Slashdot Mirror

I've found the easiest way to implement SpamAssassin is to invoke it through MailScanner. MailScanner uses third-party virus scanners and can optionally invoke SpamAssassin as well. With the free ClamAV antivirus product, you can build a powerful open source mail scanner. Even without a virus scanner, MailScanner detects and quarantines executable attachments and other dangerous content which represent the most common types of mail-borne viruses and worms.

RedHat installs the daemonized version of SA as well as the SA Perl scripts. Using the daemon, the easiest implementation is to invoke SA in /etc/procmailrc on the mail delivery host; for mail gateways running sendmail, you need to use the milter interface. I've found the MailScanner+SpamAssassin approach much easier to configure than either of these methods, and you get virus scanning to boot!

I suspect if the reviewer had compared SA 2.60+ to the commercial products, rather than the older 2.44 version used in the review, SA would have shown better results.

I'd agree with the reviewer that one of the things SA lacks is an easy method for users to interact directly with the program. (Part of the issue has to do with security; SA runs as root. As I read the review, I wondered how the other products allow users to interact directly with the scanners without sacrificing security.) It's not easy to maintain per-user Bayesian filtering, for instance, but I generally recommend having the mail client, e.g., Mozilla, handle these tasks.

This can be a *big* problem for *nix/mac users which normally don't need or use AV software.

• 139 out of 338 discarded mails
• 188 out of 423
• 169 out of 397
• 113 out of 267
• 143 out of 238
• 179 out of 347
• 228 out of 424

Look at Clam AV for a great, free Linux based antivirus program. With the use of the 'freshclam' command and cron in Linux, you can have the system update it's virus database daily (or as many times a day as you want). The 'clamscan' command is good for an overall system scan (including the Windows partition). Again, this can be set with cron to happen at a time when no one will be using the laptop (assuming it's left on).

A good free email client?

I live by Evolution myself on the Linux side, but Mozilla's mail client and Thunderbird aren't bad at all.

A handy web browser?

Ditto here about Mozilla for both with Windows and Linux platforms. Lots of very nice features and easy to use.

As far as other software, I would HIGHLY recommend OpenSSH even though it might seem like something that the average user might not use. Mostly because having VPN-like capabilities at no cost is VERY attractive. If you are, at all, technically capable, it's not too hard to get ssh configured for non-CLI tunneling. I use it all the time to work on my Linksys web admin from the outside world without opening port 80 to the outside. :) Someone REALLY needs to write some GUI apps to configure sshd_config and ~/.ssh/config for the average Joe. Consider Cygwin for Windows as that will give you a free ssh server and client.

I'm working on something similar... Exchange/OWA on the net.

There are a couple people who just need to POP their email while away. Perdition POP3-proxy over SSL is a decent solution. Setup POP3 proxy box on a separate network (ie. DMZ) from the Exchange Server and you're set.

There are a few that must have OWA access. For them, set up a reverse proxy with Apache/Squid and get a certificate for this server to communicate with your Exchange/OWA/IIS box.

And forgoodnesssake relay all your email thru something before it hits your virus-protected Exchange box. I suggest a Postfix / Spamassasin / ClamAV setup.

-sid

I couldn't agree with you more.

My beef is with the amount of time I've spent setting up a spam filtering solution for my family at home - with the nature of a lot of the spam that gets sent to me, it scares me that my daughter will one day have an email address of her own.

I currently have a fairly robust system - qmail, qmail-scanner, clamav, spamassassin - that seems to do the trick, and manages to drop 99.99% of the spam I receive.

Mail that has been identified as Spam gets dropped into an IMAP folder so I can do a cursory check once a day to see if any false positives have been caught (2 in the past 6 months - but in both cases it would have been fairly disastrous if I'd missed them).

But why in hell should I have to jump through so many hoops to get an email service that's workable?

Since this morning, my system has had to deal with over 300 spam emails and 500 instances of Worm.Gibe.F - if things carry on the way they are at the moment it won't be long before people start ditching their email accounts

ClamAV.

Picked up some of the momentum behind the failed? stalled? Open AntiVirus.

ClamAV is pretty much Linux command line only, designed for scanning e-mail. It also cannot remove viruses from executables, only detect them. However, it's Free, and that's a Good Thing.

Clam Antivirus is probably what you're looking for. Its viral signatures come from a database maintained by the OpenAntivirus project. Note that Clam aims at protecting Mail Servers by filtering mails content rather than protecting Desktops.

You could try Clamav from http://clamav.elektrapro.com/
Lightwieght, GPLed, has current signatures, doesn't have a lot of older stuff, so the number of signatures is a lot smaller. It has so far caught everything Sophos and Trend have, and then more.

I've been using clamav for virus scanning since it appeared in Debian unstable. It is used by amavisd-new for virus scanning and with spamassassin for spam scanning of my incoming (and outgoing) email. Amavisd-new is then integrated with postfix and cyrus-imapd (2.1.x) for my mail server. Works like a champ on a Power Mac 8600/200 with 512MB RAM!

The only problem with using clamav is that it needs more mirrors to distribute the virus definitions. The main virus definition download site was down over this past weekend, I'm guessing because of the BugBear.B worm.

I've been using clamav for virus scanning since it appeared in Debian unstable. It is used by amavisd-new for virus scanning and with spamassassin for spam scanning of my incoming (and outgoing) email. Amavisd-new is then integrated with postfix and cyrus-imapd (2.1.x) for my mail server. Works like a champ on a Power Mac 8600/200 with 512MB RAM!

The only problem with using clamav is that it needs more mirrors to distribute the virus definitions. The main virus definition download site was down over this past weekend, I'm guessing because of the BugBear.B worm.

You know the old saying: when life throws you a curve ball, make lemonade. Or something like that.

I think we all agree that we like multi-platform virus scanning. This just goes to show the biggest advantage of free software: no one can ever take it away from you.

If Microsoft decides to, they can terminate all versions of this product but the Windows versions. If we can get a really effective free alternative, that can never happen. (The very worst thing that can happen is slow updates to the virus definitions.)

I have always thought that anti-virus software was an ideal candidate for free software. Non-coders can easily contribute: whenever they find a virus that the scanner doesn't know, just send it in. (They can find the virus either by using a payware virus scanner, such as Norton Antivirus, or they can find it the hard way by getting it. However they find it, they can send it in.)

Heck, I'd be willing to keep one machine with Windows on it, running Norton, and also run the free scanner on it, just to help out the community.

So, is there a free virus scanner? Yes. Two, actually.

First came OpenAntiVirus. But that project's virus database was last modified in October 2002. The better alternative is ClamAV.

ClamAV is available for a whole bunch of platforms, including Linux and FreeBSD. It can be set up to scan mail on servers. There is a library you can use to add antivirus scanning to your own applications (maybe OpenOffice should do that?).

I hope that lots of people will start running ClamAV, even just as a test project. Remember that you can put ClamAV on as many computers as you want, for free, but you can still buy a few payware virus scanners to hedge your bets if you want to.

If lots of people run ClamAV, and send in viruses that it misses, it should be able to find all the viruses that the payware can find.

steveha

[Disclaimer: I work in AV]

If cost is even slightly an issue, I can recommend using qpsmtpd and clamav. The clamav team are pretty fast at adding new virus signatures to their database, and they catch most of the common viruses out there. I've written a qpsmtpd plugin for clamav which you can find here.

I can't honestly recommend Sophos for gateway scanning. They are better on the desktop. If you can I would go for NAI who have the best gateway scanning of the commercially available scanners (according to our live tests).

Alternatively, if a 100% guarantee appeals to you, the company I work for, MessageLabs will give you a 100% guarantee against letting through an email virus. We'll also do spam scanning for you. Yes, I'm biased.

See also ClamAV which is an Open Source virus scanner that uses the same signature files as OpenAntiVirus but is written in C In the interview, the guy points out that the speed differences are minimal (Clam being slightly slower) but the reason I'd go for C above Java isn't speed but that it's easier to set up etc.

See Clam AntiVirus and OpenAntiVirus.

AmaVis: Antivirus filtering daemon; packaged by most linux distros; multi-threaded (recognized multiple CPU's); sends out email alerts; very configurable; supports many antivirus scanners; works well with postfix; written in Perl; GPL

Clam Antivirus (clamav): virus scanner; written in C; fast; virus definition update tool included; uses virus definitions from the Open Antivirus project; (does not disinfect, just identifies); GPL

SpamAssassin: Perl-based Spam filter; use with Procmail; client-server architecture (one daemon); Perl Artistic License

Our application of the above software seems to work quite well. We server about a thousand users (about 100 "heavy users"), and the average server load rarely gets above 0.21 with a Dual AMD 1500+ MP that provides SMTP, IMAP, and POP all w/SSL enabled.