antivirus gateway

[milo974]

Hello, at work, we have openbsd 4.3 with pf and 2 network cards. Openbsd machine is configured as a gateway for our network (it provides internet to us).
I wish to add an antivirus (like clamav or others) on openbsd machine and so have an antivirus gateway. How can i do that ? I need to modify my pf.conf ?

[RudiK]

Are you running email and a proxy (squid) on the gateway?

[jggimi]

Typically, Milo, virus scanning over-the-network is accomplished two ways:

1. During transmission of incoming and outgoing e-mail. The test is performed at the Mail User Agent -- MUA -- (e-mail client), and/or by a Mail Transfer Agent -- MTA -- (e-mail server) en route. ClamAV in particular is designed to interface with MTAs for this purpose.
2. Remote filesystem scanning. NFS and/or SMB mounts are used, as needed. An example of using ClamAV with SMB mounts can be found in Dru Levigne's BSD Hacks, O'Reilly Media ISBN 0-596-00679-9. If I recall -- I don't have the book in front of me -- sharity-light was the port/package used in the example.

[DutchDaemon]

For HTTP/FTP traffic, you can use Squid with HAVP/ClamAV on the gateway.

[DutchDaemon]

(in other words, there is no "let pf redirect all traffic through a virus scanner" type of solution)

[hydra]

For HTTP/FTP traffic we use Dansguardian-Havp-Squid, works pretty well.

[roundkat]

Originally Posted by milo974

Hello, at work, we have openbsd 4.3 with pf and 2 network cards. Openbsd machine is configured as a gateway for our network (it provides internet to us).
I wish to add an antivirus (like clamav or others) on openbsd machine and so have an antivirus gateway. How can i do that ? I need to modify my pf.conf ?

I have 3 smtp gateways that serve 2 Linux Email Servers.
I use OpenBSD's spamd, Amavisd-New , SpamAssassin, ClamAV , DCC and Razor..


You will need to modify your pf.conf for spamd but if you look in the default (installed)
pf.conf ,the settings are there..
- There are a few more steps / tweaks but not difficult..

Spamd is well documented but if you want I can post my setup..

For the others, this what I followed /used.. it is a bit older and you need to make
a few minor changes..
http://www.kernel-panic.it/openbsd/mail/mail6.html

Note:
I used the package system for this and found there are 3 items not
included in the package system
- freeze
- unarj
- unrar
These will need to be installed from ports...

Note2:
This also uses Postfix as the MTA - not Sendmail...

DCC and Razor
I also added DCC and Razor using this:
DCC Link
http://flakshack.com/anti-spam/wiki/...Installing+DCC
Razor Link
http://flakshack.com/anti-spam/wiki/...stalling+Razor

These links are also older but the instructions still apply..

I did this on a test box first because getting amavisd-new configured took a bit of time..

My Steps
- Installed freeze , unarj and unrar through ports
- Installed amavisd-new through packages (this pulls in spamassasin and clamav IIRC.
- Once I was receiving email and sending email without issue
(check your maillogs for errors... big help as to what is going on..)

- After I was happy with system - I then added DCC and Razor

Note:
DCC and Razor are "activated" through SpamAssassin..
I had some trouble figuring where to enable them..
It is
/etc/mail/spamassassin/v310.pre

hth
rk

Final Note:
After all this discussion with me and myself I will probably write a Guide on this as to not have
to remember all the steps...

Give this a shot first.. if you are comfortable on the command line and do... take some time reading
before the "cut and paste" it sure does help..

- I can't stress this enough... your maillog will really help you debug any problems you have..

[milo974]

thank's for yours answers !! very good !! i will test the squid config with clamav ...

[roundkat]

Originally Posted by milo974

thank's for yours answers !! very good !! i will test the squid config with clamav ...

No worries..

Let us know how you make out..

rk

[Sunnz]

Originally Posted by hydra

For HTTP/FTP traffic we use Dansguardian-Havp-Squid, works pretty well.

Hey may I ask how would this work?

I already have Squid running here... so is that a plug in to install??