Anti-virus + Anti-spamfor UNIX Mail Servers© 2011 Doctor Web

Dr.Web, SpIDer Mail, SpIDer Guard, CureIt!, CureNet!, AV-desk,
Dr.WEB
Doctor Web

Doctor Web

Anti-virus Dr.Web for UNIX mail servers
6.0.1
09.11.2011
2-12A, 3rd str. Yamskogo polya
Moscow, Russia
125124www.drweb.com+7 (495) 789-45-87

Doctor Web
Dr.WebR

Dr.WebDr.Web

1992

4

8
9
10
12
13

22
Distribution Package for UNIXsystems
GUI

23
27
34

Distribution Package for UNIX
Systems
GUI

37
38
41
43
49
50

Dr.Web for UNIX mail servers

53

Linux Solaris

53

FreeBSD

54

SELinux

54

56
Dr.Web Scanner

59
59

5
64
Dr.Web Scanner

78

Dr.Web Daemon

80
80
81

Dr.Web Daemon

93
94

Dr.Web Daemon

94
99

Dr.Web Updater

100
100

cron

102
102
103
108

Dr.Web Agent

109
110
112
113

[Logging]

113[Agent]114[Server]

115[EnterpriseMode]

116[StandaloneMode]

117[Update]119

Dr.Web Unix Control Agent

120

6
121
123

Dr.Web Monitor

128
128
130
130

[Logging]

130[Monitor]

131

Dr.Web Unix Monitor

135
136

Dr.Web for UNIX Mail Servers

138
140
141
142
144
144

Lookup

259
268
271
279

drweb-inject
Receiver/Sender

305
306

Unified Score

309

Reputation IP Filter

310
315

drweb

315

7
headersfilter

327

vaderetro anti-spam

332

Modifier

341

MTA

357

SMTP

357

CommuniGate Pro

358

Sendmail MTA

361

Mail Postfix

367

Exim MTA

372

qmail MTA

378

ZMailer MTA

381

Courier

385

Proxy

386

Dr.Web console for UNIX mail servers

393
395
398
398
399
405
426

429

8

UNIX®
Dr.Web®
Anti-virus + anti-spam Dr.Web for UNIX mail servers
Anti-spamDr.Web for UNIX mail servers
Anti-virus Dr.Web for UNIX mail servers
Anti-virus + anti-spam Dr.Web for UNIX mail gateways
Anti-spam Dr.Web for UNIX mail gateways
Anti-virus Dr.Web for UNIX mail gateways

Dr.Web for UNIX mail servers

FreeBSD Solaris x86

UNIX OSUNIX
3
Dr.Web for UNIX mail servers

Linux

UNIX
SMTP
UNIX
Word Excel

Windows

Dr.Web for UNIX mail servers

Dr.Web Daemon

Vaderetro
Dr.WebMailD
Sendmail Postfix

9
Courier Qmail CommuniGate Pro ZMailer
Dr.Web MailD

Exim
Dr.Web Security Suite

Dr.Web for UNIX mail servers

2
SDK
Receiver/Sender
MTA

SDK
SDK

Dr.Web for UNIX mail servers
MTA

Dr.Web for UNIX mail servers
Dr.Web for UNIX mail servers
Dr.Web for UNIX mail servers

Dr.Web1
UNIX
Dr.Web10GUI

Doctor Web
Web

('+')

: ALT+F1%bin_dir, %etc_dir, %var_dir
OSLinux, Solaris:%bin_dir = /opt/drweb/%etc_dir = /etc/drweb/%var_dir = /var/drweb/
FreeBSD:%bin_dir = /usr/local/drweb/%etc_dir = /usr/local/etc/drweb/%var_dir = /var/drweb/

Dr.Web for UNIX mail servers

ALT

F1

11

OS
Linux
2.4.x
FreeBSD 6.x
Intel x86
Solaris 10 Intel x86
32bit/64bit x86_64

64bit

32bit

:
32bit

Debian/Ubuntu Linux
ALT Linux

ia32-libs

Dr.Web for UNIX mail servers
CLI
serversi586-glibc-core

Dr.WebDr.Web for UNIX mail servers
X Window
xterm
xvd

libglade2
libgtk2
libstdc++6
base64unzip
crond
Dr.Web for UNIX mail servers

forUNIX mail
165Mb

12

Dr.Web for UNIX mail servers%bin_dir%etc_dir %var_dir
OS%bin_dir - Dr.Web for UNIX mail servers
Dr.Webupdate.pl)%bin_dir/lib/ drweb32.dll)

Updater

Perl

Dr.Web for UNIX

mail servers%bin_dir/agent/ - Dr.Web Agent%etc_dir/monitor/ - Dr.Web Monitor
MTA%bin_dir/maild/scripts/ Dr.Web for UNIX mail servers
4.44
5.0

%bin_dir/doc/ —KOI8-R UTF-8%var_dir/bases/*.vdb —%etc_dir — Dr.Web for UNIX mail servers
drweb32.ini
agent.conf monitor.
conf plugin_NAME.conf maild_MTA.conf
drwebd.enable drweb-monitor.enable2%bin_dir/lib/ru_scanner.dwl — Dr.Web Scanner
Dr.Web Daemon%etc_dir/maild/templates/ —Daemon%bin_dir/web/

Dr.Web for UNIX mail servers

13

drweb-maild-web.
wbm.gz%var_dir/infected/ Dr.Web

Dr.Web for UNIX mail servers--- beginning of the file --[Section 1 name]Parameter1 = value1, ..., valueK...
ParameterM = value1, ..., valueK...
[Section X name]Parameter1 = value1, ..., valueK...
ParameterY = value1, ..., valueK--- end of the file --";""#"

Dr.Web for UNIX mail servers
Dr.Web for UNIX mail servers

14:

Names = XXXXX, YYYYY

Names = XXXXX
Names = YYYYYParameterName
values}={}{parameter

type

|

possible:

ParameterName = {value | empty}

numerical value - 0time 0smhd: 30s, 15m

size b

0

15

k
m
g
: 20b, 15k

permissions : 755 (-rwxr-xr-x), 644 (-rw-r--r--)path to file/directory actions Dr.Web MailD

2
1

3
Dr.Web Scanner1:o Cure o Remove o Discard o Pass o Reject o Tempfail :o Quarantine o Redirect [(address[|

address|...])] [MailD]

RedirectMail
"|"

16

o Notify o Add-header (HEADER) -HEADERHEADERNAME
DrWeb-MailD BODYo Score (SCORE) SCORE
Dr.Web Scannero Cure -[NAME:]BODYXSCORE:o Delete o Rename o Move o Ignore o Report -address -Dr.Web for UNIX mail servers

TYPE:ADDRESS
o inet - TCP
PORT@HOST_NAME
HOST_NAME
IP:

Address = inet:3003@127.0.0.1
o local -UNIX:

Address = local:%var_dir/.daemon
o PID

text

value -

-

PID

17

pool options o auto o N -N

o N-M -

M =NN

M
o timeout = {time} -N: 2mo stat = {yes|no} -SIGUSR1[General]

BaseDir: noo log_level = {Quiet|Error|Alert|

Info|Debug} [Logging]

LogLevelo stop_timeout = {time} -:InPoolOptions = auto,yes
1string file:/path_to_file

timeout=1m,

stat

=

18

path_to_file
path_to_file
lookups -[PREFIX1:]VALUE 1, [PREFIX2:]VALUE2, ...

o file -o regex -Perlo rfile -Perlo ldap - LDAPo odbc, oracle - ODBCSQLo postgres - PostgreSQL
SQL
o cdb - CDB
CDB

OracleSQL[textkey]:[text value]o berkeley - Berkeleyo firebird - Firebird
o sqlite - SQLiteo mysql - MySQL
LookupsLite - 1
filestorage $s

SQL
SQL
SQL

lookups

lookups

19

o odbc SQL

LDAP:name<type>
name

type
o oracle -ODBCo postgres,mysql,

sqlite,1

ODBC

firebird -char(length)
varchar_long:"odbc:insert into plugin_stat values (:plugin_name<varchar_long>,:size<int>,:
num<int>)";TLS Settings - TLS
SSL
PARAMETER VALUEPARAMETER VALUE
VALUE

o use_sslv2 {yes | no} - SSLv2

o use_sslv3 {yes | no} - SSLv3
o use_tlsv1 {yes | no} - TLSv1
o private_key_file{path to the file} PEM20o private_key_password {string} -private_key_fileo certificate {path to the file} -private_key_fileo verify_mode{none | peer | client_once | fail_if_no_peer_cert} none -peer -

client_once peer

fail_if_no_peer_cert -peer:verify_mode
client_oncepeer,

verify_mode

21verify_mode none
peer

none

o verify_ca {thepath to a filethe path to a directory} - PEM
CAo cipher_list {string} man ciphers

OpenSSLvalue Dr.Web MailD

Debug
Quiet

Quiet Error Info Alert Notice Warning
Verbose Debug
Dr.Web

MailD

Quiet Error Alert

Info Debug
Dr.Web Daemon

Dr.Web Scanner

Error

Info Notice Warning Alert
Dr.Web

Updater

Info Debug Verbose

Quiet Error Alert|

22

Dr.Web for UNIX mail servers
root

rpm

deb

Dr.Web for UNIX mail servers UNIX
ESP Package Manager EPM
EPM
GUI
Dr.Web for UNIX mail servers

EPM

Dr.Web for UNIX mail servers
GUI

drweb-daemon
commondrweb-bases
EPM

Dr.WebDr.Web for UNIX mail servers
GUI
Dr.Webdrweb-

23

Distribution Package for UNIXsystems
Dr.Web for UNIX mail servers

drweb-mail-[product-name]_[version number]~[OSname].run

drweb-common:

drweb32.ini
drweb

drweb

drweb-bases:
drweb-common
drweb-libs:
drweb-epm6.0.0-libs: GUI
drweb-libs
drweb-epm6.0.0-uninst: GUI
drweb-epm6.0.0-libs
drweb-boost144: Dr.Web Agent Dr.Web Monitor
drweb-libs
drweb-updater:
drweb-common drweb-libs
drweb-agent:Dr.Web
Agent
drweb-common drweb-boost144
drweb-daemon: Dr.Web Daemon
drweb-bases drweb-libs
drweb-scanner: Dr.Web Scanner

24

drweb-bases drweb-libs
drweb-monitor: Dr.Web Monitor
drweb-common drweb-boost144
drweb-maild: Dr.Web
drweb-maild-common

MailD

drweb-maild-common:

Dr.WebMonitor Dr.Web

MailD

Agent Dr.Web

drweb-common
drweb-agent drweb-

drweb-gperftools0
monitordrweb-maild-plugin-drweb: drweb

drweb-maild
drweb-maild-web: Dr.Web for UNIX mail servers
drweb-maild-plugin-headersfilter:
headersfilter
drweb-maild
drweb-maild-plugin-modifier: modifier
drweb-maild
drweb-maild-plugin-vaderetro: vaderetro
drwebmaild drweb-libvaderetro
drweb-libvaderetro: vaderetro
drweb-maild-smtp: Dr.Web for UNIX mail servers
SMTP
LMTP
SenderReceiver
Web MailD

Dr.Web MonitorDr.

drweb-maild

drweb-maild-cgp: Communigate Pro MTA mail transfer
agent

SenderReceiver25

Communigate

MTA
Dr.WebPro

Dr.Web MailD
MailD

drweb-

maild
drweb-maild-courier:

Courier MTA mailtransfer
SenderReceiver
MTA
Dr.Web MailD
Dr.Web MailD

agent

Courierdrweb-maild

drweb-maild-exim: Exim MTA mail transfer agent
SenderMTA
Dr.Web

ReceiverDr.Web MailD

MailD

Exim

drweb-maild
drweb-maild-postfix: Postfix MTA mail transfer agent
SenderMTA
Dr.Web

ReceiverDr.Web MailD

MailD

Postfix

drweb-maild

drweb-maild-qmail: Qmail MTA mail transfer agent
SenderMTA
Dr.Web MailD

ReceiverDr.Web MailD
Qmail

drweb-maild
drweb-maild-sendmail:agent

Sendmail MTA mail transfer
SenderReceiver
MTA
Dr.Web MailD
Dr.Web MailD

Sendmaildrweb-maild

drweb-maild-zmailer:ZMailer MTA mail transfer agent
SenderMTA
Dr.Web
ZMailer

ReceiverDr.Web MailD

MailD

drweb-maild

26

drweb-gperftools0: Dr.Web MailD

Googledrweb-libs

drweb-mail-servers-gateways-doc:
64bit

drweb-libs64

Dr.Web for UNIX mail servers
CLIGUI# chmod +x drweb-mail-[product-name]_[version number]~[OS name].run# ./drweb-mail-[product-name]_[version
number]~[OS name].run
drweb-mail-[product-name]_[version number]~[OS
name]
GUI
root
root
GUI

CLI

-noexec# .drweb-mail-[product-name]_[version
number]~[OS name].run --noexec
GUI# drweb-mail-[product-name]_[version
number]~[OS name]/install.sh# drweb-mail-[product-name]_[version

27

number]~[OS name]/setup.shN.

[configuration_file_name].
%etc_dir/software/conf/[file_name].O[file_name].ORun
postinstall script
Dr.Web for UNIX mail servers

interactive

GUI
GUI
1.

# drweb-mail-[product-name]_[version
number]~[OS name]/install.sh"Next""Cancel"2.

"Next"

28

1.

3.

2. MTA29

3.Dr.Web for Mail Gateways"Custom Configuration"

4. Select Software

Select Software

30

Dr.Web Antivirus Daemon
Dr.Web Common Files

Dr.Web Bases

MTA
drweb-maild-smtp
drweb-maild-MTA
Dr.Web Mail Daemon Exim Connector Dr.Web Mail
DaemonPostfix Connector
1"Select None""Next"
2.

Confirm

5.Confirm"Next”"Back”

31

3.
Language6.

4.

3Installing
7. Installing

drweb-mail-[product-name]_32

install.log"Run interactive postinstall script"
Dr.Web for
UNIX mail servers[version number]~[OS name]8.

Dr.Web for UNIX mail servers
Dr.Web Daemon Dr.Web Agent
Dr.WebMonitor33

9. MTA

5. Finish

Dr.Web for UNIX mail servers

34

10.

"Close"GUI# drweb-mail-[product-name]_[version
number]~[OS name]/setup.sh

1.

35

2. Dr.Web for UNIX mail servers
Yes

Y
N
ENTER

3.

ENTER
4. ”Custom Configuration"

No

36

ENTER
5.

37

Y
Yes
6.

7.

Dr.Web for UNIX mail servers
Dr.Web for UNIX mail servers
Dr.Web Daemon Dr.Web Agent Dr.Web
MonitorDistribution Package for UNIX
Systems
GUI

Dr.Web for UNIX mail servers# drweb-mail-[product-name]_[version
number]~[OS name]/remove.sh

38

root

root

GUI

drweb

drweb

%etc_dir/software/conf/

Dr.Web[file_name].O

GUI
GUI
1.

# drweb-mail-[product-name]_[version
number]~[OS name]/remove.sh"Next""Cancel"2.

"Next"

39

11.

3. Select Software
12. Select Software

EPM-packages
Dr.WebDr.Web for UNIX mail servers
GUI
Dr.Web40"Select All"
None"

"Select

Next
3. Confirm
13.

"Next”
4. Removal"Back”

41

14. Removal

5. "Close"

GUI

1.

42

Dr.Web for UNIX mail servers
Yes

N
ENTER

2.

3.

Y
No

43
4.

Y

Yes

ENTER

5.
6.

Dr.Web for UNIX mail servers
Solaris FreeBSD
Dr.Webdrweb/

Dr.WebLinux

http://officeshield.drweb.com/

44

drweb-mail-gateways-as - Dr.Web Antispam forUNIX Mail Gateways

drweb-mail-gateways-av - Dr.Web Antivirus forUNIX Mail Gateways

drweb-mail-gateways-av-as - Dr.Web Antivirus
Antispam for UNIX Mail Gateways
drweb-courier-as - Dr.Web Antispam for Courier
Mail Servers
drweb-courier-av - Dr.Web Antivirus for Courier Mail
Servers- Dr.Web
Antivirus
Antispam for Courier Mail Servers
drweb-postfix-as - Dr.Web Antispam for Postfix
Mail Servers
drweb-postfix-av - Dr.Web Antivirus for Postfix Mail
Servers
drweb-postfix-av-as - Dr.Web Antivirus
Antispam for Postfix Mail Servers
drweb-qmail-as - Dr.Web Antispam for qmail Mail
Servers
drweb-qmail-av - Dr.Web Antivirus for qmail Mail
Servers
drweb-qmail-av-as - Dr.Web Antivirus
Antispamfor qmail Mail Servers
drweb-sendmail-as - Dr.Web Antispam for Sendmail
Mail Servers
drweb-sendmail-av - Dr.Web Antivirus for Sendmail
Mail Servers
drweb-sendmail-av-as - Dr.Web Antivirus
Antispam for Sendmail Mail Servers
drweb-cgp-as - Dr.Web Antispam for CommuniGate
Pro Mail Servers
drweb-cgp-av - Dr.Web Antivirus for CommuniGate
Pro Mail Servers

drweb-courier-av-as

45

drweb-cgp-av-as - Dr.Web Antivirus

Antispam forCommuniGate Pro Mail Servers
drweb-exim-as - Dr.Web Antispam for Exim Mail
Servers
drweb-exim-av - Dr.Web Antivirus for Exim Mail
Servers
drweb-exim-av-as - Dr.Web Antivirus
Antispamfor Exim Mail Servers
drweb-zmailer-as - Dr.Web Antispam for ZMailer
Mail Servers
drweb-zmailer-av - Dr.Web Antivirus for ZMailer Mail
Servers
drweb-zmailer-av-as - Dr.Web Antivirus
Antispam for ZMailer Mail Servers

Debian Ubuntu (apt)
Debianwget -O - http://officeshield.drweb.com/drweb/
drweb.key | apt-key add -curl http://officeshield.drweb.com/drweb/drweb.
key | apt-key add /etc/apt/sources.list
deb http://officeshield.drweb.com/drweb/debian stablenon-freeDr.Web for UNIX mail servers

apt-get update
apt-get install <package name>46

Dr.Web for UNIX mail servers

apt-get remove <package name>
Synaptic

ALT Linux PCLinuxOS (apt-rpm)/etc/apt/sources.list
32-bit:rpm http://officeshield.drweb.com/drweb/
altlinux stable/i386 drweb
64-bit:rpm http://officeshield.drweb.com/drweb/
altlinux stable/x86_64 drweb
Dr.Web for UNIX mail servers

apt-get update
apt-get install <package name>
Dr.Web for UNIX mail servers

apt-get remove <package name>
Synaptic

Mandriva (urpmi)

rpm --import http://officeshield.drweb.com/

47

drweb/drweb.key

http://officeshield.drweb.com/drweb/drweb-i386.urpmi-media

http://officeshield.drweb.com/drweb/drweb-x86_64.urpmi-media

urpmi.addmedia drweb http://officeshield.drweb.
com/drweb/mandriva/stable/i386/

urpmi.addmedia drweb http://officeshield.drweb.
com/drweb/mandriva/stable/x86_64/
Dr.Web for UNIX mail servers

urpmi.update drweb
urpmi <package name>
Dr.Web for UNIX mail servers

urpme <package name>rpmdrake

Red Hat Enterprise Linux Fedora CentOS (yum)/etc/yum.repos.d
32-bit:48[drweb]name=DrWeb - stablebaseurl=http://officeshield.drweb.com/drweb/
el5/stable/i386/
gpgcheck=1
enable=1
gpgkey=http://officeshield.drweb.com/drweb/
drweb.key
64-bit:[drweb]name=DrWeb - stablebaseurl=http://officeshield.drweb.com/drweb/
el5/stable/x86_64/
gpgcheck=1
enable=1
gpgkey=http://officeshield.drweb.com/drweb/
drweb.key
Dr.Web for UNIX mail servers

yum install <package name>
Dr.Web for UNIX mail servers

yum remove <package name>
PackageKit Yumex

Zypper package manager (SUSE Linux)

zypper ar -t YUM http://officeshield.drweb.com/

49

drweb/el5/stable/i386/ drweb

zypper ar -t YUM http://officeshield.drweb.com/
drweb/el5/stable/x86_64/ drweb
Dr.Web for UNIX mail servers

zypper refreshzypper install <package name>
Dr.Web for UNIX mail servers

zypper remove <package name>YaST

FreeBSDFreeBSD
Dr.Webofficeshield.drweb.com/drweb/freebsd/ports/

http://

make install
SolarisSolarisFTP
drweb/unix/release/Solaris/packages

ftp://ftp.drweb.com/pub/

Dr.Web MailD

configure.pl%bin_dir/maild/scripts/

pkgadd

50

Dr.Web for UNIX mail servers
MTA

MTA

%bin_dir/maild/scripts/
configure_<MTA>.shplugin_<name>_configure.pl
MTA

Dr.Web for UNIX mail servers
4.44

6.0 i

%bin_dir/maild/scripts/
Dr.Web for UNIX mail servers
dwmigrate_to_new_conf.pl# ./dwmigrate_to_new_conf.pl <> <>"4.44"

"6.0"

%
CONF

etc_dir
CONF.NEWdwmigrate_to_new_rules.pl
.conf
.conf

.conf.new.conf.new51

dwmigrate_to_new_rules.pl# ./dwmigrate_to_new_rules.pl <
><

>

if
rcpt:"foo\.com"

notify.Virus=allow

if:

Sender:"lol@foo\.com"
notify.Skip=allow,
notify.Virus=allow if rcpt:"foo\.com"
Sender:"regex:lol@foo\.com"
rcpt:"regex:foo\.com"
contVirus=allow&&
notify.

Sender:"lol@foo\.com"
Skip=allow

notify.

4.44

drweb
servers

6.0

cont

Dr.Web MailD 2

headersfilter
Dr.Web for UNIX
Dr.Web for UNIX Anti-virus solution%bin_dir/maild/scripts/

mail

52

Dr.Web for UNIX mail servers
1. %etc_dir
MTA
2. Dr.Web for UNIX mail servers
drweb
headersfilter
3. %bin_dir/maild/scripts/
Dr.Web for UNIX mail servers

addresses_conf_to_rules.pl
addresses.conf
MailD

Dr.Web[Rules]users_conf_to_rules.pl
Dr.Webusers.conf
MailD[Rules]viruses_conf_to_rules.plviruses.
conf
Dr.Web MailD[Rules]filter_conf_to_maild.pl
drweb32.ini
Dr.WebMailD drweb headersfilter

Dr.Web for UNIX mail servers

53

Dr.Web for UNIX mail servers

Linux Solaris
Dr.Web for UNIX mail servers
1.
2. drweb32.key

Dr.Web for UNIX mail servers
UNIX%bin_dirdrweb32.iniStandalone
Dr.WebKey

Agentagent.conf

LicenseFile3.
4. %etc_dir

1

drwebd.enable
Dr.WebENABLE

DaemonDr.WebDaemonDaemon5. %etc_dir

ENABLE
6.

ENABLE0drweb-monitor.enable1

Dr.Web Monitor

OS
Dr.Web Daemon
Dr.Web Monitor
Dr.Web Monitor Dr.Web for UNIX mail servers
Sender Receiver Notifier
Agent

Dr.Web Agent

Dr.Web for UNIX mail servers

FreeBSD
Dr.Web for UNIX mail servers
1.
2. drweb32.key
UNIX

Dr.Web for UNIX mail servers%bin_dirKey

drweb32.iniStandalone

Dr.Web Agent

agent.conf LicenseFile3.
4. /etc/rc.conf

drwebd_enable="YES"
DaemonDr.WebDr.WebDaemon-Daemon- Dr.
Web Monitor
5.
OS
Dr.Web Daemon
Dr.WebMonitorDr.WebMonitor Dr.Web for UNIX mail servers
Sender Receiver Notifier
Agent
Dr.Web Agentdrweb_monitor_enable="YES"

SELinux
SELinux

OS

Dr.Web Scanner Dr.Web Daemon

drweb-scanner drweb-daemon

54

Dr.Web for UNIX mail servers

Linux

55

SELinux
Linuxpolicygentool2:# policygentool drweb-scanner
real - Dr.Web Scanner%bin_dir/drweb.

# policygentool drweb-daemon
real - Dr.Web Daemon%bin_dir/drwebd.

3[module_name].te[module_name].fc[module_name].if[module_name].te
checkmodule -M -m -o module-name [module_name].
techeckpolicy

semodule_package -o [module_name].pp -m modulename

semodule -i [module_name].pp

56

Dr.Web for UNIX mail servers

Dr.Web for UNIX mail servers

Dr.Web*.key

forUNIX mail servers

Dr.Web for UNIX mail servers

Dr.Webservers

*.key
zip

for

UNIX

mail

57

zip

*.key
Web
Dr.WebUNIX

servers

for

UNIX

mail

%bin_dir*.key%bin_dirWeb
Web

Dr.Web for UNIX
mail servers

Dr.Webfor UNIX

servers

25

25
http://support.drweb.co.jp/

register/Dr.Web for UNIX mail servers

drweb32.ini

Key:

Key = %bin_dir/drweb32.key

mail

58

2
Dr.Webdrweb32.ini

Dr.Web Scanner
Daemon[Daemon]

MailCommand
Dr.Web Agent[StandaloneMode] LicenseFile[StandaloneMode]

Dr.Web for UNIX mail servers

1

1

Dr.Webfor UNIX mail servers:
3
10,00015,00010,0002
3

drweb
vaderetro1
drweb
vaderetro

1

1
drweb
1
Dr.Web for UNIX mail servers
1

20,0001

15,000

Dr.Web Scanner

Dr.Web Scanner
Dr.Web Scanner

Dr.Web Scanner$ %bin_dir/drweb <path> [parameters]<path>
Scanner<path>$ %bin_dir/drweb ~/path/file infected [virus] VIRUS_NAME

Report for "/opt/drweb/tmp":
Scanned: 34/32

Cured

: 0

Infected: 5/5

Removed: 0

Modifications : 0/0

Renamed: 0

Suspicious

: 0/0

Moved

: 0

Scan time
KB/s: 00:00:02 Scan speed : 5233

"/"

2

59

Dr.Web Scanner

readme.
eicar
Dr.Webeicar.com
Scanner%bin_dir/doc/eicar.com infected by Eicar
Test File (Not a Virus!)
Eicar Test File68
ScannerUNIX("- ")-? -h -help

Scanner:path @[+]<file> "+"1

sd fl mask -60

Dr.Web Scanneralar[d|m|r][n]ARJ CABGZIP RAR TAR ZIP

m

d

r

n
*.tar

*.tar.bz2*.tbz
cn[d|m|r][n]HTML RTF

PowerPointdrml[d|m|r][n]
d
upn

m

n
m

r

n

LZEXE DIET PKLITE EXEPACK

FilesTypes

ex
ha
:

cu[d|m|r]
ic[d|m|r]r
sp[d|m|r]r
adw[d|m|r|i]ridls[d|m|r|i]rijok[d|m|r|i]rrsk[d|m|r|i]
r
i

d

m

r

:d

m

:d

m

:d

m

:d

m
:d

m

i
:d

m

61

Dr.Web Scannerhck[d|m|r|i]
r

: d

m

i
:

v, version

Scanner
UTF8

ki
foreground[yes|no]

Scannerotoqok
log=<path to file>
ini=<path to file>"Ok"

lng=<path to file>-a=<Agent address> -Scanner--only-key-

Scanner Agent"-"-ar -cu -ha -ic -fl -ml -ok -sd -sp:<path>$ drweb <path> -haScanner-ar -ha -fl- -ml -sd

62

Dr.Web ScannerWord Excel

cu
icd
spm
spr
cu

Scanner

ScannerdrScanner

Scanner
eicar. #om
OS

*.#??
#"

m

Scanner"63

Dr.Web Scanner%var_dir/infected/
OS

UNIX
UNIX

$ drweb <path> -cu -icd -spm -ar -ha -fl-ml -sd# chmod a+x [file name]Scanner

Scanner
Scanner%etc_dirdrweb32.ini$ %bin_dir/drweb -ini=%bin_dir/etc/drweb.ini[Scanner]
drweb32.dll
UpdaterEnginePath = {pathto file}:EnginePathdrweb32.dll=%bin_dir/lib/

64

Dr.Web Scanner

VirusBase = {listof paths to masks}

"*"

","

:
VirusBase = %var_dir/bases/*.
vdb,%var_dir/bases/*.VDB
UpdatePath = {pathto directory}

Updater

update.pl:

UpdatePath = %var_dir/updates/
TempPath = {path todirectory}:
TempPath = /tmp/
LngFileName = {pathto file}:LngFileName = %bin_dir/lib/
ru_scanner.dwl

Key = {path to
file}:
Key = %bin_dir/drweb32.key
OutputMode ={Terminal | Quiet}

drweb
Terminal :Quiet -

65

Dr.Web Scanner

OutputMode = Terminal
HeuristicAnalysis ={Yes | No}

drweb.com/sendvirus/

http://vms.
Dr.WebScanner:
HeuristicAnalysis = Yes
ScanPriority ={value}Scanner–20
20 Linux~ 19 Linux:

ScanPriority = 0
FilesTypes = {listof file extensions}

ScanFiles"*" "?":

ByType66

Dr.Web Scanner

FilesTypes = EXE, COM, SYS,
OV?, BAT, BIN, DRV, PRG, BOO,
SCR, CMD, VXD, 386, DLL, FON,
DO?, XL?, WIZ, RTF, CL*, HT*,
VB*, JS*, INF, AR?, ZIP, R??,
PP?, OBJ, LIB, HLP, MD?, INI,
MBR, IMG, CSC, CPL, MBP, SHS,
SHB, PIF, SO, CHM, REG, XML,
PRC, ASP, LSP, MSO, OBD, THE*,
NWS, SWF, BMP, MPP, OCX, DVB,
CPY, MSG, EML
FilesTypesWarnings= {Yes | No}
ScanFiles

ByType:FilesTypesWarnings = Yes
ScanFiles = {All |ByType}All
ByTypeFileType:
ScanFiles = All
ScanSubDirectories= {Yes | No}:
ScanSubDirectories = Yes

67

Dr.Web Scanner

CheckArchives ={Yes | No}

ZIP RAR ARJ TAR GZIP CAB:
CheckArchives = Yes

CheckEMailFiles ={Yes | No}:
CheckEMailFiles = Yes
ExcludePaths ={list of path(masks)}:ExcludePaths = /proc,/sys,/dev

FollowLinks = {Yes
| No}:
FollowLinks = No
RenameFilesTo ={mask}
"#??"
"#"
??"
eicar.com
eicar.#om".#":
RenameFilesTo = #??
MoveFilesTo = {pathto directory}

:

"#"
"

68

Dr.Web Scanner

MoveFilesTo = %var_dir/
infected/
multiparthtml

EnableDeleteArchive
Action = {Yes | No}

mbox:
EnableDeleteArchiveAction = No
InfectedFiles ={Report | Cure |Delete | Move |Rename | Ignore}

Report Cure Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore Delete Move Rename:
InfectedFiles = Report
SuspiciousFiles ={Report | Delete |Move | Rename |Ignore}Report Delete Move -MoveFilesTo

69

Dr.Web Scanner

Rename - RenameFilesTo

Ignore :SuspiciousFiles = Report
IncurableFiles ={Report |Delete |Move | Rename |Ignore}InfectedFiles = Cure
Report Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore :IncurableFiles = Report
ActionAdware ={Report | Delete |Move | Rename |Ignore}Report Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore :ActionAdware = Report70

Dr.Web Scanner

ActionDialers ={Report | Delete |Move | Rename |Ignore}Report Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore :ActionDialers = Report
ActionJokes ={Report | Delete |Move | Rename |Ignore}Report Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore :ActionJokes = Report
ActionRiskware ={Report | Delete |Move | Rename |Ignore}Report Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore :71

Dr.Web Scanner

ActionRiskware = Report
ActionHacktools ={Report | Delete |Move | Rename |Ignore}Report Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore :ActionHacktools = Report
ActionInfectedMail= {Report | Delete| Move | Rename |Ignore}Report Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore :ActionInfectedMail = Report
ActionInfectedArchive = {Report |Delete | Move |Rename | Ignore}

Report Delete Move -MoveFilesTo

72

Dr.Web Scanner

Rename - RenameFilesTo

Ignore :ActionInfectedArchive = Report
ActionInfectedConta
iner = {Report |Delete | Move |Rename | Ignore}

Report Delete Move -MoveFilesTo

Rename - RenameFilesTo

Ignore :ActionInfectedContainer =ReportLogFileName = {filename}syslog
SyslogFacility SyslogPriority:
LogFileName = syslog

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |User | Mail}syslog:
SyslogFacility = Daemon

73

Dr.Web Scanner

SyslogPriority ={Alert | Warning |Notice | Info |Error}
LimitLog = {Yes |No}syslog:
SyslogPriority = Info

LogFileName = syslog(yes)

Scanner.bak
MaxLogSize:
LimitLog = No
MaxLogSize = {valuein Kbytes}

LimitLog = Yes
00:
MaxLogSize = 512
LogScanned = {Yes |
No}

Yes
:
LogScanned = Yes

LogPacked = {Yes |No}

DIET PKLITE

Yes:

LogPacked = Yes

74

Dr.Web Scanner

LogArchived = {Yes
| No}

Yes
:
LogArchived = Yes

LogTime = {Yes |No}

Yes
LogFileName = syslog:
LogTime = Yes

LogStatistics ={Yes | No}

Yes:
LogStatistics = Yes

RecodeNonprintable= {Yes | No}:
RecodeNonprintable = Yes
RecodeMode ={Replace |QuotedPrintable}

RecodeNonprintable = Yes
Replace

RecodeChar
quoted-QuotedPrintable
printable:

RecodeMode = QuotedPrintable
RecodeChar = {"?" |"_" | ...}

RecodeMode:=

Replace75

Dr.Web Scanner

RecodeChar = "?"MaxCompressionRatio= {value}:
MaxCompressionRatio = 5000
CompressionCheckThreshold = {value in
Kbytes}:CompressionCheckThreshold
1024

MaxFileSizeToExtract = {value in
Kbytes}:MaxFileSizeToExtract = 500000
MaxArchiveLevel ={value}:MaxArchiveLevel = 8
MaximumMemoryAlloca
tionSize = {valuein Mbytes}

1

"0"

=

76

Dr.Web Scanner:
MaximumMemoryAllocationSize =0ScannerScanTimeout= {time in seconds}

1"0":
ScannerScanTimeout = 0

MaxBasesObsolescenc
ePeriod = {time inhours}"0":
MaxBasesObsolescencePeriod =24
ControlAgent ={Agent socket
address}

Agent

TYPE:ADDRESS
TYPE

inet - TCP
unix - UNIX

local
:

ControlAgent =inet:4040@127.0.0.1,local:%
var_dir/ipc/.agent:
ControlAgent = local:%var_dir/
ipc/.agent

77

Dr.Web Scanner

OnlyKey = {Yes |
No}

Yes

Scanner AgentNo

Scanner Agent:

OnlyKey = No

Dr.Web Scanner
Dr.Web Scanner$ %bin_dir/drweb%bin_dir"drweb"Dr.Web Scanner

PATH
Dr.Web Scanner

root

$HOME
ScannerDr.Web (R) Scanner for Linux, v6.0.1 (February
19, 2010)
Copyright (c) Igor Daniloff, 1992-2010
Support service: http://support.drweb.com/
To purchase: http://buy.drweb.com/
Program version: 6.0.0.10060 <API:2.2>
Engine version: 6.0.0.9170 <API:2.2>
Loading /var/drweb/bases/drwtoday.vdb
virus records: 1533

-

Ok,

78

Dr.Web Scanner

Loading /var/drweb/bases/drw60012.vdb
virus records: 3511-

Ok,-------------------------------------------Loading /var/drweb/bases/drw60000.vdb
virus records: 1194-

Ok,

Loading /var/drweb/bases/dwn60001.vdb
virus records: 840-

Ok,

Loading /var/drweb/bases/drwebase.vdb
virus records: 78674-

Ok,

Loading /var/drweb/bases/drwrisky.vdb
virus records: 1271-

Ok,

Loading /var/drweb/bases/drwnasty.vdb
virus records: 4867-

Ok,

Total virus records: 538681
Key file: /opt/drweb/drweb32.key
Key file number: XXXXXXXXXX
Key file activation date: XXXX-XX-XX
Key file expiration date: XXXX-XX-XX
Scanner79

Dr.Web Daemon

Dr.Web Daemon
Dr.Web Daemon

Web

Dr.Web

UNIX
Daemon Scanner

TCP

Dr.

Dr.Web Daemon

Dr.Web Daemon
"-"

-? -h

-help

drwebdDr.Web Daemon-ini=<path to file>--foreground=<yes|no>"Yes"
DaemonDaemon"No"--check-only <command line parameters forchecking>-a=<Agent address>--only-key

Agent

DaemonAgent

80

Dr.Web Daemon

Dr.Web Daemon
Daemon%etc_dirdrweb32.ini[Daemon] section
EnginePathto file}=drweb32.dll{path:
EnginePathdrweb32.dll

VirusBase ={listof files or masks}=%bin_dir/lib/

"*"

","

Default value:
VirusBase = %var_dir/bases/*.
vdb,%var_dir/bases/*.VDB
UpdatePath = {pathto directory}

Updater

update.pl:

UpdatePath = %var_dir/updates/
TempPath = {path todirectory}81

Dr.Web Daemon

TempPath = %var_dir/spool/
Key = {path tofile}

Daemon Scanner

Daemondrweb32.ini
Key[Daemon]Daemon:Key = %bin_dir/drweb32.key
MailAddressesList ={path to file}

15

30

:
MailAddressesList
email.ini
OutputMode ={Terminal | Quiet}=%etc_dir/drweb
Terminal -Quiet -:
OutputMode = Terminal
RunForeground ={Yes | No}

Yes

DaemonNo
Dr.WebMonitor82

Dr.Web Daemon:
RunForeground = No
User = {user name}

DaemonDaemondrweb
Daemon root
SIGHUP:
User = drweb
PidFile = {path tofile}

Daemon PID:
PidFile = %var_dir/run/drwebd.
pid

BusyFile = {path tofile}

DaemonPID/var/run/drwebd.
bsy.123456:
BusyFile
drwebd.bsy

ProcessesPool ={process poolsettings}

auto N -1=%var_dir/run/83

Dr.Web Daemon

N-M - 1N
M

timeout=
seconds} -

{time

in

N

stop_timeout
seconds} -

=

{time

in

:
ProcessesPool = auto,timeout=120,stop_timeout=1
OnlyKey = {Yes |
No}

Yes

Agent

No

Agent
:

OnlyKey = No
ControlAgent ={socket address}

Agent

TYPE:ADDRESS
TYPE

inet - TCP
unix - UNIX

local
:

ControlAgent
inet:4040@127.0.0.1,local:%
var_dir/ipc/.agent
:

=

84

Dr.Web Daemon

ControlAgent = local:%var_dir/
ipc/.agent
MailCommand ={command}DaemonUpdater2

Daemon:
MailCommandsendmail -i
root"

=
-bm

NotifyPeriod ={value}"/usr/sbin/-f drweb --"0":
NotifyPeriod = 14
NotifyFile = {pathto file}:NotifyFile = %var_dir/.notify
NotifyType = {Ever| Everyday | Once}
Once - 1
Everyday Ever - Daemon:
NotifyType = Ever

85

Dr.Web Daemon

FileTimeout ={value in seconds}

1:
FileTimeout = 30
1

StopOnFirstInfected= {Yes | No}:
StopOnFirstInfected = No
ScanPriority ={value}Daemon–20
20 Linux~ 19 Linux:

ScanPriority = 0
FilesTypes = {listof file extensions}

ScanFiles"*"

ByType"?":FilesTypes = EXE, COM, SYS,
OV?, BAT, BIN, DRV, PRG, BOO,
SCR, CMD, VXD, 386, DLL, FON,
DO?, XL?, WIZ, RTF, CL*, HT*,
VB*, JS*, INF, AR?, ZIP, R??,
PP?, OBJ, LIB, HLP, MD?, INI,
MBR, IMG, CSC, CPL, MBP, SHS,
SHB, PIF, SO, CHM, REG, XML,
PRC, ASP, LSP, MSO, OBD, THE*,
NWS, SWF, BMP, MPP, OCX, DVB,
CPY, MSG, EML
FilesTypesWarnings= {Yes | No}
ScanFiles

ByType86

Dr.Web Daemon:
FilesTypesWarnings = Yes
ScanFiles = {All |ByType}All
ByTypeFileType:
ScanFiles = All
CheckArchives ={Yes | No}

ZIP, RAR, ARJ, TAR, GZIP, CAB:
CheckArchives = Yes

CheckEMailFiles ={Yes | No}:
CheckEMailFiles = Yes
ExcludePaths ={list of paths ormasks}:
ExcludePaths = /proc,/sys,/dev

FollowLinks = {Yes
| No}
:

87

Dr.Web Daemon

FollowLinks = No
RenameFilesTo ={mask}
"#??"
"#"

"#"
"

??"
eicar.com
eicar.#om".#":
RenameFilesTo = #??
MoveFilesTo = {pathto directory}:
MoveFilesTo
infected/=%var_dir/Cure

BackupFilesTo ={path to directory}:
BackupFilesTo
infected/
LogFileName = {file
name}

=

%var_dir/syslog
SyslogFacility SyslogPriority:
LogFileName = syslog

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |syslog:
SyslogFacility = Daemon

88

Dr.Web Daemon

User | Mail}
SyslogPriority ={Alert | Warning |Notice | Info |Error}

syslog:
SyslogPriority = Info

LimitLog = {Yes |No}:
LimitLog = No

MaxLogSize = {valuein Kbytes}

LimitLog = Yes
0:
MaxLogSize = 512

LogScanned = {Yes |
No}

Yes
:
LogScanned = Yes

LogPacked = {Yes |No}

DIET PKLITE

Yes:

LogPacked = Yes
LogArchived = {Yes
| No}

Yes
:
LogArchived = Yes

89

Dr.Web Daemon

LogTime = {Yes |No}

Yes
LogFileName = syslog:
LogTime = Yes

LogProcessInfo ={Yes | No}

PID

Yes
IP
:
LogProcessInfo = Yes

RecodeNonprintable= {Yes | No}:
RecodeNonprintable = Yes
RecodeMode ={Replace |QuotedPrintable}

RecodeNonprintable
Replace=Yes

RecodeChar

QuotedPrintable
printable

quoted-:RecodeMode = QuotedPrintable
RecodeChar = {"?" |"_" | ...}

RecodeMode =:RecodeChar = "?"Socket = {socket
address}

DaemonReplace90

Dr.Web Daemon

1
TYPE:ADDRESS
TYPE
inet - TCP
unix - UNIX

local
:

Socket = inet:3000@127.0.0.1,
local: %var_dir/.daemon
PORT [interfaces][access]
TCP
PORT
IP

|

FILE

10
interfaces:
Socket = 3000 127.0.0.1,
192.168.0.100
UNIX

FILE
access8:
Socket = %var_dir/.daemon
SocketDaemon3000 0.0.0.0:
Socket = %var_dir/run/.daemon
SocketTimeout ={value in seconds}

91

Dr.Web Daemon:
SocketTimeout = 10

ArchiveRestriction

MaxCompressionRatio= {value}:
MaxCompressionRatio = 500
CompressionCheckThreshold = {value in
Kbytes}

MaxCompressionRatio:
CompressionCheckThreshold
1024

MaxFileSizeToExtract = {value in
Kbytes}:MaxFileSizeToExtract = 40960
MaxArchiveLevel ={value}=92

Dr.Web Daemon:
MaxArchiveLevel = 8

Dr.Web Daemon
Daemon-ini: {path/to/your/drweb32.ini}%etc_dir/drweb32.ini
Daemon/var/log/
User
LogFileName

DaemonUser
drweb
Engine drweb32.dll

DaemonDaemonEngineDr.Web for UNIX mail servers
TCP
1
UNIX

Daemon93

Dr.Web Daemon/var/log/
User

SocketDaemon PID
PID

Daemon

/var/
User

log/

PID

PidFilePID

Dr.Web Daemon

SIGHUPSIGTERM
SIGKILL

DaemonDaemonDr.Web Daemon
Daemon$ netstat -a

TCP:--- cut --Active Internet connections (servers andestablished)
Proto Recv-Q Send-Q
Address State
tcp

0

0

Local Address

localhost:3000*:*

LISTEN

Foreign94

Dr.Web Daemon

raw

0

0 *:icmp

*:*

raw

0

0 *:tcp*:*

7
7

Active UNIX domain sockets (servers andestablished)
Proto

RefCnt

Flags

Type

I-NodePath

LISTENING

384

/dev/

unix 0gpmctl[ ACC ]unix

[ ]STREAM

CONNECTED

190

unix 1 [ ]@00000031

STREAM

CONNECTED

1091

0

unix 0 [ ACC ]font-unix/fs7100
unix

STREAM

State

STREAM

LISTENING

4

[ ]

DGRAM

293

unix 1
gpmctl[ ]STREAM

CONNECTED

unix

0

[ ]

DGRAM

450

unix

0

[ ]

DGRAM

433

unix

0

[ ]

DGRAM

416

unix

0

[ ]

DGRAM

308

@0000001b

403 /tmp/.

/dev/log
1092

/dev/

--- cut ---

Unix

:

--- cut --Active Internet connections (servers andestablished)
Proto Recv-Q Send-Q
Address State

Local Addressraw

0

0 *:icmp

*:*

7

raw

0

0 *:tcp*:*

Foreign

7

Active UNIX domain sockets (servers andestablished)95

Dr.Web Daemon

Proto

RefCnt

Flags

Type

STREAM

State

I-NodeLISTENING

Path

unix 0gpmctl[ ACC ]

384 /dev/

unix

0

[ ]

STREAM

CONNECTED

190 @0000001b

unix

1

[ ]

STREAM

CONNECTED

1091 @00000031

unix 0 [ ACC ]var_dir/.daemon

STREAM

LISTENING

1127 %

unix 0 [ ACC ]font-unix/fs7100

STREAM

LISTENING

403 /tmp/.

unix

4

[ ]

DGRAM

293

/dev/log

unix 1
gpmctl[ ]STREAM

CONNECTED

unix

0

[ ]

DGRAM

450

unix

0

[ ]

DGRAM

433

unix

0

[ ]

DGRAM

416

unix

0

[ ]

DGRAM

308

1092 /dev/--- cut --Daemon
DaemonTCP

drwebdc:$ drwebdc -nHOSTNAME -pPORTNUM -sv -sb
Unix:$ drwebdc -uSOCKETFILE -sv -sb--- cut --- Version: DrWeb Daemon 6.00
- Loaded bases:

96

Dr.Web Daemon

Base /var/drweb/bases/drwtoday.vdb
contains 5 records.
Base /var/drweb/bases/drw60003.vdb
contains 409 records.
Base /var/drweb/bases/drw60002.vdb
contains 543 records.
Base /var/drweb/bases/drwebase.vdb
contains 51982 records.
Base /var/drweb/bases/drw60001.vdb
contains 364 records.
Total 53303 virus-finding records.
--- cut --drwebdc
TCP:$ drwebdc -nHOSTNAME -pPORTNUM -sv -sb -v
UNIX:$ drwebdc -uSOCKETFILE -sv -sb -v

dwlib: fd: connect() failed - Connection
refuseddwlib: tcp: connecting to 127.0.0.1:3300 failed
dwlib: cannot create connection with a DrWeb
daemonERROR: cannot retrieve daemon version
Error -1297

Dr.Web Daemon

Daemoneicar.com
readme.eicar
eicar.com

50

:

TCP

$ drwebdc -nHOSTNAME -pPORTNUM -f eicar.com
UNIX:$ drwebdc -uSOCKETFILE -f eicar.com
15

30

:

TCP

$
drwebdc-nHOSTNAME-pPORTNUM-e
FEMAIL_ADDRESS -REMAIL_ADDRESS -f eicar.com
UNIX

-

:

$ drwebdc -uSOCKETFILE -e
REMAIL_ADDRESS -f eicar.com
EMAIL_ADDRESS

email.ini-FEMAIL_ADDRESS

1Results: daemon return code 0x20
(known virus is found)
DaemonDaemon-98

Dr.Web Daemon

Dr.Web Daemon

DaemonDaemonDaemonDaemonDaemonDaemonDaemonDaemonDaemonDaemon99

Dr.Web Updater

Dr.Web Updater
Dr.Web Updater

update.pl
Dr.Webini

Dr.Web for UNIX mail servers
Perl
Dr.Web for UNIX mail servers

Updater%etc_dir[Updater]drweb32.

$ %bin_dir/update.pl [parameters]

Dr.Web for UNIX mail servers".vdb"lzma
KB

drwXXXYY.vdb
6.0

drwtoday.vdb
XXX

YY 00
drw60000.vdb
1drwtoday.vdb
drwtoday.vdb
drwtoday.vdb

drwXXXYY.vdb

100

Dr.Web Updater

drwtoday.vdb

Dr.Webfor UNIX mail servers/var/

drweb/bases/
drwrisky.vdb drwnasty.vdb 2-

Engine1EngineEnginedrwebase.vdb
drwXXXYY.vdb
drwtoday.vdb 1
drwtoday.vdb
drwnasty.vdb
dwnXXXYY.vdb
dwntoday.vdb 1

dwntoday.vdb
drwrisky.vdb
dwrXXXYY.vdb
dwrtoday.vdb 1

dwrtoday.vdb

101

Dr.Web Updatercron
For Linux:/
cron Dr.Web

etc/cron.d/Updater

For FreeBSD and Solaris: cron Dr.Web Updater

cron
FreeBDS

drweb

crontab*/30 * * * * /usr/local/drweb/update.pl
Solaris# crontab -e drweb# 0,30 * * * * /opt/drweb/update.pl

Dr.Web Updater--ini=path_to_configuration_file;--what=component_to_be_updated.
Component_to_be_updated

scanner

daemonUpdater--not-need-reload--not-need-reload

update.pl

daemon--not-need-reload
update.pl

daemon102

Dr.Web Updater

daemon--not-need-reload
1
daemon:$ %bin_dir/update.pl --not-need-reload=drwebd

Updater%etc_dirdrweb32.ini[Updater] section
UpdatePluginsOnly{Yes | No}=

Yes
DaemonScanner:
UpdatePluginsOnly = No
Section = {Daemon |Scanner}

Daemon Scanner--what--what:Section = Daemon

ProgramPath = {pathto file}DaemonScanner
Web Updater
:

Dr.
API

103

Dr.Web Updater

ProgramPath = %bin_dir/drwebd
SignedReader{path to file}=:
SignedReader
read_signed

LzmaDecoderPath{path to file}==%bin_dir/lzma:
LzmaDecoderPath =LockFile = {path to
file}

Dr.Web Updater:
LockFile=
update.lock

CronSummary
| No}

=

{Yes

Yes

%var_dir/run/

Dr.Web Updater
Updatercron:
CronSummary = Yes
DrlFile
file}

=

{path

to
URL
Dr.Web Updater
Dr.Web:
DrlFile=update.drl%var_dir/bases/

104

Dr.Web Updater

CustomDrlFile{path to file}=drl
Dr.Web(*.drl):CustomDrlFile=
bases/custom.drl
FallbackToDrl{Yes | No}=%var_dir/

*.drl
Yes
Updater
CustomDrlFile
DrlFile:FallbackToDrl = Yes

DrlDir = {pathdirectory}URL

toDr.Web
:
DrlDir = %var_dir/drl/

Timeout={numerical value inseconds}:
Timeout = 90

Tries =
value}{numerical

Dr.Web Updater:
Tries = 3

105

Dr.Web Updater

ProxyServer{proxy server
or IP}

=
name

IP
:
ProxyServer =ProxyLogin = {proxy
server user login}:
ProxyLogin =ProxyPassword{proxy server
password}=
user:
ProxyPassword =LogFileName = {filename}syslog
SyslogFacility
SyslogPriority:
LogFileName = syslog

SyslogFacility={Daemon | Local0 ..
Local7|
Kern|
User | Mail}
LogLevel = {Debug |Verbose | Info |Warning | Error |Quiet}
LotusdPidFile{path to file}=syslog:
SyslogFacility = Daemon:
LogLevel = Verbose
Lotus Daemon PID:

106

Dr.Web Updater

LotusdPidFile =drweblotusd.pid
MaildPidFile{path to file}=%var_dir/run/drweb-maild PID:
MaildPidFile =drweb-maild.pid

IcapdPidFile{path to file}=%var_dir/run/drweb-icapd PID:
IcapdPidFile =drweb_icapd.pid

BlacklistPath={path to directory}%var_dir/run/.dws:BlacklistPath = %var_dir/dws

AgentConfPath{path to file}

=

Agent
:
AgentConfPathagent.conf

PathToVadeRetro{path to file}==libvaderetro.so:
PathToVadeRetro=lib/libvaderetro.so

ExpiredTimeLimit{number}%var_dir/=:ExpiredTimeLimit = 14

%var_dir/107

Dr.Web Updater

ESLockfile
to file}={path
Dr.Web Updater cron:
ESLockfile=
es_updater.lock%var_dir/run/

Dr.Web Updater
Dr.Web Updater [Updater]

EnginePath VirusBase UpdatePath PidFile
Dr.Web Updater
lzma

lzma

*.vdb
LzmaDecoderPath[Updater]lzma
Updating

108

Dr.Web Agent

Dr.Web Agent
Dr.Web Control Agent
Agent
Dr.Web for UNIX mail servers
Dr.Web

for

UNIX

mail
servers
Agent

Dr.Web for UNIX mail servers
Monitordrweb-agent

drweb-monitor
Agent
1

1

:

GlobalRules=
selectmessage,append_html"lookup:file:/maild-files/somehtml.html"

GlobalRules = select message
GlobalRules = append_html "lookup:file:/maildfiles/somehtml.html"

"\"
Agent

:

to:neko@neko cont \1

109

Dr.Web Agentmodifier/LocalRules=selectSpam-Level" "\\*\\*\\*", \mime.headers"X-# 3 or more stars
if found,\select mime.headers Subject ".*",\
replace "[SPAM] " "^",\
endif

Dr.Web for UNIX mail servers
Security Suite

Dr.Web Enterprise

Dr.Web for UNIX mail servers
Agent

2

Standalone
Agent
Enterprise
Dr.Web
mail

for

UNIX

servers

Enterprise1.
2. Agent[EnterpriseMode]:%etc_dir/agent.conf

110

Dr.Web Agent

PublicKeyFile%var_dir/drwcsd.
Dr.Web Enterprise Security Suite

pub

Dr.Web Enterprise Security Suite

Dr.Web Enterprise Security Suite IP

ServerHost
Dr.Web Enterprise Security Suite
2193 ServerPort
3.

UserEnterpriseMode
Yes
Dr.Web for UNIX mail servers

Dr.Web for UNIX mail servers
MonitorMonitorEnterprise
Dr.WebUNIX

Operation Mode

Standalone
1. Agent: %etc_dir/agent.conf[StandaloneMode]
2. Agent[EnterpriseMode]
UseEnterpriseMode
No
Dr.Web for UNIX mail servers
Dr.Web for UNIX mail servers

111

Dr.Web Agent

Dr.Web for UNIX mail servers Standalone

Agent-h, --help -v, --version -Agent-u, --update-all -f, --update-failed Agent-C, --check-only -p, --newpwd - Dr.Web ESS-d, --droppwd - Dr.Web ESS
Dr.Web

ESS-c <path to file>, --conf <path to file> -s <path to file>, --socket <path to file>-P <path to file>, --pid-file <path to
file> - Agent PID-e<applicationname>,--export-config<application name> Dr.
Web ESS

Agent

112

Dr.Web Agent

Dr.Web Agent%etc_dir/agent.conf[Logging][Logging]

Dr.Web Agent[Logging]

Level = {Quiet |Error | Alert |Info | Debug}

Agent:
Level = Info

IPCLevel = {Quiet |Error | Alert |Info | Debug}

IPC:
IPCLevel = Error

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |User | Mail}syslog:
SyslogFacility = Daemon

FileName = {path}
syslog:FileName = syslog

113

Dr.Web Agent[Agent][Agent]Dr.Web Agent[Agent]MetaConfigDir ={path to directory}meta-

drweb-agent
configuration files
Agent Dr.Web
Dr.Web:

MetaConfigDir = %bin_dir/
agent/
UseMonitor = {Yes |No}

YesMonitormail
servers
drweb-agent

Dr.Web for UNIX:
UseMonitor = Yes
MonitorAddress ={address}

Agent Monitor
Monitor
Address:
MonitorAddress = local:%
var_dir/ipc/.monitor

MonitorResponseTime= {time in seconds}

drweb-monitor
MonitorAgent
drweb-monitor
Monitor

114

Dr.Web Agent:
MonitorResponseTime = 5
PidFile = {path to
file}

Agent PID:
PidFile = %var_dir/run/drwebagent.pid[Server][Server]Dr.Web Agent Dr.Web for UNIX mailservers[Server]
Agent

Address = {socket
address}:

Address = local:%var_dir/ipc/.
agent, inet:4040@127.0.0.1
Threads ={numerical value}

drweb-agent
Agent
SIGHUP:
Threads = 2

Timeout = {time inseconds}

Agent

Dr.Web:Timeout = 15

115

Dr.Web Agent[EnterpriseMode]
Agent Enterprise[EnterpriseMode][EnterpriseMode]
UseEnterpriseMode ={Yes | No}Yes
drweb-agent
EnterpriseStandalone

No:
UseEnterpriseMode = No
ComputerName ={text value}

Dr.Web Enterprise Security Suite:
ComputerName =VirusbaseDir ={path to directory}:
VirusbaseDir = %var_dir/bases
PublicKeyFile ={path to file}

Dr.Web Enterprise Security Suite:
PublicKeyFile
drwcsd.pub
ServerHost = {IPaddress}=%bin_dir/Dr.Web Enterprise Security Suite
IP:
ServerHost = 127.0.0.1

116

Dr.Web Agent

ServerPort = {portnumber}Dr.Web Enterprise Security Suite:
ServerPort = 2193

CryptTraffic = {Yes
| Possible | No}

Dr.Web Enterprise Security Suite
Agent:
CryptTraffic = possible
Dr.Web Enterprise Security Suite
Agent

CompressTraffic ={Yes | Possible |No}:
CompressTraffic = possible
CacheDir = {path todirectory}

Dr.WebSecurity Suite

Enterprise:CacheDir = %var_dir/agent[StandaloneMode]
Agent Standalone[StandaloneMode][StandaloneMode]IP

StatisticsServer ={server address}:

StatisticsServer = stat.drweb.
com:80/update

117

Dr.Web Agent

StatisticsUpdatePer
iod = {time inminutes}5:
StatisticsUpdatePeriod = 10

StatisticsProxy ={proxy server
address}

IP:
StatisticsProxy
localhost:3128=:
StatisticsProxy =StatisticsProxyAuth= {text value}:
StatisticsProxyAuth
testpwd

=

test:

:
StatisticsProxyAuth =http://stat.drweb.com/

UUID = {identifier}
UUID
UUID

md5
:
UUID =
LicenseFile = {pathto file}Dr.Web:sum

118

Dr.Web Agent

LicenseFile = %bin_dir/drweb32.key
ProtectedEmails ={lookups}
lookup:ProtectedEmails = file:%
etc_dir/email.ini[Update]Dr.Web Enterprise Security Suite
Web for UNIX mail servers[Update][Update]CacheDir = {path todirectory}

Agent:
CacheDir = %var_dir/updates/
cache

RegFile = {path tofile}:
RegFile = %var_dir/agent.reg
Timeout = {time inseconds}

Agent:
Timeout = 120

RootDir = {path to

Dr.

119

Dr.Web Agent:

directory}

RootDir = /Dr.Web Enterprise Security Suite

Dr.Web Unix Control Agent"Configuration Services"Dr.Web Agent

Agent
1.
Agent
2. [EnterpriseMode]
Dr.Web for UNIX mail servers
Agent Enterprise[Standalone]
Agent Standalone[Standalone]
Agent
3. Agent
TCP

Dr.Web1
UNIX
drweb-agent
Agent

Dr.Webfor UNIX mail servers

Enterprise
Security
Agent Standalone

Suite

Dr.Web120

Dr.Web AgentEnterprise
Agent
Dr.Web Enterprise Security Suite
Dr.Web Enterprise Security Suite
Agent Standalone
Agent
Suite

Dr.Web Enterprise Security
AgentStandalone
Agent

Dr.Webmeta-configuration
Agent[Agent]MetaConfigDir

meta-configuration

Agent

Agent metaconfiguration
Dr.Webamc-files
Agent

Application
EndApplication

id: Dr.Web Enterprise Security Suite
ConfFile:
Components:
EndComponents

ID/
Quarantine/DBISettings
General121

Dr.Web Agent\
Dr.Web MailD for Linux amc-file:

Application "MAILD"
id40

ConfFile"/etc/drweb/maild_smtp.conf"

Components
lookup_ldap

LDAPlookup_regex

REGEX

drweb-maild General, Logging, MailBase, Stat,
Maild, Filters,
Quarantine, /_Rules=Rule*:Rules, /Reports/Send,/Reports/SendTimes, /Reports/Names, /Reports/MaxPoolSize,/Reports/MaxStoreInDbPeriod,Reports/
CheckForRemovePeriod,/Notifier/FilterMail,/Notifier/NotifyLangs,/Notifier/LngBaseDirdrweb-notifier General, Logging, Notifier, /Sender/Method, /_Rules,
Reports, /Filters/BeforeQueueFilters,/Filters/AfterQueueFilters,
Quarantine/AccessByEmail,//Quarantine/StoredTime
drweb-sender

General, Logging, Sender

drweb-receiver
General,ProtectedNetworks,

Logging,/Maild/ProtectedDomains,
IncludeSubdomains,
SASL, Receiver/Maild//Maild/122

Dr.Web Agent

EndComponents
EndApplication

Agent

Dr.Webhttp://stat.drweb.com/
Dr.Web Enterprise Security Suite Agent Enterprise
Agent
UUID
MD5
UUID
Dr.Web
UUID
Agent
UUID
Dr.Websystems
Agent

Anti-virus for UNIX
Doctor Web

Dr.WebHTML XMLWeb

http://stat.drweb.com/

Web

Dr.Web123

Dr.Web Agent

15.

1. MailFiles

2. Start date End date
3. Top4.
5. Querytop

Plot graph
http://info.drweb.com/export/xml/
XML

124

Dr.Web Agent:<drwebvirustop
period="24"
top="5"vdbaseurl="http://info.drweb.com/
virus_description/"
updatedutc="2009-06-09
09:32:02"><item><vname>Win32.HLLM.Netsky</vname><dwvlid>62083</dwvlid><place>1</place><percents>34.201062139103</percents></item><item><vname>Win32.HLLM.MyDoom</vname><dwvlid>9353</dwvlid><place>2</place><percents>25.1303270912579</percents></item><item><vname>Win32.HLLM.Beagle</vname><dwvlid>26997</dwvlid><place>3</place><percents>13.4593034783378</percents></item><item><vname>Trojan.Botnetlog.9</vname><dwvlid>438003</dwvlid><place>4</place><percents>7.86446592583328</percents></item>125

Dr.Web Agent<item><vname>Trojan.DownLoad.36339</vname><dwvlid>435637</dwvlid><place>5</place><percents>7.31494163115527</percents></item></drwebvirustop>XML
periodtop
updatedutc
vname
place
percents

periodWebHTMLview/<UUID>
XML
xml/<UUID>

http://stat.drweb.com/
http://stat.drweb.com/<UUID>
Dr.Web

MD5
UUID

:

<drwebvirustop period="24" top="2" user="<UID>"
lastdata="2005-04-12 07:00:00+04"><item>

126

Dr.Web Agent<caught>69</caught><percents>24.1258741258741</percents><place>1</place><vname>Win32.HLLM.Netsky.35328</vname></item><item><caught>57</caught><percents>19.9300699300699</percents><place>2</place><vname>Win32.HLLM.MyDoom.54464</vname></item></drwebvirustop>XML
periodtop
user
lastdata
vname
place
caughtpercents

period127

Dr.Web Monitor

Dr.Web Monitor
Dr.Web Unix Monitor

MonitorDr.Web Unix Monitor

Dr.Web for UNIX mail servers
MonitorMonitorMonitorMonitorMonitorMonitorMonitorDr.WebControl Agent

Dr.Web for UNIX mail servers
Security Suite

Dr.Web Enterprise

Dr.Web for UNIX mail servers
Agent

2

Standalone
Agent
Monitor

128

Dr.Web Monitor

Enterprise
Dr.Web
mail

for

UNIX

servers

Enterprise1.
2. Monitor

conf

:

%etc_dir/monitor.
Yes

UseEnterpriseMode

Dr.Web for UNIX mail servers

Dr.Web for UNIX mail servers
AgentEnterprise
Dr.Web UNIX Agent:%etc_dir/monitor.
RunAppList

Operation Mode

Standalone
1. Monitor

conf[Monitor]

Monitor
2. Monitor[Monitor]
UseEnterpriseMode
No
Dr.Web for UNIX mail servers
Dr.Web for UNIX mail servers

129

Dr.Web Monitor

Dr.Web for UNIX mail servers Standalone

Dr.Web Monitor-h, --help -v, --version -Monitor-u, --update -C, --check-only -A, --check-all -c <path to file>, --conf <path to file> -r, --run component1[,component2]:-r AGENT, DAEMON

Dr.Web Monitor%etc_dir/monitor.conf[Logging]
Dr.Web Monitor

monitor.conf.

% etc_dir/

130

Dr.Web Monitor[Logging]
Level = {Quiet |Error | Alert |Info | Debug}

Monitor:Level = Info

IPCLevel = {Quiet |Error | Alert |Info | Debug}

IPC:
IPCLevel = Error

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |User | Mail}
FileName = {syslog| path to file}syslog:
SyslogFacility = Daemon

syslog:FileName = syslog[Monitor][ Monitor]

Monitor[Monitor]

RunForeground ={Yes | No}

Monitor daemon

YesNo
daemontools
Yes:
RunForeground = No

131

Dr.Web Monitor

Monitor

User = {user name}:
User = drweb

MonitorGroup = {group
name}:Group = drweb
PidFileDir = {pathto directory}

MonitorPID:

PidFileDir = %var_dir/run/
ChDir = {path todirectory}

MonitorMonitor:
ChDir = /MetaConfigDir ={path to directory}meta-configuration files
Monitor Dr.
Web
Dr.Web:
MetaConfigDir = %etc_dir/
monitor/
Address = {address}

Monitor:132

Dr.Web Monitor

Address = local:%var_dir/ipc/.
monitor
Timeout = {time inseconds}

MonitorDr.Web:Timeout = 5
TmpFileFmt = {text}
path_to_file.XXXXXX X :TmpFileFmt = %var_dir/msgs/
tmp/monitor.XXXXXX
RunAppList = {text}

Monitor

RunAppList
Monitor:
RunAppList = AGENT
UseEnterpriseMode ={Yes | No}

Enterprise
Yes

Monitor
RunAppList
drweb-agent

NoStandalone:

UseEnterpriseMode = No

133

Dr.Web Monitor

RecoveryTimeList={time in seconds}
1
2

2
3
:

RecoveryTimeList = 0,30,60
InjectCmd ={string}root@localhost:
InjectCmd = "/usr/sbin/
sendmail -t"
AgentAddress ={socket address}

Monitor Agent
Dr.Web Agent
Address:
AgentAddress = local:%var_dir/
ipc/.agent

AgentResponseTime ={time in seconds}

drweb-agent
Agent
Monitor drweb-agent
Agent:
AgentResponseTime = 5134

Dr.Web Monitor

Dr.Web Unix Monitor"Configuration Services"Dr.Web Agent

Monitor1.
Monitor2. daemon
3. Monitor

TCP
1
UNIX

drweb-monitor

4. Monitor PID

PID

5. drweb-monitor
MonitorMonitorMonitorMonitor meta-configuration
Dr.Web Monitor%etc_dir/drweb-monitor.enable
ENABLE
1
Linux Solaris/etc/rc.conf
drweb_monitor_enable="YES"FreeBSD135

Dr.Web Monitor

mmc-files

Monitor configuration files mmc-files
Dr.Web Monitor

Application
EndApplication

FullName Path Depends DAEMON

AGENT

Dr.WebDaemon mmc-files

AGENT
Components -Notification type -

MAIL
LOG
Startup privileges -Dr.Web Daemon for Linux mmc-file:

Application "MAILD"FullName
Path"Dr.Web (R) MailD""/opt/drweb/"

Depends136

Dr.Web Monitor

Depends"AGENT"

Components# nameargs
NotifyType User:Group

MaxStartTime MaxStopTime

drweb-notifier local:/var/drweb/ipc/.agent 30
30 MAIL drweb:drweb
drweb-sender
local:/var/drweb/ipc/.agent 15
30 LOG drweb:drweb
drweb-maild
local:/var/drweb/ipc/.agent 120
30 MAIL drweb:drweb
drweb-receiver local:/var/drweb/ipc/.agent 15
30 MAIL root:drweb
EndComponents
EndApplication

137

Dr.Web for UNIX Mail Servers

Dr.Web for UNIX Mail Servers
Dr.Web for UNIX mail servers
Dr.Web for UNIX mail servers
SMTP
LMTP
proxy-server
MTA Sendmail Postfix Exim
CommuniGate Pro Courier Zmailer Qmail
Dr.Web for UNIX mail servers
1. Receiver

SMTP/LMTP

drweb-maild

drwebreceiver drweb-milter drweb-cgp-receiver
Receiver
Receiverdrweb-maild
drweb-milter

SMTP

Sendmail
2. Drweb-maild
MIME
Receiver
Sender3.

drweb-maild
drweb-maild
Sender

4. Sender
SMTP/LMTP

senderSenderdrweb-sender drweb-cgpdrweb-maild

138

Dr.Web for UNIX Mail Servers

drweb-notifier drweb-monitor
5. drweb-notifier

Drweb-maild
SenderDSN

6. drweb-agent
Enterprise Security Suite

Enterprise

Dr.WebStandalone
Enterprise
drweb-monitor

drweb-agent
drweb-agent
drweb-agent

7. drweb-monitor

drweb - Dr.Web Daemon
DaemonMIMEheadersfilter Perlvaderetro VadeRetromodifier -VadeRetro

139

Dr.Web for UNIX Mail Servers

UNIX

Dr.Web for UNIX mail servers

module_name [parameters] agent_socket
module_name
Dr.Web for UNIX mail servers
drweb-maild
drweb-notifierparameters
agent_socket
Dr.Web for UNIX mail servers
Dr.Web Agent

-h

-help

Dr.Web for UNIX mail servers-v, --version -l <level>, --level <level> - Dr.Web for UNIX
mail servers
info-t <value in seconds>, --timeout <value inseconds> --component arg - Agent--log-name arg --unique-id arg - Receiver Sender
ID

Receiver Sender
Receiver Sender
ID
ID
Receiver/Sender
SenderSenderSenderSIGHUP--check-only

Dr.Web Agent

140

Dr.Web for UNIX Mail Servers

Options OK

Options ERROR
Dr.Web Monitor--check-all :$ drweb-maild -t 30 local:%var_dir/ipc/.agent
Agent
Dr.Web MailD

local:%var_dir/ipc/.agent
30

SIGHUP - Dr.Web Monitor
SIGINT SIGTERM -Receiver

SenderReceiver

Sender

SIGUSR2
SIGUSR1SIGALRM

141

Dr.Web for UNIX Mail Servers

SIGUSR1
Dr.WebMailD[General]

BaseDir

Dr.WebMailD

InPoolOptions OutPoolOptions
stat = yes:

InPoolOptions = auto, stat = yes
SIGUSR1
name_[callback_](cli|srv)[.unique-id].txt
name_[callback_](thr[N])[.unique-id].txt -name - "drweb-"callback - Receivercli srv - server
unique-id thr -142

Dr.Web for UNIX Mail Servers==================================
start:Tue Oct

9 14:44:15 2008

curr:

Tue Oct

9 14:44:29 2008

period: 0d 0h 0m 14s

srv
closed: 0 (0 num/sec)
total created = 0 (0 num/sec)
max rea = 0 est = 0 don = 0 act = 0
clicreated on request = 0 (0 num/sec)
closed by timeout = 0 (0 num/sec)
avg number = 0
current = 2
thr
min = 2 max = 2147483647 type = 0 freetime =120busy max = 0 avg = 0
requests for new threads = 0 (0 num/sec)creating fails = 0
max processing time = 0 ms; avg = 0 ms
curr = 2 busy = 0

1

- 1

(
2

-

143

Dr.Web for UNIX Mail Servers

3
4
5

-

6

-

Dr.Web for UNIX mail servers

Dr.Web for UNIX mail servers
3

maild_MTA.conf
Monitoragent.conf%etc_dirDr.Web MailD
Dr.Web Agent

Dr.Webmonitor.conf

Dr.Web for UNIX mail servers

configure.plbin_dir/maild/scripts/
maild_MTA.conf
Dr.Web MailD

Dr.Web MailD%etc_dir/maild_MTA.conf[General][ General]

Dr.Web

MailD

%

144

Dr.Web for UNIX Mail Servers

BaseDir = {pathdirectory}toDr.
Web MailD
SUGHUP:
BaseDir = %var_dir/

MaxTimeoutForThread
Activity = {time}

MaxTimeoutForThreadActivity:
MaxTimeoutForThreadActivity
30s
IpcTimeout = {time}:
IpcTimeout = 40s
Hostname = {string}

Dr.Web for UNIX mail servers:
Hostname =[Logging][ Logging]
Dr.Web for UNIX mail servers=

145

Dr.Web for UNIX Mail Servers

Level = {Quiet
Error
|
Alert
Info | Debug}||:
Level = Info

IPCLevel = {Quiet |
Error
|
Alert
|
Info | Debug}

IPC:
IPCLevel = Alert

SyslogFacility={Daemon | Local0 ..
Local7|
Kern|
User | Mail}
FileName = {syslog| path to file}syslog:
SyslogFacility = Mailsyslog:FileName = syslog

SyslogFacility
syslogDaemonsyslogd'['tid']' name[.sub] level [id(/mta-id)] text

tid name sub -ipc thrN report ldap odbc oracle sqlite mysql postgres
cdb berkeley firebird -146

Dr.Web for UNIX Mail Servers

control parser MRS - SMTP/LMTP
smtp - SMTP
lmtp - LMTP
pipe - PIPE
queue level
FATAL ERROR WARN INFO DEBUG
16

id MTA
Dr.Web MailD MTA

mta-id -MTAtext INFO
Agent

DEBUG
Agent

--leveldebug[MySQL][ MySQL]

Dr.Web MailD MySQL

User = {string}

MySQL:
User =

Password = {string}

MySQL:
Password =147

Dr.Web for UNIX Mail Servers

MySQL

DB = {string}

:
DB =
MySQL

Host = {hostname}:Host = localhostPort=address}

{port

MySQL
:
TCP
Port = tcp://1234
UNIXPort = unix:///path/to/socket:
Port =

Connections{integer}

=

MySQL
0

:
Connections = 4
SizeLimit{integer}

=

1
0

148

Dr.Web for UNIX Mail Servers:
SizeLimit = 10
SkipDomains{LookupsLite}=:
SkipDomains =
Lib
=
file}

{path

to

libmysqlclient.so:Lib=libmysqlclient_r.so/usr/lib/[PostgreSQL][ PostgreSQL]

ConnectionsString{string}

Dr.Web MailD PostgreSQL=

PostgreSQL

keyword = value

http://postgresql.org/
docs/8.3/static/libpq-connect.html:
ConnectionString=

149

Dr.Web for UNIX Mail Servers

host=localhost
port=5432
user=ai
password=qwerty
dbname=drweb
ConnectionString
hostaddr=127.0.0.1:5432
dbname=mailddb
user=mailddbuser
password=Str0ngPaSSw0rd=:
ConnectionsString =SizeLimit{integer}

1

=

0
:
SizeLimit = 10

SkipDomains{LookupsLite}=:
SkipDomains =
Lib
=
file}

{path

to

libpq.so:
Lib = /usr/lib/libpq.so[Firebird][ Firebird]

Host = {hostname}

Dr.Web MailD Firebird

Firebird

150

Dr.Web for UNIX Mail Servers:
Host = localhost
Database = {string}Firebird:
Database =Firebird

User = {string}:
User =
Password = {string}Firebird:
Password =Firebird

Charset = {string}

charset:Charset = us-ascii
SizeLimit{integer}

1

=

0
:
SizeLimit = 10

SkipDomains{LookupsLite}=:
SkipDomains =151

Dr.Web for UNIX Mail Servers

Lib
=
file}

{path

to

libFBclient.so:
Lib = /usr/lib/libFBclient.so[CDB][ CDB]

Sources
file}

Dr.Web MailD CDB

=

{path

to

CDB
:
Sources =SkipDomains{LookupsLite}=:
SkipDomains =[Berkeley][ Berkeley]

Databases
to file}Dr.Web MailD Berkeley

=

{path
:
Databases =Environment = {pathto directory}

Berkeley:
Environment =152

Dr.Web for UNIX Mail Servers

SizeLimit{integer}

1

=

1024

65536

:
SizeLimit = 1
SkipDomains{LookupsLite}=:
SkipDomains =
Lib
=
file}

{path

to

libdb.so:
Lib = /usr/lib/libdb.so[SQLite][ SQLite]

Dr.Web

Database = {path to
file}

MailD SQLite

SQLite:Database =SizeLimit{integer}

1

=

0
:
SizeLimit = 1

153

Dr.Web for UNIX Mail Servers

SkipDomains{LookupsLite}=:
SkipDomains =
Lib
=
file}

{path

to

libsqlite3.so:
Lib = /usr/lib/libsqlite3.so

BusyTimeout = {timein milliseconds}

Dr.Web MailD:
BusyTimeout = 2000

[ODBC][ ODBC]

Lib
=
file}

Dr.Web{path

to

MailD ODBC

ODBC

3.0
UnixODBC
dlopenSIGHUP:

Lib = /usr/lib/libodbc.so
ConnectData{string}=

ODBC
2USER/PASSWORD/@DSN

154

Dr.Web for UNIX Mail Servers

DSN=value;UID=value;
PWD=value
ODBC
DSN

:
ConnectData =SizeLimit{string}

1

=

0

:
SizeLimit = 0
SkipDomains{LookupsLite}=:
SkipDomains =[Oracle][ Oracle]

Lib
=
file}

Dr.Web MailD Oracle

{path

to

Oracle OTL

8dlopenSIGHUP:

155

Dr.Web for UNIX Mail Servers

Lib =ConnectData{string}=

Oracle2
USER/PASSWORD/@DSN
DSN=value;UID=value;
PWD=value
OracleDSN:
ConnectData =SizeLimit{string}

1

=

0

:
SizeLimit = 0
SkipDomains{LookupsLite}=:
SkipDomains =[LDAP][ LDAP]

Dr.Web MailD LDAP156

Dr.Web for UNIX Mail Servers

Lib
=
file}

{path

to

2.0

OpenLDAP"_r"dlopenSIGHUP:
Lib = /usr/lib/libldap_r.so
Hostname = {string}

LDAP
localhost:
Hostname =Port = {number}

LDAP
389

:
Port = 389
Timeout = {time}

LDAP:
Timeout = 10s
Version = {string}LDAP
TLS/SSL3
3

157

Dr.Web for UNIX Mail Servers:
Version = 3
LDAP
LDAP

Bind = {Yes | No}

bind
3

bind

:
Bind = No
bind

BindDn = {string}

DN Distinguished Name:
BindDn =bind

BindPw = {string}

DN:
BindPw =SearchBase{string}

DN=
RFC2253:
SearchBase =SizeLimit{integer}

1

=

0

:
SizeLimit = 0
Dereference

=

{3

|

LDAP

158

Dr.Web for UNIX Mail Servers

0 -2 | 1 | 0}

1 2 3 -:
Dereference = 0
ChaseReferrals{integer}=

LDAP_OPT_REFERRALS
LDAP
3

:
ChaseReferrals = 0
SkipDomains{LookupsLite}=:
SkipDomains =CheckPeriod{time}

=

LDAP
LDAP

:
CheckPeriod = 2m

159

Dr.Web for UNIX Mail Servers[MailBase][ MailBase]Dr.Web MailD

MaxStoredMessages{integer}=0:
MaxStoredMessages = 100000
MaxStorageSize{size in bytes}=
0:
MaxStorageSize = 0
MaxPoolSize{integer}=
0

SIGHUP:
MaxPoolSize = 0160

Dr.Web for UNIX Mail Servers

SendTimeout{time}=[Maild]ProcessingErrors:
SendTimeout = 30s
FrozenTimeout{time}=
SendTimeout
FrozenTimeout:
FrozenTimeout = 2h
DeleteTimeout{time}=
FrozenTimeout:
DeleteTimeout = 48h

BackupPeriod{time}=
0:
BackupPeriod = 0161

Dr.Web for UNIX Mail Servers

BackupName{filename}=?
?
:
BackupName=%var_dir/msgs/
db/.maildb.backup

MaxBodySizeInDB{size}=:
MaxBodySizeInDB = 1k
SyncMode
No}

=

{Yes

|
yes

fsync

no

OS
drweb-

maild
DB

no
:
SyncMode = no

[Filters][ Filters]

Dr.Web MailD

162

Dr.Web for UNIX Mail Servers

LibDir = {path todirectory}:
LibDirplugins/=%bin_dir/maild/

Settings = {list ofplug-in settings}
Settings = [plugin_settings],[plugin_settings]...
[plugin_settings]
plugin_name:[PARAM1]|...|[PARAMN][PARAMN]
setting_name = setting_value:
Settings = vaderetro: max_size= 400k|log_level=debug, drweb:
max_size = 10m
Vaderetro
400
debug

drweb
10

:
Settings =section = {textvalue}

163

Dr.Web for UNIX Mail Servers

max_size = {size}
0

MaxSizeBeforeQueueFilters
MaxSizeAfterQueueFilters
plugin_name/max_size =value

max_size[Rule:client1]...
plugin_name/max_size = {size}[Rules]md-client:client1
rule=client1

cont:[Rule:Client1]
AdminMail
drweb.ru=

root@client1.

SenderAddress
inet:25@10.0.0.0
ProtectedDomains
drweb.ru, client1==

client1.

ProtectedEmails=*@client1.drweb.ru,*@client1

regex:.
regex:.

ProtectedNetworks
10.0.0.0/32=

drweb/max_size = 100k
[Rules]...
md-client:client1=client1

cont

rule

164

Dr.Web for UNIX Mail Servers

log_level = {Quiet| Error | Alert |Info | Debug}

Level[Logging]

log_ipc_level ={Quiet | Error |Alert | Info |Debug}

IPC

syslog_facility ={Daemon | Mail |Local0 .. Local7}

syslog[Logging]
SyslogFacility[Logging]
IpcLevelsysloglog_filename ={syslog | path tofile}syslogd

path_to_lib = {pathto file}[Filters]
LibDir
LibDir"/lib+plug-in

name.so"Linux
vaderetro
Dr.Web MailD%bin_dir/maild/plugins/libvaderetro.so
Settings
Dr.Web

MailD

Settings=
NewUserPlugin:log_level=info|max_size=200k

165

Dr.Web for UNIX Mail Servers

BeforeQueueFilters= {list of plugins}:
BeforeQueueFilters =MaxSizeBeforeQueueF
ilters = {size}

BeforeQueueFilters
max_size
0:
MaxSizeBeforeQueueFilters =AfterQueueFilters ={list of plug-ins}:
AfterQueueFilters =MaxSizeAfterQueueFi
lters = {size}

AfterQueueFilters
max_size
0:
MaxSizeAfterQueueFilters = 0

PluginsBaseDir ={path to directory}:
PluginsBaseDir
plugins/=%var_dir/

166

Dr.Web for UNIX Mail Servers[Stat][ Stat]Dr.Web MailD

Detail = {value}
off -

low

-

medium -

Web

high

-

Web
low

StatDetail:
Detail = low

167

Dr.Web for UNIX Mail Servers

Send = {Yes | No}
Suite

Dr.WebDr.Web
MailD:
Send = Yes
SendPeriod = {time}:
SendPeriod = 10m
Timeout = {time}:
Timeout = 30s

Dr.Web MailD

storagestorage
1. [Stat]

ExportStat

2. [Stat]

ExportStat = {Yes |No}:
ExportStat = No

Yes

Security168

Dr.Web for UNIX Mail Servers

ExportBlockObjectsS
torage = {query
string}:number<int> :q_name<varchar_long>-:virus_name<varchar_long>:virus_code<int> -o 1 o 2 o 3 o 4 o 5 o 6 o 7 o 8 o 9 o 10 o 11 o 12 o 13 o 14 o 15 o 16 --169

Dr.Web for UNIX Mail Servers:
plugin_name<varchar_long>:sender<varchar_long> :client_ip<varchar_long>IP:date<timestamp>-:client_id<varchar_long>:
ExportBlockObjectsStorage="odbc:insert
intovirusesvalues(:number<int>,:
q_name<varchar_long>,:virus_name<varchar_long>,:virus_code<int>,:
plugin_name<varchar_long>,:
sender<varchar_long>,:
client_ip<varchar_long>,:
date<timestamp>,:
client_id<varchar_long>)":
ExportBlockObjectsStorage =ExportStatStorage ={query string}170

Dr.Web for UNIX Mail Servers

SendPeriod[Stat]:size<int> :num<int>-:q_num<int> :r_num<int> :n_num<int> :pass_num<int> :reject_num<int> :discard_num<int>-:tempfail_num<int> :date<timestamp>:q_size<int>-:r_size<int>--:n_size<int> :pass_size<int>-171

Dr.Web for UNIX Mail Servers:reject_size<int>-:discard_size<int> :tempfail_size<int> -:work_time<int> -:ExportStatStorage="odbc:
insert into g_stat values(:
size<int>,:num<int>,:
q_num<int>,:r_num<int>,:
n_num<int>, :pass_num<int>, :reject_num<int>,:
discard_num<int>,:
tempfail_num<int>,:
date<timestamp>)":
ExportStatStorage =ExportPluginStatSto
rage = {query
string}[Reports]

SIGHUP

Names

172

Dr.Web for UNIX Mail Servers

ExportStatStorage:
plugin_name<varchar_long>-:
ExportPluginStatStorage="
odbc:insert into plugin_statvalues(:plugin_name<varchar_long>,:size<int>,:num<int>,:
q_num<int>,:r_num<int>,:
n_num<int>, :pass_num<int>, :reject_num<int>,:
discard_num<int>,:
tempfail_num<int>,:
date<timestamp>)":
ExportPluginStatStorage =[Reports][ Reports]

Send = {Yes | No}

ReportsSend:
Send = Yes

173

Dr.Web for UNIX Mail Servers

SendTimes = {time}

hour:minute:second[period] Nw/hour:minute:second[period] N
012 Nm/hour:minute:second[period] N{time}
24:
SendTimes=
1w/00:00:00-7d,
31d

00:00:00-24h,
2M/21:23:320

2

0
21:23:32

ReportsSendTimes:
SendTimes = 24h
Mail=address}{e-mail[Notifier]AdminMail

174

Dr.Web for UNIX Mail Servers

ReportsMail
ReportsMail
AdminMail

Mail =
Names = {listplug-ins}ofplug-in_name1,
in_name2, ... .

plug[

Filters]
BeforeQueueFilter
AfterQueueFilter

ReportsNames

Names =
TopListSize{integer}=0-1ReportsTopListSize
TopListSize = 20

175

Dr.Web for UNIX Mail Servers

MaxStoreInDbPeriod= {time}0
MaxStoreInDbPeriod = 31d

CheckForRemovePeriod ={time}
CheckForRemovePeriod = 5m

Dr.Web MailD
Super-Administrator
GeneralSend = {Yes
| No}

Super-Administrator

GeneralGeneralSend = Yes
GeneralSendTimes ={time}

Super-Administrator

hour:minute:second[period] Nw/hour:minute:second[period] N
012 Nm/hour:minute:second[period] N

24:GeneralSendTimes = 00:00:00

176

Dr.Web for UNIX Mail Servers

GeneralClientFilter= {regularexpression}

GeneralClientFilter =GeneralTotalStat ={Yes | No}
GeneralTotalStat = Yes
GeneralMail = {email address}

Super-Administrator
GeneralMail =GeneralNames ={list of plug-in
modules}

Super-Administrator
plugin_name1, plug-in_name2, ... .
[Filters]
BeforeQueueFilter
AfterQueueFilter
GeneralNames = drweb1, drweb2

GeneralTopListSize= {number}SuperAdministrator
GeneralTopListSize = 20

[Quarantine][ Quarantine]

Quarantine

177

Dr.Web for UNIX Mail Servers

Path = {path todirectory}:
Path = %var_dir/infected/

FilesMode ={numeric value}

QuarantineFilesMode:
FilesMode = 0660

FilenamesMode ={Std | Tai |Rand48}

Std - mkstemp%FilenamesPrefix.XXXXXX%FilenamesPrefix
FilenamesPrefix
XXXXXX
Tai - TAI International Atomic Time%sec.%usec.%
FilenamesPrefix.XXXXXX
Rand48 -lrand48%FilenamesPrefix.XXXXXXXX:FilenamesMode = Std

178

Dr.Web for UNIX Mail Servers

FilenamesPrefix ={text value}

"%"

"_"

QuarantineFilenamesPrefix:
FilenamesPrefix = maild
AccessByEmail ={Yes | No}
FilterMail
Subject
q:relative_path_to_file
relative_path_to_file/drweb/drweb.quarantine.
puYtWx1

MUA:
AccessByEmail = Yes
StoredTime = {time}0:
StoredTime = 24h
MaxSize = {size in
Kbytes}0179

Dr.Web for UNIX Mail Servers

DBI:
MaxSize = 0
MaxNumber ={numerical value}

0

DBI

:
MaxNumber = 0
MoveToDBI = {Yes |
No}

DBI
Perl

File::Temp

DBI:
MoveToDBI = No
DBISettings ={string}

DBI:"dbi:Pg:dbname=emails_db"

180

Dr.Web for UNIX Mail Servers

SQL-ASCII:
DBISettings =DBIUsername = {textvalue}DBI:
DBIUsername =DBIPassword = {textvalue}DBI:
DBIPassword =SQLInsertCommand ={string}

DBI

1. number 2. string :prefixclient/plug-in/id.
client"def"

plug-in
id 16
8
prefix FilenamesMode
FilenamesPrefix
3. timestamp 4. string 5. string

From
-

181

Dr.Web for UNIX Mail Servers

6. string "?":SQLInsertCommand=
INTO
mail_export(?,?,?,?,?,?)""INSERT
values:SQLInsertCommand =SQLRemoveCommand ={string}

DBI

time
"?"
:
SQLRemoveCommand=
FROM
mail_export
put_time<=?""DELETEWHERE:
SQLRemoveCommand =SQLSelectCommand ={string}

DBI"?"
1. number 2. timestamp 3. string 4. string -

From

182

Dr.Web for UNIX Mail Servers

5. string -6. <relative path to file>

SQLInsertCommand:
SQLSelectCommand = "SELECT id,
put_time,body,sender,rcpts,
filename
FROM
mail_export
WHERE filename LIKE ?":SQLSelectCommand =PulseTime = {time}
DBI
0
PathToDrwebQp:
PulseTime = 5m
PathToDrwebQp ={path to file}

drweb-qp:
PathToDrwebQp
drweb-qp

MoveAll = {Yes |No}=%bin_dir//Path_parameter_value/
def/backup/
MoveToDBI = yes:

183

Dr.Web for UNIX Mail Servers

MoveAll = No

[Maild][ Maild]

Dr.Web MailD

ProtectedNetworks ={lookups}

CIDR:
ProtectedNetworks=
10.0.0.0/24,
127.0.0.0/8,
192.168.0.68:
ProtectedNetworks
127.0.0.0/8

ProtectedDomains ={lookups}=:
ProtectedDomains = example.ru,
example.com:
ProtectedDomains =IncludeSubdomains ={Yes | No}:
IncludeSubdomains = yes
InPoolOptions ={pool settings}:
InPoolOptions = auto

184

Dr.Web for UNIX Mail Servers

OutPoolOptions ={pool settings}:
OutPoolOptions = auto
RedirectMail = {email address}

Redirect:
RedirectMail = root@localhost

OnlyTrustedControlM
ails = {Yes | No}

ReceiverIP
Dr.Web for UNIX
mail servers
MTA
Received
GetIpFromReceivedHeader = Yes

Dr.Web:
OnlyTrustedControlMails = Yes
MaxScore ={numerical value}
MaxScoreAction:
MaxScore = 10000

185

Dr.Web for UNIX Mail Servers

MaxScore

MaxScoreAction ={actions}

reject
UseCustomReply
yes
SMTP
ReplyMaxScore

pass discard reject tempfail
quarantine
redirect add-header score:
MaxScoreAction = reject
MaxMimeParts ={numerical value}

MIME
0
MIME
ProcessingError:
MaxMimeParts = 1000
MIME

MaxNestedMimeParts= {numerical value}0
MIME
ProcessingError:
MaxNestedMimeParts = 100

186

Dr.Web for UNIX Mail Servers

LicenseLimit ={actions}
pass discard reject tempfail
quarantine
redirect notify add-header
score:
LicenseLimit = pass
From

EmptyFrom ={actions}

continue discard reject
quarantine
redirect add-header score:
EmptyFrom = continue
ProcessingErrors ={actions}
pass discard reject tempfail
quarantine
redirect notify add-header
score

187

Dr.Web for UNIX Mail Servers:
ProcessingErrors = pass
RulesLogLevel ={Quiet | Error |Alert | Info |Debug}:
RulesLogLevel = Alert

PidFile = {path to
file}

PID

drweb-maild:
PidFile =maild.pid%var_dir/run/drweb-

SMTP

Dr.Web for UNIX mail servers
SMTP
550 5.7.0

UseCustomReply ={Yes | No}

SMTP
SMTP
:
UseCustomReply = No

ReplyEmptyFrom ={string}

EmptyFrom = reject
UseCustomReply = Yes"550 5.7.0 Text":
ReplyEmptyFrom = "DrWEB maild:

188

Dr.Web for UNIX Mail Servers

Messages from <> areby administrator."
ReplyProcessingErro
r = {string}

blockedProcessingError = reject
UseCustomReply = Yes
"550
5.7.0

Text"
:

ReplyProcessingError = "DrWEB
maild: Message is rejected due
to software error."
ReplyMaxScore ={string}

MaxScoreAction =UseCustomReply

reject
= yes
"550

5.7.0

Text"
:

ReplyMaxScore = "Dr.Web MailD:
Message is rejected due toscore limit exceed."
GetIpFromReceivedHe
ader = {Yes | No}

ReceiverIP

Received:
GetIpFromReceivedHeader = Yes

Control = {Yes |No}drweb-maild:
Control = No

189

Dr.Web for UNIX Mail Servers

drweb-maild

ControlAddress ={socket address}:
ControlAddress
inet:3009@127.0.0.1
ControlPoolOption ={pool settings}=

drweb-maild.
:ControlPoolOption = auto
Reject

SkipDSNOnBlock ={Yes | No}

Tempfail
ReceiverDSN:

SkipDSNOnBlock = No

[Receiver][ Receiver]
Exim
UNIX mail servers

ReceiverPostfix
Dr.WebDr.Web for UNIX mail gateways

Address = {socket
address}for

ReceiverTCP

inet:port@hostname
UNIXlocal:
path_to_socket_file:
Address = inet:25@0.0.0.0
PoolOptions = {poolsettings}:

190

Dr.Web for UNIX Mail Servers

PoolOptions = auto
MTA

RealClients = {Yes
| No}:

RealClients = Yes
ProcessingErrors ={actions}
tempfail discard reject1:
ProcessingErrors = reject
StalledProcessingIn
terval = {time}

Checker:
StalledProcessingInterval
10m
OneCommandTimeout ={time}

1:
OneCommandTimeout = 5m

OneMessageTimeout ={time}

1:
OneMessageTimeout = 10m=

191

Dr.Web for UNIX Mail Servers

Received

AddReceivedHeader ={Yes | No}:

AddReceivedHeader = Yes
ReturnReject = {Yes
| No}

Reject
5** error
2** error
Exim
BeforeQueueFilters

Receiver
Yes
No
DSN
MTA

Exim
ReturnReject= No:
ReturnReject = Yes
GreetingString ={string}"%host%"Hostname"%ver%"[General]drweb-receiver:

GreetingString = "%host% Dr.
Web
SMTP
receiverv%ver%
ready"
0

MaxRecipients ={integer}IP

trusted:MaxRecipients = 100

192

Dr.Web for UNIX Mail Servers

MaxConcurrentConnec
tion = {integer}

1

IP

SMTP
0
:

MaxConcurrentConnection = 5
MaxMailsPerSession= {integer}

10:MaxMailsPerSession = 20

MaxReceivedHeaders= {integer}

Received
0:
MaxReceivedHeaders = 100

MaxErrorsPerSession= {integer}

10:
MaxErrorsPerSession = 10

MaxMsgSize = {size}IPtrusted
Receiver:MaxMsgSize = 10m
MaxJunkCommands ={integer}

RSET NOOP NTFY193

Dr.Web for UNIX Mail Servers

drwebmaild
00:

MaxJunkCommands = 100
HELO EHLO LHLO

MaxHELOCommands ={integer}0:
MaxHELOCommands = 20
RelayDomains ={lookups}:
RelayDomains =trustedlocalhostIP

SessionRestrictions= {string}

IP

UNIX

SMTP

trusted194

Dr.Web for UNIX Mail Servers

trust_protected_network[SCORE] - [SCORE] IP
ProtectedNetworks
trustedSCORE

IPtrust_protected_domains[SCORE]
IP
ProtectedDomains
DNS
ProtectedDomains
PTR

IP
A
trusted IP
SCORE

IP
trust_white_networks[SCORE]IP
WhiteNetworks
trusted
SCORE
IP

195

Dr.Web for UNIX Mail Servers

trust_white_domains[SCORE]IP
WhiteDomains
PTR
trusted
SCORE

IP

IP
reject_dnsbl [SCORE] IP
DNSBLList
RBL/DNSBL
PTR

SCORE

IP
reject_black_networks[SCORE]
IP
BlackNetworks
SCORE

IP

196

Dr.Web for UNIX Mail Servers

reject_black_domains[SCORE]
IP
BlackNetworks
PTR

SCORE

IP
:
SessionRestrictions =trust_protected_network,
trust_sasl_authenticated
HeloRestrictions ={string}

HELO/EHLO
reject_unknown_hostname[SCORE] DNS A
DNS MX
SCORE

IP
A

reject_diff_ip
Receiver IP
IP

MX[SCORE]

SCORE

IP
:

-

197

Dr.Web for UNIX Mail Servers

HeloRestrictions =SenderRestrictions= {string}

FROM
reject_unknown_domain[SCORE] DNS A
DNS MX

SCORE

IP
A
MX
trust_sasl_authenticated[SCORE] - SASL
trusted IP
SCORE:
SenderRestrictions
trust_sasl_authenticatedRecipientRestrictio
ns = {string}

RCPT
reject_unknown_domain[SCORE] DNS A
DNS MX

SCORE

IP
A
MX

=

198

Dr.Web for UNIX Mail Servers

reject_unauth_destination[SCORE] RelayDomains
ProtectedDomains
SCORE

reject_unknown_rcpts[SCORE] ProtectedEmails

SCORE
anti_dha
Reputation IP Filter:
RecipientRestrictions
reject_unauth_destination
DataRestrictions ={string}=

RCPT
reject_spam_trap<USER@HOST>[SCORE]

ProtectedDomains

SpamTrap
SCORE

SpamTrap

199

Dr.Web for UNIX Mail Servers

reject_multi_recipient_bo
unce [SCORE] - FROMSCORE:
DataRestrictions =RestrictionStat ={Yes | No}

drweb-receiver
SIGUSER1[General]
BaseDir
restrictions.txt:
RestrictionStat = No

DelayRejectToRcpt ={Yes | No}

RCPT:DelayRejectToRcpt = Yes
BlackNetworks ={lookups}
WhiteNetworks ={lookups}

trust_white_networks
reject_black_networks
ProtectedNetworks:
BlackNetworks =WhiteNetworks =200

Dr.Web for UNIX Mail Servers

DNSBLList ={lookups}

DNSBL
reject_dnsbl:
DNSBLList =PositiveDNSBLCacheT
imeout = {time}

DNSBL:
PositiveDNSBLCacheTimeout
24h

NegativeDNSBLCacheT
imeout = {time}

=

DNSBL
:
NegativeDNSBLCacheTimeout
10m

NegativeDNSCacheTim
eout = {time}

DNS
DNSBL

DNS
:

NegativeDNSCacheTimeout = 10m
BlackDomains ={lookups}
WhiteDomains ={lookups}

trust_white_domains
reject_black_domains
ProtectedDomains:
BlackDomains =WhiteDomains ==201

Dr.Web for UNIX Mail Servers

SpamTrap ={lookups}

reject_spam_trap:
SpamTrap =ReputationIPFilter= {list of filters}

Reputation IP filter
IPIP

anti_dha errors_filter
score_filter:
ReputationIPFilter =ProtectedEmails ={lookups}

reject_unknown_rcpts

FilterDHA
Reputation
anti_dhaIPreject_unknown_rcpts
anti_dha:
ProtectedEmails =MaxSessionScore ={integer}
0202

Dr.Web for UNIX Mail Servers:
MaxSessionScore = 10000

drweb-maild
drweb-receiver

SMTP

SMTP

SessionRestrictions
HeloRestrictions

HELO/EHLO
FROM
SenderRestrictions
RCPT
RecipientRestrictions
DATA
DataRestrictions*Restrictions

Trusted IP
Trusted IP

UNIXdrweb-receiver
RestrictionStat
SMTP

SessionRestrictions

203

Dr.Web for UNIX Mail Servers[ SCORE]
set_score

add_score

SMTP

SessionRestrictions
HeloRestrictions

mark_trust [SCORE] - Trusted IP
SCORE
Trusted IP
sleep SEC [SCORE] -

SEC
SCORE

tempfail [SCORE] - SMTP

4*
SCORE

reject [SCORE] - SMTP
SCORE

5*

204

Dr.Web for UNIX Mail Servers[SCORE]-

pass_sasl_authenticated
SASL

SMTP

HELO/EHLO
SenderRestrictions
RecipientRestrictions
DataRestrictions
SCORE
SMTP

pass_sasl_authenticatedset_score SCORE SessionRestrictions

SCORE
HeloRestrictions

add_score SCORE - SCORE
SessionRestrictions

HeloRestrictions:

SenderRestrictions = trust_protected_networks,
reject- ProtectedNetworks
IP

IP

SenderRestrictions = trust_protected_networks,
trust_protected_domains, sleep 5, add_score 10-

IP

ProtectedNetworks
ProtectedDomains
5[SASL][ SASL]Dr.Web for UNIX mail gateways SMTP

10

205

Dr.Web for UNIX Mail Servers

SASL

Use = {Yes | No}

SASL:
Use = No

Driver = {cyrus}

SASL
cyrus
cyrus-sasl2:
Driver = cyrus

BrokenAuthClients ={Yes | No}

AUTH
SMTP
:
BrokenAuthClients = Yes
Received

AuthenticatedHeader= {Yes | No}

Yes:
AuthenticatedHeader = No

[Cyrus-SASL][ Cyrus-SASL]

Lib = {path tofile}cyrus-sasl

cyrus-sasl2:

206

Dr.Web for UNIX Mail Servers

Lib = /usr/lib/libsasl2.so.2.confcyrus-sasl2

Path = {string}:
Path = maild
ServerHostname ={string}[General]Hostname
Hostnamegethostname:ServerHostname =ServerRealm ={string}

SASL:
ServerRealm =SecurityOptions ={string}
noplaintext PLAIN LOGIN
noactive -nodictionary noanonymous -207

Dr.Web for UNIX Mail Servers

mutual_auth :SecurityOptions = noanonymous[Sender][ Sender]SenderCommunigate Pro
Dr.Web

UseSecureHash ={Yes | No}

SecureHash
UseSecureHash
SecureHash
Courier Exim

Dr.Webgateways
Sendmailfor

QmaiMTA

UNIX

mail

Dr.Webfor

UNIX mail servers
MTA
UseSecureHash

MTA

Yes

SecureHash
No:
UseSecureHash = Yes

208

Dr.Web for UNIX Mail Servers

Zmailer MTA

Dr.Web for UNIX mailservers

drwebprocess.cf
Yesdrweb-sender
drweb-

zmailerzmailer
SecureHash:
UseSecureHash = No
Postfix MTA

servers

Dr.Web for UNIX mailPosxfix

drweb-milter

milterYes

drweb-sender
drweb-milter
SecureHash:
UseSecureHash = No
SecureHash ={string}

SecureHash
10

Zmailer MTA

Dr.Web for UNIX mailservers

Zmailerdrweb-zmailer--hash:SecureHash=!!!--------___EDIT_THIS___!!!

209

Dr.Web for UNIX Mail Servers

StalledProcessingIn
terval = {time}

Checker:
StalledProcessingInterval
10m
SendingIntervals ={time}=:
SendingIntervals = 0s, 30s,
60s, 10m, 30m, 2h, 8h, 1d, 1d

Method = {SMTP |LMTP | PIPE}

SenderSMTP - SMTP
LMTP - LMTP
PIPE - PIPE:
Method =MailerName = {SMTP| Sendmail |Postfix |CommuniGate | Qmail| Exim | Zmailer |Courier}Dr.Web for UNIX mail servers
MTA

Method=pipe
SIGHUP:
MTA

210

Dr.Web for UNIX Mail Servers

Address = {address}

SenderMethod= pipeMTA

Dr.Web forUNIX

mail gateways
mx:HOSTNAME
HOSTNAME
MX:
MTA

Options = {string}

Method = pipe:
Options =InPoolOptions ={pool settings}:
InPoolOptions = auto
OutPoolOptions ={pool settings}:
OutPoolOptions = auto

Exim
UNIX mail gateways

Postfix MTA

HeloCmdTimeout ={time}

HELO/EHLO

Dr.Web for

211

Dr.Web for UNIX Mail Servers:
HeloCmdTimeout = 5m
MailFromCmdTimeout= {time}MAIL:
MailFromCmdTimeout = 5m

RcptToCmdTimeout ={time}RCPT:
RcptToCmdTimeout = 5m

DataCmdTimeout ={time}

DATA/BDAT:
DataCmdTimeout = 2m

DataBlockTimeout ={time}:
DataBlockTimeout = 3m
EndOfDataTimeout ={time}

SMTP/LMTP.
:
EndOfDataTimeout = 10m

OtherCmdsTimeout ={time}

SMTP/LMTP:
OtherCmdsTimeout = 2m

212

Dr.Web for UNIX Mail Servers

PipeTimeout ={time}PIPE:
PipeTimeout = 2m

SendDSN = {Yes |
No}

DSN
:
SendDSN = No

Router = {string}

DOMAINADDRESSDOMAIN<user@host>"@localhost"<test@localhost><yy@localhost.
localdomain><@localhost><test@localhost>213

Dr.Web for UNIX Mail Servers

ADDRESSDOMAINADDRESS
Address"|":
Router = @main.server.com> mx:
main.server.com|
inet:25@backup.server.com
main.server.com
main.server.
com MX
25

backup.server.com:
Router =[Milter][ Milter]drweb-milter
drweb-milter

milterDr.Web for UNIX mail servers Postfix
Sendmail MTA
Postfix
Sendmail
Dr.Web MailD

Address = {socket
address}

milterSendmail MTA sendmail.cf
Postfix MTA main.cf
PID

214

Dr.Web for UNIX Mail Servers:
Address = local:%var_dir/ipc/
drweb-milter.skt:
Address = inet:3001@127.0.0.1
Timeout = {time}

drweb-milter
MTA

Sendmail

Postfix
Timeout:
Timeout = 2h
PendedConnections ={numeric value}

drwebmilter MTA:
PendedConnections = 64

CanChangeBody ={Yes | No}

MTA
2.4
Postfix MTA
SIGHUP:
CanChangeBody = Yes

ProcessingTimeout ={time}

drweb-milter[MailBase]
SendTimeout:
ProcessingTimeout = 40s

215

Dr.Web for UNIX Mail Servers

ProcessingErrors ={actions}pass
1

tempfail discard
reject:ProcessingErrors = reject
MinPersistConnection = {numeric value}

drweb-milter:
MinPersistConnection = 2

UseStat = {Yes |No}drweb-milter
drwebmilter

SIGUSR1:

UseStat = No
MaxFreetime ={time}

drweb-milter:
MaxFreetime = 2m

ReplyPoolOptions ={pool settings}

drweb-milter:
ReplyPoolOptions = auto

[CgpReceiver][ CgpReceiver]Pro
MTA

ReceiverCommuniGate
Dr.Web MailD

216

Dr.Web for UNIX Mail Servers

ProcessingTimeout ={time}

Receiver[MailBase]
SendTimeout:
ProcessingTimeout = 40s

PoolOptions = {poolsettings}:
PoolOptions = auto

ProcessingErrors ={actions}pass
1

tempfail discard
reject:ProcessingErrors = reject
ChownToUser ={string}

CommuniGate Pro MTA
drwebcgp-receiver
root

Dr.Web for UNIX mailservers
Dr.Web for UNIX mailservers
drweb:
ChownToUser = drweb[CgpSender][ CgpSender]

Sender
MTA

CommuniGate Pro
Dr.Web MailD

217

Dr.Web for UNIX Mail Servers

UseSecureHash ={Yes | No}

SecureHash
No
drweb-cgp-receiver
PIPE
Yes
SecureHash
MTA

SecureHash
No:
UseSecureHash = No
SecureHash ={string}

SecureHash
10:
SecureHash=!!!--------___EDIT_THIS___!!!
PoolOptions = {poolsettings}:
PoolOptions = auto

SubmitDir = {pathto directory}

CommuniGate Pro MTA
drweb-cgp-sender:
SubmitDir
Submitted

SubmitFilesMode ={permissions}:=/var/CommuniGate/218

Dr.Web for UNIX Mail Servers

SubmitFilesMode = 0600
SubmitFilenamesPref
ix = {string}%{SubmitDir}/%{SubmitFilenamesPrefix}XXXXXX
CommuniGate Pro MTA"%s":
SubmitFilenamesPrefix
drweb_submit_%s_
SubmitFilenamesMode= {std | tai |rand48}=

Std - mkstemp
drweb_submit_XXXXXXTai - TAI%sec.%usec.
drweb_submit_XXXXXX
Rand48 -lrand48
drweb_submit_XXXXXXXX:
SubmitFilenamesMode = std219

Dr.Web for UNIX Mail Servers[Courier][ Courier]

Dr.Web MailD Courier

MTA

Dr.Web MailD

ProcessingTimeout ={time}

drweb-courier[
MailBase]

SendTimeout:
ProcessingTimeout = 40s
ProcessingErrors ={actions}

tempfail discard
pass reject:
ProcessingErrors = reject

MainPoolOptions ={pool settings}:
MainPoolOptions = auto
ReplyPoolOptions ={pool settings}

drweb-maild:
ReplyPoolOptions = auto

BaseDir = {path todirectory}

Courier MTA:
BaseDir = /usr/lib/courier

1220

Dr.Web for UNIX Mail Servers

SocketDirs = {pathto directory}

Courier MTA

UNIX
UNIX

drweb-courier
UNIX
SIGHUP:
SocketDirs = /usr/lib/courier/var/allfilters,/usr/lib/courier/var/filters
Dr.Web MailD Courier MTA
UNIX
SIGHUP

SocketAccess ={permissions}:
SocketAccess = 0660

[Qmail][ Qmail]

Dr.WebMailD Qmail
MTA

Dr.Web MailD
ProcessingTimeout ={time}

drweb-qmail[
MailBase]

SendTimeout:
ProcessingTimeout = 40s
ReadingTimeout ={time}

qmail-queue:

221

Dr.Web for UNIX Mail Servers

ReadingTimeout = 20m
ProcessingErrors ={actions}

tempfail discard
1

pass reject:
ProcessingErrors = reject
MainPoolOptions ={pool settings}:
MainPoolOptions = auto
ReplyPoolOptions ={pool settings}

drweb-maild:
ReplyPoolOptions = auto

ListenUnixSockets ={socket address}

drweb-qmail

qmail-queueUNIXqmail-queue
qmail-queue --help:
ListenUnixSockets
var_dir/ipc/.qmail
QmailQueue = {pathto file}qmail=

local:%

qmail-queue:

QmailQueue = /var/qmail/bin/qmail-queue.original

222

Dr.Web for UNIX Mail Servers[Notifier][ Notifier]drweb-notifier
drweb-notifier Dr.Web

for

UNIX

mail

servers
PoolOptions = {poolsettings}
auto -

N

N

N-M -

M
N

N
M

timeout = {time} -N: 2mstat = {yes|no} SIGUSR1[General]

BaseDir: nolog_level = {Quiet|Error|
Alert|Info|Debug} -[Logging]
LogLevel

223

Dr.Web for UNIX Mail Servers

stop_timeout = {time} -:PoolOptions = auto
TemplatesBaseDir ={path to directory}:
TemplatesBaseDir
maild/templates
LngBaseDir = {pathto directory}=%etc_dir/

.lng
ru
en

NotifyLangs:
LngBaseDirlng=%etc_dir/maild/

AdminMail = {e-mailaddress}:
AdminMail = root@localhost
FilterMail = {email address}

From

224

Dr.Web for UNIX Mail Servers:
FilterMail = root@localhost
NotifyLangs ={string}:
NotifyLangs = en
TemplatesParserLogLevel = {quiet |
error | alert |info | debug}:
TemplatesParserLogLevel = info

RulesLogLevel ={quiet | error |alert | info |debug}:
RulesLogLevel = info

MsgIdMap = {string}

Receiver

SenderSender:MsgIdMap=
sender_notifications
id1

id2

Receiversender_notifications
Sender:MsgIdMap =id[12]

225

Dr.Web for UNIX Mail Servers

QuarantinePrefix ={string}

Dr.Web for UNIX mail servers
HTTP
QuarantinePrefix=
http://mailhost/quarantine/
http://mailhost/quarantine/
headersfilter/drweb.
quarantine.2kqtvI:
QuarantinePrefix =Dr.WebMailD
Dr.WebSenderdrweb-notifier

NotifierDr.

.msg
Web Notifier

TemplatesBaseDir

notify.*3
Dr.Web MailD
DSN

drweb-notifier
DSN

html

html

226

Dr.Web for UNIX Mail Servers

1
Dr.Web

Notifier[Rules].msg
admin_

rcpts

sender_2

Dr.Web Notifier
1report.msg
3

DSN

dsn.msg
Dr.Web Notifier( admin|rcpts|sender|report|dsn) _?( .

*?) \.msg.
NotificationNamesMap
Dr.Web

Notifier

Dr.Web Notifier[ProxyClient][ProxyClient]

ProxyServersAddress
es
=
{list
of

drweb-proxy-client

drweb-proxy-server

227

Dr.Web for UNIX Mail Servers

sockets}[WEIGHT1],..
ADDRESSWEIGHT 0

ADDRESS2: ADDRESS1[WEIGHT2]

100
1

WEIGHTdrweb-proxy-client
Receiver1
Using Proxy:
ProxyServersAddresses
inet:8088@SERVER-IP
Address =sockets}

{list

of

=

drweb-proxy-server
Senderdrweb-proxy-server
ProxyServer]
ProxyClientsAddresses:
Address = inet:8066@0.0.0.0
MailPoolOptions{pool settings}=

Receiver228

Dr.Web for UNIX Mail Servers

Receiverdrweb-proxy-server
Receiver
Sender:
MailPoolOptions = auto
SenderPoolOptions{pool settings}=

drweb-proxy-server
SenderSenderSenderdwreb-proxy-server:
SenderPoolOptions = auto

[ProxyServer][ProxyServer]

Address =sockets}{list

drweb-proxy-serverofdrweb-proxy-client
drweb-proxyserver
drweb-proxy-client [ProxyClient]
ProxyServersAddresses
drweb-proxy-server:
Address = inet:8088@0.0.0.0

229

Dr.Web for UNIX Mail Servers

ProxyClientsAddress
es
=
{list
of
sockets}

drweb-proxy-client[WEIGHT1],..
ADDRESSWEIGHT 0

ADDRESS2: ADDRESS1[WEIGHT2]

100
1

WEIGHT

ProxyClient]

Address:
ProxyClientsAddresses
inet:8066@CLIENT-IP
drweb-maild

ReceiverPoolOptions= {pool settings}

drweb-proxy-clientID
drweb-maild
drweb-proxyclient:
ReceiverPoolOptions = auto
SenderPoolOptions{pool settings}=

Senderdrweb-proxy-client=

230

Dr.Web for UNIX Mail Servers

drweb-proxy-client:
SenderPoolSettings = auto

[POP3]
Dr.Web MailD
POP3

POP3
POP3

drweb-maild

POP3
POP3

[POP3]

drweb-pop3

ServerAddress{socket address}

=

POP3

POP3
:

ServerAddress
pop3@localhost
ListenAddress{socket address}

=

inet:

=

inet:.. or inet-ssl:..
POP3

TLS/SSL
POP3S:
ListenAddress
inet:5110@localhost=

231

Dr.Web for UNIX Mail Servers

ServerTLSSettings ={TLS/SSL settings}

POP3

TLS/SSL

private_key
inet-ssl:
ServerTLSSettings = use_sslv2
no, private_key_file /path/to/pkey, certificate/path/to/certificate
POP3
drweb

:
ServerTLSSettings =ClientTLSSettings ={TLS/SSL settings}

POP3

TLS/SSL:
ClientTLSSettings = use_sslv2
no, private_key_file /path/to/pkey,
certificate/path/to/certificate
POP3
drweb

:
ClientTLSSettings =232

Dr.Web for UNIX Mail Servers

IoTimeout = {time}:
IoTimeout = 60s
ProcessingTimeout{time}=

drweb-maild:
ProcessingTimeout = 60s

MinFilterToMaildCon
nections={numerical value}

POP3

drweb-maild:

MinFilterToMaildConnections
2
MaxFilterToMaildCon
nections={numerical value}

POP3

=

drweb-maild
0:

MaxFilterToMaildConnections
0
FilterToMaildKeepAl
iveTime = {time}POP3

drweb-maild

drweb-maild
drweb-maild
1

POP3

MaxFilterToMaildConnection

FilterToMaildKeepAliveTime

MinFilterToMaildConnections=

233

Dr.Web for UNIX Mail Servers:
FilterToMaildKeepAliveTime
30s=

ThreadInactivityTim
eout = {time}:ThreadInactivityTimeout = 30s
PoolOptions = {poolsettings}:
PoolOptions = auto
CallbackPoolOptions= {pool settings}

drweb-maild:
CallbackPoolOptions = auto

MaxConnections{numerical value}

0=:
MaxConnections = 0

DoS_Blackhole{Yes | No}

=

1

IP

234

Dr.Web for UNIX Mail Servers:
DoS_Blackhole = noDisablePlainText{Yes | No}=
OpenSSL:DisablePlainText = no

MaxConnectionsPerIp= {numerical value}

1

IP
0
:

MaxConnectionsPerIp = 0
MaxCommandLength{size}

=

POP3
RFC
1000
10
0
:
MaxCommandLength = 1000b

OnFilterErrors{actions}

drweb-maild=

rejectpass:

OnFilterErrors = reject

POP3

USER username
POP3

235

Dr.Web for UNIX Mail Servers

RETR

RETR

drweb-maild

POP3

redirect
Dr.Web for UNIX mail servers
Sender

POP3

POP3

MTA

maild_MTA.

mmc
drweb-pop3 local:/var/drweb/ipc/.agent
MAIL drweb:drweb

1530[IMAP]
Dr.Web MailD
IMAP

IMAP
IMAP

drweb-maild
IMAP[IMAP]

drweb-imap

ServerAddress{socket address}

=

IMAP
:
ServerAddress
imap@127.0.0.1

ListenAddress{socket address}

=

=

inet:

236

Dr.Web for UNIX Mail Servers: inet:.. or inet-ssl:..

TLS/SSL

IMAP
IMAPS
:
ListenAddress
inet:5200@0.0.0.0
ServerTLSSettings ={TLS/SSL settings}

IMAP

=

TLS/SSL

private_key
inet-ssl:
ServerTLSSettings = use_sslv2
no, private_key_file /path/to/pkey, certificate/path/to/certificate
IMAP
drweb

SSL
:
ServerTLSSettings =ClientTLSSettings ={TLS/SSL settings}

IMAP

TLS/SSL.

:237

Dr.Web for UNIX Mail Servers

ClientTLSSettings = use_sslv2
no, private_key_file /path/to/pkey,
certificate/path/to/certificate
IMAP
drweb

SSL
:
ClientTLSSettings =IoTimeout = {time}:
IoTimeout = 60s
ProcessingTimeout{time}=

drweb-maild:
ProcessingTimeout = 60s

MinFilterToMaildCon
nections={numerical value}

IMAP

drweb-maild:

MinFilterToMaildConnections
2
MaxFilterToMaildCon
nections={numerical value}

IMAP

=

drweb-maild
0:

MaxFilterToMaildConnections=

238

Dr.Web for UNIX Mail Servers

0
FilterToMaildKeepAl
iveTime = {time}

IMAP

drweb-maild

drweb-maild
drweb-maild
1

IMAP

MaxFilterToMaildConnection

FilterToMaildKeepAliveTime

MinFilterToMaildConnections:
FilterToMaildKeepAliveTime
60s
CallbackPoolOptions= {pool settings}

drweb-maild:
CallbackPoolOptions = auto

ThreadInactivityTim
eout = {time}:ThreadInactivityTimeout = 30s=

239

Dr.Web for UNIX Mail Servers

PoolOptions = {poolsettings}:
PoolOptions = auto
MaxConnections{numerical value}

0=:
MaxConnections = 0

MaxConnectionsPerIp= {numerical value}

1

IP
0
:

MaxConnectionsPerIp = 0
DisablePlainText{Yes | No}=
OpenSSL:DisablePlainText = no

DoS_Blackhole{Yes | No}

=

1

IP

:
DoS_Blackhole = no
MaxCommandLength{size}

=

IMAP
RFC
1000

240

Dr.Web for UNIX Mail Servers

100:
MaxCommandLength = 1000b
MaxCachedHeadersPer
Mail = {size}

IMAP

0
:
MaxCachedHeadersPerMail = 64k
MaxLettersPerUser{numerical value}

=

1
IMAP
1
IMAP

2
0

:
MaxLettersPerUser = 6
MaxDiskPerUSer{size}=:
MaxDiskPerUSer = 10m

241

Dr.Web for UNIX Mail Servers

OnFilterErrors{actions}

drweb-maild=

rejectpass:

OnFilterErrors = reject

IMAP
RAM
IMAP

IMAP
flooding

anti-

MaxCachedHeadersPerMail
MIME attachment

IMAP

MTA

maild_MTA.

mmc
drweb-imap local:/var/drweb/ipc/.agent
MAIL drweb:drweb

15[Rules][ Rules]
Dr.Web

MailD

IP

2

CONDITION stop|cont [SETTINGS]CONDITIONSETTINGS
true

CONDITIONi

SETTINGS
ldap mysql

30

242

Dr.Web for UNIX Mail Servers

SETTINGS
2[prefix_name:][value]
prefix_namevalue

any from ( sender) to ( rcpt) block - lookup
client-ip IP- lookup- lookup- lookup

ReceiverIP-

client-port -Receiver-server-unix-socket -UNIXReceiver- UNIX
Receiverserver-ip IP

server-portReceiverIP--

Receiverid ID- ReceiverID
auth -

Receiver

ID Receiver

Receiver-size | > | <= | >=}{!= | == | <243

Dr.Web for UNIX Mail Servers

"!"

"="

:

"size:>=10m" cont scan=no10

MB

md-client ID

Dr.Web MailD:"md-client:client1"
client1
truescore | < | > | <= | >=}"!"{!= | =="="any"|&)(!="""""\"[prefix_name:][value]
true false:

true cont some_settings

AND

&&

OR

||

NOT

!

244

Dr.Web for UNIX Mail Servers:

sender:test && "size:>=10k""test"

CONDITION

10

true

!("rcpt:ldap:///??sub?(mail=$s)" OR auth:)
CONDITION

ldap "mail"1
true
Dr.Web MailD
Dr.Web MailD

1.

2.

CONDITIONSETTINGS
3.

CONDITION"stop"

Dr.Web MailD

CONDITION"cont"

Stop

:

rcpt
(sender,any):[address
expression] stop|cont [settings]

orregular245

Dr.Web for UNIX Mail Servers

Dr.Web MailD

SETTINGS[plug-in_name/]param1 = value1, [plug-in_name/]param2 = value2 ...
paramNvalueNSETTINGS
check-only--check-only:

sender:a@drweb.com cont headersfilter/Action =pass, vaderetro/max_size = 100k
a@drweb.com

Action = pass
max_size 100

headersfilter
vaderetro"\"

valueN:

to:a@drweb.com cont drweb/ProcessingErrors
pass\, redirect(err@drweb.com)
pass, redirect(err@drweb.com)
1

ProcessingErrors
SETTINGSCONDITION

lookup=246

Dr.Web for UNIX Mail Servers

LDAP

to:regex:.*@drweb.com && "ldap:///-drwebRulessub-(mail=$s)" contldap

drweb.com"mail=$s"

drwebRules
LDAP

"\"

html=yes,html=no
html=noLocalRules Dr.Web Modifier
AcceptCondition headersfilter
RejectCondition headersfilter
AcceptPartCondition headersfilter
RejectPartCondition headersfilter
MissingHeader headersfilter
WhiteList VadeRetroBlackList VadeRetro
RegexsForCheckedFilename drweb

247

Dr.Web for UNIX Mail Servers

address- user1

domain-:test1@drwe
b.com

VadeRetro/SubjectPrefix=
modifier/localrules=selectappend_text "Some Text"\"spam\",message\,test2@drweb.com

headersfilter/MissingHeader=
headersfilter/MissingHeader
headersfilter/MissingHeader = To

Date,
=From,

stop
:
ODBC

test@drweb.com

modifier/LocalRules = selectappend_text "Scanned 3333!

message\,

true
cont
modifier/LocalRules=
selectmessage\, append_text "Scanned 44444 - global
rules!", modifier/LocalRules = quarantine> email-info test@drweb.com
test@drweb.com A=1 S=1
name:aliases: alias_test@drweb.com
groups: divine good evil

248

Dr.Web for UNIX Mail Servers

rules:
1: true cont modifier/LocalRules
message\, append_text "Scanned!",LocalRules = quarantine= selectmodifier/

2: true cont modifier/LocalRules =message\, append_text "Scanned 2222!"

select

3: "rcpt:odbc:selecta='$s'" cont

where

rules

from

maild

custom:Dr.Web Modifier

test@drweb.com

LocalRules
selectmessage,append_text"Scanned!",quarantine,
selectmessage,append_text"Scanned 2222!", select message, append_text"Scanned 3333!", select message, append_text"Scanned 44444 - global rules!", quarantine

modifier/LocalRules

select message, append_text
global rules!", quarantine"Scanned

44444

drweb-maild--check-only-249

Dr.Web for UNIX Mail Servers

1
ID md-client[ rules]Yes
html
Dr.Web MailD

html = {Yes | No}:html = Yes
quarantine = {Yes |
No}

Yes
:
quarantine = Yes

scan
=
{list
plug-ins}

Dr.Web MailD

of

All
No
":"
"-"
"-"
"-"
:
scan = allscan = no

All

250

Dr.Web for UNIX Mail Servers

scan = all:-foo

fooscan = Foo:Bar

fooscan = all:foo
All

"-"

scan = -foo:allAllscan = -foo
All
"-"
:
scan = All
notify[.
{notificationtype}]={allow|
block}[({address
types})][condition]

allow
block

drwebnotifier

notify.Virus notify.Cured notify.Skipbar-notify.Archive notify.Error -251

Dr.Web for UNIX Mail Servers

notify.Rule notify.License notify.Malware qualifier

qualifiersender rcpt admin any

qualifier-:Notify=block(any) -

ornotify=block

notify.Virus = block
admin) -NotifyModifier(sender:Dr.Web
LocalRules:
true cont notify.virus = allow(sender)true cont notify.virus = allow(admin), notify = block252

Dr.Web for UNIX Mail Servers

true cont notify.virus = allow(sender:admin), notify = block:

notify = block(any)notify.Virus = allow(any)notify.Cured
sender)=allow(admin:

notify.Skip = allow(sender)
notify.Archive(admin:sender)
notify.Error
sender)

=

=

allow

allow(admin:

notify.Rule = allow(admin)
notify.License(admin)=allow

notify.Malware = allow(any)plugin_name/max_size = {size}
plugin_name/use ={Yes | No}

NotificationNamesMap=notify_name1

Yes
No

253

Dr.Web for UNIX Mail Servers

NotificationNamesMap = name1
file_name1, name2 file_name2...

file_name1,
notify_name2
file_name2 ...

nameN notify
reportDSN

dsn

file_nameN sender_ rcpts_ admin_
report_ dsn_
.msg
[Notifier]TemplatesBaseDir

sender_file_nameN.msg:
NotificationNamesMap = virus
my-virus, archive my-arch
SenderAddress{address1|
address2|...}

Sender"|"=SenderAddress"to:mysql:select * from adr"cont SenderAddress = address1|
address2|address3

254

Dr.Web for UNIX Mail Servers"to:mysql:select * from adr"

address1
address2
address2
address3
SenderSenderAddress
SMTP/LMTP
drweb-sender

rule
name}

=

1

{section

User

rule

Dr.Web MailD
1

1
rule

[Rule: name],
name

user
default
Rule255

Dr.Web for UNIX Mail Servers[Rule:MySection]
quarantine = nonotify = block
MySection[Rules]Rcpt:regex:example\.com
rule=mysection

contSender:lol@foo.com && block:vir1 cont notify.Skip=allow,
notify.Virus=allow,
rule=MySection
example.com
lol@foo.com
vir1

plugin_name/max_size
NotifyLangs
AdminMail
html
scan
plugin_name/use
2256

Dr.Web for UNIX Mail Servers

CONDITION

drweb-maild-s [ --sender ] arg -r [ --rcpt ] arg -b [ --block ] arg --client-ip arg IP--server-ip arg --client-port arg --server-port arg --server-us arg --id arg ID--auth --size arg --score arg --md-client arg -

IP

UNIX

{size}
ID:$ ./drweb-maild --authThu May 29
maild.rules DEBUG

16:03:44 2009
notify* :[3081324208]

Thu May 29
maild.rules DEBUG

16:03:44 2009
all : block[3081324208]

Thu May 29 16:03:44 2009 [3081324208]
maild.rules DEBUG
archive : from=allow;
admin=allow;
Thu May 29
maild.rules DEBUG

16:03:442009[3081324208]

257

Dr.Web for UNIX Mail Servers

Thu May 29
maild.rules DEBUG

16:03:44 2009 [3081324208]
cured : from=allow;

Thu May 29
maild.rules DEBUG

16:03:442009[3081324208]

Thu May 29 16:03:44 2009 [3081324208]
maild.rules DEBUG
error : from=allow;
admin=allow;
Thu May 29
maild.rules DEBUG

16:03:44

2009

Thu May 29
maild.rules DEBUG

16:03:44 2009 [3081324208]
license : admin=allow;

Thu May 29
maild.rules DEBUG

16:03:442009[3081324208][3081324208]

Thu May 29 16:03:44 2009 [3081324208]
maild.rules DEBUG
malware : from=allow;
to=allow; admin=allow;
Thu May 29
maild.rules DEBUG

16:03:44

2009

Thu May 29
maild.rules DEBUG

16:03:44 2009 [3081324208]
rule : admin=allow;

Thu May 29
maild.rules DEBUG

16:03:44

Thu May 29
maild.rules DEBUG

16:03:44 2009 [3081324208]
skip : from=allow;

Thu May 29
maild.rules DEBUG

16:03:44

2009

2009

[3081324208][3081324208][3081324208]

Thu May 29 16:03:44 2009 [3081324208]
maild.rules DEBUG
virus : from=allow;
to=allow; admin=allow;
Thu May 29
maild.rules DEBUG

16:03:44 2009scan : all[3081324208]

Thu May 29
maild.rules DEBUG

16:03:44 2009
html : 1[3081324208]

258

Dr.Web for UNIX Mail Servers

LookupLookuplookup[prefix1:]value1, [prefix2:]value2, ...

value file -1

regex -

Perl

rfile -Perl1ldap - LDAP
[param1=val1|param2=val2|...|] ldap_url
ldap_url LDAP

URLparam1 param2
Dr.Web MailD[LDAP]

lookupLDAP URL

ldap://hostport/dn[?attrs[?scope[?filter[?
exts]]]]o hostport

hostname[:port]o dn o attrs -259

Dr.Web for UNIX Mail Servers

o scope - base one sub 3
o filter o exts - LDAP

API:

ldap://ldap.example.net/dc=example,dc=net?
cn,sn?sub?(cn=*)
LDAP
o $s

$s
$s

o $d -$do $u -$uo $$ - $1
LDAP

OpenLDAP v. 2.0

odbc, oracle - ODBC Oracle

SQL[param1=val1|param2=val2|...|] sql_request
param1 param2
Dr.Web MailD

ODBC lookup
Oracle lookup[ ODBC] [ Oracle]

ldap
lookupDSN

SIGHUP260

Dr.Web for UNIX Mail Servers

ODBC

ODBC version 3.0

ODBC

UnixODBC 2.0
OracleOracleOTLv8
libclntsh

OracleConnectionString
ConnectionString
password@connectionname

=

user/

2
1. Dr.Web MailD Oracle
OracleORACLE_HOME Dr.Web MailD$ORACLE_HOME/network/admin/
tnsnames.ora
TNS
1
2. $ORACLE_HOME/network/admin/tnsnames.

ora:

tnsnames.ora:
CONNECTIONNAME =(DESCRIPTION =(ADDRESS = (PROTOCOL = TCP)(HOST =localhost)(PORT = 1521))(CONNECT_DATA =(SERVER = DEDICATED)(SERVICE_NAME = CONNECTIONNAME)
)
)

261

Dr.Web for UNIX Mail Servers

user/password@ CONNECTIONNAME
user/pasword@(DESCRIPTION = (ADDRESS =(PROTOCOL = TCP)(HOST = localhost)(PORT=1521))(CONNECT_DATA=(SERVER=
DEDICATED)(SERVICE_NAME=
CONNECTIONNAME)))

postgres - PostgreSQL

SQL

ODBC
cdb -

CDB

[alphanumericalvalue]
tinycdb
lookupkey]:[alphanumerical

CDB
1

file:

/path/to/table.cdb --> table.cdb

select * from table.cdb where key='123'
select * from table.cdb where key='$'CDB
lookup

SQL
SQL

select*key='@string'from@tablename Dr.Web MailD
cdb lookup:

ldap lookup@tablename
[CDB]

where

262

Dr.Web for UNIX Mail Servers

cdb:skipdomains=regex:^inbox|selectfrom my_file where key='$s'
berkeley - Berkeley DB
cdb/usr/lib/libdb.so/usr/lib/libdb-4.5.solookupldap lookup

v.

4.3

firebird - Firebird

SQL

ODBC

4.6

Host

Host=somehost#somehost:3050

Host=somehost/1234#somehost:1234

sqlite-SQLiteSQL

ODBC

lookup

SQLitev. 3.xSQLite1
Dr.WebMailD

SQLite[SQLite]BusyTimeout"Database is locked"
GUI
Dr.Web MailD

sqlite lookup

1

ldap lookup
SQLiteSQLiteHUP

drweb-maild*

263

Dr.Web for UNIX Mail Servers

mysql - MySQL

SQL

ODBC

lookup

NAME1 = VALUE1 | NAME2 = VALUE2 | ... |NAMEM VALUEN -SkipDomains - lookup
lookupOnError = {ignore|exception} - lookup"ignore""exception"

ProcessingError
lookuplookupOnErrorLDAP ODBC ...

lookupOnErrorDr.Web MailD
lookuplookupOnError

LookupODBC

maild

domain264

Dr.Web for UNIX Mail Servers

ProtectedDomains = "odbc:selectmaild where domain='\$s'"domainfrom%etc_dir/email.ini
LDAPldaps:///??sub?(mail=$s)
fake.com:ProtectedEmails=
file:%etc_dir/email.ini,
localhost, ldap:skipdomains=regex:.*fake.com$|ldaps:///--sub-(mail=$s)

MySQL

maild

email

routerinfo
foo
Router = mysql:select routerinfo from
where email='\$s', foo inet:234@foo.ru

maild

Lookup

mailLDAP
rules

rules
CONDITIONs"rcpt:ldap:///-rules-sub-(mail=$s)" contrcpt:"ldap:///-rules-sub-(mail=$s)" cont,

Mon Jun 29 18:53:01 2009 [3081262768]
maild.rules
ERROR
'('
can
not
follow'"ldap:///-rules-sub-'
Mon

Jun

29

18:53:01

2009[3081262768]

265

Dr.Web for UNIX Mail Servers

maild.rules ERROR error in parse condition:'rcpt:"ldap:///-rules-sub-(mail=$s)" cont'

SQLitedomainskipaddr
drweb"any:sqlite:select skipaddr from domain
where skipaddr = '$s'" cont scan=all:-drweb

Lookuplookups

LookupsLite

LookupsLite lookups
fileLookupsLite
lookuplookup

SkipDomains

lookupWed Jun 10 14:02:20 2009 [4160149200] Modifier
ERROR Error in init lookup [cdb:select * from /root/mail/base_file_for_CDB.txt
where
key='domain']: can't use this lookup here

Lookuplookupdrweb-lookup
$

query

%bin_dir/drweb-lookup[parameters]

266

Dr.Web for UNIX Mail Servers

lookupqueryparameters-h [ --help ] -v [ --version ] -l [ --level ] arg --syslogfacility arg - syslog-i [ --ipc-level ] arg - IPC--log-filename arg -a [ --agent ] arg - lookup

Agent-t [ --timeout ] arg - Agent-q [ --query ] arg "-"-e [ --exist ] - lookup:$ ./drweb-lookup -q q -e e,w
q NOT FOUND$ ./drweb-lookup -q q -e q,q
FOUND q$ ./drweb-lookup -q test@drweb.com'ldap:///-displayName-sub-(mail=$s)'-e

FOUND test@drweb.com$./drweb-lookup-q
test@drweb.com'ldap:///-displayName-sub-(mail=$s)'notify.

267

Dr.Web for UNIX Mail Servers

virus=block, notify.virus=allow(rcpt),
ProcessingErrors = passdrweb/$ ./drweb-lookup -q test@drweb.com "odbc:
select rules from maild where a='\$s'" scan =all:-drweb

Dr.Web MailD
2
Dr.Web5

DB

drweb-maild
DB[Stat]

DetailStatDetail
Stat

off

mail servers

Stat low

Stat medium

Dr.Web for UNIX

268

Dr.Web for UNIX Mail Servers

Stat highAgentDr.Web MailD
2

Agent

Agent

Dr.WebAgent%etc_dir/agent.conf[StandaloneMode]
StatisticServerHost
StatisticServerPort UUID
Agent
%etc_dir/agent.conf[EnterpriseMode]
Dr.Web MailD"$s"lookupLDAP

odbc SQLo name o type -:name<type>269

Dr.Web for UNIX Mail Servers

o varchar_long - ODBCo timestamp - ODBCSQL_LONGVARCHARTIMESTAMP_STRUCTo int - 32
o char(length) - 0

oracle ODBC
postgresmysql sqlite firebirdcharlengthvarchar_long
ODBC:

ExportStatStorage="odbc:insert
intoplugin_stat values(:plugin_name<varchar_long>,:size<int>,:num<int>)"

storage[Stat]

Yes

ExportStat[ Stat]1

ExportBlockObjectsStorage ExportStatStorage - Dr.Web for UNIX mail servers
ExportPluginStatStorage [Stat][ Stat]ExportStat
ExportBlockObjectsStorage ExportStatStorage
ExportPluginStatStorage

270

Dr.Web for UNIX Mail Servers:[Rule:client1]...
ExportStat = yes
ExportBlockObjectsStorage
into client1_viruses values="odbc:insert(:number<int>, :q_name<varchar_long>,virus_name<varchar_long>, \::virus_code<int>,
plugin_name<varchar_long>,
sender<varchar_long>,\:::client_ip<varchar_long>,
date<timestamp>)":...

drweb-maild/quarantine/path/def/name/name2

FilenamesMode"_"

int4_t sN int4_t int4_t sN -1

FilenamesPrefix"."

1

int4_t4

MoveAll

Yes

Dr.Web MailD

271

Dr.Web for UNIX Mail Servers/path/def/backup/

StoredTime
MaxSize
MaxNumber

MaxSize MaxNumber
StoredTime
PulseTime
DBI

drweb-qp
Perl

5.0

PathToDrwebQp
PulseTime
0StoredTime

drweb-qp
drweb-qp
PulseTimedrweb-qp

DBI

Perl

File::Temp
DBI

SQL-ASCII
DBI

drweb-qp
PathToDrwebQp

DBI
5.0
DBI

DBI
DBI

272

Dr.Web for UNIX Mail Servers

DBI

MoveToDBI
Yes
DBISettings DBIUsername DBIPassword
DBI

3

DBI->connect
DBI

man

DBD::mysql

man DBD::Pg

SQLo SQLInsertCommand -DBIo SQLRemoveCommand -DBIo SQLSelectCommand - DBI:

maild ERROR Error in system call for [/opt/
drweb/drweb-qp --Level debug --SyslogFacility
Daemon --BaseDir /var/drweb/ --ProcessMail 1 -MoveToDBI
0--StoredTime
86400-SQLInsertCommand "" --MDClient "def" >/dev/null
2>&1 &]
drweb-maild
ulimit -m

Subject
drweb-maild
Dr.WebMailD[ Notifier]FilterMail
ACL

273

Dr.Web for UNIX Mail Servers

Dr.WebMailD[ Maild]

OnlyTrustedControlMails
Dr.WebAccessByEmail

MailD[ Quarantine]

Yes

Subjectq:relative_path_to_file
relative_path_to_file/def/drweb/F/00014F8F.DW_SHOT_PRODUCT.QqFpdH
1

Dr.WebMailD
MUA

drweb-qcontrol
drweb-qcontrol
DBI-h [ --help ] --version -v [ --verbose ] -l [ --level ] arg (=error) quiet error
alert info debug--syslogfacility arg (=mail) daemon mail local0...local7

syslogd274

Dr.Web for UNIX Mail Servers-i [ --ipc-level ] arg (=error) - IPC
quiet error alert info debug--log-filenamearg(=syslog)
syslogd
syslog--sendmail arg (=/opt/drweb/drweb-inject)- drweb-inject-s [ --socket ] arg (=local:/var/drweb/
ipc/.ctl) - Dr.Web MailD--agent arg (=local:/var/drweb/ipc/.agent)
Dr.Web Control Agent--timeout arg (=60) - Dr.Web Control Agent

"%" 0

"_" 1
def/

:

def/%00014F7F%-00014F7F

def/drweb/% - drweb--view -

PAGER
PAGER
cat

--send drweb-inject275

Dr.Web for UNIX Mail Servers--redirect [list_of_rcpts] drwebinject--remove---stat -:drweb-qcontrol --stat def/%1.

def/backup/B/00014F8B.DW_SHOT_PRODUCT.U0dshM
from: a@1; to: a@fff; time: 2008-08-14
12:10:57
2.

def/drweb/F/00014F8F.DW_SHOT_PRODUCT.QqFpdH
from: a@4; to: a@fff; time: 2008-08-14
13:00:50
3. def/backup/C/00014F8C.DW_SHOT_PRODUCT.A39xp7
from: a@2; to: a@fff; time: 2008-08-14
13:00:50
4. def/backup/F/00014F8F.DW_SHOT_PRODUCT.tMi6W2
from: a@4; to: a@fff; time: 2008-08-14
13:00:50
5.

def/drweb/3/00014F93.DW_SHOT_PRODUCT.n9xPjU
from: a@3; to: a@fff; time: 2008-08-14
13:30:49
6. def/backup/3/00014F93.DW_SHOT_PRODUCT.ewYFVA
from: a@3; to: a@fff; time: 2008-08-14
13:30:49
7. def/backup/4/00014F94.DW_SHOT_PRODUCT.JQ3sLH
from: a@3; to: a@fff; time: 2008-08-14
13:30:49
1

276

Dr.Web for UNIX Mail Servers:

drweb-qcontrol--send--remove
F/00014F7F.DW_SHOT_PRODUCT.yv4ro9

def/backup/

def/backup/F/00014F7F.DW_SHOT_PRODUCT.
yv4ro9DBI

Dr.Web MailD
SQL--sql-remove-command :--sql-remove-command"DELETE
mail_export WHERE filename LIKE ?"FROM

drweb-qcontrol--search-from {address} --search-to {address} --search-headers {header_name[:value]} header_name
value
value

--search-inbody {list of strings} MIME-decoding* ^ $ --search-headers
inbody\--search-

277

Dr.Web for UNIX Mail Servers:--search-inbody \* --stat:--search-to addr1 --search-to addr2
addr1

addr2

OR
:

--search-fromfrom@drweb.com--search-to
to@drweb.com –search-headers "Subject: [SPAM]"--search-inbody "spam"
from@drweb.com
Subject[ SPAM]

to@drweb.com:

drweb-qcontrol
backup/%--stat--search-from

a@5

def/

a@5

1.

def/backup/5/00014F95.DW_SHOT_PRODUCT.1LXzg1
from: a@5; to: a@drweb.com time: 2008-8-14
15:1:46

Dr.Web MailD

6.0

278

Dr.Web for UNIX Mail Servers%bin_dir/maild/scripts/
quarantine_migration.pl

Dr.Web MailD

drweb-maild
drweb-maild

1. Dr.Web MailD[ Maild]

ControlYes
2. Dr.Web

MailD

ControlAddress
1

drweb-maild
1

drweb-maild
IPv4

Control
MailD

IPv6
Dr.Web/directory_specified_as_a_value_of_BaseDir_parameter/ipc/.ctl

279

Dr.Web for UNIX Mail Servers

help [section|command] -help alloption [regex] - drweb-maild
optiondb-state Number: NC/NM
Size: SC/SM
NC
SM

NM

SC
NM

SM

0

queue-state drweb-maild 2
OutPoolOptions
send-stat Web MailD
Dr.WebDr.

SendPeriod[Stat]
MailD[Stat]

Send
Yes
send-report [period] Dr.Web

MailD

SendTimes[Reports]

Dr.WebMailD

Send
period[Stat]
24

backup quarantine-pulse -drweb-qp

Dr.Web[Quarantine]

PulseTime

MailD

Yes

280

Dr.Web for UNIX Mail Servers

dump-cache-stat get [(id1|-|id1-[id2]) [(plugin_name|-)]] idN

id1-id2
id1

id1

16

plugin_name"-":get - drweb - drweb
get - outputs send [(id1|-|id1-[id2])[force]] get
send=noget
force
send=yes[(plugin_name|-)]export[(id1|-|id1-[id2])[(plugin_name|-)] [(dir_name|-)] [env] 2

get
dir_name Dr.Web

MailD

BaseDir[General]
env 1

"

"
.eml"
.envelope"

2281

Dr.Web for UNIX Mail Servers:

export 00002D94 vaderetro /t env
Success export body to /t/00002D94.eml
and envelope to /t/00002D94.envelope
remove[(plugin_name|-)] get[(id1|-|id1-[id2]):

remove 00002D93
Success remove record 00002D93
send_and_remove[(plugin_name|-)][ignore_send_error] force_send
force[(id1|-|id1-[id2])[force_send]

ignore_send_error
notify notify.*
version stop reload - drweb-maild SIGHUP

Rules

send
send_and_remove282

Dr.Web for UNIX Mail Servers

email-info[client-id1/]email1 A=active1 S=stat1
name: name1
aliases: alias1 alias2 ..
groups: group1 group2
rules:
1: rule11
2: rule12...
custom:tag1: info1..
tag2: info2..
...
client-id1 A=active1 -ID

S=stat1 highname: name1 aliases:, groups:, rules:, custom: -IDgroups-info[client-id1/]group1 A=active1 S=stat1

283

Dr.Web for UNIX Mail Servers

emails:email1email2...
custom:tag1: info1..
tag2: info2..
...
1
1

2
1.

2.

[Rules]284

Dr.Web for UNIX Mail Servers

1client - Dr.Web for UNIX mail servers
RFC53221024

email ''

client-email - 2[client-id/]email
Web MailD
client-id
emails-list - client-email

<>

Dr.

group 1024

client-group - 2[client-id/]group
Dr.
Web MailD
client-id
ext-client-group=[client-id/]group|client-id/ - client-group
group-list - client-groupext-group-list - ext-client-group
RULE - Dr.Web MailD
\ 1

1

\\\
:

true cont headersfilter/RejectCondition =FileName = \"\.e\\\,e\"\, FileName = \"\.

285

Dr.Web for UNIX Mail Servers

com\", headersfilter/RejectPartCondition =FileName = \"\.e\\\,e\"\, FileName = \"\.
com\"true cont vaderetro/action = discard\,
quarantine
tag [a-zA-Z0-9_-]webinfo settingsparameter_name=valueo A (active) - 0

1o S (stat) -010o N (name) -1000:

S=1 A=0 N='Some user'
S=0client-email
client-email
client-email

286

Dr.Web for UNIX Mail Servers

user

email-set client-email [settings] email
clientemail
settings
email-remove
emailclient-email client-email

email-rename client-email email 2

email-set-groups
client-emailgroups] - client-email

list-of-groups[list-of-client-email
list-of-groups
client-email
2client-email
list-of-groups
client-email

client-id
client-id
list-of-groups
client-id
client-email client-id
email-get-groups emails-list - emails-listclient-email

287

Dr.Web for UNIX Mail Servers:

client-id/email1: group1 group2 group3 ...
client-id/email2:...

group21group22group23groupNemail-get-rules emails-list - emails-list:[client-id1/]email1
1: rule1
2: rule2...
[client-id2/]email2
1: rule21
2: rule22...
email-insert-rule client-email- emailclient-email

index

RULE

email
index
1

index

email
RULE
index

: email

2

10
index

0

index
index 3
RULE

email-getrules

288

Dr.Web for UNIX Mail Servers

email-remove-ruleclient-email
index
email
client-email
index
index 1client-email
index
emailiindex
0-email-get-rules
email-get-custom
emails-list-tagemails-list
tag

-

tag
1
"-"

tag
:

[client-id1/]email1
tag: info..
[client-id2/]email2
tag2: info2..
email-set-custom tag client-email [info] client-email
tag
info
info

email-info emails-list - emails-list:[client-id1/]email1 A=active1 S=stat1

289

Dr.Web for UNIX Mail Servers

name: name1
aliases: alias1 alias2 ..
groups: group1 group2
rules:
1: rule11
2: rule12...
custom:tag1: info1..
tag2: info2..
...
[client-id2/]email2 A=active2 S=stat2
name: name2
aliases:email2alias12alias22

..

|

alias

for

groups: group3
rules:
1: rule21
2: rule22...
custom:tag21: info21..
tag22: info22..
...
groupN:[client-id1/]email1
aliases: alias for email
email-search [range:START/NUMBER] [email:part-of-email][name:'part-of-name']

290

Dr.Web for UNIX Mail Servers[ignore:alias|nonalias] START 0
NUMBERSTARTNUMBERSTARTNUMBERSTARTNUMBERSTARTNUMBERo part-of-email -email-info
emailpart-ofIDo part-of-name -''o ignore -aliasnonalias

email nameemail-count [range:START/NUMBER][email:part-of-email][name:'part-of-name'][ignore:alias|nonalias] email-searchaliases-get emails-list - emails-list
emails-list
2
:

291

Dr.Web for UNIX Mail Servers[client-id1/]email1:...
[client-id2/]email2:
alias23 ...

alias1

alias2alias21alias3alias22aliases-set client-email [emails-list]
client-email
emailclient-email
emailslist
client-email-

1

emails-listclient-id
client-email
client-id
client-id
emails-listclient-email
client-id

groups-set client-group [settings] - groupclient-groupsettings
groups-remove client-group - groupclient-group

groups-rename client-group group - 1
2groups-get-rules [group-list] - group-list
group-list

292

Dr.Web for UNIX Mail Servers:[client-id1/]group1
1: rule1
2: rule2...
[client-id2/]group2
1: rule21
2: rule22...
groups-insert-rule client-group index RULE
- groupindex
clientgroupindex 1
index
index

RULE
:
2

3
index

0

index = 10
index =
RULE

groups-get-rules
groups-remove-rule client-groupclient-group
group
index
index 1
group
Client
index
index
0
groups-info
list[ext-group-list]-

index clienti

ext-group-

ext-group-list

293

Dr.Web for UNIX Mail Servers

ext-group-list
Clients
ID:[client-id1/]group1 A=active1 S=stat1
emails:email1email2...
custom:tag1: info1..
tag2: info2..
...
[client-id2/]group2 A=active2 S=stat2
emails:email21email22...
custom:tag21: info21..
tag22: info22..
...
groups-countgroups-info[ext-group-list]

groups-get-custom
group-list
group-list-|taggroup-list
tag
tag

1

tag

"-"

-

-

294

Dr.Web for UNIX Mail Servers:[client-id1/]group1
tag: info..
[client-id2/]group2
tag2: info2..
groups-set-custom
client-group
info
info

tag

client-grouptag

Client - Dr.Web for UNIX mail servers
id - [Quarantine][info]ID

Path[Quarantine]
Path
/var/
drweb/infectedID
def/drweb/
E/00020EBE.maild.xeAX4u/var/
drweb/infected/def/drweb/E/00020EBE.maild.
xeAX4uo def - "def"o drweb drweb-maild
maild
backupid-like "%" 0

id
"_" 1

:

def/%00014F7F% - 00014F7F
def/drweb/% - drweb

295

Dr.Web for UNIX Mail Servers

UTF8
ASCII 0..21 127

quarantine-search[range:START/NUMBER][sort:SORT_TYPE][sender:EMAIL_SUBSTR][rcpt:EMAIL_SUBSTR]*[period:DATE1[/
DATE2]][size:SIZE][subject:'SUBJECT_SUBSTR'][id:id-like][order:ascent|descent] START 0
NUMBERSTARTNUMBERNUMBER 0
o SORT_TYPE -

date

-

size sender subject o EMAIL_SUBSTRo period- rcptsender-o DATE1 o DATE2 -

DATE

296

Dr.Web for UNIX Mail Servers

ISO

YYYYMMDDTHHMMSS T
Dr.WebMailD
o SIZE -0o SUBJECT_SUBSTR -'1o order -descent

ascent descentquarantine-search
AND

rcpt
rcpt
:

N. id SENDER RCTPSSIZE DATE SUBJECTBLOCK_OBJECT1BLOCK_OBJECT2...
o N o SENDER o RCPTS o SUBJECT o SIZE o DATE o BLOCK_OBJECTN -

UTF8

297

Dr.Web for UNIX Mail Servers:# quarantine-search# quarantine-searchdrweb/%

range:45/15

id:def/

45

drweb
15

# quarantine-search rcpt:vasya@pupkin.com
vasya@pupkin.com#
quarantine-searchsort:size
sender:period:20090101T100001/20090102T100000
size:5242880 id:def/vaderetro/%
2009

1

1

10

10

vaderetro

5:quarantine-search0.
def/drweb/9/00021569.maild.BMED3y<ai@drweb.com> <alias_ai81@drweb.com>
829 20091117T102126 [EICAR] test2
EICAR Test File (NOT a Virus!)
1.
def/backup/9/00021569.maild.3PLb8e<ai@drweb.com> <alias_ai81@drweb.com>
828 20091117T100213 [EICAR] test
quarantine-count[range:START/NUMBER][sort:SORT_TYPE][sender:EMAIL_SUBSTR][rcpt:EMAIL_SUBSTR]*[period:DATE1[/
DATE2]][size:SIZE][subject:'SUBJECT_SUBSTR'][id:id-like][order:ascent|descent] - quarantine-search:quarantine-count298

Dr.Web for UNIX Mail Servers

234
quarantine-remove id-like [part-of-email1,
part-of-email2, ..] part-of-email1, part-of-email2, ...
ID id-like:# quarantine-remove %/backup/% drweb.com>
drweb.com#
quarantine-remove<foo2@dwreb.com>%

foo@dwreb.com<foo@dwreb.com>
foo2@dwreb.com#
quarantine-remove
E/00020EFE.maild.Q5FRbO

client2/drweb/ID

quarantine-limits :client-id1:
SIZE

NUMBER/MAX-NUMBER

SIZE/MAX-...
total: NUMBER/MAX-NUMBER SIZE/MAX-SIZE
where:o NUMBER/MAX-NUMBER -0o SIZE/MAX-SIZE-

0o client-id1 -

ID

299

Dr.Web for UNIX Mail Servers

o total -quarantine-send...] -

id-like[email1
email2
email1 email2 ...

RES in sending (to RCPTS_LIST): ido RCPTS_LIST o RES -

OK

ERROR

o id :

OK in sending (to <ai@drweb.com> <as@sd>):
def/backup/6/00004DD6.maild.VQ80Ro
OK in sending (to <ai@drweb.com> <as@sd>):
def/backup/6/00004DC6.maild.PWfqe3
quarantine-add id from rcpt1 rcpt2... from
rcptN
<>
id

Dr.Web

for

UNIX

mail

servers

client - Dr.Web for UNIX mail serversIDemail RFC5322<>''
client-email - [client-id/]email
id clientIDclientclient-id
group ''
1'client-300

Dr.Web for UNIX Mail Servers

client-group = [client-id/]group - client-id
clientID
client-id

5

dump-cache-stat
Dr.Web for UNIX mail servers

HUP

5

5

period = period:DATE1[/DATE2] where:o DATE1-o DATE2 -ignore = ignore:total|block total block -301

Dr.Web for UNIX Mail Servers

plugin = plugin:name nameplugin*stat-client
client-id|*|[ignore] [plugin] client-id
client-id[period]client-id

"*"
"-"
ID

stat-group client-group[plugin] - client-group[period][ignore]stat-email client-email [period][plugin] client-email[ignore]stat-remove-client client-id|*|- [period][ignore] [plugin] client-id
client-id
client-id

"*"
"-"
ID

stat-remove-groupclient-group[period]302

Dr.Web for UNIX Mail Servers[ignore] [plugin] - client-groupstat-remove-email
client-email[period][ignore] [plugin] client-email

remove-old-stat [time] time

( time)24

dump-cache-stat HUP

2
1.
PLUGIN DATE [P] [R] [D] [T] [Q] [RE] [N] [C] [S] [U] [F] [I][DI] [DM] [DSV] [DC] [DD] [DSK] [DAR] [DE] [DTA] [DTD][DTJ] [DTR] [DTH] [PS] [RS] [DS][TS] [QS] [RES] [NS] [CS][SS] [US] [FS] [IS] [WT] ...
2.
PLUGIN DATE FROM|- IP|- 'BLOCK1' TYPE1 'BLOCK2' TYPE2.. .

*PLUGIN -DATE 5YYYYMMDDTHHMMSS T
Dr.Web for UNIX mail servers

ISO

303

Dr.Web for UNIX Mail Servers

WT

WT
P, PS...
0

NAME=VAL - NAME

VAL/

P/PS R/RS -passrejectD/DS -

discard

T/TS -

tempfail/

Q/QS -

tempfail/

RE/RES N/NS C/CS S/SS U/US F/FS I/IS DI DM DSV DC DD DSK DAR DE -///redirect/notifiy
/
/
/
/
/

304

Dr.Web for UNIX Mail Servers

DTA DTD DTJ DTR DTH WT -BLOCK[12..]NAME
DI-DTH F S U

TYPE[12..] -FROM IP -IP

drweb-inject
Senderdrweb-

inject0--help --version --agent arg -non-zero

Agent
Agent

--timeout arg - Agent--id arg -SenderID-f [ --env-from ] arg -

From

305

Dr.Web for UNIX Mail Servers-F [ --from ] arg Full Name-i [ --ignore-dot ] - "."From-t [ --extract-recipients ] - "To:"drweb-inject
drweb-qcontrol--sendmail-v

non-zero

Receiver/Sender
Receiver

Senderdrweb-

maild

MTA
SMTP
Receiver Sender

1MTA

1. ReceiverID

MTA

SenderReceiverID Sender
ID
Receiver2.
3. Receiver
4.

ID

ID

drweb-maild Receiver ID

ID

306

Dr.Web for UNIX Mail Servers

Sender5.

SenderSenderID

Sender

6. drweb-notifier
Web MailD

SIGHUPDr.
[ Notifier]

MsgIdMap
Receiver

SenderReceiver Sender

ID --unique-id%var_dir/msgs/{in|out}
Sender2

drweb-receiver2*.conf*.conf*.confDr.Web MailD *.amc:

drweb-receiver2 General, Logging, /MailDesk/Clients, /_Rules, /Maild/ProtectedNetworks, /Maild/ProtectedDomains, /Maild/
IncludeSubdomains, SASL, Receiver2

UNIX

307

Dr.Web for UNIX Mail Servers

drweb-receiver2 Dr.Web Agent
Receiver2*.amc
Dr.Web Agent*.conf2
Dr.Web Agento --unique-id

id - idIDo --component name - name Dr.Web Agentdrweb-receiver2o --section -Receiver2:

DEFAULT_BIN_PATH/drweb-receiver --unique-id id1--component drweb-receiver2 --section Receiver2
DEFAULT_BIN_PATH/drweb-sender --unique-id id1--component drweb-sender2 --section Sender2*.conf*.conf308

Dr.Web for UNIX Mail Servers*.conf*.amc*.confDr.Web Agento --unique-id

id - idIDo --component name - name Dr.Web Agentdrweb-receiver2:

DEFAULT_BIN_PATH/drweb-receiver --unique-id id2--component drweb-receiver2
DEFAULT_BIN_PATH/drweb-sender --unique-id id2--component drweb-sender2
Dr.Web Monitor
Dr.Web MailD *.mmc*.
Dr.Web Monitor

mmc

Unified Score
Unified Score

99
1000

100-999309

Dr.Web for UNIX Mail Servers

Actionscore(SCORE)SCORE
Vaderetro

add_score

set_score

Reputation IP Filter

Vaderetro[Rules]Modifier
Dr.Web Modifier
Dr.WebMailD

MaxScore[MailD]
MaxScoreAction[Receiver]

MaxSessionScore
drweb-receiver
Reputation IP Filter score_filter

Reputation IP Filter
Reputation IP Filter
IP
IP

Dr.Web for UNIX mail servers
IP
DHA

310

Dr.Web for UNIX Mail Servers

Reputation IP Filter
1

ReputationIPFilter

MaxConcurrentConnection

ReputationIPFilter
score_filter
IP

IP

0

IP

RAM

drweb-receiver
SIGALRM
StalledProcessingInterval
drweb-receiverdrweb-receiver
1

ReputationIPFilter
IP
IP
IPv4

[General]
BaseDir
ipv4.bin
ipv6.bin
IPv6
OS

IP Trusted IP
Reputation IP Filter
IP
SessionRestrictions*Restrictions
Trusted IP[Receiver]

Reputation

IP

FilterSessionRestrictions

IP
Trusted IP

Reputation IP Filter

IP

SessionRestrictions
TrustedReputation IP Filter

IP

Reputation IP filter

IP

IP
IP

311

Dr.Web for UNIX Mail Servers

IP

anti_dha errors_filter
score_filter
Reputation IP filter

IP

SessionRestriction
trusted
TrustedSessionRestrictions

IP

Reputation IP filter

NAME=VAL

U

I

D

min_msgs=U - drweb-maild0SMTP

min_errors=U -0min_wrong_rcpts=U

-

SMTP

RCPT
0

TO

IP

min_conn=U 0
IPblock_period=T T{time}
IP

0score=I IP

312

Dr.Web for UNIX Mail Servers

0

block_periodIP

anti_dha - DHA Directory Harvest Attack
ProtectedEmails:
o wrong_per_valid_rcpts=D -RCPT TO1

0: 10.0:o min_msgs=0
o min_errors=0
o min_wrong_rcpts=20
o min_conn=0
o block_period=2h
o score=0
errors_filter -

IP
IP

SMTP

:
o errors_per_msg=D - SMTP

drweb-maild
drweb-maild
1:0
o errors_per_conn=D
IP

0

0

- SMTPIP

313

Dr.Web for UNIX Mail Servers

1
: 2.0

errors_per_msg
errors_per_conn
0:o min_msgs=0
o min_errors=100
o min_wrong_rcpts=0
o min_conn=50
o block_period=2h
o score=0
IPscore_filter IP
Unified

Score

SMTP
:
o score_per_msg=D IP
IPIP

drweb-maild
drweb-maild
10:0
o score_per_conn=D
IP

0

-

IP
IP

1
: 100.0score_per_msg
score_per_conn
0
:

314

Dr.Web for UNIX Mail Servers

o min_msgs=0
o min_errors=0
o min_wrong_rcpts=0
o min_conn=100
o block_period=2h
o score=0:

ReputationIPFilter
score_filter=

errors_filter

score=20,

SMTP

IP
20

2
IP

Dr.Web for UNIX mail servers

drweb
vaderetro
headersfilter
modifier

drweb
drweb Dr.Web for UNIX mail servers

drweb
Web Anti-virus Engine drwebd

drwebdUNIX

mailservers

Dr.
Dr.Web Daemon
Engine Dr.Web
for

315

Dr.Web for UNIX Mail Servers

drweb
drwebddrwebdEngineAddXHeaders

MIME

Yes

X-Anti-virus: Name - Name
X-Anti-virus-Code - Code drwebd
drweb

plugin_drweb.conf

drweb
Dr.Web for UNIX mail servers

drweb

Dr.

Web MailD

drweb
drweb
Dr.Web MailD[Filter]

BeforeQueueFilters:

BeforeQueueFilters = drweb, vaderetro
drweb
Dr.Web MailD[Filter]

AfterQueueFilters:

AfterQueueFilters = drweb

drweb plug-in%etc_dir/

316

Dr.Web for UNIX Mail Servers

plugin_drweb.conf[ anti-virus]

drweb[Antivirus]

Address =address}

drwebd{socketDaemonsPID
daemonPID:
PID
Address=
drwebd.pid

pid:%var_dir/run/

Address=
drwebd.pid,
example.com

pid:%var_dir/run/inet:3000@srv2.

:
Address=
drwebd.pid
Timeout
value}={time

pid:%var_dir/run/drwebd0:Timeout = 30s

317

Dr.Web for UNIX Mail Servers

HeuristicAnalysis{Yes | No}

drwebd=:HeuristicAnalysis = Yes
TCP_NODELAY
| No}

=

{Yes

Yes

TCP_NODELAY
No:

TCP_NODELAY = No
ReportMaxSize{size}=

drwebdReportMaxSize = 0

null:
ReportMaxSize = 50k
AddXHeaders
| No}

=

{Yes

Yes
X-Anti-Virus X-AntiVirus-Code:
AddXHeaders = Yes

318

Dr.Web for UNIX Mail Servers

Paranoid
No}

=

{Yes

|

Yes
Daemonpass

notify redirect

2:
Paranoid = No
RegexsForCheckedFil
ename = {list of
regularexpressions}drwebd">"">"BlockByFilename:
RegexsForCheckedFilename"^>.*?\\s{5\\,}"
BlockByFilename
5:
RegexsForCheckedFilename ==319

Dr.Web for UNIX Mail Servers

LicenseLimit{actions}=
pass tempfail discard
rejectquarantine
redirect notify:
LicenseLimit = pass
Infected{actions}=cureremove discard reject
quarantine redirect notify:
Infected = cure, quarantine
Suspicious{actions}=
pass remove discard reject
quarantine redirect
notify:Suspicious=
quarantine, notify
Incurable{actions}

reject,=removediscard reject
quarantine redirect notify:
Incurable=

reject,320

Dr.Web for UNIX Mail Servers

quarantine, notify
Adware = {actions}pass remove
discard reject
quarantine redirect notify:
Adwarenotify=reject,quarantine,

Dialers = {actions}pass remove
discard reject
quarantine redirect notify:
Dialers = reject,
notifyquarantine,

Jokes = {actions}pass remove
discard reject
quarantine redirect notify:
Jokes =
notifyRiskware{actions}

reject,quarantine,=
pass remove
discard reject
quarantine redirect notify:

321

Dr.Web for UNIX Mail Servers

Riskware = reject, quarantine,
notifyHacktools{actions}=pass
remove discard reject
quarantine redirect notify:
Hacktools=
quarantine, notify
SkipObject{actions}

reject,=drweb32.ini
SocketTimeout
FileTimeout
pass remove discard
rejectquarantine
redirect notify:
SkipObject = passdrweb32.ini

ArchiveRestriction= {actions}
daemon322

Dr.Web for UNIX Mail Servers

drweb32.ini
MaxCompressionRatio

drweb32.ini
MaxFileSizeToExtract

drweb32.ini

MaxArchiveLevel

pass remove discard
rejectquarantine
redirect notify:
ArchiveRestriction
quarantine, notify
ScanningErrors{actions}==

reject,drwebdDaemonpass remove reject tempfail
quarantine redirect
notify:ScanningErrors
quarantine=

reject,323

Dr.Web for UNIX Mail Servers

ProcessingErrors{actions}=

daemonpass discard
reject tempfail
quarantine redirect notify:
ProcessingErrors = reject
BlockByFilename{actions}=

RegexsForCheckedFilename

pass discard reject
tempfailquarantine
redirect notify
TCP

drwebd:127.0.0.1 [17078] >/var/drweb/
msgs/db/6/00007976/.msg/1.part
- Ok
">"

IP

RegexsForCheckedFilename:
BlockByFilename=
quarantine, notify

reject,Dr.Web MailD
SMTP

550 5.7.0

324

Dr.Web for UNIX Mail Servers

UseCustomReply{Yes | No}

SMTP

=
:

UseCustomReply = No
ReplyInfected{text value}=

Infected = reject
Incurable= reject
UseCustomReply = yes
SMTP:
550 5.7.0 "Text part of reply":
ReplyInfected = "DrWEB antivirus:
Messageisrejected
because it contains a virus."
ReplyMalware{text value}=

Adware Dialers Jokes Riskware
Hacktools = reject
UseCustomReply = yes
SMTP:
550 5.7.0 "Text part of reply":
ReplyMalware =virus:
Messagebecauseitmalware."ReplySuspicious{text value}="DrWEB antiis
rejected
containsaSuspicious = reject
UseCustomReply = yes
SMTP

325

Dr.Web for UNIX Mail Servers:
550 5.7.0 "Text part of reply":
ReplySuspicious = "DrWEB antivirus:
Messageisrejected
because it contains suspicious
content."
ReplySkipObject{text value}=

SkipObject = reject
UseCustomReply = yes
SMTP:
550 5.7.0 "Text part of reply":
ReplySkipObject = "DrWEB antivirus:
Messageisrejected
because it cannot be checked."
ReplyArchiveRestriction = {text value}

ArchiveRestriction = reject
UseCustomReply =
yes
SMTP

:
550 5.7.0 "Text part of reply":
ReplyArchiveRestriction="DrWEB anti-virus: Message isrejected because it contains
archivewhich
violates
restrictions."

326

Dr.Web for UNIX Mail Servers

ReplyError
value}={text

ScanningErrors ProcessingErrors
UseCustomReply =
yes
SMTP

:
550 5.7.0 "Text part of reply":
ReplyError="DrWEBantivirus: Message is rejected due
to software error."
ReplyBlockByFilename = {text value}

BlockByFilename = reject
UseCustomReply = yes
SMTP:
550 5.7.0 "Text part of reply":
ReplyBlockByFilename = "DrWEB
MailD: Message is rejected due
to filename pattern"headersfilter
Headersfilter
Perlheadersfilter
headersfilter
Dr.Web MailD

headersfilter

Dr.Web for UNIX mail servers

327

Dr.Web for UNIX Mail Servers

headersfilter
Dr.Web MailD[ Filter]

BeforeQueueFilters:

BeforeQueueFilters = drweb, headersfilter
headersfilter
Dr.Web MailD

Filter]AfterQueueFilters:

AfterQueueFilters =headersfilter

headersfilter%etc_dir/plugin_headersfilter.conf[ Headersfilter]

headersfilter

Reject*Accept*Dr.Web MailD[headersfilter][

328

Dr.Web for UNIX Mail Servers

ScanEncodedHeaders= {Yes | No}

Yes
RejectCondition Subject ="iso-8859-5"
Subject
iso-8859-5
Yes
2:
ScanEncodedHeaders = Yes

RejectCondition={set of conditions}
ActionHEADER = regular_expression
OR AND"!=":
RejectCondition
Subject"money"AND
Content-Type"text/html"==

2
No HEADER :RejectCondition
From

No

From -

329

Dr.Web for UNIX Mail Servers

HEADER = "8bit" - 8:
RejectCondition =AcceptCondition={set of conditions}

AcceptCondition
RejectCondition:
AcceptCondition =FilterParts
| No}

=

{Yes

RejectPartCondition
AcceptPartCondition:
FilterParts = Yes

RejectPartCondition
=
{set
of
conditions}
AcceptPartCondition
=
{set
of
conditions}RejectCondition
AcceptCondition
FileName = mask
mask POSIX
1003.2FilterParts

Yes:
RejectPartCondition =AcceptPartCondition =330

Dr.Web for UNIX Mail Servers

MissingHeader{text value}=:
MissingHeader = "To", "From":
MissingHeader =Action = {actions}pass tempfail
discard reject
quarantine redirect notify
add-header
1:
Action = reject, notify

Dr.Web MailD

SMTP

550 5.7.0

UseCustomReply{Yes | No}

SMTP

=
:

UseCustomReply = No
ReplyRuleFilter{text value}=

Action = reject
UseCustomReply = yes

SMTP:
550 5.7.0 "Text part of reply":
ReplyRuleFilter="DrWEB

331

Dr.Web for UNIX Mail Servers

HeadersFilter plugin: Message
is rejected by headers rulefilter."vaderetro anti-spam
Vaderetro Dr.Web for UNIX mail servers
Goto Software
VadeRetro

VadeRetro

10000+10000vaderetro
SpamThreshold
SpamThreshold
VadeRetro

X-Drweb-SpamScore: nnVadeRetro

X-Drweb-SpamState: b

b

Yes
No

X-Drweb-SpamState-Num:
0 1 2 3

s = 0
s = 1
s = 2
s = 3
vaderetro

s s

332

Dr.Web for UNIX Mail Servers

Yes

AddXDrwebSpamStateNumHeader
X-Drweb-SpamVersion:

version version
vaderetro

VadeRetro

Yes

AddVersionHeader
X-Spam-Level:z z "*""*"

10

vaderetroYes

AddXSpamLevel
X-DrWeb-SpamReason:

some_text some_text

AddXHeadersyesvaderetro

VadeRetro

vaderetro
SubjectPrefix
SubjectPrefix
Subject

NotifySubjectPrefix
UnconditionalSpamThreshold
Subject

UnconditionalSubjectPrefix
vrnonspam@drweb.com
vrspam@drweb.com

vaderetro
Dr.Web for UNIX mail servers

vaderetro
Dr.Web

MailD

vaderetro
vaderetro
Dr.WebBeforeQueueFilters

MailD[ Filter]

333

Dr.Web for UNIX Mail Servers:

BeforeQueueFilters = drweb, vaderetro
vaderetro
Dr.WebMailD[

AfterQueueFilters

Filter]:AfterQueueFilters = vaderetro

vaderetro%etc_dir/plugin_vaderetro.conf[VadeRetro]

vaderetro[Vaderetro]

FullCheck
No}

=

{Yes

|
10000

+10000

SpamThreshold:
FullCheck = Yes

334

Dr.Web for UNIX Mail Servers

NoHamFrom
No}

=

{Yes

Yes

|

Dr.Web MailD
nospam@domain.ru:
NoHamFrom = Yes

AddXHeaders
| No}

=

{Yes

X-Drweb-SpamState
SpamScore

X-Drweb-:
AddXHeaders = Yes
AddVersionHeader{Yes | No}=

VadeRetro
Drweb-SpamVersion

X-:
AddVersionHeader = No
AddXDrwebSpamStateN
umHeader = {Yes |No}

X-Drweb-SpamState-Num
VadeRetro

0 1 2 3 :AddXDrwebSpamStateNumHeader
No

=

335

Dr.Web for UNIX Mail Servers

AddXSpamLevel{Yes | No}=

X-Spam-Level
10*110
X-Spam-Level:***********:AddXSpamLevel = No

CheckForViruses{Yes | No}=:
CheckForViruses = Yes

CheckDelivery{Yes | No}

=

SMTP
:
CheckDelivery = No

AllowRussian = {Yes
| No}:
AllowRussian = Yes

AllowCJK
No}

=

{Yes

|
:
AllowCJK = Yes

WhiteList{lookups}=1*@mycompany.com*

1:
hello@myneighbourhood.co.uk

336

Dr.Web for UNIX Mail Servers*@mycompany.com:
WhiteList =BlackList{lookups}=1*@mycompany.com*

1:BlackList =SubjectPrefix{text value}=
SpamThreshold:
SubjectPrefix =UnconditionalSubjec
tPrefix={text
value}

UnconditionalSpamThreshold:
UnconditionalSubjectPrefix =NotifySubjectPrefix= {text value}

VadeRetro"3":
NotifySubjectPrefix =PathToVadeRetro{path to file}=

VadeRetro
update.pl

337

Dr.Web for UNIX Mail Servers

drwebmaild SIGHUP:
PathToVadeRetro=lib/libvaderetro.so
UnconditionalSpamTh
reshold={numerical value}%var_dir/

UnconditionalAction
SpamThreshold:
UnconditionalSpamThreshold
1000

SpamThreshold{numerical value}==
ActionUnconditionalSpamThreshold
UnconditionalSpamThreshold:
SpamThreshold = 100
UnconditionalAction= {actions}passremove discard reject
quarantine redirect:
UnconditionalAction = pass338

Dr.Web for UNIX Mail Servers

Action = {actions}pass
reject discard tempfail
quarantine redirect:
Action = pass
NotifyAction{actions}=
pass
reject discard tempfail
quarantine redirect:
NotifyAction = pass

UseCustomReply{Yes | No}

SMTP

=
:

UseCustomReply = No
SpamCustomReply{text value}=

Action UnconditionalAction
NotifyAction = reject
UseCustomReply = yes
SMTP:
550 5.7.0 "Text part of reply":
SpamCustomReply=
vaderetro
plugin:spam!""Dr.Web
this
is

339

Dr.Web for UNIX Mail Servers

FromProtectedNetwor
kScoreAdd ={numerical value}

ProtectedNetwork

0:
FromProtectedNetworkScoreAdd =UseReplyCache = {Yes | No}

ProtectedNetworkReplyCacheLifeT
ime
ReplyToProtectedNetworkScoreAdd
reply_cache:
UseReplyCache =ProtectedNetworkRep
lyCacheLifeTime ={time}

reply_cache
ProtectedNetwork

reply_cache
reply_cache
ReplyToProtectedNetworkScoreAdd:
ProtectedNetworkReplyCacheLife
Time =
ReplyToProtectedNet
workScoreAdd ={numerical value}

reply_cache:
ReplyToProtectedNetworkScoreAd
d =

340

Dr.Web for UNIX Mail Servers

Modifier
Modifier
Dr.WebModifier

Perl

Modifier

4

pass accept -reject discard notify Dr.Web

MailD

TemplatesBaseDir:

GlobalRules = select message, notify ruleadmin_
tempfail redirect quarantine stop
pass accept reject.msg

Dr.Web Notifier

341

Dr.Web for UNIX Mail Servers

accept pass + stop

acceptpass

pass discard

tempfail

rejectnotifyMIME
MIME

select or and nand nor
1

select message
MIME

select mime(headers), select mime.headers
selectmime(prologue),
prologueselectmime.

select mime(body), select mime.body
selectmime(epilogue),epilogueselectmime.

Content-type

"x-

MIME
MIME

:

selectvideo"

mime(headers)342

Dr.Web for UNIX Mail Servers

removevideo

selectvideo"

mime.headers

Content-type"x-

removevideo
MIME

mime(headers)
header_nameregular_expression_to_match_header_b ody
select mime(prologue) regular_expression
selectselect mime(body) regular_expression
select mime(epilogue) regular_expression

select sender <regular_expression>
select recipient <regular_expression>

select senderselect message

select receiver:

selectrecipient"root@localhost",
append_text "hello, root"and nand -343

Dr.Web for UNIX Mail Servers

or nor MIME

html"<script"

MIME

select mime(headers) Content-type html
and mime(body) "\<script"
2

html

Content-type"<script2""<""<script":select mime(headers) Content-type html
nand mime(body) "\<script"

2

Content-type"<script"

html:

select mime(headers) Content-type html
or mime(body) "\<script"

2:

Content-type"<script"

html

344

Dr.Web for UNIX Mail Servers

select mime(headers) Content-type html
nor mime(body) "\<script"

2

Content-type"<script"

html

select:select mime(headers) Content-type html
select mime(body) "\<script"
Content-type

html"<script"2:

select mime(headers) Content-type html
mime(body) "\<script"
Content-type
Modifier

html

vaderetro
">n"

"<n"

X-Drweb-SpamScore "30"
select mime(headers) X-Drweb-SpamScore "<50"
Modifier"\<50"

select mime(headers) X-Drweb-SpamScore
X-Drweb-SpamScore "<50""<"

select_mimes

MIME

345

Dr.Web for UNIX Mail Servers

1
3
MIME
expression_for_replacement
regular_expression_to_b e_replaced
replace_all new_text

replace:select mime.headers"filename=.*\\.exe",\

Content-disposition

or mime.headers Content-typeexe",\"name=.*\\.

replace "\\.ex_" "\\.exe",\
pass
2
MIME

select message
replace_all «text»

replacereplace_all

expression_for_replacement

new_text${func_name}regular_expression_to_b e_replaced346

Dr.Web for UNIX Mail Servers

347

o lc o uc o urlencode -URL

o self :selectmime.headers"Subject""^.*$",
replace_all "old:${self} new:${lc}"is Subj"

Subject"This"old:This is Subj new:this is subj":

selectmime.body".*","Upper:${uc}" "http://\\S+"replace"Text1
http://vasya.pup.kin
Text2"
Text1 Upper:HTTP://VASYA.PUP.KIN Text2"":

select mime.body ".*", replace "http://
check-url.com?url=${urlencode}""http://\\S+""Visithttp://vasya.com?id=3" "Visit
http://check-url.com?url=http%3A%2F%2Fvasya%2Ecom%3Fid%3D3"

removeMIME

Dr.Web for UNIX Mail Servers:

removeGlobalRules =remove, passselectmime(body)"text",

GlobalRules = select mime(body) "script",
remove, passprepend_text
append_text
prepend_html
append_html
MIME

html

:

select message
append_html "<h1>checkedh1>" [[7b:]encoding]byanti-spam</encoding"7b:"
context

7-bit

transfer

.lng

.lng
$1, $2 ... $nn .lng:.lng
1 = string1

348

Dr.Web for UNIX Mail Servers

2 = some other string...
append_text
string"$2

append_text

"some

other

LookupsLite:

append_text "lookup:file:path_to_file"select message, addheader "foo:bar"
foo

bar

if/elsegoto goto(y) -1

goto(n) -:mime(header) Content-type "executable"goto(n) 1
reject349

Dr.Web for UNIX Mail Servers

selection=find(mimes"*executable*")withcontent

typeif(selection){
reject mail;}if [not] found .... else .... endif:

select mime.headers "X-DrWeb-SpamState" "yes",\
if found,\select mime(headers) Content-type "image",\remove,\endif,\
Vaderetro

"\"
"\"

6

:

GlobalRules = select mime.headers Subject ".*\\\\\\"", if found, reject, endif0

if score add_score set_score"if score" "if found""select":....
if found,\set_score 10,\350

Dr.Web for UNIX Mail Servers

endif,\
10:....
add_score 11,\
11
:

....
if score >100,\
reject,\else,\
add_score -5,\
endif
100
5
1

if score<100

if score <2 if score >5 if score =8 -20

+20

< 100

2
5
8
32bit

add_score
MIME

2000000000

351

Dr.Web for UNIX Mail Servers

1.
* mime.body+:-

GlobalRules = select mime(headers) Content-type"text", and mime(body) "typical spam",\-goto(n) 1,\
discard,\-selectexe",\
remove,\mime(headers)Content-disposition

".

352

Dr.Web for UNIX Mail Servers-

select message, append_text "checked!"goto(n)1,\

discard,\html

GlobalRules=
selectmessage,append_html"lookup:file:/maild-files/somehtml.html"

GlobalRules=
selectmime(headers)From"weirdohacker@server.net", if found, reject,
endif

GlobalRules=
select"someaddress@my-net.com","anotheraddress@my-net.com"

mime.headersTo
replace_all

someaddress@my-net.com
anotheraddress@my-net.com

GlobalRules"Help",\=

selectmime.headers

Subject

if found,\selectcom",\

mime.headersTo"someaddress@my-net.

if found,\redirect "anotheraddress@my-net.com",\

353

Dr.Web for UNIX Mail Servers

discard,\endif,\
stop,\
endif,\

GlobalRules = \-select mime.headers Subject "support|bugreport[s]|help",\
if found,\-select mime.headers To "@company.com", \if found,\redirect "support@company.com",\
endif,\
pass, \
endif,\-

select mime.headers Subject "price|buy|order",\
if found,\select mime.headers To "@company.com", \if found,\redirect "sell@company.com",\
endif,\
pass, \
endif,\

354

Dr.Web for UNIX Mail Servers-

select mime.headers To "@company.com", \redirect "inbox@company.com",\
passselectmime.headers"filename=.*\\.exe", ortype "name=.*\\.exe",\

Content-disposition
mime.headers Content-

replace "\\.ex_" "\\.exe",\
pass

Modifier
Modifier
Web MailD
Modifier
MailD

Dr.Web for UNIX mail servers

Dr.
Modifier
Dr.Web[ Filter]

BeforeQueueFilters:

BeforeQueueFilters = modifier
Dr.WebModifier
MailD

AfterQueueFilters:

AfterQueueFilters = modifier

Modifier%etc_dir/plugin_modifier.conf[ Filter]

355

Dr.Web for UNIX Mail Servers[ Modifier]

Modifier[Modifier]GlobalRules = {listof rules}readmeGlobalRules
4o pass -o reject o discard o notify o tempfail -if/else:html
GlobalRules = select message,
append_html"lookup:file:/
maild-files/somehtml.html"

GlobalRules=

selectmime

356

Dr.Web for UNIX Mail Servers(headers)
From"weirdohacker@server.net",if
found, reject, endif:
GlobalRules...
Encoding
value}

=

{text

=

rule1,

rule2,

append_text
prepend_text:
Encoding = koi8-r

MTA
Dr.Web for UNIX mail servers
MTA

configure_MTA.sh

Dr.Web for UNIX mail servers

SMTP
Dr.Web MailD
SMTP/LMTP
SMTP/LMTP

receiversenderdrwebdrweb-sender
drweb-

357

Dr.Web for UNIX Mail Servers

drweb-receiver
dev/poll

epoll kevent /
SMTP
IPv6

SMTP
SMTP

PIPELINING RFC2920
8BITMIME RFC1652
ENHANCEDSTATUSCODES RFC3463
SIZE RFC1870
AUTH RFC4954
drweb-receiver
Reputation IP Filter

SMTP
DHA

drweb-receiver drweb-sender
Dr.Web MailD[Receiver]
Receiver[Sender]

SenderCommuniGate Pro

CommuniGate Pro
CommuniGate Pro
1.
2.

CGP

Dr.Web MailD

WebAdmin
->

CGP

->

3.

Use Filter: DrWeb Maild
Log: Problems
Path: %bin_dir/drweb-cgp-receiver
Time-Out: 2 minutes

358

Dr.Web for UNIX Mail Servers

Auto-Restart: 15 seconds
4.

CGP

5.

drweb-cgp-receiver-> Queue ->6. "check messages of less than N bytes"

1.

Create New

drweb-filter

2. EditActionExternal Filter

3. Parameters
Filter->->GROUP LIST RULES http://www.communigate.com/
CommuniGatePro/Transfer.html

Submit Address not in GROUP*,LIST*,RULES*
PIPEAfterQueueFilters
Any Recipientall@*main.domain

not

in

alldomains@main.domain,

CGP

CGP

Dr.Web MailD
CGP
SenderDr.WebMailD drweb-cgp-sender

mail

cgp
Web MailD drweb-cgp-receiver
CGP

Dr.
Receiver

root

359

Dr.Web for UNIX Mail Servers

Dr.WebMailD

Dr.WebMailD
Dr.Web MailD[CgpReceiver]

ChownToUser
root
CGP

drweb-cgp-sender PIPE
Dr.Web MailD[ CgpSender]
SecureHash

UseSecureHash

drweb-cgp-receiver
Dr.Web MailD

UseSecureHash[ CgpSender]

No
PIPE

Dr.Web MailD CGP

Dr.Web MailD[CgpReceiver]
CgpReceiverLinux[ CgpSender]
CgpSender

Helpers
CGP:

drweb-cgp-receiver/usr/libexec/ld-elf.so.1:
Sharedobject"libstdc++.so.6"
notfound,
requiredby"libboost_thread.so":%bin_dir/lib/
libstdc++.so.6

libgcc_s.so.1

360

Dr.Web for UNIX Mail Servers%bin_dir/lib/

Sendmail MTA
Sendmail Dr.Web MailD
Sendmail Milter API
SendMail
Dr.Web MailD

Milter API
Sendmail[ Sender]SecureHash

10

UseSecureHash
Sendmail

MTA Dr.Web

drweb-milter

Yes

MailD
Receiver

MilterAPI

Sendmail drweb-milter__ADDRESS__
Milter API

helo mail from: rcpt to:
drweb-milter
drweb-milter
Milter API
Sendmail
Milter API
Sendmaildrweb-milter

sendmail.cf
Sendmaildrweb-milter
drweb-maild
drweb-milter
drweb-maild
Sendmail drweb-milter

Sendmail361

Dr.Web for UNIX Mail Servers

drweb-milter

drweb-maild

Sendmail
Sendmail Dr.Web MailD

sendmail.mc

sendmail.cf
sendmail.cf

8.14.0:-------------------- cut -----------------############################# Input mail filters############################O InputMailFilters=drweb-filter
O Milter.LogLevel=6#############################

Xfilters############################
Xdrweb-filter,

S=__ADDRESS__,

F=T, T=C:1m;S:5m;R:5m;E:1h------------------- cut ---------------------

submit.cf
submit.cf

mailsendmailsendmail.cf
submit.mc
submit.mc
PrivacyOptions

nobodyreturn362

Dr.Web for UNIX Mail Servers:-------------------- cut -----------------# privacy flags
O PrivacyOptions=goaway,noetrn,nobodyreturn-------------------- cut -----------------Or in {sendmail_src}/cf/cf/feature/msp.m4:-------------------- cut -----------------define('confPRIVACY_FLAGS''goaway,noetrn,nobodyreturn,restrictqrun')-------------------- cut -----------------F=R T F=R

F=T

sendmail.mc
8.14.0:------------------- cut --------------------INPUT_MAIL_FILTER('drweb-filter','S=__ADDRESS__,
F=T, T=C:1m;S:5m;R:5m;E:1h')define('confMILTER_LOG_LEVEL','6')------------------- cut --------------------Sendmail

O Timeout.datablock=XX
1

XX=>1h363

Dr.Web for UNIX Mail Servers

sendmail.cf__ADDRESS__

drweb-milter
Dr.WebMilter]

MailD[

Address

TCP

inet:__PORT__@__HOST____PORT__ and __HOST__
inet:3001@localhost
UNIX

local:__SOCKPATH____SOCKPATH__
local:/var/run/drweb-milter.
sock
Sendmail
Sendmail
Sendmaildrweb-maild
messageID
maild

ID sendmails

drwebsendmail.cf------------------- cut --------------------O Milter.macros.envfrom=i,{auth_type}, ...
------------------- cut ---------------------

Dr.Web MailD

IP

drweb-maild
sendmail.cf------------------- cut --------------------O Milter.macros.connect=_,{if_addr}, ...

364

Dr.Web for UNIX Mail Servers------------------- cut ---------------------

syslog------------------- cut --------------------X-Authentication-Warning:some.domain.com:
drweb set sender to DrWeb-DAEMON@some.domain.
com using -f------------------- cut --------------------(

drweb-milter
submit.cf
submit.cf

drweb

trusted-users
sendmail.cf------------------- cut --------------------######################

Trusted users######################
Tdrweb------------------- cut --------------------submit.mc------------------- cut --------------------define('confTRUSTED_USERS', 'drweb')------------------- cut ---------------------

Dr.Web MailD
SenderDr.Web MailD

drweb-milter[ Sender]SenderMilter[ Milter]365

Dr.Web for UNIX Mail Servers:
Sendmail
Sendmail
8.12.2

UNIX

Milter API:
8.12.xlistener-8.12.0-1.patch
8.11.x

Sendmail

8.12.2

:

2

size
:
Sendmail

8.12.3:"...
Milter(drweb-filter):interrupted system call":
Sendmail

8.12.3

select(read):366

Dr.Web for UNIX Mail Servers:"...
Milter(drweb-filter):timeout before data write"

select(read):"... Milter (drweb-filter): to error state":
Sendmail
8.11

5
8.12

C

Xdrweb-filter,
S:5m;R:5m;E:1h

S=__ADDRESS__,

F=T,

T=C:1m;Mail Postfix

Dr.Web MailD Postfix
http://www.postfix.org/
FILTER_README.html#advanced_filter
before-queue
http://www.postfix.org/
SMTPD_PROXY_README.html
milterhttp://www.postfix.org/MILTER_README.
html

after-queue

after-queue

Dr.Web MailD

Postfix

367

Dr.Web for UNIX Mail Servers

SMTP/LMTP

drweb-receiver Postfix SMTP
drweb-maild
Postfix
SMTP/LMTP

Postfix
FILTER_README.html

smptd
drweb-sender
http://www.postfix.org/

Postfix

Dr.Web MailD before-queue

Postfix

before-queue
http://www.postfix.org/
SMTPD_PROXY_README.html
milterPostfix

drweb-milter Receiver
Postfix

Milter API
helo mail from: rcpt to:
drweb-milter
drweb-milter
Milter API
Postfix
Milter API
Postfix
drweb-milter
Postfix mail.cf
drweb-milter
Postfix

drweb-milter
drweb-maild
drweb-milter
Postfixl
drweb-maild
Postfix drweb-milter
drweb-milter
drweb-maild368

Dr.Web for UNIX Mail Servers

Mail Postfix

Dr.Web MailD Postfix
Postfix main.cf

after-queue

content_filter = scan:_ADDR_REC_
receive_override_options =no_address_mappings_ADDR_REC_
127.0.0.1:8025drweb-receiver
Dr.Web MailD
Receiver]Address
Postfix master.cf

scan unix-- n - NN smtp

-o smtp_send_xforward_command = yes_ADDR_SEN_ inet n - n - NN smtpd-o content_filter =-o receive_override_options =no_unknown_recipient_checks,
no_header_body_checks-o smtpd_helo_restrictions =-o smtpd_client_restrictions =-o smtpd_sender_restrictions =-o smtpd_recipient_restrictions =permit_mynetworks, reject-o mynetworks = 127.0.0.0/8-o smtpd_authorized_xforward_hosts =127.0.0.0/8[

369

Dr.Web for UNIX Mail Servers_ADDR_SEN_
127.0.0.1:8026drweb-sender[ Sender]Address

Dr.Web MailD

NN
Postfix
receiverdrwebdrweb-sender
Dr.Web MailD[ Receiver]
PoolOptions[ Sender]
OutPoolOptions
NN"-"

Dr.Web for UNIX mail servers

Postfix
configure_MTA.sh
Dr.Web for UNIX mailafter-queue

servers Postfix

Postfix
Postfix

2.3.3

Dr.Web for UNIX mail servers Postfix
afterqueue
milterPostfix
content_filter
smtpd_milters
master.cf
Postfix

Postfix

drweb-milter
TCP

UNIX

Postfix

main.cf smtpd_milters
TCP

host@port

inet:
smtpd_milters=inet:127.0.0.1:3001
UNIX
unix:pathname

pathname UNIX370

Dr.Web for UNIX Mail Servers

UNIX

Postfix

Postfix drweb-milter
Web MailD[ Milter]Dr.

Address
main.cf

smtpd_milters
main.cf
milter_content_timeout = 300s - Postfix
Dr.WebMailD

BeforeQueueFilters
Dr.Web MailD[ Milter]ProcessingTimeout

milter_default_action = tempfail drweb-milter
Postfix

milter_protocol = 6 - milter
milter_mail_macros = _ MailD

Dr.WebIP

milter_end_of_data_macros = i auth_type drweb-milter
ID

Dr.Web MailD
Dr.Web MailD
Dr.Webdrweb-milter

Dr. Web Monitor
Receiverdrweb-milter%etc_dir/monitor/
drweb-

maild_postfix.mmc
receiverdrweb_postfix.mmc

371

Dr.Web for UNIX Mail Servers# drweb-receiver local:%var_dir/ipc/.agent
15 30 MAIL drweb:drweb
drweb-milter local:%var_dir/ipc/.agent 15
30 MAIL drweb:drweb
Dr.Web MailD

drweb-sender[ Sender]Address = /usr/local/sbin/sendmail
Method = pipe
MailerName = postfix
Postfix

Address
Dr.Web MailD

sendmail[ Sender]SecureHash

10

UseSecureHash

Yes
Dr.Web MailD

drweb-milter Sender
Dr.WebSender][ Milter]

Receiver
MailD

Postfix[ Receiver] [Receiver

Sender Milter

Exim MTA
Dr.Web MailD Exim
Receiver
Sender2
special transport: EximExim

drweb-receiverdrweb-sender
Exim Dr.Web MailD

372

Dr.Web for UNIX Mail Servers:
Exim local_scan
Dr.WebAgent

ReceiverExim:: EximExim

4.50

Exim MTA

Exim

MAIN CONFIGURATION SETTINGS
drweb------------------ cut ----------------------###############################################

MAIN CONFIGURATION SETTINGS###############################################
trusted_users = drweb------------------ cut ----------------------Exim

drweb-sender
SMTP[ Sender]

PipeTimeout
Exim

drweb-sender
Exim
Exim

acl

acl_check_drweb_scanned:
warn

373

Dr.Web for UNIX Mail Servers

condition = ${if and {{def:received_protocol}{eq {${received_protocol}}\{drweb-scanned}}} {yes}{no}}control = queue_only
acceptacl_not_smtp = acl_check_drweb_scanned
Exim4.xx

3.xx
http://www.exim.org/index.

html
Exim

special transport

Routers

Configuration------------------ cut ----------------------###############################################

ROUTERS CONFIGURATION## Specifies how remote addresses are handled ##################################################ORDER DOES MATTER#

A remote address is passed to each inturn until it is accepted.

################################################
begin routersdrweb_router:
driver = accept
condition = "${if eq{drweb-scanned}{0}{1}}"# check_local_user{$received_protocol}

374

Dr.Web for UNIX Mail Servers

retry_use_local_part
transport = drweb_transportcheck_local_user
Exim------------------ cut ----------------------###############################################

TRANSPORTS CONFIGURATION##################################################ORDER DOES NOT MATTER#

Only one appropriate transport is called
for each delivery.

################################################------------------ cut -----------------------

drweb_transport:
driver = lmtp
socket = __ADDRESS__
batch_max = 100
timeout = 5m
user = drweb# headers_add
Exim"

=

_ADDRESS_ UNIXdrweb-receiver[ Receiver]
Dr.Web MailD
Exim"X-Maild-Checked:

DrWEB

for

%var_dir/ipc/.drweb_maild
Dr.Web

MailD

Address[ Sender]Address/usr/exim/bin/exim/[

375

Dr.Web for UNIX Mail Servers

Sender]MailerName

Exim

Dr.Web MailD Exim
Dr.Web MailD

Exim

4.50

local_scan
EximFirst, you must recompile Exim with support of local_scanfunction:%bin_dir/doc/maild/local_scan/local_scan.c
exim*/Local/%bin_dir/doc/maild/local_scan/Makefile.
sampleexim*/Local/
Exim Makefile
Makefile
Exim Makefile

Exim
Dr.Web MailD

EXIM_USER
EXIM_USER = drweb
Exim
make
installmake/libexec/ld-elf.so.1:
Sharedobject"libgcc_s.so.1" not found, required by"libboost_thread.so"
2
o

so.1

libstdc++.so.6%bin_dir/lib/

libgcc_s.

o$ export LD_LIBRARY_PATH=%bin_dir/lib/:$LD_LIBRARY_PATH376

Dr.Web for UNIX Mail Servers

Exim
Exim
%bin_dir/doc/
maild/local_scan/configure.sample
Exim
local_scan$ PATH_TO_BIN_DIR/exim -bP local_scan
PATH_TO_BIN_DIR Exim

Dr.Web MailD
Exim[ Sender]Dr.Web MailD

Address/usr/exim/bin/exim/
Exim

Dr.Web MailD
Exim

MailerName
Receiverlocal_scan
Eximdrweb-receiver
Dr.Web Monitor

drweb-receivermonitor/maild_exim.mmc

Dr.Web MailD%etc_dir/#drweb-receiver local:%var_dir/ipc/.agent 15 30
MAIL drweb:drweb
Dr.Web MailD Exim
Dr.WebMailD

EximMailD Exim
[ Receiver]
Receiver
SenderDr.Web[ Sender]377

Dr.Web for UNIX Mail Servers

transport
drweb_transport:
transport driver "lmtp"
LMTP

cannotfind

LMTP
http://www.exim.org/
Exim MTA
Exim LMTP
Exim/Local/TRANSPORT_LMTP = yes

Makefile

qmail MTA
qmail
proxying

qmail-queue
qmail-

queue
UNIX

Dr.Webdrweb-qmail[ Qmail]

MailD

ListenUNIXSockets
qmailqueue --help
Dr.Web MailD

qmail

1.03
qmail

qmail
Dr.Web MailD qmail

qmail-queue
qmail-queue %bin_dir/qmail/bin/qmail-queue Dr.Web MailD
qmail-queue.original

drweb

Dr.Web MailD

qmail-queue378

Dr.Web for UNIX Mail Servers

qmail-queue-rws--x--x X drweb qmail SIZE DATE qmail-queue-rws--x--x X qmailq
queue.original

qmail

SIZE

DATE

qmail-$ chown drweb:qmail qmail-queue$ chmod 4711 qmail-queue$ chown qmailq:qmail qmail-queue.original$ chmod 4711 qmail-queue.original

Dr.Web MailD
Dr.Web
MailD
Sender

MailD qmail[ Sender]Qmail

Dr.Web[ Qmail]

:
qmail
1.

terminate
calledafter
instance of 'St9bad_alloc'
what(): St9bad_alloc

throwingan

2. bash: xmalloc: cannot allocate 2 bytes (0bytes allocated)
3. qmail-queue.real:error whileloading
shared libraries: libc.so.6: failed to map
segment from shared object: Cannot allocate
memory4. /var/qmail/bin/qmail-smtpd:
error while loading shared libraries:

379

Dr.Web for UNIX Mail Servers

libc.so.6: failed toshared object:
Cannot allocate memorymapsegment

from

:

Dave

Sill

softlimit -m
2000000002000000

:
SMTP

qmail

451 qq trouble making network connection(#4.3.0):

qmail-queue

drweb-qmail Dr.Web MailD ReceiverUNIXqmail-queue
Dr.Web MailD[ Qmail]

ListenUNIXSocket
qmail-queue --help

:
SMTP
qmail

qmail-inject: fatal: qq temporary problem(#4.3.0)/usr/libexec/ld-elf.so.1:"libstdc++.so.6" not found,

Sharedobject380

Dr.Web for UNIX Mail Servers

required by "libboost_program_options.so":%bin_dir/lib/
libstdc++.so.6%bin_dir/lib/

libgcc_s.so.1

ZMailer MTA
drweb-zmailer
Dr.Web MailD

ZMailer v. 2.99.55
2
ZMailer

SMTP: SMTP: SMTP:

ZMailer

UUCP:

rejecttempfail

ZMailer
ReceiverdiscardSecureHash

drweb-zmailer

drweb-zmailer

Dr.Web

MailD

381

Dr.Web for UNIX Mail Servers$(ZMAILER_SRCHOME)/smtpserver
ZMAILER_SRCHOME ZMailer$ patch < smtpdata.c.XXX.patch
Zmailer

XXX

SMTP
SMTP

Dr.Web MailD ZMailer

drweb-zmailer.sh $MAILBIN
zmailer.conf
smtpserver.conf
PARAM$MAILBIN/drweb-zmailer.shcontentfilter

contentfilter
drweb-zmailer.sh$MAILBIN/cf/process.cf

LOGMSG=()
log..

# This is a LIST of files where to#|
The LOGMSG variable is usedintercept facility (in crossbar.cf)
#|

to

make

sure

only

a

single

by

copy

the
of

a

382

Dr.Web for UNIX Mail Servers

message is saved when required.
#|
Each sender - recipient address pair cancause an intercept which can#|
specify a file to save
This variable is appended tothemessageto.

#| elsewhere, and processed at the end of thisfunction.

###-> Dr.Web MailD support
ch='"DEFAULT_BIN_PATH/drweb-zmailer.sh" --hash__EDIT_THIS__ --file $POSTOFFICE/router/$file'case"$ch" in-1*) #reject or disacrd/bin/rm -f "$file"
return;;1*) #tempfail/bin/rm -f "$file"
return
;;
*);;

esac
###-> end of Dr.Web MailD support_EDIT_THIS__ --hashDr.Web MailD[ Sender]SecureHash
UseSecureHash
Yes

SMTP
SMTP

383

Dr.Web for UNIX Mail Servers

policytest.c.XXX.patch
smtpdata.c.XXX.patch
ZMailer drweb-zmailer

drweb-zmailer
drwebzmailer.sh
drweb-zmailer-h [ --help ] -v [ --version ] -u [ --user ] arg (=drweb) - drweb-maild
ZMailerroot
drweb-zmailer
Dr.Web MailD
root

-u

""

-l [ --level ] arg (=info) Quiet Error Alert Info Debug-i [ --ipclevel ] arg (=info) - IPC
Quiet Error Alert Info Debug
syslogd-f [ --facility ] arg (=mail) syslog

Daemon Mail Local0-7-b [ --basedir ] arg (=%var_dir) - Dr.Web
MailD
MailD

Dr.Web[ General]

BaseDir-t [ --timeout ] arg (=30) - 1--file arg --hash arg - Dr.Web MailD[ Sender]384

Dr.Web for UNIX Mail Servers

SecureHash--interface arg (=1) - smtpserver0

2.99.55

SMTP
1

2.99.56-e [ --error-action ] arg (=reject) pass reject discard tempfail

Courier

CourierDr.Web MailD Courier
1.

drweb-courier$
chown
COURIER_USER:drweb"DEFAULT_BIN_PATH/drweb-courier"$chmodcourier"

6771

COURIER_USER"DEFAULT_BIN_PATH/drweb-

Courierdrweb

2. drweb-courier%var_dir

Courier/usr/local/libexec/filters/
symlink
3. drweb-courier

Courier$ /usr/local/sbin/filterctl startcourier$/usr/lib/courier/sbin/filterctl

drweb-

stop

385

Dr.Web for UNIX Mail Servers

drweb-courier
4.

esmtp
5. Dr.Web MailD

enablefiltering
uucp[ Courier]

BaseDir
CourierSocketDirsmancourierfilter
6. Courier$/usr/lib/courier/sbin/courierfilter

start
Dr.Web Daemon

drweb

CouriercourierDr.Web MailD
Dr.Web
MailD

MailD Courier[ Sender]SenderCourierDr.Web[ Courier]

Proxy
Dr.Web for UNIX mail servers
1.
Receiver2.

Senderdrweb-maild
Dr.Web for UNIX mail servers

N:M N
M

386

Dr.Web for UNIX Mail Servers

drweb-maild
drweb-maild
drweb-proxy-client drweb-proxy-server
drweb-proxy-client - Receiver
Senderdrweb-maild
drweb-maild
drweb-proxy-server - drweb-maild
Receiver

Senderdrweb-proxy-client drweb-proxy-server
Dr.Web for UNIX mail servers

drweb-notifier drweb-monitor

proxy

drweb-agent

387

Dr.Web for UNIX Mail Servers

16.proxy

drweb-proxy-client drweb-proxyserver

ProxyServersAddresses
ProxyClientsAddresses[ProxyClient] [ProxyServer]

ADDRESS1 [WEIGHT1], ADDRESS2 [WEIGHT2] ..

388

Dr.Web for UNIX Mail Servers

ADDRESSWEIGHT 0
WEIGHT

100[ProxyClient]
ProxyServersAddresses
drweb-proxy-server*
HOST2-*[ProxyClient]
ProxyClientsAddresses
drweb-proxy-client*
HOST1-*:

ProxyServersAddresses = inet:8066@10.3.0.73 10,
inet:8066@10.3.0.72 5
10.3.0.73
10.3.0.72
WEIGHT
WEIGHT

WEIGHT 0
1

1.

2
1

WEIGHT

WEIGHT
WEIGHT
WEIGHT 1
WEIGHT1.3

2.
p.1
3. WEIGHT 0389

Dr.Web for UNIX Mail Servers

WEIGHT

BeforeQueuedrweb-maild

AfterQueue
ProxyClientsAddresses

Rules

drweb-maild

ProxyClientsAddresses

ProxyClientsAddresses
Rules

SenderAddress
proxy Milter Qmail

CourierMTA

drweb-milter
AfterQueueproxy Receiverdrweb-maild
AfterQueuedrweb-milter ProcessingTimeout

Receiver
SMTP

M=N=1

M=N=1

1. HOST1-1

proxy-client

proxy

drwebDr.Web

MailD

390

Dr.Web for UNIX Mail Servers/etc/init.d/drweb-monitor check Linux

Solaris/usr/local/etc/rc.d/00.drwebmonitor.sh check - FreeBSD
2. HOST1-1

Dr.Web MailD

3. HOST2-1

drwebDr.Web

proxy-server
Receiver4. HOST1-1
5. HOST2-1

MailD

SenderHOST2-1%etc_dir/monitor
Receivermmc
Senderdrweb-proxy-server

Receiver/Sender
Dr.Web Monitor

drweb-proxy-server

6. HOST2-1

Dr.Web MailD[ProxyServer]

ProxyClientsAddresses
HOST1-1 IP[ProxyClient]
Address
7. HOST2-1/etc/init.d/drweb-monitor check Linux

Solaris/usr/local/etc/rc.d/00.drwebmonitor.sh check - FreeBSD
HOST2-1
Dr.Web MailD
8. HOST1-1

Dr.WebMailD[ProxyClient]
ProxyServersAddresses
HOST2-1 IP[ProxyServer]
Address391

Dr.Web for UNIX Mail Servers

9. HOST1-1%etc_dir/monitor
mmc
drweb-maild
drweb-proxy-client

drweb-proxy-client drweb-maild
Dr.Web Monitor

10. HOST1-1/etc/init.d/drweb-monitor check Linux

Solaris/usr/local/etc/rc.d/00.drwebmonitor.sh check - FreeBSD
Dr.Web MailD

HOST2-1
11. HOST1-1

M

Dr.Web Daemon

Dr.Web Updater
Dr.WebN 1[ProxyServer]
ProxyClientsAddresses[ProxyClient]
ProxyServersAddresses
WEIGHT

392

Dr.Web console for UNIX mail servers

Dr.Web console for UNIX mailservers
Dr.Web for UNIX mail servers
servers
Web
WebminWebminwww.webmin.com/).

Dr.Web console for UNIX mailWeb

WebminDr.Web console for UNIX mail servers:
XML::Parser - XML(http://

Perl

JSON::XS - JSON JavaScript Object Notation
XML::XPath - XPath
Text::Iconv - iconv() Perlperl-devel
libperl-dev- Text::Iconv
Date::Parse UNIXCGI - CGI
CGI::Carp - HTTPDMIME::Words - RFC 2047
MIME::Base64 - Base64
MIME::QuotedPrint - quoted-printable
MIME::Entity - MIMEMIME::Parser - MIMEMIME::Head - MIME
Storable POSIX - POSIX

Digest::MD5 - MD5
Encode Encode::Byte -

Unix

393

Dr.Web console for UNIX mail servers

Encode::JP File::Stat File::Find Encode::CN Encode::HanExtr -stat():

perl-Convert-BinHex, perl-IO-stringy, perl-MIMEtools, perl-XML-Parser, perl-XML-XPathrpm

noarch.rpm

(

OS

)
Debian/Ubuntu:

apt-get install libjson-perl libjson-xs-perl
libxml-parser-perl libxml-xpath-perl
libtimedate-perl libmime-tools-perlroot
Red Hat/Fedora/CentOS 5:

yum install perl-JSON perl-JSON-XS perl-XMLParser perl-XML-XPath perl-TimeDate perl-MIMEtools
root
OS:

cpan JSON JSON::XS XML::Parser XML::XPath
Date::Parse MIME::Words MIME::Entity MIME::
Parser MIME::Head
root

394

Dr.Web console for UNIX mail servers

WebminWeb

Web

Webmin 1.480
Firefox 3.0.7 (Mozilla/5.0 (Windows; U; Windows NT 5.1; ru;
rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7)

Dr.Web console for UNIX Mail Servers
WebminWebminServers

Dr.Web console for UNIX Mail

%bin_dir/web/

WebminWebmin Web

17. Webmin

WebminWebmin395

Dr.Web console for UNIX mail servers

18. Webmin

1. Webmin
Browse2.

%bin_dir/web/
console for UNIX Mail Servers

Dr.Web396

Dr.Web console for UNIX mail servers

19. Webmin

3.

OK

4.
5.

Dr.Web console
for UNIX Mail Servers
20. Dr.Web console for UNIX Mail Servers

397

Dr.Web console for UNIX mail servers

Dr.Web console for UNIX Mail Servers
init
21. Module configuration

Dr.Web console for UNIX Mail Servers
Back

Back

398

Dr.Web console for UNIX mail servers

22. Dr.Web console for UNIX Mail Servers

Dr.Web MailD

Dr.Web for UNIX mail servers

,

,

3

Start Dr.Web MailD

Stop Dr.Web

MailD

Dr.Web for UNIX mail servers(Quarantine)

399

Dr.Web console for UNIX mail servers

23. "Quarantine"

Quarantinel1(Report spam)

400

Dr.Web console for UNIX mail servers

24.

Send
Forward(e-mail),),Subject ,Attachments(()
DeleteDEL"
Not Spam"Dr.
Web for UNIX mail servers
Dr. Web

Report spam401

Dr.Web console for UNIX mail servers

25.

Sender-Recepient
SubjectDatee-mail-e-mailall dates today -12:00 a.m.

-yesterday -12:00 a.m.

this week this month custom period 26.

custom periodOK

12:00 a.m.

402

Dr.Web console for UNIX mail servers

Size

-

byte
0

Statusvirus spam rule processing error Apply

Reset

Quarantine
27.

Status-)403

Dr.Web console for UNIX mail servers

:
,

-

,

,

SenderRecipient
Subject
Date
Size

-

-

24

-

Recipient ,:Subject ,

Date

28.

(Quarantine)-404

Dr.Web console for UNIX mail servers

29.

CTRL+

Quarantine

1

10, 20, 50, 100(Preview)
Continue

Save

Editing
CancelApply and Save

405

Dr.Web console for UNIX mail servers

30.

406

Dr.Web console for UNIX mail servers

"

"
31.

Dr.Web MailD

407

Dr.Web console for UNIX mail servers

"

"
32.

Quarantine

:
DBI

408

Dr.Web console for UNIX mail servers

"

"
33.

409

Dr.Web console for UNIX mail servers

34. Anti-spam

VadeRetro

410

Dr.Web console for UNIX mail servers

35. Headers Filter

headersfilter"HEADER= regular_expression"~Condition"value"Actionredirect411

Dr.Web console for UNIX mail servers

36.

Dr.Webactions

redirectEngineRedirectMail

412

Dr.Web console for UNIX mail servers

37.

Modifier

413

Dr.Web console for UNIX mail servers

38. Modifier

"

"
39.

Dr.Web MailD[Rules]414

Dr.Web console for UNIX mail servers

Create new rule
40.

ctions(Rule editing)Settings

group
ungroupCreate new rules section

Conditions

A415

Dr.Web console for UNIX mail servers

41.

416

Dr.Web console for UNIX mail servers

"

"
42.

drweb-maild
Pool

417

Dr.Web console for UNIX mail servers

43.

MailBase

418

Dr.Web console for UNIX mail servers

44. MailBase

419

Dr.Web console for UNIX mail servers

"

"
45.

420

Dr.Web console for UNIX mail servers

"

"
46.

SMTP/LMTP

1

Dr.Web MailD

MTA

421

Dr.Web console for UNIX mail servers

47.

422

Dr.Web console for UNIX mail servers

"

"
48.

Daemon423

Dr.Web console for UNIX mail servers"IMAP"
49. IMAP

IMAP

424

Dr.Web console for UNIX mail servers"POP3"
50. POP3

POP3

425

Dr.Web console for UNIX mail servers

"

"
51.

Dr.Web for UNIX mail servers

Daemon426

Dr.Web console for UNIX mail servers

52.

ADMIN_ARCHIVE.msg - drweb32.ini
DaemonADMIN_CURED.msg-

ADMIN_ERROR.msg -DaemonADMIN_LICENSE.msg -ADMIN_MALWARE.msg -427

Dr.Web console for UNIX mail servers

ADMIN_RULE.msg -ADMIN_VIRUS.msg -DSN.msg RCPTS_MALWARE.msg -RCPTS_VIRUS.msg -REPORT.msg -DaemonSENDER_ARCHIVE.msg - drweb32.ini
DaemonSENDER_CURED.msg -SENDER_ERROR.msg - Daemon

SENDER_MALWARE.msg -SENDER_SKIP.msg -SENDER_VIRUS.msg -

428

429

Dr.Web for UNIX mail servers
web

http://www.drweb.com/:
http://buy.drweb.com/:
http://support.drweb.com/

OS
Dr.Web for UNIX mail servers© 2011 Doctor Web