Migrate Plesk to ClamAV

March 18, 2015 Lloyd Day 2 Comments

Recently a client wanted a free alternative to Plesk’s DrWeb, I went with ClamAV.
Here’s what I did to migrate the system from DrWeb to ClamAV.

REMOVE DRWEB

1. Firstly lets remove DrWeb properly:

/opt/psa/admin/bin/autoinstaller --select-product-id plesk --select-release-current --remove-component drweb

1	/opt/psa/admin/bin/autoinstaller --select-product-id plesk --select-release-current --remove-component drweb

INSTALL CLAMAV

2. Now we can install ClamAV:

apt-get install clamav clamav-base clamav-daemon clamav-freshclam clamav-milter clamsmtp libclamav6

1	apt-get install clamav clamav-base clamav-daemon clamav-freshclam clamav-milter clamsmtp libclamav6

3. Edit /etc/clamav/clamav-milter.conf and set:

MilterSocket /var/run/clamav/clamav-milter.ctl

1	MilterSocket /var/run/clamav/clamav-milter.ctl

MilterSocket inet:3381@localhost

1	MilterSocket inet:3381@localhost

4. Now edit /etc/postfix/main.cf and add:

milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:12768, inet:127.0.0.1:12345, inet:127.0.0.1:3381
non_smtpd_milters = inet:127.0.0.1:12345, inet:127.0.0.1:3381

milter_default_action = accept

milter_protocol = 6

smtpd_milters = inet:127.0.0.1:12768, inet:127.0.0.1:12345, inet:127.0.0.1:3381

non_smtpd_milters = inet:127.0.0.1:12345, inet:127.0.0.1:3381

Where 12768 = psa-remote, 12345 = OpenDKIM, 3381 = ClamAV.

5. Now we need to restart postfix, clamav-milter and send a test mail and check for these headers..

X-Virus-Scanned: clamav-milter 0.98.6 at hostname
X-Virus-Status: Clean

1 2	X-Virus-Scanned: clamav-milter 0.98.6 at hostname X-Virus-Status: Clean

Your mail should now be scanned by both Spamassasin and ClamAV.
If you are missing the Scanned by header check the file…/etc/clamsmtpd.conf, for

# A header to add to all scanned email
Header: X-AV-Checked: ClamAV using ClamSMTP

1 2	# A header to add to all scanned email Header: X-AV-Checked: ClamAV using ClamSMTP

And uncomment it.

SET UP FRESHCLAM

6. ClamAV Freshclam, can be set up in several ways, I find it best to use cron for an hourly update.
To configure freshclam run…

dpkg-reconfigure clamav-freshclam

1	dpkg-reconfigure clamav-freshclam

And select cron instead of daemon.

7. You should have a default cron job for freshclam in /etc/cron.d/clamav-freshclam, should you wish to manage the task in Plesk or crontab you should disable first by commenting it out, you can then add the task to crontab like so…

crontab -e
30	*	*	*	*	/usr/bin/freshclam --quiet

1 2	crontab -e 30 * * * * /usr/bin/freshclam --quiet

8. Now restart freshclam with

service clamav-freshclam restart

1	service clamav-freshclam restart

And you should be good.
Any questions feel free to contact me.

Ubuntu

Creating ECC Certificates

January 28, 2015 Lloyd Day

Here’s a very quick guide on creating ECC 256Bit Self-Signed Certificates with OpenSSL and Ubuntu 12 and 14.

1. Firstly lets create a folder to hold the files..

mkdir /etc/ssl/ecc

1	mkdir /etc/ssl/ecc

2. Move to that directory…

cd /etc/ssl/ecc

1	cd /etc/ssl/ecc

3. Now lets create the key

openssl ecparam -genkey -name prime256v1 -out ecc.key

1	openssl ecparam -genkey -name prime256v1 -out ecc.key

4. Create the request

openssl req -new -key ecc.key -out ecc.csr

1	openssl req -new -key ecc.key -out ecc.csr

5. Create the certificate

openssl x509 -req -days 365 -sha256 -in ecc.csr -signkey ecc.key -out ecc.crt

1	openssl x509 -req -days 365 -sha256 -in ecc.csr -signkey ecc.key -out ecc.crt

6. While we are here, lets combine the private key and certificate into a .pem file.

cat ecc.key ecc.crt > ecc.pem

1	cat ecc.key ecc.crt > ecc.pem

You now have a Self-Signed ECC 256Bit SHA256 certificate for your domain, and a .csr file for use at your favourite CA.

Should you wish to have ECC 384 Bit, simply replace “prime256v1” in step three, with secp384r1,
and “-sha256” in step five with -sha384.

Enjoy!

Ubuntu

Creating DH Parameters

December 26, 2014 Lloyd Day

By default DH Parameters are just 1024bits in Ubuntu 12.04.5 LTS which is considered weak by todays standards.
You will need to create a new one of either 2048Bit or 4096Bit depending on your certificates public key size.

1. Create a folder to hold the dhparams…

mkdir /etc/ssl/dh

1	mkdir /etc/ssl/dh

2. Move to that directory

cd /etc/ssl/dh

1	cd /etc/ssl/dh

3. Create the new DH Parameters, at 2048Bit

openssl dhparam -out RSA2048.pem -5 2048

1	openssl dhparam -out RSA2048.pem -5 2048

And 4096Bit (this will take some time)

openssl dhparam -out RSA4096.pem -5 4096

1	openssl dhparam -out RSA4096.pem -5 4096

5. You can also create DSA versions, at 2048Bit…

openssl dhparam -dsaparam -out DSA2048.pem 2048

1	openssl dhparam -dsaparam -out DSA2048.pem 2048

And 4096Bit

openssl dhparam -dsaparam -out DSA4096.pem 4096

1	openssl dhparam -dsaparam -out DSA4096.pem 4096

Now you can add the directives to your servers, Courier-Imap, Dovecot, Nginx and Postfix.

Courier-Imap

TLS_DHPARAMS=/etc/ssl/dh/RSA2048.pem

1	TLS_DHPARAMS=/etc/ssl/dh/RSA2048.pem

Dovecot (creates it’s own)

ssl_dh_parameters_length = 2048

1	ssl_dh_parameters_length = 2048

Nginx

ssl_dhparam /etc/ssl/dh/RSA2048.pem;

1	ssl_dhparam /etc/ssl/dh/RSA2048.pem;

Postfix

smtpd_tls_dh1024_param_file = /etc/ssl/dh/RSA2048.pem

1	smtpd_tls_dh1024_param_file = /etc/ssl/dh/RSA2048.pem

Enjoy!

My Blog

Migrate Plesk to ClamAV

Creating ECC Certificates

Creating DH Parameters

Servers and Security