|
rrizwanahmed@gmail.com
All
configuration are working fine in live/ LAB environments
POP
and SMTP traffic Scan Firewall Setup
This guide, will help us to configure a firewall for Scanning of our
Network's POP and SMTP traffic, without knowing any user and e-mail
server.
With the help of this firewall we will able to stop Virus and Spam
attack on our and from our network/ email-server.
This guide is very very useful for those system administrator, who did
not want to install Virus and Spam scanning on their e-mail servers, and
also useful for those system administrator who are security conscious.
That's it.
So lets start our work.
Your
POP/ SMTP Firewall seems to be install over your network like this.
OR as you like. ( I use this scenario)
Operation
system, software's and packages detail:-
» Operation system: Fedora Core-2
» Clam antivirus (for virus scanning)
» Spam-assassin (for Spam filtering)
Now lets start our installation,
We will use Fedora Core-2 installation as we
already describe in our Fedora
core2 installation guide.
We will use ClamAV Installation as we
already describe in our Clam
AntiVirus installation guide.
We will use SpamAssassin Installation as we
already describe in our SpamAssassin
installation guide.
Now its time to configure our most important tool P3Scan of our email
firewall guide.
P3Scan
If you face any problem in installation of P3Scan in Fedora Core 2
regarding pcre.h file or pcre not found.
You
can download PCRE package from
ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-6.7.tar.gz
Or
from
http://exim-ftp.itsoft.at/pcre/
(I
use pcre-6.7.tar.gz for my Fedora Core 2 installation and its working
fine)
P3Scan
installation
With
the help of:
http://www.undergroundsecurity.com/p3scan/p3scanhowto.txt
installation
procedure.
This is a small, step-by-step how-to for building your own POP3 proxy box.
Here my step to build p3scan for Fedora Core 2:
Compile and install p3scan
First of all, you have to download p3scan-pf
http://www.undergroundsecurity.com/p3scan/download/p3scan-pf-1.1.tar.gz
Just unpack it and then compile simply with "make". You will end up with an executable,
copy p3scan executable in /usr/sbin, , now make p3scan directory in /etc/p3scan and copy p3scan.conf in it.
Anyway, at the end you must have 3 files:
/usr/sbin/p3scan
/etc/p3scan/p3scan.conf
/etc/p3scan/p3scan.mail (this is the template for the mail sent in case of virus)
set-up p3scan.conf file:
Here my config file:
---------------------------------------------------------
ip = 127.0.0.1
port = 8110
user = qscand
notifydir = /var/spool/p3scan/notify
virusdir = /var/spool/p3scan
bytesfree = 100000
scannertype = basic
scanner = /usr/bin/clamdscan --no-summary
demime
virusregexp = .*: (.*) FOUND
template = /etc/p3scan/p3scan.mail
---------------------------------------------------------
Now you can start p3scan in this way:
/usr/sbin/p3scan -f /etc/p3scan/p3scan.conf
OR
service p3scan start (to start p3scan service)
service p3scan stop (to stop p3scan service)
REMEMBER, start P3SCAN after starting ClamAV, SpamAssassin.
NOTE: I had to start p3scan as qscand, because if not, I always received an errors and nothing worked.
Because my Clam Anti Virus is running by this user.
-------------Configuration
Complete-------------
|
