p3scan可以與多種掃毒引擎配合工作，我用的仍然是clamav，具體的說(shuō)應該是clamd
先安裝clamd，它在clamav-server這個(gè)包里：
rpm -ivh /usr/src/redhat/RPMS/i386/clamav-server-0.91.1-1.i386.rpm
怎么編譯出這個(gè)rpm包請參見(jiàn)：http://blog.chinaunix.net/u/2367/showart_321930.html
rpm -ivh /usr/src/redhat/RPMS/i386/clamav-server-0.91.1-1.i386.rpm
怎么編譯出這個(gè)rpm包請參見(jiàn)：http://blog.chinaunix.net/u/2367/showart_321930.html
clamd必要的配置項目如下，/etc/clamd.conf中都有解釋?zhuān)筒粏铝耍?br>LogFile /var/log/clamav/clamd.log
LogFileMaxSize 0
LogTime yes
PidFile /var/run/clamav/clamd.pid
TemporaryDirectory /dev/shm
DatabaseDirectory /var/lib/clamav
FixStaleSocket yes
TCPSocket 3310
TCPAddr 127.0.0.1
MaxConnectionQueueLength 80
StreamMaxLength 20M
MaxThreads 80
ReadTimeout 300
MaxDirectoryRecursion 20
User clamav
AllowSupplementaryGroups yes
DetectBrokenExecutables yes
ScanPDF yes
ArchiveMaxFileSize 64M
ArchiveMaxRecursion 10
ArchiveMaxCompressionRatio 300
ArchiveBlockEncrypted no
ArchiveBlockMax yes
ClamukoMaxFileSize 64M
LogFileMaxSize 0
LogTime yes
PidFile /var/run/clamav/clamd.pid
TemporaryDirectory /dev/shm
DatabaseDirectory /var/lib/clamav
FixStaleSocket yes
TCPSocket 3310
TCPAddr 127.0.0.1
MaxConnectionQueueLength 80
StreamMaxLength 20M
MaxThreads 80
ReadTimeout 300
MaxDirectoryRecursion 20
User clamav
AllowSupplementaryGroups yes
DetectBrokenExecutables yes
ScanPDF yes
ArchiveMaxFileSize 64M
ArchiveMaxRecursion 10
ArchiveMaxCompressionRatio 300
ArchiveBlockEncrypted no
ArchiveBlockMax yes
ClamukoMaxFileSize 64M
啟動(dòng)clamd：
/etc/rc.d/init.d/clamd start
/etc/rc.d/init.d/clamd start
下載、安裝、編譯p3scan的srpm包：
wget -c http://jaist.dl.sourceforge.net/sourceforge/p3scan/p3scan-2.3.2-1.src.rpm
rpm -ivh p3scan-2.3.2-1.src.rpm
cd /usr/src/redhat/SPECS/
rpmbuild -ba --clean p3scan.spec
wget -c http://jaist.dl.sourceforge.net/sourceforge/p3scan/p3scan-2.3.2-1.src.rpm
rpm -ivh p3scan-2.3.2-1.src.rpm
cd /usr/src/redhat/SPECS/
rpmbuild -ba --clean p3scan.spec
提示需要必要的庫，安裝之：
yum -y install pcre-devel openssh-devel
yum -y install pcre-devel openssh-devel
繼續編譯：
rpmbuild -ba --clean p3scan.spec
rpmbuild -ba --clean p3scan.spec
安裝編譯好的p3scan：
cd ../RPMS/i386/
rpm -ivh p3scan-2.3.2-1.i386.rpm
cd ../RPMS/i386/
rpm -ivh p3scan-2.3.2-1.i386.rpm
p3scan的配置很簡(jiǎn)單，在/etc/p3scan/p3scan.conf中，必要的項目如下：
#啟動(dòng)p3scan的userid，我嘗試用clamav，與clamd的userid相同，但進(jìn)行掃描后有一個(gè)chmod操作報錯，所以干脆用了root
user = root
scannertype = clamd
scanner = 127.0.0.1:3310
virusregexp = .*: (.*) FOUND
timeout = 90
footer = /usr/bin/clamdscan -V
#啟動(dòng)p3scan的userid，我嘗試用clamav，與clamd的userid相同，但進(jìn)行掃描后有一個(gè)chmod操作報錯，所以干脆用了root
user = root
scannertype = clamd
scanner = 127.0.0.1:3310
virusregexp = .*: (.*) FOUND
timeout = 90
footer = /usr/bin/clamdscan -V
/etc/p3scan/中的p3scan-??.mail是p3scan檢測到病毒發(fā)送通知的郵件模板，復制其中的p3scan-en.mail為p3scan.mail，或者創(chuàng )建一個(gè)連接：
cd /etc/p3scan
ln -s p3scan-en.mail p3scan.mail
當然，也可以根據這個(gè)模板翻譯成中文后使用。通知郵件的標題在/etc/p3scan/p3scan.conf中定義，也可以根據自己的需要修改。
啟動(dòng)p3scan:
/etc/rc.d/init.d/p3scan start
/etc/rc.d/init.d/p3scan start
設置iptables規則，把所有到25，110的流量重定向到p3scan的工作端口8110上：
iptables -t nat -A PREROUTING -p tcp -m multiport --dport 25,110 -j REDIRECT --to-port 8110
iptables -t nat -A PREROUTING -p tcp -m multiport --dport 25,110 -j REDIRECT --to-port 8110
收發(fā)郵件測試一下。p3scan的日志在/var/log/messages中。
把iptables、squid、clamav、havp、p3scan組合起來(lái)，就是一個(gè)完整的具有病毒過(guò)濾功能的安全網(wǎng)關(guān)！
