p3scan

p3scan [options]

p3scan is a fully transparent proxy scanning server for POP3 clients. It runs on a Linux box with iptables (for port redirection). It implements a centralized POP3 email scanning point, transparently inspecting messages fetched by internal network hosts from servers "in the wild" (the Internet) for viruses, worms, trojans, spam and potentially dangerous attachments. Since HTML email can be used by spammers to validate the recipient address (via Web Bugs) p3scan can also provide HTML stripping.

p3scan can help you in protecting your "Other OS" LAN especially if used synergically with a firewall and other proxy servers.

-a, --renattach=FILE Specify location of renattach if wanted

-b, --bytesfree=NUM Number (in KBytes) that should be available before we can process messages. If not enough, report it and die.

-B, --broken Enable broken processing (some Outlook/Outlook Express clients).

-c, --viruscode=N[,N] The code(s) the scanner returns when a virus is found

-d, --debug Turn on debugging. See /etc/p3scan/p3scan.conf for recommended debug procedure.

-f, --configfile=FILE Specify a configfile Default is /etc/p3scan/p3scan.conf

-g, --virusregexp=RX Specify a RegularExpression which describes where to get the name of the virus. The first substring is used, or if regexp ends with /X the X substring

-G --goodcode The codes that enable the message to be delivered without a warning. For example Kaspersky AV reports code 10 for an encrypted .zip file

-h, --help Prints this text

-i, --ip=IP Listen only on IP <IP>. Default: ANY

-I, --targetip=IP Connect only to IP <IP>. Default: use transparent-proxy

-j, --justdelete Just delete infected mail after reporting infection

-k, --checkspam Turn on Spam Checking

-l, --pidfile=FILE Specify where to write a pid-file

-m, --maxchilds=NUM Allow not more then NUM childs

-M, --ispspam Specify a line used by your ISP to mark Spam For example, cox.net uses -- Spam --

-n, --notifydir=DIR Create notification mails in <DIR> Default: /var/spool/p3scan/notify Also used for temporary storage.

-N, --notify Change infected file status line

-o, --overwrite Specify path to HTML parsing program executable. Default none

-p, --port=PORT Listen on port <PORT>. Default: 8110

-P, --targetport=PORT Connect to port <PORT>. Default: 8110 Ignored in transparent proxy mode

-q, --quiet Turn off normal reporting

-r, --virusdir=DIR Save infected mails in <DIR> Default: /var/spool/p3scan

-s, --scanner=FILE Specify the scanner. Every scannertype handles this in a specific way. This could be the scanner- executable or a FIFO, Socket, ...

-S, --subject Change virus reporting subject line

-t, --template=FILE Use virus-notification-template <FILE>

-T, --scannertype=T Define which buildin scanner-frontend to use. Supported types: basic: Basic file invocation scanner avpd: Kaspersky AVPDaemon trophie: Trophie antivirus daemon (for Trend Antivirus)

-u, --user=[UID|NAME] Run as user <UID>. Default: mail Only takes effect when started as superuser

-v, --version Prints version information

-x, --demime eXtract all MIME-Parts before scanning

-z, --spamcheck Specify path to Spam Checking program executable Default /usr/bin/spamc (Mail::SpamAssassin)

/etc/p3scan
/var/run/p3scan
/var/spool/p3scan
/var/spool/p3scan/children
/var/spool/p3scan/notify
/usr/doc
/usr/doc/p3scan-<version>/AUTHORS
/usr/doc/p3scan-<version>/ChangeLog
/usr/doc/p3scan-<version>/CONTRIBUTERS
/usr/doc/p3scan-<version>/LICENSE
/usr/doc/p3scan-<version>/NEWS
/usr/doc/p3scan-<version>/README
/usr/doc/p3scan-<version>/README-rpm
/usr/doc/p3scan-<version>/spamfaq.html
/usr/doc/p3scan-<version>/spamfaq.txt
/usr/doc/pscan-<version>/TODO.list
/usr/man/man8/p3scan.8.gz
/usr/man/man8/p3scan_readme.8.gz

/etc/p3scan/p3scan.conf Configuration file /etc/p3scan/p3scan.mail Symlink to the email message templates sent to client in event a virus is found. You can create a symlink, or copy a language file p3scan-??.mail for any language provided. If you translate a mail file into your own language, please consider contributing it to the project so that others may enjoy your work. /etc/p3scan/p3scan-??.mail Email templates for specific languages. /usr/sbin/p3scan Executable program file /var/run/p3scan.pid This file is written when p3scan is running. /var/spool/p3scan/children/$FILES Each email scanned is manipulated in this directory /var/spool/p3scan/notify/$FILES When a virus is found, the email sent to the client is generated here.

p3scan_readme /etc/p3scan/p3scan.conf /etc/p3scan/p3scan.mail dspam spamd spamc renattach dspam

Please report any bugs to the p3scan support mailing list accessable through:
http://sourceforge.net/projects/p3scan

Jack S. Lai <laitcg at cox dot net>
and contributers (see CONTRIBUTERS file).