Установка и настройка почтового сервера Exim на CentOS 6.5 (CentOS 7)

DEVICE="eth0"
HWADDR="08:00:27:79:17:85"
NM_CONTROLLED="yes"
ONBOOT="no"

DEVICE="eth0"
HWADDR="08:00:27:79:17:85"
NM_CONTROLLED="no"
ONBOOT="yes"
GATEWAY=192.168.1.250
IPADDR=192.168.1.2
NETMASK=255.255.255.0
BROADCAST=192.168.1.255

nameserver 192.168.1.2     //Первичный DNS
nameserver 111.222.333.444     //Вторичный DNS

mysql> CREATE DATABASE vexim;
mysql> GRANT ALL ON vexim.* to vexim@localhost identified by 'password';
mysql> quit

# yum -y install httpd php php-imap php-mbstring php-common php-pdo php-mysql php-cli mc

$CONF['configured'] = true;
$CONF['database_type'] = 'mysql';
$CONF['database_host'] = 'localhost';
$CONF['database_user'] = 'vexim';
$CONF['database_password'] = 'password';
$CONF['database_name'] = 'vexim';
$CONF['encrypt'] = 'dovecot:CRAM-MD5';
$CONF['dovecotpw'] = "/usr/bin/doveadm pw";

# 2.0.9: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-358.6.2.el6.i686 i686 CentOS release 6.4 (Final) 
auth_default_realm = point.local
auth_mechanisms = plain login cram-md5
base_dir = /var/run/dovecot/
disable_plaintext_auth = no
dotlock_use_excl = yes
first_valid_gid = 6
first_valid_uid = 26
listen = *
mail_location = maildir:/var/vmail/%d/%u
mail_privileged_group = mail
passdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
}
protocols = imap pop3
service auth {
  unix_listener auth-client {
    group = exim
    mode = 0660
    user = exim
  }
  unix_listener auth-master {
    group = exim
    mode = 0600
    user = exim
  }
  user = root
}
ssl = no
userdb {
  args = /etc/dovecot/dovecot-mysql.conf
  driver = sql
}
verbose_proctitle = yes
protocol imap {
  imap_client_workarounds = delay-newmail   tb-extra-mailbox-sep
}
protocol pop3 {
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
  pop3_uidl_format = %08Xu%08Xv
}
protocol lda {
  auth_socket_path = /var/run/dovecot/auth-master
  postmaster_address = admin@point.local
}

#File: /etc/dovecot/dovecot-mysql.conf
driver = mysql
connect = host=localhost dbname=vexim user=vexim password=password
default_pass_scheme = CRAM-MD5
password_query = SELECT `username` as `user`, `password` FROM  `mailbox` WHERE `username` = '%n@%d' AND `active`='1'
user_query = SELECT 93 AS `uid`, 93 AS `gid` FROM `mailbox` WHERE `username` = '%n@%d' AND `active`='1'

#######################
#MAIN CONFIGURATION SETTINGS#
#######################
primary_hostname = mx.point.local
hide mysql_servers = localhost/vexim/vexim/password
domainlist local_domains = ${lookup mysql{SELECT `domain` \
                            FROM `domain` WHERE \
                            `domain`='${quote_mysql:$domain}' AND \
                            `active`='1'}}
domainlist relay_to_domains = ${lookup mysql{SELECT `domain` \
                            FROM `domain` WHERE \
                            `domain`='${quote_mysql:$domain}' AND \
                            `active`='1'}}
hostlist   relay_from_hosts = localhost:127.0.0.0/8:192.168.1.0/24  #add the hosts from which you allow relaying here
acl_not_smtp = acl_not_smtp
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
av_scanner = clamd:/var/run/clamav/clamd.socket
# spamd_address = 127.0.0.1 783
qualify_domain = point.local
qualify_recipient = point.local
allow_domain_literals = false
exim_user = exim
exim_group = exim
never_users = root
rfc1413_query_timeout = 0s
sender_unqualified_hosts = +relay_from_hosts
recipient_unqualified_hosts = +relay_from_hosts
ignore_bounce_errors_after = 45m
timeout_frozen_after = 15d
helo_accept_junk_hosts = 192.168.1.0/24
auto_thaw = 1h
smtp_banner = "$primary_hostname, ESMTP EXIM $version_number"
smtp_accept_max = 50
smtp_accept_max_per_connection = 25
smtp_connect_backlog = 30
smtp_accept_max_per_host = 20
split_spool_directory = true
remote_max_parallel = 15
return_size_limit = 70k
message_size_limit = 64M
helo_allow_chars = _
smtp_enforce_sync = true
log_selector = \
    +all_parents \
    +connection_reject \
    +incoming_interface \
    +lost_incoming_connection \
    +received_sender \
    +received_recipients \
    +smtp_confirmation \
    +smtp_syntax_error \
    +smtp_protocol_error \
    -queue_run
syslog_timestamp = no
#######################################
# ACL CONFIGURATION 
# Specifies access control lists for incoming SMTP mail
#######################################
begin acl
acl_not_smtp:
        deny message = Sender rate overlimit - $sender_rate / $sender_rate_period
        ratelimit = 50 / 1h / strict
        accept
acl_check_rcpt:
  deny message          = "You blacklisted"
  condition = ${lookup{$sender_host_name}nwildlsearch{black.list}{yes}}
  deny message          = "Lookup failed"
          condition = ${if eq{$host_lookup_failed}{1}}
  deny sender_domains = !+local_domains
          ratelimit = 5/1h/leaky/$authenticated_id
          message = Bite my shiny metal shaper!
  accept  hosts = :
  deny    message       = "incorrect symbol in address"
          domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]
  deny    message       = "incorrect symbol in address"
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
  accept  local_parts   = postmaster
          domains       = +local_domains
  deny    message       = "HELO/EHLO required by SMTP RFC"
          condition     = ${if eq{$sender_helo_name}{}{yes}{no}}
  accept  authenticated = *
  deny    message       = "Your IP in HELO - access denied!"
          hosts         =  * : !+relay_from_hosts
          condition     = ${if eq{$sender_helo_name}\
    {$sender_host_address}{true}{false}}
  deny    condition     = ${if eq{$sender_helo_name}\
    {$interface_address}{yes}{no}}
          hosts         = !127.0.0.1 : !localhost : *
          message       = "My IP in your HELO! Access denied!"
  deny    condition     = ${if match{$sender_helo_name}\
    {\N^\d+$\N}{yes}{no}}
          hosts         = !127.0.0.1 : !localhost : *
          message       = "Incorrect HELO string"
# filter spammers from dynamic ips
  deny    message       = "your hostname is bad (adsl, poll, ppp & etc)."
          condition     = ${if match{$sender_host_name} \
                               {adsl|dialup|pool|peer|dhcp} \
                               {yes}{no}}
  warn
        set acl_m0 = 30s
  warn
        hosts = +relay_from_hosts:4.3.2.1/32:192.168.1.0/24 #disable waits for 'friendly' hosts
        set acl_m0 = 0s
  warn
        logwrite = Delay $acl_m0 for $sender_host_name \
[$sender_host_address] with HELO=$sender_helo_name. Mail \
from $sender_address to $local_part@$domain.
        delay = $acl_m0
                          
  accept  domains       = +local_domains
          endpass
          message       = "No such user"
          verify        = recipient
  accept  domains       = +relay_to_domains
          endpass
          message       = "i don't know how to relay to this address"
          verify        = recipient
  deny    message       = "you in blacklist - $dnslist_domain \n $dnslist_text"
          dnslists      = opm.blitzed.org : \
                          cbl.abuseat.org : \
                          bl.csma.biz 
  accept  hosts         = +relay_from_hosts
  deny    message       = "Homo hominus lupus est"
acl_check_data:
  # check for viruses
  deny malware = *
  message = "Your message contains viruses: $malware_name"
  # if needed - add spam filtering here
  # permit everything else
  accept
#########################
# ROUTERS CONFIGURATION                
# Specifies how addresses are handled 
#############################################
#     THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT!   
# An address is passed to each router in turn until it is accepted.              
#############################################
begin routers
dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more
system_aliases:
    driver      = redirect
    allow_fail
    allow_defer
    data = ${lookup mysql{SELECT `goto` FROM `alias` WHERE \
            `address`='${quote_mysql:$local_part@$domain}' OR \
                `address`='${quote_mysql:@$domain}'}}
dovecot_user:
  driver = accept
  condition = ${lookup mysql{SELECT `goto` FROM \
  `alias` WHERE \
  `address`='${quote_mysql:$local_part@$domain}' OR \
  `address`='${quote_mysql:@$domain}'}{yes}{no}}
  transport = dovecot_delivery
##############################
#                      TRANSPORTS CONFIGURATION  
##############################
#                       ORDER DOES NOT MATTER       
#     Only one appropriate transport is called for each delivery.
#######################################
begin transports
remote_smtp:
  driver = smtp
#  interface = 4.3.2.1 #your public ip address, if it's the main server ip - you could skip this parameter. if it's an alias- it must be specified in clear
dovecot_delivery:
  driver = pipe
  command = /usr/libexec/dovecot/deliver -d $local_part@$domain
  message_prefix =
  message_suffix =
  delivery_date_add
  envelope_to_add
  return_path_add
  log_output
  user = exim
address_pipe:
  driver = pipe
  return_output
address_reply:
  driver = autoreply
###########################
#                      RETRY CONFIGURATION       
###########################
begin retry
*                    *       F,2h,15m; G,16h,1h,1.5; F,4d,6h
############################
#                      REWRITE CONFIGURATION    
############################
begin rewrite
################################
#                   AUTHENTICATION CONFIGURATION       
################################
begin authenticators
auth_plain:
     driver = dovecot
     public_name = PLAIN
     server_socket = /var/run/dovecot/auth-client
     server_set_id = $auth1
auth_login:
     driver = dovecot
     public_name = LOGIN
     server_socket = /var/run/dovecot/auth-client
     server_set_id = $auth1
auth_cram_md5:
     driver = dovecot
     public_name = CRAM-MD5
     server_socket = /var/run/dovecot/auth-client
     server_set_id = $auth1

^.*\d+[-\.]\d+[-\.]\d+.*
^.*[-\.]dynamic[-\.].*
^.*[-\.]static[-\.].*
^.*[-\.]dyn[-\.].*
^.*[-\.]adsl[-\.].*
^.*[-\.]cable[-\.].*
^.*[-\.]pool[-\.].*
^.*[-\.]broadband[-\.].*
^.*[-\.]user[-\.].*
^.*[-\.]in-addr[-\.].*
^.*[-\.]customer[-\.].*
^.*[-\.]fibertel[-\.].*
^.*[-\.]cdma[-\.].*
^.*[-\.]client[-\.].*
^.*[-\.]catv[-\.].*
^.*[-\.]xdsl[-\.].*
^.*[-\.]comcast[-\.].*
^.*[-\.]dhcp[-\.].*
^.*[-\.]ppp[-\.].*
^.*[-\.]dial[-\.].*
^.*[-\.]fbx[-\.].*
^.*[-\.]kabel[-\.].*
^.*[-\.]peer[-\.].*

SELINUX=disabled

nameserver 192.168.1.2
nameserver 111.222.333.444

NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=mx.point.local

192.168.1.2 mx.point.local mx

search point.local
nameserver 192.168.1.2
nameserver 127.0.0.1
nameserver 111.222.333.444

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
        listen-on port 53 { 127.0.0.1; 192.168.1.2; }; # ставим внешний IP интерфейса
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query { any; }; # меняем, даем обращатся всем
        allow-query-cache { localhost; 10.0.0.0/24; }; # меняем, добавляем локальную сеть если она есть
        allow-recursion { localhost; 10.0.0.0/24;}; # меняем, добавляем локальную сеть если она есть
        forwarders { 111.222.333.444; 444.555.666.777; }; # добавляем, ip dns провайдера
        dnssec-enable no;
        dnssec-validation no;
        dnssec-lookaside auto;
        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
        type hint;
        file "named.ca";
};
# Зона прямого просмотра "point.local"
zone "point.local" {
type master;
file "point.local.fwd";
allow-update {none;};
allow-transfer {192.168.1.10; }; //вторичный DNS
};
# Наша обратная зона просмотра "point.local"
zone "1.168.192.in-addr.arpa" {
type master;
file "point.local.rev";
allow-update {none;};
allow-transfer {192.168.1.10; };
};
include "/etc/named.rfc1912.zones";

$ORIGIN point.local.
$TTL 3D
@                         SOA                     mx.point.local.     root.point.local. (12 4h 1h 1w 1h)
@                         IN      NS              mx.point.local.
@                         IN      MX      10      mail.point.local.
mx.point.local.     IN       A                192.168.1.2
www                 IN       A                192.168.1.2
mail                IN       A                192.168.1.2

$ORIGIN 1.168.192.in-addr.arpa.
$TTL 3D
@    SOA         mx.point.local.    root.point.local. (12 4h 1h 1w 1h)
@    IN          NS      mx.point.local.
2    IN          PTR     mx.point.local.

; <<>> DiG 9.7.4-RedHat-9.7.4-1.el5 <<>> point.local
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53153
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;point.local.                   IN      A
;; ANSWER SECTION:
point.local.            3600    IN      A       192.168.1.2
;; AUTHORITY SECTION:
point.local.            3600    IN      NS      mx.point.local.
;; ADDITIONAL SECTION:
mx.point.local.         3600    IN      A       192.168.1.2
;; Query time: 8 msec
;; SERVER: 192.168.1.2#53(192.168.1.2)
;; WHEN: Wed Aug 17 05:03:48 2011
;; MSG SIZE  rcvd: 78

mx.point.local

$CONF['setup_password'] = 'changeme';

$CONF['setup_password'] = '6c5af4c72af213f0acac5f21d8f95ca1:e59172283d2bb72a5992af8ddc15332cde62f003';

$CONF['emailcheck_resolve_domain']='NO';

Aliases - Ставим 0
Mailboxes - Ставим 0

Domain has been added!
(point.local)

SMTP/POP3 server:                        point.local
Учетная запись (Account name):   linux@point.local
Пароль (password):                      123

Alias /webmail /var/www/html/roundcube
<Directory /var/www/html/roundcube>
AddType application/x-httpd-php .php .php3 .php4 .phtml
# forcing open_base dir do not affect anything
php_admin_value open_basedir /
# AddDefaultCharset UTF-8
AddType text/x-component .htc
<IfModule mod_php4.c>
php_flag display_errors Off
php_flag log_errors On
php_value error_log logs/errors
php_value upload_max_filesize 5M
php_value post_max_size 6M
php_value memory_limit 64M
</IfModule>
<IfModule mod_php5.c>
php_flag display_errors Off
php_flag log_errors On
php_value error_log logs/errors
php_value upload_max_filesize 5M
php_value post_max_size 6M
php_value memory_limit 64M
</IfModule>
<FilesMatch "(\.inc|\~)$">
Order allow,deny
Deny from all
</FilesMatch>
Order deny,allow
Allow from all
</Directory>

mysql> GRANT ALL ON roundcubemail.* TO roundcube@localhost IDENTIFIED BY 'password';

mysql> quit

date.timezone = Asia/Almaty

date.timezone = Europe/Moscow

/var/www/html/roundcube/config/

# vi /var/www/html/roundcube/config/main.inc.php

$rcmail_config['default_host'] = '192.168.1.2';

# vi /var/www/html/roundcube/config/db.inc.php

$rcmail_config['db_dsnw'] = 'mysql://roundcube:password@localhost/roundcubemail';

# rm -R -f /var/www/html/roundcube/installer

http://point.local/webmail

http://point.local/roundcube

# vi /etc/sysconfig/firewall.sh

# chmod +x /etc/sysconfig/firewall.sh

/etc/sysconfig/firewall.sh

[roundcube-banhammer]
enabled = true
filter = roundcube.banhammer
action = iptables-multiport[name=roundcube, port="http,https", protocol=tcp]
logpath = /var/log/maillog
findtime = 3600
maxretry = 5
bantime = 3600
[dovecot-banhammer]
enabled = true
filter = dovecot.banhammer
action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp]
logpath = /var/log/maillog
maxretry = 5
findtime = 300
bantime = 3600
ignoreip = 127.0.0.1 192.168.1.2
[exim-banhammer]
enabled = true
filter = exim.banhammer
action = iptables-multiport[name=Exim, port="smtp,smtps", protocol=tcp]
#sendmail[name=exim-spam, dest=admin@company.ru, sender=fail2ban@localhost]
logpath = /var/log/exim/main.log
maxretry = 2
bantime = 18000
ignoreip = 127.0.0.1 192.168.1.2

[Definition]
failregex = roundcube: (.*) Error: Login failed for (.*) from <HOST>\.
ignoreregex =

[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
ignoreregex =

[Definition]
failregex = [\] .*(?:rejected by local_scan|Unrouteable address|Dnsbl blocked|Sender verify failed|relay not permitted|Unknown user)

failed to expand "${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}" while checking a list: lookup of "SELECT `domain` FROM `domain` WHERE `domain`='satti-telecom.net' AND `active`='1'" gave DEFER: MYSQL connection failed: Access denied for user 'vexim'@'localhost' (using password: YES)

[root@ns exim]# cat /var/log/exim/main.log | tail -10
2012-08-23 11:57:02 1T4Kq9-0006s1-E7 == root@domen.net routing defer (-51): retry time not reached
2012-08-23 11:57:07 exim 4.76 daemon started: pid=15231, -q1h, listening for SMTP on port 25 (IPv6 and IPv4)
2012-08-23 11:57:07 1T4NeL-0000NR-Bw == root@domen.net routing defer (-51): retry time not reached
2012-08-23 11:57:07 1T4FDl-0000nn-7p == root@domen.net routing defer (-51): retry time not reached
2012-08-23 11:57:07 1T4Kq9-0006s1-E7 == root@domen.net routing defer (-51): retry time not reached
2012-08-23 11:57:07 1T4IVK-0004Ra-Hg == root@domen.net routing defer (-51): retry time not reached
2012-08-23 11:57:07 1T4I1x-0003lV-UI == root@domen.net routing defer (-51): retry time not reached
2012-08-23 11:57:17 failed to expand "${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}" while checking a list: lookup of "SELECT `domain` FROM `domain` WHERE `domain`='domen.net' AND `active`='1'" gave DEFER: MYSQL connection failed: Access denied for user 'vexim'@'localhost' (using password: YES)
2012-08-23 11:57:17 H=(ArmanNB) [192.168.2.3] I=[37..хх.хх.хх]:25 F=<info@domen.net> temporarily rejected RCPT <info@domen.net>: MYSQL connection failed: Access denied for user 'vexim'@'localhost' (using password: YES)
2012-08-23 11:57:17 unexpected disconnection while reading SMTP command from (ArmanNB) [192.168.2.3] I=[37.хх.хх.хх]:25

220 mail.domen.net, ESMTP EXIM 4.76
EHLO n44.omega.d6.hsdnsrv.net
250-mail.domen.net Hello n44.omega.d6.hsdnsrv.net [91.226.136.137]
250-SIZE 67108864
250-PIPELINING
250-AUTH LOGIN PLAIN CRAM-MD5
250 HELP
MAIL FROM: <mailvalid@hsdn.org>
250 OK
RCPT TO: <info@domen.net>
451 Temporary local problem - please try later
RSET
250 Reset OK
QUIT
221 mail.domen.net closing connection

hide mysql_servers = localhost/vexim/vexim/password

mysql> GRANT ALL ON vexim.* to vexim@localhost identified by 'password';

[root@ns exim]# cat /var/log/exim/panic.log | tail -10
2012-08-23 13:43:49 failed to expand "${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}" while checking a list: lookup of "SELECT `domain` FROM `domain` WHERE `domain`='satti-telecom.net' AND `active`='1'" gave DEFER: MYSQL: query failed: Table 'vexim.domain' doesn't exist
2012-08-23 13:55:40 failed to expand "${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}" while checking a list: lookup of "SELECT `domain` FROM `domain` WHERE `domain`='satti-telecom.net' AND `active`='1'" gave DEFER: MYSQL: query failed: Table 'vexim.domain' doesn't exist
2012-08-23 13:55:57 failed to expand "${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}" while checking a list: lookup of "SELECT `domain` FROM `domain` WHERE `domain`='satti-telecom.net' AND `active`='1'" gave DEFER: MYSQL: query failed: Table 'vexim.domain' doesn't exist
2012-08-23 13:56:53 failed to expand "${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}" while checking a list: lookup of "SELECT `domain` FROM `domain` WHERE `domain`='satti-telecom.net' AND `active`='1'" gave DEFER: MYSQL: query failed: Table 'vexim.domain' doesn't exist
2012-08-23 13:57:59 failed to expand "${lookup mysql{SELECT `domain` FROM `domain` WHERE `domain`='${quote_mysql:$domain}' AND `active`='1'}}" while checking a list: lookup of "SELECT `domain` FROM `domain` WHERE `domain`='satti-telecom.net' AND `active`='1'" gave DEFER: MYSQL: query failed: Table 'vexim.domain' doesn't exist

2012-08-23 15:53:17 1T4U6H-0008Ga-Q2 malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (No such file or directory)

[root@ns pfadmin]# yum -y install clamav
Загружены модули: langpacks, presto, refresh-packagekit
Пакет clamav-0.97.5-1600.fc16.x86_64 уже установлен, и это последняя версия.
Выполнять нечего

[root@ns etc]# freshclam -v
ERROR: Please edit the example config file /etc/freshclam.conf
ERROR: Can't open/parse the config file /etc/freshclam.conf
[root@ns etc]# ls -l /etc/freshclam.conf
-rw-rw-rw- 1 root root 7768 авг.  22 18:04 /etc/freshclam.conf
[root@ns etc]#

# find / -name "clamd.socket"

# freshclam -v
ERROR: Please edit the example config file /etc/freshclam.conf
ERROR: Can't open/parse the config file /etc/freshclam.conf

# Comment or remove the line below.
# Example

find: `clamd.socket': Нет такого файла или каталога
[root@ns ~]#

# find / -name "clam*"

[root@ns clamav-server-0.97.5]# find / -name "clam*"
find: Обнаружено зацикливание в файловой системе; `/var/named/chroot/var/named' является частью той же петли файловой системы что и `/var/named'.
/var/spool/mail/clamav
/var/lib/clamav
/usr/share/selinux/devel/include/services/clamav.if
/usr/share/doc/clamav-0.97.5
/usr/share/doc/clamav-0.97.5/clamav-mirror-howto.pdf
/usr/share/doc/clamav-0.97.5/clamdoc.pdf
/usr/share/doc/clamav-server-0.97.5
/usr/share/doc/clamav-server-0.97.5/clamd.conf
/usr/share/doc/clamav-server-0.97.5/clamd.init
/usr/share/doc/clamav-server-0.97.5/clamd.logrotate
/usr/share/doc/clamav-server-0.97.5/clamd.sysconfig
/usr/share/man/man5/clamd.conf.5.gz
/usr/share/man/man5/clamav-milter.conf.5.gz
/usr/share/man/man1/clamdscan.1.gz
/usr/share/man/man1/clamconf.1.gz
/usr/share/man/man1/clamscan.1.gz
/usr/share/man/man1/clambc.1.gz
/usr/share/man/man1/clamdtop.1.gz
/usr/share/man/man8/clamd.8.gz
/usr/share/clamav
/usr/share/clamav/clamd-wrapper
/usr/sbin/clamd
/usr/sbin/clamav-notify-servers
/usr/bin/clamconf
/usr/bin/clamdscan
/usr/bin/clambc
/usr/bin/clamdtop
/usr/bin/clamscan
/etc/logrotate.d/clamav-update
/etc/selinux/targeted/modules/active/modules/clamav.pp
/etc/cron.d/clamav-update
/etc/clamd.d
/etc/clamd.d/clamav.conf
/home/clamav

# touch /var/lib/clamav/clamd.sock

# chown clamav:clamav /var/lib/clamav/clamd.sock

[root@ns clamav]# cat /var/log/exim/panic.log | tail -3
2012-08-23 16:59:14 1T4V86-0001pS-6f malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Permission denied)
2012-08-23 17:00:52 1T4V9f-0001sA-Vl malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Permission denied)
2012-08-23 17:04:50 1T4VDW-00020Q-8k malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Permission denied)
[root@ns clamav]# cat /var/log/exim/main.log | tail -3
2012-08-23 17:04:20 Delay 30s for warman.satti-telecom.net [192.168.2.3] with HELO=ArmanNB. Mail from info@satti-telecom.net to info@satti-telecom.net.
2012-08-23 17:04:50 1T4VDW-00020Q-8k malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Permission denied)
2012-08-23 17:04:50 1T4VDW-00020Q-8k H=warman.satti-telecom.net (ArmanNB) [192.168.2.3] I=[37.208.42.4]:25 F=<info@satti-telecom.net> temporarily rejected after DATA
[root@ns clamav]# ls -l
итого 0
-rw-r--r-- 1 clamav clamav 0 авг.  23 17:03 clamd.socket

[root@ns clamav]# cat /var/log/exim/panic.log | tail -3
2012-08-23 17:00:52 1T4V9f-0001sA-Vl malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Permission denied)
2012-08-23 17:04:50 1T4VDW-00020Q-8k malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Permission denied)
2012-08-23 17:07:10 1T4VFm-00024q-5W malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Connection refused)
[root@ns clamav]# cat /var/log/exim/main.log | tail -3
2012-08-23 17:06:40 Delay 30s for warman.satti-telecom.net [192.168.2.3] with HELO=ArmanNB. Mail from info@satti-telecom.net to info@satti-telecom.net.
2012-08-23 17:07:10 1T4VFm-00024q-5W malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Connection refused)
2012-08-23 17:07:10 1T4VFm-00024q-5W H=warman.satti-telecom.net (ArmanNB) [192.168.2.3] I=[37.208.42.4]:25 F=<info@satti-telecom.net> temporarily rejected after DATA
[root@ns clamav]# ls -l
итого 0
-rw-r--r-- 1 exim exim 0 авг.  23 17:03 clamd.socket

# usermod -a -G exim clamav
# chmod -Rf g+w /var/spool/exim
# chmod -Rf g+s /var/spool/exim
# mkdir /var/vmail
# chown exim:exim -R /var/vmail
# chown exim:exim -R /var/spool/exim
# chown clamav:clamav -R /var/run/clamav/

1T4Vcv-0002zq-07 malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Permission denied)

chown exim:exim -R /var/run/clamav/

17:36:40 1T4ViK-00039J-2V malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamav/clamd.socket (Connection refused)

[root@ns etc]# service exim reload
Reloading exim configuration (via systemctl):              [  OK  ]
[root@ns etc]# service exim restart
Restarting exim (via systemctl):                           [  OK  ]
[root@ns etc]# service clamd restart

[root@ns var]# rpm -qa | grep -i clamav
clamav-filesystem-0.97.5-1600.fc16.noarch
clamav-data-empty-0.97.5-1600.fc16.noarch
clamav-0.97.5-1600.fc16.x86_64
clamav-server-0.97.5-1600.fc16.x86_64
clamav-lib-0.97.5-1600.fc16.x86_64
clamav-update-0.97.5-1600.fc16.x86_64