P3scan-pf - how does it work ?

KiaN

I just installed the p3scan-pf package. I have dspam (installed with pkg_add dspam) and ClamAV up and working, or I think so.

Now I cant figure out how to make p3scan-pf do anything … id doesnt scan any incoming or outgoing mail :(

KiaN

Please ? :'(

sullrich

I would consider the package broken at this point.

MathieuMa

The package even seems broken for removal.
Do someone have steps to manualy remove it (or general package removal instructions)

Thanks, Mathieu

DanielSHaischt

@KiaN:

I just installed the p3scan-pf package. I have dspam (installed with pkg_add dspam) and ClamAV up and working, or I think so.

Is it working or is it not working? The expression 'so so' does not exist in computer science, except you are trying to use some kind of fuzzy logic.

@KiaN:

I just installed the p3scan-pf package. I have dspam (installed with pkg_add dspam) and ClamAV up and working, or I think so.

Regarding the p3scan daemon you should check …

that the service is running (Status->Services)
that pfSense catches any outgoing POP3 traffic and redirects it to 127.0.0.8100 (i.e. the rules are required to work)
You need to manually create a Firewall rule that allows access to 127.0.0.1:8100 from LAN clients
the following settings need to be part of /usr/local/etc/p3scan/p3scan.conf


## SPAM Settings.
checkspam
spamcheck = /usr/local/bin/dspam --user dspamuser --mode=teft --stdout --deliver=innocent,spam --feature=ch,no,wh

And finally if you did install DSPAM from a package (which version?), DSPAM should start to populate the directory /var/db/dspam/data if it starts filtering mail messages.

Regards
Daniel S. Haischt

DanielSHaischt

@MathieuMa:

The package even seems broken for removal.
Do someone have steps to manualy remove it (or general package removal instructions)

Package removal is generally broken, at least on HEAD it is…

KiaN

@DanielSHaischt:

Is it working or is it not working? The expression 'so so' does not exist in computer science, except you are trying to use some kind of fuzzy logic.

Running but not working.

that the service is running (Status->Services)

It is running.

that pfSense catches any outgoing POP3 traffic and redirects it to 127.0.0.8100 (i.e. the rules are required to work)

It is not catching anything.

You need to manually create a Firewall rule that allows access to 127.0.0.1:8100 from LAN clients

I dont understand something : from your email client, you have to change settings for the POP3 serveur or can I keep my original mail.fqdn.tdl ?

the following settings need to be part of /usr/local/etc/p3scan/p3scan.conf
## SPAM Settings.
checkspam
spamcheck = /usr/local/bin/dspam --user dspamuser --mode=teft --stdout --deliver=innocent,spam --feature=ch,no,wh

It's the case :

## p3scan-pf config file - generated by pfSense.
##
## at: Wednesday 06th of September 2006 08:34:26 PM
##
## Daemon Settings.
pidfile = /var/run/p3scan/p3scan.pid
maxchilds = 10
ip = 127.0.0.1
port = 8110
sslport = 995
targetip = 0.0.0.0
targetport = 8110
emailport = 25
user = root
notifydir = /var/spool/p3scan/notify
virusdir = /var/spool/p3scan
template = /usr/local/etc/p3scan/p3scan.mail
## Message Processing Settings.
bytesfree = 10000
timeout = 30
ispspam = -- Spam --
subject = Subject: "[Virus] found in a mail to you:" <virus name="">
notify = Per instruction, the message has been deleted.
smtprset = Virus detected! P3scan rejected message!
checksize = 1024
footer = /usr/local/bin/clamdscan -V
## Emergency Contacts.
emergcon = gw(*at*)kianouch.com
## Virus Scanner Settings.
scannertype = clamd
scanner = 127.0.0.1:3310
viruscode = 1
virusregexp = .*: (.*) FOUND
## SPAM Settings.
checkspam
spamcheck = /usr/local/bin/dspam --user dspamuser --mode=teft --stdout --deliver=innocent,spam --feature=ch,no,wh</virus>

And finally if you did install DSPAM from a package (which version?), DSPAM should start to populate the directory /var/db/dspam/data if it starts filtering mail messages.

I dont know which version, dont know how to check that, I'm quite new to FreeBSD, and I dont think apt-cache show dspam will tell me anything ;)

To install dspam I just did that :

pkg-add -r dspam

->

# ls /var/db/dspam/
firstrun.txt.sample             firstspam.txt.sample            quarantinefull.txt.sample

DanielSHaischt

Can you send me your dspam.conf file? address <me>at <daniel>dot <stefan>dot <haischt>dot<name></name></haischt></stefan></daniel></me>

KiaN

@DanielSHaischt:

Can you send me your dspam.conf file? address <me>at <daniel>dot <stefan>dot <haischt>dot <name></name></haischt></stefan></daniel></me>

Hmm :o I have no dspam.conf file, only the sample !

# ls /usr/local/etc
clamd.conf              freshclam.conf          openldap                pam.d                   spamd.conf              viralator.conf
clamd.conf.default      freshclam.conf.default  p3scan                  periodic                spamd.conf.sample       viralator.lang
clamsmtpd.conf          mail                    p3scan.conf             php.ini                 squid                   wgetrc
dspam.conf.sample       ntpd.conf               p3scan.conf.old         rc.d                    squirm

DanielSHaischt

@KiaN:

Hmm :o I have no dspam.conf file, only the sample !

There you go …

Most packages will be installed with an accompanying sample configuration file (here: dspam.conf.sample). It should be pretty obvious, that DSPAM refuses to run, because you did not configure DSPAM (i.e. no configuration file). You NEED to configure DSPAM manually, cause there's no way for DSPAM to guess for example which DSPAM backend driver you are going to use.

Please read the DSPAM README in /usr/local/share/doc/dspam to figure out how to configure DSPAM appropriately.

Regards
DAn.I.El S. Haischt