##########################################################################
#                                                                        #
#                         P3Scan Version 2.3.2                           #
#                                                                        #
#                       default configuration file                       #
#                      all params are set to default                     #
#                                                                        #
##########################################################################

# 
#  P3Scan v2.3.2
# 
#  (C) 2003-2005 by Jack S. Lai <laitcg@cox.net>
# 
#  It's intent is to provide a follow on program to POP3-Virusscan-Proxy 0.4
#  by Folke Ashberg <folke@ashberg.de>.
# 
#  It is based upon his program but provides numerous changes to include
#  scanning pop3 mail for spam, hardening the program, addaption to todays
#  email environment, and many other changes.
# 
#  The initial release of p3scan includes patches made and submitted to the
#  original project but were never incorporated. Please see the README for
#  further information.
# 
#  This program is free software; you can redistribute it and/or modify
#  it under the terms of the GNU General Public License as published by
#  the Free Software Foundation; either version 2 of the License, or
#  (at your option) any later version.
# 
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
# 
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
# 
#  This program is released under the GPL with the additional exemption that
#  compiling, linking, and/or using OpenSSL is allowed."
#  (http://www.openssl.org/support/faq.html#LEGAL2)
# 
# 

#
# PID File
#
#   where to write a pid-file
#
#   default: /var/run/p3scan/p3scan.pid
#
# pidfile = /var/run/p3scan/p3scan.pid

#
# Max Child's
#
#   The maximum number of connections we will handle at once. Any further
#   connections will be dropped. Keep in mind that a number of 10 also
#   means that 10 viruscanners can run at once.
#
#   default: 10
#
# maxchilds = 10

#
# IP Address
#
#   The IP Address we listen on default: 0.0.0.0 (any address)
#
# ip = 0.0.0.0

#
# Port
#
#   The tcp port on we should listen. If you need a privileged port you
#   need to start p3scan as root (but don't set username to root,
#   that's not necessary, because first after opening the port we will
#   switch to that user).
#
#   default: 8110
#
# port = 8110

#
# TargetIP, TargetPort
#
#   targetip and targetport are the ip and port to connect -
#   default is 0.0.0.0 (transparent proxy mode) and 8110 respectively
#
#   default: targetport is ignored in transparent proxy mode
#
# targetip = 0.0.0.0
# targetport = 8110

#
# Useurl
#
#   Parse username for destination url vice using iptables redirection.
#
#   To use this you should have your email clients replace the username
#   in the email client username field with "username#destinationurl:port"
#   and replace the destination url/port with the url/port of p3scan.
#
# Example:
# From:
# username: laitcg                     host: pop.gmail.com             port: 110
# To:
# username: laitcg#pop.gmail.com:110   host: <url of p3scan machine>   port: 8110
#
# default: <none>
#
# useurl

#
# Email (SMTP) Port
#
#   The port we should listen on to scan outgoing email messages.
#
#   default: 25
#
# emailport = 25

#
# Username
#
#   The username the daemon should run as. Takes no effect when you
#   start as a non-root user.
#
#   default: mail
#
# user = mail

#
# Notify Directory
#
#   Create notification mails in <DIR>. Also used for temporary storage.
#
#  default: /var/spool/p3scan/notify
# notifydir = /var/spool/p3scan/notify

#
# Virus Directory
#
#   The directory in which infected mails will be stored.  It is also
#   used for temporary storing. Ensure that the above specified user is
#   allowed to write into!
#
#   default: /var/spool/p3scan
#
# virusdir = /var/spool/p3scan

#
# Just Delete
#
#  Instead of keeping an infected message in the Virus Directory, delete
#  it after reporting it to the user.
#
#  default: Keep infected messages in Virus Directory
#
# justdelete

#
# Extra Notification Recipient
#
#  When an infection message is sent to the client, send a copy of the
#  message to the address(s) specified here, separated by a space.
#
#  NOTE: If there is a file named "p3scan.extra" it will be treated just
#  like p3scan.mail (see "template") and sent to the recipients listed here.
#  For example:
#                 /etc/p3scan/p3scan.mail -> /etc/p3scan/p3scan-en.mail
#                 /etc/p3scan/p3scan.extra -> /etc/p3scan/p3scan-ru.mail
#
#  default: Do not notify anyone else
#
# extra = root@localhost postmaster@localhost

#
# Extra Notification Recipient mail program
#
#  Use this program to send Extra Notification.
#
#  default: /bin/mail
#
# xmail =

#
# Bytes Free
#
#  The number of KB's there must be free before processing any mail.
#  If there is less than this amount, p3scan will notify the emergency
#  contact address and then terminate itself.
#
#  NOTE: p3scan could need (2 * msgsize) * children disk space free.
#        Being this is dynamic (not all space is needed all the time),
#        you should ensure you have more than enough disk space.
#
#  default: bytesfree = 10000 (10MB)
# Sample: If you want to ensure 100MB are free
# bytesfree = 100000

#
# Emergency Contact
#
#  In the event p3scan encounters a catastrophic problem and has to terminate,
#  it will send an email to these email addresses just before setting up to
#  close down on the next iteration of a child process.
#
#  default: root@localhost postmaster@localhost
#
# emergcon =

#
# Scanner Type
#
#   Select here which type of scanner you want to use.
#
#   Basic:
#
#     This is the default. The configured executable (set in variable
#     "scanner") will be invoked. You can also specify parameters (we are
#     using /bin/sh).  At the end the path to the mail and a "2>&1" is
#     appended.  The program can tell us if it's a virus returning Scanner
#     Returncode (see below) or exit code 0 means, with all ok, all
#     others are reported to syslog, but mails will be delivered unless
#     justdelete is enabled above. The output is scanned using a regular
#     expression which describes where the virusname can be found
#     (see virusregexp).
#
#     If demime is not set 'path to mail' is the full filename to the
#     rfc822 message, which you MUST NOT DELETE or MODIFY (except if you know
#     how to modify)! If your scanner can not handle rfc822 messages (e.g.
#     McAfee uvscan) set demime and 'path to mail' is a directory which
#     contains all MIME-Parts splitted into separate files. That files are
#     not needed after scanning, so p3scan deletes them.
#
#     You will find a sample-configuration for McAfee's uvscan
#     (http://www.mcafee.com/) in the below sections.
#
#
#   AVPD:
#
#     AVPD is a frontend to 'Kaspersky Anti-Virus for Linux'
#     (http://www.kaspersky.com/) , which provides a daemon named
#     'kavdaemon'. Once the daemon has been started we connect to
#     kavdaemons socket and tell what files to scan.  This gives a rapid
#     speed increase since the virus-definitions and other
#     scanner-initialization has only to be done once! Here a result from
#     a speedtest which I've made: Running kavdaemon, quallcomms qpopper
#     and p3scan on an Intel P1 with 133MHz and 64MB RAM a client using
#     Netscape-Mail was able to fetch 500 mails (including POP3- UIDL-
#     setting) in 62 seconds (each mail sized 2kByte)!
#
#     We just need to know in which directory your kavdaemon writes the
#     socket 'AvpCtl' and file 'AvpPid', default is '/var/run', which is
#     ok using AVP-default installation, leave in that case the below
#     variable scanner commented, otherwise set there the path. Parameter
#     viruscode and virusregexp will not be used.
#
#     Actual versions of avpd can't handle rcf822, so set demime (this is
#     not standard, it's possible that Kaspersky Labs includes rfc822
#     checking in further releases).
#
#     Important note about using kavdaemon:
#
#     Ensure that virusdir (/var/spool/p3scan) is included in AVPs
#     'enabled path list', otherwise the mails will not be scanned, but
#     kavdaemon returns ok (I've found no way to check if the mail has
#     been scanned or not). Mail yourself the eicar.com testvirus (from
#     http://www.eicar.com ) to check it!). The 'enabled path' can be set
#     in /opt/AVP/defUnix.prf in the 'Names' line (add
#     ';*/var/spool/p3scan'). Also check if there is a config file in
#     /root/.AVP/ which has higher precedence (if kavdaemon runs a root,
#     otherwise check that users $HOME/.AVP ).
#     scannertype = avpd
#
#     If you are using version 5, then instead of scannertype = avpd, use
#     scannertype = avpd_new
#
#   TROPHIE:
#
#     Trophie is an OpenSource Anti-Virus Daemon, which uses the
#     virus-scanengine and database from Trend Antivirus. Trophie can be
#     found at http://www.vanja.com/tools/trophie/ . Configuration is very
#     simple, just set scannertype to 'trophie' and it should work. If you
#     don't use trophies standard-config  you have to set scanner to the
#     trophie socket.
#     scannertype = trophie
#
#   FRISK F-Prot Antivirus: http://www.f-prot.com
#
#     Un-comment appropriate options below.
#     Use default scannertype = basic
#
#   Clam Anti-Virus: http://www.clamav.net
#
#     This program must run as the same user as p3scan is running so that
#     it can access the mail files for scanning. Either compile with the
#     options --with-user=mail --with-group=mail (if p3scan is using the
#     the default user/group of "mail") or change "User" in clamav.conf
#     to the user p3scan is running as. If you get a return code other
#     than a 0 or 1, see the clamav documentation for the reason.
#
#     Un-comment "ScanMail" in clamav.conf/clamd.conf as we are scanning mail
#     files so demime does not need to be set below.
#
#     You should start clamd before starting p3scan.
#
#     Un-comment appropriate options below.
#     Use default scannertype = basic
#
#     If using the tcp/ip mode of clamd, then use scannertype = clamd
#     This will allow using the clamav scanner even when it is not running on
#     the same server as p3scan.
#
#   Bash
#
#     This scanner type allows you to do whatever you want with the
#     variables passed to it and can also allow you to call multiple
#     scanners, etc... See p3scan.sh for an example of all the variables.
#     scannertype = bash
#
#  default: basic
#
# scannertype = avpd
# scannertype = avpd_new
# scannertype = bash
# scannertype = basic
# scannertype = clamd
# scannertype = trophie

# Virusscanner
#
#   Depends on scannertype. Read the above section of that scannertype
#   you're going to use and you do not need to ask what to fill in here.
#
#   default: depending on scannertype:
#     basic   : <no default>
#     bash:   : /path/to/filename
#     avpd    : /var/run/
#     avpd_new: /var/run/
#     trophie : /var/run/trophie
#     clamd   : tcp/ip connection
#
#
# Sample: scannertype basic using McAfee UVSCAN:
# scanner = /usr/local/uvscan/uvscan
# Sample: scannertype basic using FRISK F-Prot Antivirus:
# scanner = /usr/local/bin/f-prot -archive=5 -ai
# Sample: scannertype basic using ClamAV:
# scanner = /usr/bin/clamdscan --no-summary
# Sample: scannertype clamd using ClamAV in TCPSocket mode:
# scanner = 127.0.0.1:3310
# Sample: scannertype bash using p3scan.sh for testing:
# scanner = /usr/local/sbin/p3scan.sh

#
# Scanner Returncode
#
#   Specify the returncode(s) which the scanner returns when the mail is
#   infected. P3Scan does its part (sending the notification and not the
#   infected mail) only when it gets the specified returncode(s).
#   A returncode value of 0 from the scanner is assumed to mean that the
#   message is clean. Any other unspecified value will add warning lines
#   to your logfiles but THE MESSAGE WILL BE DELIVERED!
#
#   Only used from scannertype 'basic'.
#
#   default: 1
#
# Sample: scannertype basic using McAfee UVSCAN:
# viruscode = 13
# Sample: scannertype basic using FRISK F-Prot Antivirus:
# viruscode = 3,8

#
# Good Scanner return codes
#
#   Some scanners can report more than good or infected. Place valid return
#   codes here that will enable the message to be delivered without a
#   warning. For example, Kaspersky Anti-Virus reports code 10 for an
#   encrypted .zip file.
#
#   default: none
#   Sample: goodcode = 10
#   goodcode =

#
# Regular Expression for Virusname
#
#   Specify here a regular expression which describes where the name of the
#   virus can be found. If not specified, the first substring is used;
#   specify it appending '/' and the substring number (1-9) at the end.
#   PerlCompatibleRegularExpressions are used, case sensitive and the
#   ungreedy option. Only used by scannertype 'basic'.
#
#   default: <none>
#
# Sample: McAfee UVSCAN
# virusregexp = ^[[:space:]]*Found( the|:)[[:space:]]*(.*)[[:space:]]*(|virus[^a-z.]*)$/2
# Sample: FRISK F-Prot Antivirus
# virusregexp = (?=Infection\:)[[:space:]]*(.*)$
# Sample: ClamAV
# virusregexp = .*: (.*) FOUND

#
# deMIME Setting
#
#   Uncomment this if we should parse all MIME-sections instead of passing
#   the message as-is to the scanner. This is used for viruscanners that cannot
#   natively handle email attachments.
#
#   default: <no demime>
# demime

#
# Broken email clients
#
#   Some email clients may require special processing. If this
#   option is enabled the client will receive whole lines (vice
#   single characters) while processing a large email message.
#
#   The reason for leaving two types of large email processing
#   is that when this option is disabled, the possibility exists
#   that the client will not see any "X-P3Scan: Due to an
#   extremely large attachment you see this message line." in
#   the received message header.
#
#   Note: As of the introduction of this parameter, only some
#   instances of the use of the Outlook/Outlook Express clients
#   warrent enabling of this feature.
#
#   default: send characters during large message processing.
# broken

#
# Timeout
#
#   Change the default timeout for sending characters/lines to the
#   client while processing a message.
#
#   default: 30 seconds
# timeout = 30

#
# ISP Spam
#
#   This option allows you to set the string your ISP uses if
#   it processes your email for SPAM. If this string is found
#   in the subject line of the incoming message, it will not
#   perform any spam processing so that the message gets to
#   the client faster.
#
#   default: <none>
# Sample for cox.net:
# ispspam = -- Spam --
#
# ispspam =

# Enable Spam checking
#
#  If set, will scan for Spam before scanning for a virus.
#
#  P3scan has been tested with both dspam-3.0.0-rc2 and
#  Mail::SpamAssassin v2.6.
#
#  The DSPAM implementation uses the virtual-users capability
#  of the mysql backend to dspam. Mysql is the recommended
#  interface due to speed and stability (and in our case, the
#  virtual-users interface).
#
#  P3scan and SpamAssassin uses the interface spamd/spamc.
#  You should start spamd before running p3scan. For example:
#  "spamd -L -d" (run in local mode only, daemonize)
#  man spamd for more information.
#
#  default: no checking of spam
# checkspam

#
# Mail::SpamAssassin
#
#  Where to find spamc, the link to the Mail::SpamAssassin daemon spamd.
#
# spamcheck = /usr/bin/spamc

#
# DSPAM
#
#  This line gives SpamAssassin like functionality to dspam. All
#  users mail is scanned against a single database of "mail".
#spamcheck = /usr/bin/dspam --user mail --mode=teft --stdout --deliver=innocent,spam --feature=ch,no,wh
#
#  This line enables each virtual user to have their own database
#  of message traffic 'tokens' and is much more accurate than the
#  procedure above after training. The user 'dspamuser' will be
#  replaced by the actual user calling p3scan.
#spamcheck = /usr/bin/dspam --user dspamuser --mode=teft --stdout --deliver=innocent,spam --feature=ch,no,wh
#
#  Of course change the options in the above lines to your preferences.

#
# Rename Attachments
#
#  If renattach is installed and this option is un-commented, we
#  will execute renattach to rename dangerous attachments.
#  (See README for more information)
#
#  default: none
#
# renattach = /usr/local/bin/renattach

#
# Overwrite (disable) HTML
#
#  If a person views an HTML message, not only can the client
#  download pictures automatically, it enables someone viewing
#  the remote log file to confirm the email address is valid,
#  making it "worth" keeping/selling, etc...
#
#  p3scan comes with a separate program p3pmail that can be
#  installed for this purpose.
#
#  default: do not disable HTML
#
# overwrite = /usr/bin/p3pmail

#
# Debug
#
#   Turn on debugging. The recommended debug procedure is to
#   call p3scan as follows:
#      p3scan -d > debug 2>&1
#   This will trap debug information to the file "debug".
#   You can then monitor it with a 'tail' command.
#
#   default: off
# debug

#
# Quiet
#
#   Disable reporting of normal operating messages. Only report errors
#   or critical information.
#
# default: display all less debug info
#
# quiet

#
# Template
#
#   Where to look for an email-template when our own mail has to be send
#   instead of an infected mail. That file has to be exist, otherwise
#   p3scan will send an RFC unconform -ERR and closes the connections.
#   The email-template should start after the header with the content-type, and
#   so on. Also the leading dot is necessary (just a dot and return, no more in
#   the last line). You can use some key- words which will be replaced
#   when sending, e.g. %MAILDATE%. See the existing p3scan-en.mail for examples
#   of keywords.
#
#   p3scan.mail is normally a sym-link to your default language email template.
#   You can of course just put the actual name of your template here.
#
#   default: /etc/p3scan/p3scan.mail
#
# template = /etc/p3scan/p3scan.mail

#
# Alternate virus notification email
#
#   In the event you wish to modify the virus notification email on the
#   fly, as in using the bash scanner, uncomment this to allow a copy of the
#   p3scan.mail virus template to be placed in:
#   $virusdir/<pid>/vnmsg or /var/spool/p3scan/children/<pid>/vnmsg
#
# default: use template defined in template= w/out modification.
#
# altvnmsg

#
# Subject
#
#   This option can be used to change the default subject line when reporting
#   a virus infected message. In the default below, everything between the quotes
#   can be changed and are not part of the actual default subject line and
#   <virus name> will be replaced by the actual name of the detected virus.
#
#   default: Subject: "[Virus] found in a mail to you:" <virus name>
#
# subject =

#
# Notify
#
#   This option can be used to change the default file deleted notification that
#   is displayed in the virus notification message when the "justdelete" option
#   is used.
#
# default: Per instruction, the message has been deleted.
#
# notify =

#
# SMTP Reject
#
#   This option can be used to change the default SMTP Reject message that is sent
#   to the client in the event a message is rejected due to a virus.
#   The error message will have a prefix of "554".
#
# default: Virus detected! P3scan rejected message!
#
# smtprset =

#
# Check SMTP size
#
#   This option can be used to set the maximum message size (in KBytes) that
#   p3scan will use to determine if it should scan an smtp submission. If a
#   message is greater than this size, it will not be scanned to help alleviate
#   smtp timeouts.
#
# default: none
#
# checksize =

#
# SSL/POP3S messages
#
#   Check for SSL/POP3S protocol on a different port.
#
# default: 995
#
# sslport =

#
# Insert SMTP message virus scanner information.
#
#   This option is used to add the virus definition info from your scanner
#   to an smtp message. It will only be added as a footer if the message
#   is not signed cryptographically and is only a text message.
# 
#   It is used in conjunction with the file /etc/p3scan/p3scan.footer in the
#   following fashion:
#
#   /etc/p3scan/p3scan.footer:
#
#   1) If file does not exist and "footer" is defined:
#      No footer information will added to outgoing messages, but the p3scan
#      version and scanner info will be added to the header.
#
#   2) If file exists but blank and "footer" is defined:
#      P3Scan version/host info and scanner info will be added to end of
#      message and header.
#
#   3) If file contains information and "footer" is defined:
#      All lines of this file will be added to the end of the smtp message and
#      then p3scan version/host info and scanner info will be appended.
#
#   4) If file does not exist and "footer" is not defined:
#      P3Scan will only insert p3scan version info into the header.
#
# Sample: FRISK F-Prot Antivirus:
# footer = /usr/local/bin/f-prot -verno
# Sample: ClamAV:
# footer = /usr/bin/clamdscan -V

#
# TOP command processing
#
#   This command may cause p3scan to hang when the client does not
#   disconnect after using the TOP command. It is now disabled by
#   default. If it was working for you in the past, then go ahead
#   and enable it below.
#
#   NOTE: This command will be removed in the future as it is only
#         a work-around until the problem can be resolved.
#
# enabletop

# END of configuration
