p3scan for Debian
-----------------

See the author's README for full information.


-----------------------------------------------------------------------
Setting up the iptables rules
-----------------------------------------------------------------------

p3scan depends on redirecting outgoing pop3 connections to port 8110
on the firewall/nat machine. The most common way to do this is to add
a iptables PREROUTING rule for the _incoming_ interface (the one the 
connection is made from, the "safe" side of the firewall). Example:
you have a firewall using nat. eth0 is the internet side and eth1 is
the protected network. The PREROUTING rule should be for eth1 in this
case and look something like:

  #  iptables -t nat -A PREROUTING -p tcp -i eth1 \
              --dport pop3 -j REDIRECT --to 8110


An alternative to using the nat PREROUTING is to use the UID matching
support in iptables. This is a little bit harder to set up but can be
useful if you are not using a standard NAT setup. The Debian package
adds a system user called p3scan when the package is installed. You need
the UID, which running 'id p3scan' will give you. Example:

  # id p3scan
  uid=109(p3scan) gid=109(p3scan) groups=109(p3scan)

Now, add the following iptables rules, substituting <UID> with the
uid from the previous command.

  #  iptables -t nat -A OUTPUT  -p tcp --dport pop3 \
              -m owner --uid-owner <UID> -j ACCEPT
  #  iptables -t nat -A OUTPUT  -p tcp --dport pop3 \
              -j REDIRECT --to 8110


-----------------------------------------------------------------------
Using Clam Antivirus with p3scan
-----------------------------------------------------------------------

Clam antivirus is a nice Open Source virus scanner which is included
with Debian. Run 'apt-cache search clamav' for available Clam packages.

Note: is you are using clamav-daeamon, you have to add the clamav user
to the p3scan group in order to read the p3scan temporary files. The
command to use is:

  # adduser clamav p3scan

Also add the option 'AllowSupplementaryGroups' to the file clamd.conf
file.

This is not a problem if you are using clamscan instead of clamdscan.

Example rules for p3scan (/etc/p3scan/p3scan.conf):

scannertype = basic
scanner = /usr/bin/clamscan --no-summary -i
virusregexp = .*: (.*) FOUND


-----------------------------------------------------------------------
Debugging p3scan
-----------------------------------------------------------------------

p3scan can be debugged using the --debug command line switch. Note
that p3scan will not daemonize and output debugging statements to
stdout/stderr. The right way to use this feature is to stop the daemon
with

  #  /etc/init.d/p3scan stop

and then run it from the shell

  #  p3scan --debug


-----------------------------------------------------------------------
 -- Mats Rynge <mats@rynge.net>
