diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..2e6588b --- /dev/null +++ b/.gitattributes @@ -0,0 +1 @@ +*.cvd filter=lfs diff=lfs merge=lfs -text diff --git a/.travis.yml b/.travis.yml index 8d276fe..39faf05 100644 --- a/.travis.yml +++ b/.travis.yml @@ -5,3 +5,4 @@ env: script: - nix-build tests/intern.nix - nix-build tests/extern.nix + - nix-build tests/clamav.nix diff --git a/mail-server/rmilter.nix b/mail-server/rmilter.nix index aed5009..9401ece 100644 --- a/mail-server/rmilter.nix +++ b/mail-server/rmilter.nix @@ -23,7 +23,7 @@ let then '' clamav { - servers = /var/run/clamav/clamd.ctl; + servers = /run/clamav/clamd.ctl; }; '' else ""; diff --git a/mail-server/systemd.nix b/mail-server/systemd.nix index 9066eab..9567a98 100644 --- a/mail-server/systemd.nix +++ b/mail-server/systemd.nix @@ -102,8 +102,8 @@ in }; systemd.services.rmilter = { - requires = [ "rmilter.socket" ]; - after = [ "rmilter.socket" ]; + requires = [ "rmilter.socket" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service"); + after = [ "rmilter.socket" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service"); }; }; } diff --git a/tests/clamav.nix b/tests/clamav.nix new file mode 100644 index 0000000..166a5f8 --- /dev/null +++ b/tests/clamav.nix @@ -0,0 +1,228 @@ +# nixos-mailserver: a simple mail server +# Copyright (C) 2016-2018 Robin Raymond +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see + +import { + + nodes = { + server = { config, pkgs, lib, ... }: + let + clamav-db = pkgs.srcOnly { + name = "ClamAV-db"; + src = pkgs.fetchurl { + url = "https://files.griff.name/ClamAV-db.tar"; + sha256 = "eecad99f4c071d216bd91565f84c0d90a1f93e5e3e22d8f3087686ba3bd219e7"; + }; + }; + in + { + imports = [ + ../default.nix + ]; + + virtualisation.memorySize = 1500; + + services.rsyslogd = { + enable = true; + defaultConfig = '' + *.* /dev/console + ''; + }; + + services.clamav.updater.enable = lib.mkForce false; + systemd.services.old-clam = { + before = [ "clamav-daemon.service" ]; + requiredBy = [ "clamav-daemon.service" ]; + description = "ClamAV virus database"; + + preStart = '' + mkdir -m 0755 -p /var/lib/clamav + chown clamav:clamav /var/lib/clamav + ''; + + script = '' + cp ${clamav-db}/bytecode.cvd /var/lib/clamav/ + cp ${clamav-db}/main.cvd /var/lib/clamav/ + cp ${clamav-db}/daily.cvd /var/lib/clamav/ + chown clamav:clamav /var/lib/clamav/* + ''; + + serviceConfig = { + Type = "oneshot"; + PrivateTmp = "yes"; + PrivateDevices = "yes"; + }; + }; + + mailserver = { + enable = true; + debug = true; + fqdn = "mail.example.com"; + domains = [ "example.com" "example2.com" ]; + dhParamBitLength = 512; + virusScanning = true; + + loginAccounts = { + "user1@example.com" = { + hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/"; + aliases = [ "postmaster@example.com" ]; + catchAll = [ "example.com" ]; + }; + "user@example2.com" = { + hashedPassword = "$6$u61JrAtuI0a$nGEEfTP5.eefxoScUGVG/Tl0alqla2aGax4oTd85v3j3xSmhv/02gNfSemv/aaMinlv9j/ZABosVKBrRvN5Qv0"; + }; + }; + enableImap = true; + }; + + environment.etc = { + "root/eicar.com.txt".text = "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"; + }; + }; + client = { nodes, config, pkgs, ... }: let + serverIP = nodes.server.config.networking.primaryIPAddress; + clientIP = nodes.client.config.networking.primaryIPAddress; + grep-ip = pkgs.writeScriptBin "grep-ip" '' + #!${pkgs.stdenv.shell} + echo grep '${clientIP}' "$@" >&2 + exec grep '${clientIP}' "$@" + ''; + in { + environment.systemPackages = with pkgs; [ + fetchmail msmtp procmail findutils grep-ip + ]; + environment.etc = { + "root/.fetchmailrc" = { + text = '' + poll ${serverIP} with proto IMAP + user 'user1@example.com' there with password 'user1' is 'root' here + mda procmail + ''; + mode = "0700"; + }; + "root/.procmailrc" = { + text = "DEFAULT=$HOME/mail"; + }; + "root/.msmtprc" = { + text = '' + account test2 + host ${serverIP} + port 587 + from user@example2.com + user user@example2.com + password user2 + ''; + }; + "root/virus-email".text = '' + From: User2 + Content-Type: multipart/mixed; + boundary="Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607" + Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) + Subject: Testy McTest + Message-Id: <94550DD9-1FF1-4ED1-9F09-8812FF2E59AA@example.com> + Date: Sat, 12 May 2018 14:15:44 +0200 + To: User1 + X-Mailer: Apple Mail (2.3445.6.18) + + + --Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607 + Content-Transfer-Encoding: 7bit + Content-Type: text/plain; + charset=us-ascii + + Hello + + I have attached a dangerous virus. + + Mfg. + User2 + + + --Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607 + Content-Disposition: attachment; + filename=eicar.com.txt + Content-Type: text/plain; + x-unix-mode=0644; + name="eicar.com.txt" + Content-Transfer-Encoding: 7bit + + X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* + --Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607-- + ''; + "root/email2".text = '' + From: User + To: User1 + Cc: + Bcc: + Subject: This is a test Email from user@example2.com to user1 + Reply-To: + + Hello User1, + + how are you doing today? + + XOXO User1 + ''; + }; + }; + }; + + testScript = + '' + startAll; + + $server->waitForUnit("multi-user.target"); + $client->waitForUnit("multi-user.target"); + + $client->execute("cp -p /etc/root/.* ~/"); + $client->succeed("mkdir -p ~/mail"); + $client->succeed("ls -la ~/ >&2"); + $client->succeed("cat ~/.fetchmailrc >&2"); + $client->succeed("cat ~/.procmailrc >&2"); + $client->succeed("cat ~/.msmtprc >&2"); + + # fetchmail returns EXIT_CODE 1 when no new mail + $client->succeed("fetchmail -v || [ \$? -eq 1 ] >&2"); + + # Verify that mail can be sent and received before testing virus scanner + $client->execute("rm ~/mail/*"); + $client->succeed("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email2 >&2"); + # give the mail server some time to process the mail + $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]'); + $client->execute("rm ~/mail/*"); + # fetchmail returns EXIT_CODE 0 when it retrieves mail + $client->succeed("fetchmail -v >&2"); + $client->execute("rm ~/mail/*"); + + + subtest "virus scan file", sub { + $server->fail("clamscan --follow-file-symlinks=2 -r /etc/root/ >&2"); + }; + + subtest "virus scanner", sub { + $client->fail("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/virus-email >&2"); + # give the mail server some time to process the mail + $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]'); + }; + + subtest "no warnings or errors", sub { + $server->fail("journalctl -u postfix | grep -i error >&2"); + $server->fail("journalctl -u postfix | grep -i warning >&2"); + $server->fail("journalctl -u dovecot2 | grep -i error >&2"); + $server->fail("journalctl -u dovecot2 | grep -i warning >&2"); + }; + + ''; +}