KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Service manual

KASPERSKY LABS
Kaspersky Anti-Virus®5.0 for Linux,
FreeBSD and OpenBSD Mail Servers
ADMINISTRATOR’S GUIDE

KASPERSKY ANTI-VIRUS®5.0 FOR LINUX,
FREEBSD AND OPENBSD MAIL SERVERS
Administrator's
guide
Kaspersky Labs, Ltd.
http://www.kaspersky.com
Revision date: September, 2003

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUS®TM FOR LINUX, FREEBSD, AND
OPENBSD MAIL SERVERS ....................................................................................... 6
1.1. What’s new in version 5.0 ..................................................................................... 7
1.2. Licensing policy ..................................................................................................... 8
1.3. Hardware and software requirements .................................................................. 9
1.4. Distribution kit ........................................................................................................ 9
1.5. Help desk for registered users ............................................................................ 10
1.6. Conventions......................................................................................................... 11
CHAPTER 2. TYPICAL PATTERNS OF PRODUCT DEPLOYMENT ....................... 12
2.1. Internal architecture of Kaspersky Anti-Virus®.................................................... 12
2.2. Operation on the same server as mail system................................................... 14
2.3. Operation as the secondary filter ........................................................................ 16
2.4. Operation on a dedicated server......................................................................... 17
2.5. Filtering mail received from external mailboxes ................................................. 19
CHAPTER 3. INSTALLING KASPERSKY ANTI-VIRUS®........................................... 21
3.1. Universal installation............................................................................................ 21
3.1.1. Starting the installation procedure................................................................ 22
3.1.2. Previous version search ............................................................................... 23
3.1.2.1. Creating a backup copy of the previous distribution package.............. 23
3.1.2.2. Updating to version 5.0.......................................................................... 24
3.1.2.3. Installing along with an earlier version .................................................. 24
3.1.3. Copying the distribution files......................................................................... 25
3.1.4. Integration with the mail system................................................................... 26
3.1.5. License key installation................................................................................. 26
3.1.6. Installing / updating the anti-virus database................................................. 27
3.1.7. Completing the installation ........................................................................... 27
3.1.8. Installation report........................................................................................... 28
3.2. Installing the program on a server running Linux ............................................... 29
3.3. Installing the program on a server running FreeBSD or OpenBSD .................. 30
CHAPTER 4. POST-INSTALLATION SETTINGS ....................................................... 31
4.1. Setting the program by default............................................................................ 31

3 Kaspersky Anti-Virus for Unix Mail Servers
4.2. Installing / updating anti-virus database.............................................................. 33
4.3. Setting up joint operation with Webmin .............................................................. 33
4.4. Manual integration with mail systems................................................................. 35
4.4.1. Integration with the sendmail mail system................................................... 35
4.4.2. Integration with the qmail mail system ......................................................... 36
4.4.3. Integration with the Postfix mail system....................................................... 37
4.4.4. Integration with the Exim mail system.......................................................... 38
4.4.5. Configuring Kaspersky Anti-Virus®for integration with the mail system..... 39
4.5. Creating a list of protected users ........................................................................ 42
CHAPTER 5. WORKING WITH KASPERSKY ANTI-VIRUS®.................................... 45
5.1. Anti-virus database updating............................................................................... 45
5.1.1. Scheduling anti-virus database updating using cron................................... 46
5.1.2. One-time update of the anti-virus database................................................. 48
5.2. Antiviral protection of the server’s mail traffic ..................................................... 50
5.2.1. Delivering only clean and disinfected messages......................................... 50
5.2.2. Delivery of infected messages ..................................................................... 55
5.2.3. Blocking message delivery to the recipients................................................ 58
5.2.4. Complementary filtration of messages by attachment types ...................... 59
5.2.5. Setting traffic-based license expiration notifications.................................... 64
5.3. Antiviral protection of file systems....................................................................... 66
5.3.1. Launching directory scan from the command line....................................... 66
5.3.2. Scheduled daily directory scan .................................................................... 67
5.3.3. Moving objects to a separate directory (quarantine) ................................... 68
5.3.4. Advanced options: using script files............................................................. 69
5.3.4.1. Cleaning infected objects in archives.................................................... 70
5.3.4.2. Sending notifications to the administrator ............................................. 72
5.4. License key management................................................................................... 73
5.4.1. Viewing the license key information............................................................. 74
5.4.2. Renewing the license ................................................................................... 78
CHAPTER 6. ADVANCED SETTINGS ........................................................................ 79
6.1. Setting up antiviral protection of mail traffic ........................................................ 79
6.1.1. Forming user groups .................................................................................... 81
6.1.2. Message check and disinfection mode........................................................ 82
6.1.3. Actions taken with mail messages ............................................................... 83
6.1.4. Notifying senders, recipients, and administrators........................................ 85

Contents 4
6.2. Setting antiviral protection of the server’s file systems....................................... 88
6.2.1. Scan area...................................................................................................... 88
6.2.2. File check and disinfection mode................................................................. 89
6.2.3. Actions taken with the files ........................................................................... 90
6.3. Setting the operation of the aveserver process.................................................. 91
6.3.1. Aveserver reloading...................................................................................... 92
6.3.2. Forced ending of the aveserver operation................................................... 93
6.4. Localization of the format of time and date display ............................................ 93
6.5. Parameters of Kaspersky Anti-Virus®report generation.................................... 94
6.5.1. Format of messages about scanning........................................................... 95
6.5.2. The format of other messages ..................................................................... 97
6.5.3. The format of messages output to the console ........................................... 98
CHAPTER 7. QUESTIONS AND ANSWERS.............................................................. 99
CHAPTER 8. UNINSTALLING KASPERSKY ANTI-VIRUS®.................................... 104
APPENDIX A. SUPPLEMENTARY INFORMATION ABOUT THE PRODUCT....... 105
A.1. Location of the product files in the directories.................................................. 105
A.2. Kaspersky Anti-Virus®configuration file ........................................................... 106
A.3. Command line keys for the kavscanner component ....................................... 115
A.4. The kavscanner component return codes ....................................................... 118
A.5. Command line keys for the aveserver component.......................................... 119
A.6. The aveserver component return codes .......................................................... 119
A.7. Command line keys for the smtpscanner component..................................... 120
A.8. The smtpscanner component return codes ..................................................... 121
A.9. Command line keys for the licenseviewer component .................................... 121
A.10. Command line keys for the kavupdater component...................................... 122
A.11. The kavupdater component return codes...................................................... 123
A.12. A sample script file (vox.sh) for disinfecting tar- and zip-archives................. 123
A.13. A sample configuration file for the Postfix mail program – master.cf ............ 125
APPENDIX B. MALICIOUS PROGRAMS IN THE UNIX ENVIRONMENT.............. 127
B.1. Viruses............................................................................................................... 127
B.2. Trojan horses .................................................................................................... 128
B.3. Internet worms................................................................................................... 129
APPENDIX C. KASPERSKY LABS LTD.................................................................... 132

5 Kaspersky Anti-Virus for Unix Mail Servers
C.1. Other Kaspersky Labs products....................................................................... 133
C.2. Contact us ......................................................................................................... 136
APPENDIX D. INDEX .................................................................................................. 139
APPENDIX E. LICENSE AGREEMENT..................................................................... 139

CHAPTER 1. KASPERSKY ANTI-
VIRUS®FOR LINUX,
FREEBSD, AND OPENBSD
MAIL SERVERS
Kaspersky Anti-Virus®for Linux, FreeBSD, and OpenBSD Mail Servers
(hereinafter also referred to as Kaspersky Anti-Virus®, Kaspersky Anti-Virus®
for Unix Mail Servers) is designed for anti-virus processing of mail traffic and
file systems of servers running Linux, FreeBSD, or OpenBSD operating systems
and using one of the following mail programs: sendmail, Postfix, qmail, Exim.
This software product allows the user to:
• Check for viruses in all mounted file systems , as well as incoming and
outgoing mail messages, as part of the server’s SMTP traffic .
• Detect infected, suspicious, corrupted, and password-protected files, as
well as files that fail to be scanned because of an error.
• Carry out anti-virus processing (disinfect) infected objects in file systems
and mail messages.
• Move to the quarantine directory all infected, suspicious, and corrupted
objects of the server file system and its mail traffic. For the latter,
disinfected and password-protected files can also be quarantined, as well
as files that fail to be scanned because of an error.
• Process mail traffic according to rules preset for groups of senders and
recipients.
• Provide secondary filtering of mail traffic by name and type of attached
objects, and use individual processing rules for the filtered objects.
• Notify sender, recipient, and group administrator about mail messages
that contain infected, suspicious, and other objects.
• Update the program’s anti-virus database. Anti-virus database updates
are downloaded from Kaspersky Lab’s update servers.
The anti-virus database is used in the process of searching and cleaning
infected objects. Based on its contents, during the scan, each file is
analyzed for the presence of viruses and the file’s code is compared to

7 Kaspersky Anti-Virus for Unix Mail Servers
codes specific to particular viruses. If the file is infected, the program
disinfects it.
It should be kept in mind that new viruses appear daily, therefore
we recommend updating the anti-virus database every day in
order to maintain the product in up-to-date condition.
• Configure Kaspersky Anti-Virus®via the web-interface provided by the
Webmin program and the product configuration file.
1.1. What’s new in version 5.0
Version 5.0 of Kaspersky Anti-Virus®has the following changes compared to
version 4.0:
• All the product components have been transferred to the new antiviral
engine, which puts a lower load on workstations or servers but provides
the same functionality.
• A number of drawbacks of Kaspersky Anti-Virus®for Unix v. 4.0 related to
its architectural features have been corrected.
• The executable kavdaemon component has been renamed to aveserver
and has been improved.
• The kavkeeper component has been renamed to smtpscanner and has
been debugged.
• The web-configuration component WebTuner has been replaced by a
plug-in from the commonly used program Webmin. This has extended the
functionality of the product.
• Mail traffic licensing supervision has been modified: notifications can now
be sent to administrators on reaching a critical amount of license traffic.
• Configuration files of all the components have been united into one file
kav4mailservers.conf, thus making it possible to manage the entire
product. In this connection, the configuration of the entire product has
been transferred from a binary to a text framework.
• The possibility has been added to configure formats of time and date
representation in the program components operation reports and
notifications. Notifications regarding mail messages checking results are
translated into various languages.
• The set of macros used in mail message scan notifications has been
extended.

Kaspersky Anti-Virus for Unix Mail Servers 8
• It is now possible to use script files for processing of objects with different
status (infected, corrupted etc.)
• An option has been added of automatic restarting of the program’s
resident components after successful update of the anti-virus database.
• The product is distributed in the form of standard installation packages for
the supported operating systems (rpm, deb).
• The product licensing policy has been changed:
• After the license expires, Kaspersky Anti-Virus®remains
functional except for the anti-virus database updating feature.
• Kaspersky Anti-Virus®does not work without a license key.
• The component kavucc (Control Centre) has been excluded due to
simplification of the product architecture.
• The components kavinspector (Inspector), kavtuner (Tuner) and
kavmonitor (Monitor) have been excluded from the product.
1.2. Licensing policy
Kaspersky Anti-Virus®licensing policy includes a system of product use
limitations based on:
• Product use duration ( usually limited to one year from the date of
purchase).
• Number of users (e-mail addresses).
• Daily mail traffic volume (Mb per day).
A license can be purchased based on either a single type of limitation (e.g. daily
mail traffic), or on several types (e.g. for a certain number of mailboxes for one
year).
Depending on the type of license purchased, there are various options for
product setup. For example, with a limited NUMBER OF USERS (e-mail
addresses) you will have to create the list of users covered by antiviral protection
(see section 4.5 on page 42). With limited MAIL TRAFFIC VOLUME you can set
up an administrator notification regarding the license expiration caused by
reaching the critical volume of the licensed mail traffic (see section 5.2.5 on page
64).

9 Kaspersky Anti-Virus for Unix Mail Servers
1.3. Hardware and software
requirements
In order to function properly, Kaspersky Anti-Virus®needs a system complying
with the following requirements:
• Hardware requirements:
• Intel Pentium-class processor
• 32 Mb of RAM or more
• 100 Mb or more of hard disk space
• Software requirements:
• One of the following operating systems:
o Linux RedHat (version 7.3, 8.0 or 9.0), Linux SuSE (version
8.1 or 8.2) or Linux Debian (version 3.0)
o FreeBSD version 4.7 or 5.0
o OpenBSD version 3.3
• One of the following mail systems: sendmail version 8.x, qmail
version 1.03, Postfix version snapshot_20000529 or higher,
Exim version 4.0
• The Wget program (http://gnu.org/software/wget/wget.html) for
anti-virus database updating using kavupdater.
• The Webmin program (www.webmin.com) for Kaspersky Anti-
Virus®remote administration.
• Perl version 5.0 or higher (www.perl.org) for Kaspersky Anti-
Virus®installation using install.pl.
1.4. Distribution kit
You can purchase Kaspersky Anti-Virus®either from our distributors (retail box)
or in our Internet-shop (www.kaspersky.com, Buy online section).
When purchasing a retail box you will receive the following distribution kit:
• A sealed envelope with an installation CD (or a set of floppy disks)
containing software product files.

Kaspersky Anti-Virus for Unix Mail Servers 10
• Administrator’s guide
• License key
• License agreement.
Before you unseal the envelope containing the CD (or floppy disks), be sure to
thoroughly review the license agreement.
When purchasing Kaspersky Anti-Virus®in the Web-shop you download the
product from Kaspersky Lab’s website. The distribution file contains the product
and the license key.
The License Agreement (LA) is a legal agreement between you (either an
individual or a single entity) and the manufacturer (Kaspersky Labs Ltd.)
describing the terms on which you may employ the anti-virus product, which you
have purchased.
Make sure to read the terms of the LA!
If you do not agree to the terms of this LA, Kaspersky Labs is not willing to
license the software product to you and you should return the unused product to
your Kaspersky Anti-Virus®dealer for a full refund, making sure the envelope
with CD (or diskettes) is sealed.
If you unsealed the envelope, you have agreed to all the terms of the LA.
1.5. Help desk for registered users
Kaspersky Labs offers a large service package enabling legal users to efficiently
employ Kaspersky Anti-Virus®.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:
• daily virus-definition database updates via e-mail;
• product upgrades;
• phone and e-mail advice on matters related to your software installation,
configuration and performance;
• information about new Kaspersky Labs products and new computer
viruses (for those who subscribe to our newsletter).
Kaspersky Labs does not give advice on the performance and use of
your operating system or various other technologies.

11 Kaspersky Anti-Virus for Unix Mail Servers
1.6. Conventions
In this book we use various conventions to emphasize different meaningful parts
of the documentation.
Convention Meaning
Bold font Menu titles, commands, window titles,
dialog elements, etc.
Note.
Additional information, notes
Attention!
Very important information
To do this,
1. Step 1.
2. …
Actions that must be taken
Task
Example of a user defined task to be
accomplished using this program.
Solution
Solution of the task.
[switch] – function of the switch. Command line switches
Info message text Text of the configuration files and
information messages of the program.

CHAPTER 2. TYPICAL
PATTERNS OF PRODUCT
DEPLOYMENT
Depending on the initial architecture of the mail server, we offer several variants
of deployment of Kaspersky Anti-Virus®for Unix Mail Servers:
• On a single mail server with mail system. This variant is used when the
server has an installed and adjusted mail system sendmail, qmail, Postfix
or Exim (see section 2.2 on page 14).
• On a dedicated server as a secondary filter: This method is
recommended when the primary mail server is running an unsupported
operating and mail system (see section 2.4 on page 17).
• On a single server with mail system as a secondary filter: This variant of
deployment is recommended in the event that a mail filter, such as
Kaspersky Anti-Spam, is installed on the mail server (see section 2.3 on
page 16).
• As a filter for external mailboxes. This method of deployment is useful in
the event that mail server users have their mailboxes on external servers
and it is necessary to provide antiviral protection of downloaded mail
messages (see section 2.5 on page 19).
In all the cases mentioned above, besides filtering mail traffic, Kaspersky Anti-
Virus®can also scan all mounted file systems.
Prior to studying the above deployment patterns in detail, we shall review the
internal architecture of Kaspersky Anti-Virus®in order to fully understand its
operation algorithm.
2.1. Internal architecture of
Kaspersky Anti-Virus®
When using Kaspersky Anti-Virus®, it is important to understand the operation
algorithm.
In this section, we shall review the product’s internal architecture, especially as
applied to mail traffic scanning , since the process of scanning server file
systems is quite simple and does not require a special in-depth study.

13 Kaspersky Anti-Virus for Unix Mail Servers
It should be noted that Kaspersky Anti-Virus®is only developed to filter mail
against viruses and does not constitute a mail agent capable of receiving and
routing mail traffic. This is carried out by a mail system installed on the server
with which the anti-virus program is integrated after installation.
Let us use the sendmail mail system as an example to take a detailed look at the
internal operation algorithm of Kaspersky Anti-Virus®for Unix Mail Servers after
its integration with the mail system (see Figure 1).
It should be noted that in the process of anti-virus integration into the
sendmail mail system, an additional configuration file sendmail.cf.listen
is created.
When started with this configuration file, sendmail receives mail traffic
and passes it to Kaspersky Anti-Virus®for scanning. If started with the
original configuration file (sendmail.cf), it delivers mail messages
received from the anti-virus.
Thus, the operation algorithm is as follows:
1. Mail traffic is received by sendmail via the SMTP protocol (configuration
file sendmail.cf.listen). sendmail creates a queue, in which it stores the
incoming mail and passes it via the LMTP protocol to the smtpscanner
component for scanning.
2. The smtpscanner component processes the mail traffic according to its
settings. The process of scanning and cleaning is carried out in the
following way:
• Smtpscanner passes the file name of the mail message to the
aveserver component using the local socket.
• Aveserver scans and disinfects the object using the anti-virus
database.
• Smtpscanner receives from aveserver a return code that
defines the status of the file.
• Depending on the object status, smtpscanner processes it
according to the configuration file settings.
3. Processed mail traffic with notifications regarding the results of
scanning and cleaning is transferred via the SMTP protocol to the
sendmail mail system (with configuration file sendmail.cf), which
delivers this mail traffic to local users or routes it to other mail servers.

Typical patterns of product deployment 14
Mail server
Kaspersky Anti-Virus
sendmail A smtpscanner
aveserver
queue
SMTP
LMTP SMTP
Anti-virus database
The Internet
sendmail B
queue
SMTP
Figure 1. Internal architecture of
Kaspersky Anti-Virus®for Unix Mail Servers
2.2. Operation on the same server as
mail system
Hereinafter, in review of Kaspersky Anti-Virus®and its setup, this
variant – operation on the same server with mail system – is described!
Installation and operation of Kaspersky Anti-Virus®on the same server as the
mail system is only possible with supported operating systems (Linux, FreeBSD
or OpenBSD).
The following programs can be used as mail systems: sendmail, qmail, Postfix or
Exim.

15 Kaspersky Anti-Virus for Unix Mail Servers
This variant is recommended in case of average specific load of the
mail server.
Let us take a detailed look at the operation of Kaspersky Anti-Virus®on the same
server as any of the above mentioned mail systems (see Figure 2). The
sequence of processing incoming and outgoing mail is identical, and consists of
the following stages:
1. The stream of mail messages comes in from other servers or from the
LAN via the SMTP protocol.
2. The mail system receives the mail traffic and passes it to Kaspersky
Anti-Virus®for scanning.
3. Kaspersky Anti-Virus®processes the mail traffic according to its settings
and returns it to the mail system along with additional set of
notifications.
4. The mail system routes the mail traffic either to external servers or to
mailboxes in the LAN.
Server running UNIX system
Kaspersky Anti-Virus
(filtering)
Mail system
(routing)
Intranet
SMTP on
port 25,
incoming traffic
SMTP
SMTP
The Internet
SMTP on port 25,
outgoing traffic
SMTP,
outgoing traffic
LMTP
Mail system
(reception)
Figure 2. Diagram of Kaspersky Anti-Virus®operation
on the same server as mail system
Based on the above diagram, when installing Kaspersky Anti-Virus®you will
need to adjust the following settings (during the installation or right after it):
• Set the mail server port on which Kaspersky Anti-Virus®will operate.
• Set the mail system port that it will use to receive mail from Kaspersky
Anti-Virus®after filtering.

Typical patterns of product deployment 16
2.3. Operation as the secondary
filter
Kaspersky Anti-Virus®can be used as either a primary or a secondary filter. If
your mail server had a mail traffic filter when Kaspersky Anti-Virus®was installed,
you have to define which of the mail filters (Kaspersky Anti-Virus®or the one
installed earlier) will be the primary filter and which will be secondary. Selection
criterion is by the filtering method.
The primary filter (we shall call this MX1) is the one that filters mail traffic based
on the sender’s IP address. Such a filter is installed as the first one on the
server’s 25th port. It receives incoming mail, filters it, and then passes it to the
secondary filter for processing. The secondary filter (we shall call this MX2) is
installed on the same host as the primary one but is assigned another IP address
and another port.
If no filter based on the sender’s IP address is installed on your server, you can
install Kaspersky Anti-Virus®as a primary filter. In the event that an IP-based
filter is installed, install the anti-virus as a secondary filter. The reason for this is
that all the mail traffic scanned by Kaspersky Anti-Virus®goes out from the same
IP-address. Therefore, filtering mail by IP after anti-virus processing will make no
sense.
Server running UNIX system
Intranet
SMTP on
port 25,
incoming
traffic
SMTP
The Internet
Filter
(filtering)
MX1
SMTP
SMTP,
outgoing
traffic
SMTP on
port 25,
outgoing traffic
Anti-virus filter
(MX2)
Figure 3. Diagram of Kaspersky Anti-Virus®operation
as a secondary filter on the same server with the mail system
Make the following settings for the primary and the secondary filters:
• Primary filter (MX1) settings:
Name of the host where the filter is installed: mx1.yourhost.domain
The filter’s IP address: all the available.

17 Kaspersky Anti-Virus for Unix Mail Servers
Number of the port through which the filter works: 25.
Host name for mail sending: mx2.yourhost.domain:10026
• Secondary filter (MX2) settings:
Name of the host where the filter is installed: mx2.yourhost.domain
The filter’s IP address: 127.0.0.1
Number of the port, through which the filter works: 10026
Host name the mail is received from: mx1.yourhost.domain
MX1 and MX2 must have different host names since the server will not
accept a message if host names in the helo/ehlo dialog are the same.
MX2 must be trusted for MX1 and vice versa, otherwise delivery will fail.
2.4. Operation on a dedicated server
Kaspersky Anti-Virus®for Unix Mail Servers can filter mail traffic and carry out its
anti-virus processing even if your mail server is running another operating
system, for example Windows.
In this situation, Kaspersky Anti-Virus®is installed on a dedicated server running
Linux, FreeBSD or OpenBSD.
In order to receive mail traffic and forward it to the mail server running Windows,
besides the anti-virus, a mail system (sendmail, qmail, Postfix or Exim) is
installed on the dedicated server and integrated with Kaspersky Anti-Virus®(see
section 4.4 on page 35).
With this layout, the operation has the following sequence (see Figure 4):
• Mail traffic is received by the server running a Unix-family operating
system.
• The mail system (e.g. qmail) forwards it to Kaspersky Anti-Virus®via the
LMTP protocol for scanning.
• Checked mail with notifications created by the anti-virus is passed back to
the mail system, which in turn forwards it to the main mail server for
delivery or further routing.

Typical patterns of product deployment 18
Server running UNIX system
IntranetThe Internet
Server running Windows
SMTP on
port 25,
incoming traffic
SMTP on
port 25,
outgoing traffic
Mail system
(routing)
MX2
SMTP
SMTP/MAPI/
POP3/IMAP,
incoming traffic
SMTP,
outgoing traffic
Anti-virus filter (MX2)
Figure 4. Diagram of Kaspersky Anti-Virus®operation on a dedicated server
On the above diagram, the server with Kaspersky Anti-Virus®installed is the
primary server since it receives mail traffic and resends it, while the server with
MS Exchange is the secondary one, which only delivers mail.
However, if prior to installation of Kaspersky Anti-Virus®your mail server had
been used for filtering messages by senders’ IP addresses, then the server with
Kaspersky Anti-Virus®must be defined as secondary. The reason is that if you
make the server with the anti-virus a primary one, then all the mail messages will
be received by the secondary server (with IP filtering) from the same IP address,
thus making filtering impossible.
If there are mail servers within your LAN, then the MX-records or
forwarding parameters must point to the primary server, not the
secondary one.
• Primary filter (MX1) settings:
Name of the host where the filter is installed: mx1.yourhost.domain
Host name for mail forwarding: mx2.yourhost.domain
• Secondary filter (MX2) settings:
Name of the host where the filter is installed: mx2.yourhost.domain
Host name from which the mail is received: mx1.yourhost.domain

19 Kaspersky Anti-Virus for Unix Mail Servers
2.5. Filtering mail received from
external mailboxes
Nowadays, external mailboxes on servers like www.mail.ru, www.aport.ru,
www.hotmail.com etc. are widely used.
How can infection be prevented when downloading infected messages from such
mailboxes? In fact, this mail is delivered via the POP3 protocol, while Kaspersky
Anti-Virus®only scans mail traffic that uses the SMTP protocol.
In order to ensure antiviral protection of external mail the following is required:
1. Block port 110 and give users simple access to the external mail and
make the gateway work as a proxy-server for POP3 using the fetchmail
package. This package downloads mail messages from external servers
and sends them to the local SMTP port. This is exactly what we need,
since after their coming to the SMTP port the messages are scanned by
Kaspersky Anti-Virus®.
Filtering mail from external mailboxes requires a local SMTP
server and a local user account on the computer where the
fetchmail package is installed!
Adjustment of fetchmail is very simple: every user in the directory $HOME
has a file .fetcmailrc, containing at least the following lines:
set postmaster "user"
set bouncemail
set no spambounce
set properties ""
poll mail.that.is.free.ru with proto POP3
user 'remote_user' there with password 'pass12345'
is 'user' here
poll mail2.that.is.free.ru with proto POP3
user 'remote_user2' there with password 'pass123452'
is 'user' here
where:
user is the user’s name in the local network.
mail.that.is.free.ru and mail2.that.is.free.ru are names of the hosts from
which we need to collect mail.
remote_user and remote_user2 are logins for the servers
mail.that.is.free.ru and mail2.that.is.free.ru, respectively.