
avg.patch file there (included in the AVG for Linux
E-mail Server installation package), and apply the patch using the
$ patch -p1 < amavis-{version}-avg.patch
command.
Run autoconf with the
$ autoconf
command.
Then create the aclocal.m4 file using the
$ touch aclocal.m4
command and continue with the installation as described in chapter 4.2 Third Party
Products/AMaViS.
Note: The patch is needed only for the amavis variant of AMaViS. For the version
‘p7’ and higher of the recommended amavisd-new you just have to uncomment
the AVG Anti-Virus related lines in the amavisd.conf file. For older versions, use
the respective amavisd-new patch
Besides the amavis patch, the Qmail-Scanner (versions 1.20, 1.22) patch is also
needed when you are planning to install this tool. Switch to the unpacked Qmail-
Scanner installation directory and copy the qmail-scanner-{version}-avg.patch
file (included in the AVG for Linux E-mail Server installation package) there.
Apply the patch using the

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
11
$ patch -p1 < qmail-scanner-{version}-avg.patch
command, and follow the installation instructions as described in chapter 4.3 Third
Party Products/Qmail-Scanner.
4.2. AMaViS
You can download the package from the http://www.amavis.org/download/ page.
Four separate packages are available:
zamavis for low and medium mail volume (home or small office use with up to
ten accounts)
zamavisd for higher mail volume
zamavisd-new for higher mail volume with various add-ons included (such as
anti-spam or ISP features)
Note: We strongly recommend the amavisd-new variant to be used with
AVG for Linux E-mail Server!
zamavis-ng, a modular rewrite of amavis (intended for experienced
administrators and/or AMaViS developers); this project is not being
developed any longer, although its source code can be obtained via the
AMaViS CVS repository.
a) Prerequisites
The C language compiler and also the make and autconf / automake
utilities are needed to build the AMaViS tools.
The essential modules responsible for extracting e-mail content and passing it
to the AVG for Linux E-mail Server scanning engine are implemented in
Perl. This is why the Perl language interpreter has to be installed on your
system. The following Perl modules are required:
oArchive::Tar (Archive-Tar-x.xx)
oArchive::Zip (Archive-Zip-x.xx, version 1.09 or later is recommended!)
oCompress::Zlib (Compress-Zlib-x.xx)
oConvert::TNEF (Convert-TNEF-x.xx)
oConvert::UUlib (Convert-UUlib-x.xxx, stick to the newest version)
oMIME::Base64 (MIME-Base64-x.xx)
oMIME::Parser (MIME-Tools-x.xxxx)
oMail::Internet (MailTools-1.58 or later have workarounds for Perl 5.8.0
bugs)
oNet::Server (Net-Server-x.xx)
oNet::SMTP (libnet-x.xx, use libnet-1.16 or later for better
performance)
oDigest::MD5 (Digest-MD5-x.xx)
oIO::Stringy (IO-stringy-x.xxx)

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
12
oTime::HiRes (Time-HiRes-x.xx, use 1.49 or later, older versions can
cause problems)
oUnix::Syslog (Unix-Syslog-x.xxx)
oBerkeleyDB with bdb library 3.2 or later (4.2 or later preferred)
All of these modules are available for free at http://www.cpan.org/. The usual
way of installing a new Perl module consists of unpacking the downloaded file,
switching into the unpacked directory, and running the following sequence of
commands as root:
# perl Makefile.PL
...
# make test
...
# make install
Make sure AVG for Linux E-mail Server is installed and operational before
starting the AMaViS installation.
b) Installation
To install AMaViS from the source code, unpack the selected downloaded
package (the amavis package is given in the following example):
$ tar -xvzf amavis-{version}.tar.gz
Switch to the unpacked directory. It is recommended to read the detailed
instructions in the INSTALL and/or README file located in this directory. The
easiest way of performing the installation is to run the following sequence of
commands as root (although the installation steps may slightly differ
according to the particular AMaViS package):
# ./configure
...
# make
...
# make install
...
c) Configuration
Most configuration options should have been resolved by automatic
configuration. Of course, it is also possible to perform manual changes to the
generated amavis script (note that the exact name of the script may depend
on which AMaViS package you have decided to install). If you switch to a

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
13
different MTA, you must re-run AMaViS configuration, because the script
contains only the code for the MTA it was initially configured for.
The configuration steps to be taken for particular mail transport agent consist
of making small subtle changes in the related configuration files in order to
ensure AMaViS can access the messages in the mail transport agent's queue
before they are processed further. As MTA configuration is specific for each
agent as well as for the particular administrator options and policies, it is not
covered in detail in this documentation.
If you experience any problems with integrating your mail transport agent and
AMaViS, refer to your mail transport agent documentation, and also to the
README.{MTA_name} file in the README_FILES subdirectory of the
AMaViS installation directory (the MTA_name stands for the name of your
mail transport agent). These README files contain detailed information and
configuration examples for all supported mail transport agents.
4.3. Qmail-Scanner
a) Prerequisites
The qmail version 1.03 or higher is needed.
Make sure the reformime tool for reformatting the MIME e-mail format is
installed on your computer. The reformime package can be obtained for free
at http://prdownloads.sourceforge.net/courier/.
Also the Perl language interpreter (version 5.005_03 or higher) and the
following Perl modules are needed:
oTime::HiRes
oDB_File
oSys::Syslog
All of these modules are available for free at http://www.cpan.org/. The usual
way of installing a new Perl module consists of unpacking the downloaded file,
switching into the unpacked directory, and running the following sequence of
commands as root:
# perl Makefile.PL
...
# make test
...
# make install
The qmailqueue patch is needed in order to enable qmail to call a different
qmail-queue program than the one compiled by default. The patch
instructions and also the patching process details are presented at
http://www.qmail.org/qmailqueue-patch. Here is a direct example transcript
(according to the previous website) of the differences that have to be
performed:

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
14
diff -u qmail-1.03-orig/Makefile qmail-1.03/Makefile
--- qmail-1.03-orig/Makefile Mon Jun 15 04:53:16 1998
+++ qmail-1.03/Makefile Tue Jan 19 10:52:24 1999
@@ -1483,12 +1483,12 @@
trigger.o fmtqfn.o quote.o now.o readsubdir.o qmail.o date822fmt.o \
datetime.a case.a ndelay.a getln.a wait.a seek.a fd.a sig.a open.a \
lock.a stralloc.a alloc.a substdio.a error.a str.a fs.a auto_qmail.o \
-auto_split.o
+auto_split.o env.a
./load qmail-send qsutil.o control.o constmap.o newfield.o \
prioq.o trigger.o fmtqfn.o quote.o now.o readsubdir.o \
qmail.o date822fmt.o datetime.a case.a ndelay.a getln.a \
wait.a seek.a fd.a sig.a open.a lock.a stralloc.a alloc.a \
- substdio.a error.a str.a fs.a auto_qmail.o auto_split.o
+ substdio.a error.a str.a fs.a auto_qmail.o auto_split.o env.a
qmail-send.0: \
qmail-send.8
diff -u qmail-1.03-orig/qmail.c qmail-1.03/qmail.c
--- qmail-1.03-orig/qmail.c Mon Jun 15 04:53:16 1998
+++ qmail-1.03/qmail.c Tue Jan 19 09:57:36 1999
@@ -6,14 +6,25 @@
#include "fd.h"
#include "qmail.h"
#include "auto_qmail.h"
+#include "env.h"
-static char *binqqargs[2] = { "bin/qmail-queue", 0 } ;

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
15
+static char *binqqargs[2] = { 0, 0 } ;
+
+static void setup_qqargs()
+{
+ if(!binqqargs[0])
+ binqqargs[0] = env_get("QMAILQUEUE");
+ if(!binqqargs[0])
+ binqqargs[0] = "bin/qmail-queue";
+}
int qmail_open(qq)
struct qmail *qq;
{
int pim[2];
int pie[2];
+
+ setup_qqargs();
if (pipe(pim) == -1) return -1;
if (pipe(pie) == -1) { close(pim[0]); close(pim[1]); return -1; }
Before installing the software a special account must be created, which the
Qmail-Scanner processes will run under. By default, the user/group name for
this account is qscand. For extra security, create it with a normal home
directory (e.g. /home/qscand), but with a "fake" shell (e.g. /bin/false), as
Qmail-Scanner never logs in directly.
Make sure AVG for Linux E-mail Server is installed and operational before
attempting to install Qmail-Scanner.
b) Installation
Unpack the Qmail-Scanner package using the
$ tar -xvzf qmail-scanner-{version}.tgz

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
16
command (the version stands for the downloaded package version).
Switch to the unpacked directory and run the
$ ./configure –help
command if you want to get an overview of possible configuration options.
Run the
$ ./configure
command (possibly with selected options). This determines all the features
and recognizes the AVG for Linux E-mail Server virus scanning software on
your computer.
Run the
# ./configure –install
command as root this time (again, possibly with other options you have
selected before). This updates the qmail directory structure on your system
and also installs the
qmail-scanner-queue.pl script.
You can test the installation using the
$ ./contrib/test_installation.sh
command in the installation directory. This will send four e-mails: one normal,
two infected with the EICAR anti-virus test file, and one obvious spam to the
root's address. Ideally
Qmail-Scanner should let one through, catch the viruses, and tag the spam
as "spammy" (if SpamAssassin is installed of course). As Qmail-Scanner
initially defaults not to notifying anyone when a virus is caught, you may have
to view the logs (e.g. syslog) to see what Qmail-Scanner exactly did.
c) Configuration
To enable Qmail-Scanner to access the e-mail queue contents the qmail-
smtpd daemon has to be told that qmail knows to use the qmail-scanner-
queue.pl script instead of the default qmail-queue binary executable. This is
done via the TCP server control files for SMTP. See where the TCP server for
qmail-smtpd gets its rules from according to your installation options of
qmail mail transport agent. Edit the rule file and tell qmail-smtpd what IP
address range (corresponding to SMTP client IP addresses) you want Qmail-
Scanner to be invoked on. You should select all the addresses to be scanned.
A typical example of changing the rule file for the qmail-smtpd daemon
follows:
#/etc/tcpserver/smtp.rules
#

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
17
# No Qmail-Scanner at all for mail from 127.0.0.1
127.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qm
ail-queue"
# Use Qmail-Scanner without SpamAssassin on any mail from the local
network
# [it triggers SpamAssassin via the presence of the RELAYCLIENT var]
10.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmai
l-scanner-
queue.pl"
#
# Use Qmail-Scanner with SpamAssassin on any mail from the rest of the
world
:allow,QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl"
The above example means that all SMTP e-mails will be scanned, but each in a
different manner according to the address classification. E-mail from the LAN
(the 10. prefixed network) will be scanned by the AVG for Linux E-mail
Server whereas e-mail from the Internet will be scanned for viruses (and also
tagged by SpamAssassin if present). This control philosophy provides you
with a lot of versatility – virus scanning can be only performed for example on
mail coming from your Exchange server and not on mail from your Unix
servers.
Note: You must increase the amount of memory your system allows qmail-
smtpd to run with because it is now running the entire Perl language
interpreter and also the AVG for Linux E-mail Server.Typical installations of
qmail are provided with the system rc/startup scripts (e.g.
/etc/rc.d/init.d/qmail or /service/smtp/run). These scripts limit the
amount of RAM the qmail-smtpd daemon can use (via ulimit or softlimit
shell commands). You must increase the limit to approximately 5-11MB (the
exact range depends on your system parameters and load).
If you want to enable AVG for Linux E-mail Server to scan all mail sent by
local shell users, the qmailqueue must be defined in /etc/profile file.
If the "$DEBUG=1" (the default) variable is set within qmail-scanner-
queue.pl script, then every transaction will be logged to the
/var/spool/qmailscan/qmail-queue.log file. Regardless of debugging,
errors (and attachment info if enabled) should also be recorded in the qmail
logs (probably via syslog). Note that the /var/spool/qmailscan/qmail-
queue.log log file will grow in time unless you manage its regular cleanup
(either manual or scheduled for example via the cron utility).

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
18
Any dropped SMTP session (for example due to network outages) may lead to
files lying around in /var/spool/qmailscan. Running the
# /var/qmail/bin/qmail-scanner-queue.pl -z
command as root at least once a day will ensure such files are deleted when
they are over 30 hours old (for example the cron utility can be employed to
perform the regular cleanup).
Note: For details on the Qmail-Scanner please refer to the http://qmail-
scanner.sourceforge.net/ website.
4.4. Testing the Installation
Successful installation of AVG for Linux E-mail Server and the appropriate mail
content scanner (AMAViS or Qmail-Scanner) can be tested within any supported
e-mail server by sending a message with the Eicar test file attachment. The
attachment should be removed from the e-mail, and replaced by a virus infection
notification. Refer to the http://www.eicar.org/anti_virus_test_file.htm website for
detailed information and the test file itself.

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
19
5. E-mail Scanning
5.1. General Principles
The AVG for Linux E-mail Server service responsible for e-mail scanning runs as
a set of memory resident daemons. These daemons are identical preforked
processes bearing the AVG Anti-Virus scanning kernel and interface for scanning
the e-mail content fetched by AMaViS, Qmail-Scanner or respective commercial
e-mail server.
The number of e-mail scanning daemons can be specified in the AVG for Linux E-
mail Server configuration file (see chapter 8.3 Configuration File/AvgDaemon for
detailed information on this issue). The default number of daemons is 2, possible
values range across all non-negative integers. Increase the number of daemons for
very busy servers to accelerate the e-mail scanning by introducing a higher level of
parallel processing. A general rule of how to regulate the number of daemons can
not be formulated exactly because the scanning performance widely varies
according to the particular system configuration, other services running and
software installed.
Note: Be careful when changing the number of daemons; its excessive increase can
cause temporary service failure problems after restarting or sending another signal
to the AVG for Linux daemons (for example when the virus database is updated
and being reloaded by scanning daemons)!
The AVG for Linux E-mail Server e-mail scanning service is bound to the IP
address that is also specified in the respective section of the configuration file
(127.0.0.1 by default). The address must be the same as the one the mail transport
agent is bound to. The default port which the daemons are listening on is 55555. If
necessary, this value can be changed in the configuration file as well.
AVG for Linux E-mail Server does not support direct configuration of actions to be
performed after virus detection and/or suspicion in the processed e-mail. These
features are covered by the e-mail server agent and/or respective mail content
scanner. Please refer to the documentation of your e-mail server and AMaViS or
Qmail-Scanner for detailed information.
5.2. Performance and Resource Usage
Adding virus scanning to an e-mail server can slightly increase the resource usage
of the server for the open source mail transport agents (these are sendmail,
postfix, qmail, exim). As both of the e-mail scanner wrappers (AMaViS and
Qmail-Scanner) are written in Perl instead of low-level C, some amount of memory
and other system resources is required to make the scanning processes run in order
to scan the e-mail server traffic efficiently. However, the real additional system load
depends on many factors (such as the size of e-mail float, the number of memory
resident processes and so on) that can be effectively optimized by the system
administrator.
It is suggested that you look at how many simultaneous SMTP sessions you are
willing to run on your system. Each SMTP session can claim a certain number of
AVG for Linux E-mail Server virus scanning daemons. The estimated amount of
memory to be used by all the scanning processes per SMTP session is about 5-6 MB.
It is strictly recommended to take this into the account when planning a server
policy and usage management strategies.

www.grisoft.com
Copyright (c) 1992-2006 GRISOFT, s.r.o. All rights reserved.
AVG Linux Email Server / User Manual
20
5.3. Using Unix Socket for an Extra Security
You can take advantage of launching the AVG Anti-Virus e-mail scanning daemon
within the same account as the e-mail content scanner (AMaViS or Qmail-
Scanner). Moreover, the e-mail scanning daemon can create a Unix socket and
listen on it then in order to increase the e-mail scanning security. The socket is
created and also destroyed by the daemon automatically with the proper access
rights and ownership (e. g. amavis when the daemon is running under the amavis
account).
To enable the using of the socket, follow these steps (you must be logged in as
root):
zUncomment the line with the unixSocketName parameter in the
/ect/avg.conf AVG for Linux E-mail Server configuration file. You can also
change the parameter value if necessary (the default value is
/tmp/avg.sock). See chapter 8. Configuration File for detailed information
on the configuration file.
zIn the /opt/grisoft/avg7/etc/init.d/avgdinit.conf file, change the SUSER
parameter value to the name of the user who is supposed to run the e-mail
scanning AVG Anti-Virus daemon (for example amavis).
zFinally, you must change the configuration file of the respective e-mail content
scanner (AMaViS or Qmail-Scanner). For example, in the case of the
preferred amavisd-new scanner the AVG Anti-Virus related section of the
/etc/amavisd.conf file should look like as follows:
['AVG Anti-Virus', \&ask_daemon, ["SCAN {}\n", '/tmp/avg.sock'], qr/^200/,
qr/^403/, qr/^403 .*?: (.+)/ ]
Note: The on-access scanning must be running under the root account. So if you
change the user who is running the daemons in the /etc/init.d/avgd file, you will
disable the on-access scanning! You have to resolve the trade-off between the on-
access scanning and increased e-mail scanning security.