Install ClamAV

echo 'deb http://volatile.debian.org/debian-volatile etch/volatile main contrib non-free' >> /etc/apt/sources.list
apt-get update
apt-get install clamav clamav-daemon clamav-docs libgmp3c2 clamav arj unzoo unrar lha clamav-testfiles libcompress-zlib-perl libdigest-md5-perl libemail-valid-perl libfile-readbackwards-perl libfile-scan-perl libmail-spf-query-perl libmail-srs-perl libnet-dns-perl libsys-syslog-perl libnet-ldap-perl libtime-hires-perl mysql-server mysql-client libmysqlclient15-dev 

tail -f /var/log/clamav/freshclam.log

/etc/init.d/clamav-daemon start

clamscan /usr/share/clamav-testfiles/

Install Required Libraries and Test

cd /usr/src
wget http://search.cpan.org/CPAN/authors/id/C/CF/CFABER/File-Scan-ClamAV-1.8.tar.gz
tar -xzvf File-Scan-ClamAV-1.8.tar.gz
cd File-Scan-ClamAV-1.8
perl Makefile.PL
make
make test # I get a lot of errors on this, but it seems to work, so I do the next step
make install

cd /usr/src
wget http://search.cpan.org/CPAN/authors/id/L/LD/LDS/Tie-DBI-1.02.tar.gz
tar -xzvf Tie-DBI-1.02.tar.gz
cd Tie-DBI-1.02 
perl Makefile.PL
make
make test  # again i get errors, but the install goes well
make install

cd /usr/src
wget http://search.cpan.org/CPAN/authors/id/L/LH/LHOWARD/Net-Syslog-0.03.tar.gz
tar -xzvf Net-Syslog-0.03.tar.gz
cd Net-Syslog-0.03
perl Makefile.PL
make
make test
make install

apt-get install libcompress-zlib-perl libdigest-md5-perl libemail-valid-perl libfile-readbackwards-perl libfile-scan-perl libmail-spf-query-perl libmail-srs-perl libnet-dns-perl libsys-syslog-perl libnet-ldap-perl libtime-hires-perl unzip libdbi-perl libplrpc-perl libnet-daemon-perl

#! /usr/bin/perl -w
use File::Scan::ClamAV; # ensure File::Scan::ClamAV is installed
use Net::Syslog; # ensure Net::Syslog is installed
use Tie::RDBM;   # ensure Tie::RDBM is installed
# test configuration of File::Scan::ClamAV
my $av = new File::Scan::ClamAV(port => '/var/run/clamav/clamd.ctl', find_all => 1);
if($av->ping){
       my %found = $av->scan('/usr/share/clamav-testfiles/');
       for my $file (keys %found){
               print "Found virus: $found{$file} in $file\n";
       }
}
1;

perl -w test.pl

Install ASSP

mysql -u root -p # just log in
create database assp;
grant all on assp.* to assp@localhost identified by 'your password here';

cd /usr/src/
wget -c http://surfnet.dl.sourceforge.net/sourceforge/assp/ASSP_1.3.1-Install.zip
mkdir ASSP
cd ASSP
unzip ../ASSP_*-Install.zip
mkdir -p /usr/share/assp/spam
mkdir /usr/share/assp/notspam
mkdir /usr/share/assp/errors
mkdir /usr/share/assp/errors/spam
mkdir /usr/share/assp/errors/notspam
mv -f ASSP/* /usr/share/assp
cd ..
rm -fRv ASSP
chown -R 0.0 /usr/share/assp
cd /usr/share/assp
# this gives us a starting place for spam filtering
# See http://www.asspsmtp.org/wiki/Documentation#Training
lynx http://www.iworld.de/homes/fb/ASSP/S05BB20E1?WasRead=1 # (download spamdb.zip)
unzip spamdb.zip

perl assp.pl

Configure postfix and init.d

• Comment out the line that reads smtp inet n - - - - smtpd
• Add the line ((preserve any additional 'n's) Only if running proxy on your mail server

125  inet  n  -  -  -  -  smtpd

/etc/init.d/postfix restart

#!/bin/sh -e
# Start or stop ASSP
#
# original version by Ivo Schaap <ivo@lineau.nl> had issues on Debian4. Modified by atramos.
PATH=/bin:/usr/bin:/sbin:/usr/sbin
case "$1" in
   start)
      echo -n "Starting the Anti-Spam SMTP Proxy"
      cd /usr/share/assp
      perl assp.pl 2>&1 > /dev/null &
   ;;
   stop)
      echo -n "Stopping the Anti-Spam SMTP Proxy"
      kill -9 `ps ax | grep "perl assp.pl" | grep -v grep | awk '{ print $1 }'`
   ;;
   restart)
      $0 stop || true
      $0 start
   ;;
   *)
   echo "Usage: /etc/init.d/assp {start|stop|restart}"
   exit 1
   ;;
esac
exit 0

chmod 755 /etc/init.d/assp
update-rc.d assp defaults
/etc/init.d/assp start

Configure ASSP

1. Network Setup
   1. SMTP Listen Port = 25
   2. SMTP Destination = IP/Port of your mail server
2. Spam Control
   1. Add Spam Probability Header = Check
3. Relaying
   1. Skip Local domain Check = Check
4. Validate Sender
   1. Block All Remote Sender with Local Domain Address = check
   2. Reversed Lookup = 2 (log only)
   3. Validate Sender Domain MX/A = 2 (log only)
5. Attachment & Viruses
   1. Use ClamAV = check
   2. Port or file socket for ClamAV = /var/run/clamav/clamd.ctl (for Debian)
6. Bayesian Options
   1. Add Bayes Confidence Header = check
7. TestModes
   1. Prepend Spam Subject Testmode = TEST MODE
   2. Prepend Spam Tag = check
   3. BlackDomain Test Mode = check
   4. Helo-Blacklist Test Mode = check
   5. Spam Address Test Mode = check
   6. DNSBL Test Mode = check
   7. URIBL Test Mode = check
   8. Missing MX/A Record Test Mode = check
   9. Reversed Lookup Test Mode = check
   10. Invalid Helo Test Mode = check
   11. Forged Local Helo Test Mode = check
   12. Forged Local Sender Test Mode = check
   13. Message Scoring Test Mode = check
8. Email Interface
   1. Help Address = SpamHelp
   2. Report Spam Address = ThisIsSpam
   3. Report not-Spam Address = NotSpam
   4. Add To Whitelist Address = AddToWhitelist
   5. Remove from Whitelist Address = RemoveFromWhitelist
   6. From Address for Reports = A (possibly valid) admin e-mail address
9. File Paths
   1. Email Whitelist Database File = mysql
   2. Email Redlist Database File = mysql
   3. Delaying Database = mysql
   4. MySQL hostname or IP = localhost
   5. MySQL database name = assp
   6. MySQL username = assp
   7. MySQL password = the dataase password
10. Collecting
    1. Use Subject as Maillog Names = Check
11. Logging
    1. SYSLOG Centralized Logging = Check
12. Server Setup
    1. Run ASSP as a Daemon = Check
    2. My Name = your FQDN
    3. Web Admin Port = Change to some weird port
    4. Web Admin Password = Change this
    5. Jump to the End of the Maillog = check

Optional

cd /usr/share/assp
perl rebuildspamdb.pl

• BRuWRT-FORSSE v2.0
• Easy-SSHd
• Web-Hacking-Portal v2.0
• Perlwd
• Netgh0st v3.0
• YouTube - Thief!
• Netgh0st v2.2
• DomainScan
• ADtrace
• Admin-Tool
• Tartarus v0.1

• 256 MB of system memory (RAM)
• 2 GB of disk space
• Graphics card and monitor capable of 800×600 resolution