Server Side Virus Scanning Options?

Unknown Relic asks: "Because of the number of virii which are propagated through email, and the tendancy for some users to open executable attachments no matter what they are told, we have decided to seek out a server side solution. We are currently running Linux with qmail on the server side, and while a we have found a couple of products which may fit the bill, I wanted to hear about the experiences and recommendations of slashdotters on this subject. Do you or your company make use of a server side virus scanning engine, Open Source or otherwise, and if so what are your impressions?"

Comments

Virii the word _does not exis_t. Read why. tsarkon

[Anonymous Coward]

What's the Plural of `Virus'? What's the Plural of `Virus'? The plural of virus is neither viri nor virii, nor even vira nor virora. It is quite simply viruses, irrespective of context. Here's why.

Sections in this document:

• English Inflections
• Classical Inflections and References
• Journey Into the Fourth Declension (new)
• Other Latin Resources
• ASM News
• ASM News Update (new)
• Footnotes

English Inflections First off, the OED gives nothing but viruses for the plural. Here's its abbreviated entry:

Etymology: a. L. virus slimy liquid, poison, offensive odour or taste. Hence also Fr., Sp., Pg. virus.

1 Venom, such as is emitted by a poisonous animal. Also fig.

2 Path. a A morbid principle or poisonous substance produced in the body as the result of some disease, esp. one capable of being introduced into other persons or animals by inoculations or otherwise and of developing the same disease in them. Now superseded by the next sense.

b Pl. viruses. An infectious organism that is usu. submicroscopic, can multiply only inside certain living host cells (in many cases causing disease) and is now understood to be a non-cellular structure lacking any intrinsic metabolism and usually comprising a DNA or RNA core inside a protein coat (see also quot. 1977). [ Formerly referred to as filterable viruses, their first distinguishing characteristic being the ability to pass through filters that retained bacteria. ]

Other sources that support viruses include Birchfield (n Fowler :-) in Modern English Usage (3rd Edition), and also the Cambridge Encyclopedia of the English Language . Classical Inflections While one would hope that the authoritative sources cited above would suffice, some writers prefer to maintain the classical inflections on some English words, particularly in technical writing. For example, conflicting indexes/indices and minimums/minima are both easily found, depending on the intended audience and use. In that case, what's the classical plural of virus?

The simple answer is that there wasn't one. The longer answer follows.

Writers who, searching for a fancy plural to virus, incorrectly write *viri are doubtless blindly applying an overreaching -us => -i rule. This mis-inflects many words. For example, status and hiatus only change the length of the final vowel; genus goes to genera; corpus goes to corpora. Others are even worse if this rule is mis-applied, like syllabus, caucus, octopus, mandamus, and rebus.

Anyway, Latin already had a word viri, but it was the nominative plural not of virus (slime, poison, or venom), but of vir (man), which as it turns out is also a 2nd declension noun. I do not believe that writers of English who write viri are intentionally speaking of men. And although there actually is a viri form for virus, it's the genitive singular[1], not the nominative plural. And we certainly don't grab for genitive singulars for the plurals when we've started out with a nominative. Such hanky panky would certainly get you talked about, and probably your hand slapped as well.

This apparently invariant use of virus as a genitive singular may also imply that it's 4th declension, as some scholars believe.

Those confused souls who write *virii are tacitly positing the existence of the non-word *virius, and declining it as though it were like filius. It's true that l/r are both linguals that sometimes get interchanged, and that f/v are just a change in voicing[2], but that's just reaching. *Virii is still completely silly, so don't do that; otherwise, everyone will know you're just a blathering script kiddie.

The crucial problem here is that, classically speaking, there appears to be no recorded use of virus in the plural. It was a 2nd declension noun ending in -us, which is rather common, but it was also a neuter, which is rather rare. I could only come up with three such 2nd declension neuters: virus (some poison), pelagus (the sea, usually poetically), and vulgus (the crowd). None appear to admit plurals. Perhaps this is because they are mass nouns, not count nouns. [3]

One citation below wonders whether these -us 2nd declension neuters might have inflected -us => -ora, the way the 3rd declension's neuter plurals for tempus and corpus do. There's really not any support for that notion--that I could find at least. If so, that would end up producing *virora. Most other citations think that these plurals just never happened at all, or that if they did, they didn't jump declensions. Perhaps they were invariant as they oddly are for the vocative and accusative cases. In any event, *virora does not fit comfortably in the mouth of an English speaker, which is a good reason to avoid it.[4]

Another theory holds that virus, if it was a 2nd declension neuter, must go to *vira in the plural as do its -um neuter brethren in the 2nd declension. However, that assumes that it works like a -um form, not as a -us form does. And it really seems to do neither. If it were a -us form (again, as a 2nd declension nominative), then its vocative would have to be *vire; but it's really only virus. You also expect an accusative form *viros, but that too is missing; it's still just virus in the accusative. And if it were a -um form, then its vocative would have to be *virum. But it's not--here again, it's only virus. (Vocative examples of virus are not particularly common. Apparently the Romans seldom addressed their slime in a personal fashion. :-)

So what we have here is something of a mixed or invariant declension. Trying to find a plural for something that didn't take a plural (possibly because it was not a count but a mass noun), or at least, one for which no plural is classically attested, is a fruitless endeavour. Best to stick with English and use viruses. Journey Into the Fourth Declension Some scholars, includining Gavin Betts, believe that virus pertained not to the second declension, but to the fourth one. Here is an example or two that support[5] Betts and dispute the 2nd declension theory. The first is classical, from Ammianus:

qui ut coluber copia virus exuberans natorum

That seems to be using virus as a genitive, which contradicts the assertion that it's 2nd declension, which would have lead to viri, and supports the 4th declension position. This was brought to my attention by Andreas Waschbuesch, who went on to write:

Just another note: You must not forget that Ammian's native tongue was Greek, not Latin - so it's (very hypothetical!) possible he understood virus as a so called accusativus respectus and copia as adverbial expression. (A more common phenomenon in Greek.) exuberare was combined that way with lucrum and there was a tendency to use non-transitive verbs in a (active) transitive way - like anhelare or spumare in late antiquity's Latin as well. (The pseudo-Ciceronian Rhetorica ad Herennium's fourth book is an outstanding exception with its usage of anhelans et spumans in the passage about the denarratio and the following example IF one dates it to 80 a.Chr.n. ...) But - to make a conclusion - it's not classical at all to use the form viri(i), because there isn't any genitive-singular- or nominative-plural-form (*) viri found in the whole Latin literature up to the first century p.Chr.n. as far as PHI-CD-Rom can tell :-)

This recent letter also supports the fourth declension point of view. Of course, even if virus really turns out to have been in the fourth declension, we'll still have vulgus, pelagus, and cetus as irregular -us neuters in the second declension. Let's blame it all on the Greeks. References

Here's what other sources have to say about this matter:

alt.usage.english FAQ Not all Latin words ending in -us had plurals in -i. Apparatus, cantus, coitus, hiatus, impetus, Jesus, nexus, plexus, prospectus, and status were 4th declension in Latin, and had plurals in -us with a long `u'. Corpus, genus, and opus were 3rd declension, with plurals corpora, genera, and opera. Virus is not attested in the plural in Latin, and is of a rare form (2nd declension neuter in -us) that makes it debatable what the Latin plural would have been; the only plural in English is viruses. Omnibus and rebus were not nominative nouns in Latin. Ignoramus was not a noun in Latin.

[...] classical plurals [...] What is the plural of virus? This neuter in Latin lacked a plural; it would presumably [disputable -tchrist ] have been virora like corpora, the plural of neuter corpus. (Like corpora, virora would be stressed on its initial syllable. As indicated earlier, *corpi would be as outlandish--as far beyond the pale--as *rhinoceri and *octopi.)

Latin had several declensions containing neuter, feminine, and masculine words ending in -us; the plurals are different in each one. Incidentally, the singular of mores (pronounced `moh-rehs') is mos, with the same change of `s' to `r' between vowels heard in corpus : corpora and in genus : genera.

Allen and Greenough The authors at the cited reference point out the follwoing:

Many Greek nouns retain their original gender: as, arctus (F.), the Polar Bear; methodus (F.), method.

a. The following in -us are Neuter; their accusative (as with all neuters) is the same as the nominative: pelagus, sea; virus, poison; vulgus (rarely M.), the crowd. They are not found in the plural, except pelagus, which has a rare nominative and accusative plural pelage.

NOTE.--The nominative plural neuter cete, sea monsters, occurs; the nominative singular cetus occurs in Vitruvius.

Whether this leading would lead to ?vire, however, is unclear, since virus does not appear to be of Greek extraction.

Latin inflections And for those who just can't get enough, try this. It is a bunch of inflection tables, more complete than I've seen elsewhere. For a good time, figure out the nominative plural of venus is. Hint: it's not veni. ASM News Apparently this question is `in the air'. The following is from the June 1999 issue of ASM News by the American Society for Microbiology, sent it by Jim Sandoz.

/* Begin Excerpt */

Numerous Latin words have been taken over into the modern scientific vocabulary, most without difficulty. The Latin word virus, however, presents a minor but interesting problem, if one wishes to express a phrase such as Index of Viruses in its Latin form. By analogy with other nouns, one would expect the normal Latin equivalent to be Index Virorum. The difficulty stems from the fact that the Latin noun virus is defective, i.e. does not have a full set of case--forms, singular and plural. The Roman grammarian Priscian (fl. 500 A.D.) states that some claim the word is indeclinable (i.e., has only one form for all the cases in the singular); others, apparently more accurately, that it is declined in the singular according to the second declension neuter and cite two passages from the poet Lucretius in substantiation. All of the ancient grammarians are in agreement, however, that the word is used in the singular only, which indeed appears to be true, for no plural forms are attested in extant Latin works.

In antiquity the word virus had not yet acquired, of course, its current scientific meaning; rather it denoted something like toxicity, venom, a poisonous, deleterious, or unpleasant agent or principle, or poison in the abstract or general sense. (The first meaning given for this word, a slimy liquid, slime, in the most widely used Latin-English dictionaries is inaccurate; the error has been corrected in the more recent Oxford Latin Dictionary.) Nouns denoting entities that are countable pluralize (book, books); nouns denoting noncountable entities do not (except under special circumstances) pluralize (air, mood, valor). The term virus in antiquity appears to have belonged to the latter category, hence the nonexistence of plural forms.

When the word was taken over into modern languages and acquired its current scientific meaning, it changed categories and denoted a countable entity. The modern languages which have adopted the word each pluralize it in their own fashion (e.g., Eng. viruses, Germ. Viren; French and Italian do not distinguish in form between singular and plural, virus). But what to do in neo-Latin, which normally is subject to the rules and constraints of classical Latin?

W. T. Steam in his manual on botanical Latin (Botanical Latin, Newton Abbey, 2nd ed., 1973) gives what would be the normal plural forms of such a second declension neuter noun: nominative vira, genitive virorum, without, however, indicating his authority for those forms. It may be observed that in Latin as in other languages when the plural of noncountable nouns does occur, it generally denotes various kinds of the entity (e.g., wine, honey, oil). Steam may have applied this principle to virus in order to meet the requirements of modern scientific terminology. If Latin had continued to be the common international language of scholars and scientists at the time that viruses were first identified, it appears likely that it would have generated the forms adduced by Steam.

Robert J. Smutny

/* End Excerpt */

ASM News Update The following letter recently appeared in ASM News, from Ton E. van den Bogaard. (Formatting added.)

On the Presence of a Plural of the Latin Noun "Virus"

With interest I read the contribution `On the Absence of a Plural of the Latin Noun ``Virus''' in the June 1999 ASM News, p. 388, by Robert J. Smutny. However, according to my Latin grammar, one of the very few books of my gymnasium (high school) days that is still up to date, the plural of the noun virus in Latin is, like the plural nowadays used for virus in Romance languages (e.g., Italian and French), also virus. The Latin noun virus does not belong to the second declension group but, like the noun fructus, meaning fruit or piece of fruit, belongs to a group of Latin words that is declined according to the fourth declension. Hence, two pieces of fruit is in Latin duo fructus and two viruses would be duo virus. According to the fourth declension the plural genitive of virus in Latin is viruum and therefore an Index of Viruses is in Latin an Index Viruum. Virorum is the plural genitive of the Latin noun vir (second declension) meaning man or husband. Consequently an Index Virorum would indicate a list of husbands or men.

Moreover, because the noun virus belongs to the fourth declension group the study of viruses should have been called virulogy and people practicing that science virulogists. My former professor in virology at veterinary school consequently called himself a virulogist and he lectured virulogy. I am afraid that these words have become extinct since he died.

It is important to realize that Latin and Greek derived expressions in biomedical English have been coined by scientists for convenience and not by scholars based on classical grammar. The old Romans might have said to these scientists modulating their language: ``Ut desint vires, tamen est laudanda voluntas,'' which means freely translated: ``Despite your lack of knowledge, still appreciated.''

Ton E. van den Bogaard
University Maastricht, the Netherlands

Other Latin Resources One textbook I'd like to recommend Gavin Betts's Teach Yourself Latin, which you can look up on Amazon if you'd like. No, I don't believe in kickbacks.

Here are some Web resources: The Perseus Project Read Caesar, Catullus, Cicero, Hirtius, Horace, Livy, Ovid, Plautus, Servius, and Vergil, plus quite a bit of other useful material. For example, you can look up virus for a definition and forms, or find its citations in literature. Here's one by Vergil.

Latin Textbook: Wheelock's Latin (HTML) Wonderful on-line course notes designed as a study aid for those without formal grammar/linguistics training. Note that `the entire zip archive' he advertises isn't really complete, and so I used these commands to pull in and view the whole thing locally: % cd /tmp % wget -r -l2 http://humanum.arts.cuhk.edu.hk/Lexis/Wheelock-Lat in/ % netscape /tmp/humanum.arts.cuhk.edu.hk/Lexis/Wheelock-Latin /index.html

The Classics Page Innumerable links, including some to on-line interactive exercises and to various dictionaries.

Transcriptio Nuntiorum Hebdomadalis Read your daily news--in Latin! Also contains sound files for the radio version whence it was transcribed. I'm sure glad that we now write FAQ instead of interrogata usitatissima. :-)

De Meditatione Various Latin snippets and sound clips. Footnotes [1] One examble of an invariant genitive form of virus is attested in Ammianus, which reads: qui ut coluber copia virus exuberans natorum. See the original for details. [2] Well, in English; in Latin it probably wasn't, as their `v' was likely more akin to the intervocalic `v' in today's Spanish, a sound with no equivalent in English but which is often perceived as a `w'. To be even more technical, an English `v' is a voiced labial-dental fricative. An intervocalic Spanish `v' (or `b') such as in aves, is a voiced bilabial fricative, usually represented in IPA as a lower-case Greek beta. [3] Some budding Romance philologist should go research a possible connection between the neuter conceptual nouns versus the gendered discrete ones in asturianu , the only extant Romance tongue with anything aproximating neuter nouns (I'm not counting the nominalized adjectives of Spanish such as lo difcil, since these aren't really nouns the way the so-called nomes de xneru neutru (de materia) are in asturianu.) a [4] The word virora actually appears to exist, but as some sort of South American tree. [5] Yes, I hated this sentence, too. It takes the singular verb "is" because the singular "an example" is the closer of the two elements in the disjunction, but likewise, "support" should be in the plural because the closer thing to it is now "two", which is obviously nonsingular. I think only a rewrite would be tolerable. Silly rules.

Sections in this document:

• English Inflections
• Classical Inflections and References
• Other Latin Resources
• ASM News
• Footnotes

O tempora, o mores! Senatus haec intellegit. consul videt; hic tamen vivit. Vivit? immo vero etiam in senatum venit, fit publici consilii particeps, notat et designat oculis ad caedem unum quemque nostrum.

Cicero, Oratio in Catilinam Prima, 2

piss@fuck.com Last update: Wed Nov 17 09:20:10 MST 1969

Unpopular, but...

[Tadrith]

The company I work for has a twofold solution which has effectively stopped *anything* from getting through to our system. I haven't seen a virus make it through since it's been implemented.

On the top half, we have an intermediate company called Big Fish scan our e-mail as it comes through, and then it passes it on to our Exchange server. On the Exchange server, we're running Norton Antivirus for Exchange.

The added benefit of the intermediate company, is that they also effectively remove 99% of all spam, and all of my normal e-mail gets through. They save all discarded e-mails so you can see how good of a job it does - so far, it's been perfect.

Re:Unpopular, but...

[alnapp]

same here only its:

Messagelabs and Network associates.
No Viruses, Viri, virii or virus from e-mail since we implemented them.

Re:Unpopular, but...

[Tadrith]

Yeah... I think the really key thing is having two points of protection. The additional services don't seem to be too cost prohibitiive, and the added benefit from them easily pays off. The spam filtering is also a nice bonus, because I *know* I should be getting tons of spam by now. :)

McAfee

[itwerx]

I wouldn't normally recommend Mcafee because their products have had so many problems the last few years but their e500 appliance is actually pretty decent.

(Hmm, and it's linux-based. Coincidence? I didn't think so... :)

Mailscanner

[redcliffe]

I'm using mailscanner with exim, it strips out any evil javascript or any attachments that are executable. This seems to work for me.

Re:Mailscanner

[ngibbins]

We also use mailscanner here at Southampton (unsurprisingly, given that it's developed locally). It's a capable piece of software, and has a sizeable number of installations worldwide (the maintainer's current conservative underestimate is 7000-8000 sites with a throughput of around 3.5 billion messages per day).

Re:Mailscanner

[Anonymous Coward]

Stop using the word "attachments". Use attachmentii. It's more correct.

Re:Virii the word _does not exis_t. Read why. tsar

[cookd]

How long have you been waiting to post this? : )

Surprisingly well written for an offtopic troll. If you weren't an anonymous coward, I would have modded you up!

(You see, I believe that not all offtopic trolls are bad.)

A truly effective method of stopping incomming...

[karmavore]

In the last couple of years many companies have discovered a truly effective method of stopping incomming viruses and spam.

They stopped forwarding money to their ISP's

Define your objectives

[tpv]

You need to decide what it is you want to stop, and then you can evaluate the options.

the tendancy for some users to open executable attachments no matter what they are told

There's two parts to that:

1. some users
2. executable attachments

The simplest solution is to strip all executable attachments. Save them somewhere and add a piece of text to the mail saying
Attachment 'blah.exe' stripped for virus protection. To get a copy of this attachment please call the helpdesk and quote 'Attachment Id: 44591'

It's a bit painful, but it stops people from randomly clicking on attachments.
If they need the file they can call the helpdesk and they can release it for them. It tends to work.

You can also throw in the first point of "some users", and have this based on user.

It depends on how you want to balance the factors of:

• Risk of letting a virus through
• Risk of false-positives
• Annoyance to users
• Cost to implement
• Cost to run

You really need to think about those, and come up with a solution that's right for your organisation.

Amavis and OAV

[mwilson]

Check out Amavis and Open AntiVirus. I've got them working under courier with some mods with great results. Plus the whole thing is free!

Re:Amavis and OAV

[perp]

Me too and I agree it works great. It even unzips zip|tar|jar files and scans all the files in them.

I run it on SuSE 7.something on a Compaq DL with sendmail, Cyrus IMAP and SpamAssassin. We only have 300 or so users and it can keep up with that no problem.

I also scan *outgoing* email, which is a bit trickier to set up but is good for legal reasons and for assuring someone that the Klez virus that they received which appeared to come from one of our users actually did not originate from within our network. I would recommend scanning your outgoing mail; it saves a lot of grief.

The only issue we had was the one regarding notification of the apparent sender of the virus; with so many spoofed senders, I just has to turn it off.

Qmail, Sophos, ClamAV, and Spamassassin

[MaufTarkie]

I've been running qmail forever at my place of employment, so when the bosses told me it was finally time to get an anti-Microsoft virus solution on my mail server, I dug around. Everyone seems to be using Sophos, so we went with that. Having used it for just half a month, I am really impressed with it. Easy to update. Fairly quick. I highly recommend it. However, if you do go with it I urge you to look into Sophie.

I'm also using Clam Anti-Virus as a backup. Out of the 3000+ viruses my server has caught so far, only 4 have been caught by ClamAV. Probably don't need it, but hey... anything free is worth keeping around.

I threw spamassassin in there because I was already wasting time scanning -- might as well tag spam. It helps my users filter spam, and they're happier for it. Plus, it gave me stats to throw out there -- nearly 50% of our incoming email that originates off-site email is spam. Scary.

Okay, so here's my setup:

• qmail-scanner
• Sophos (SAVI) + Sophie
• ClamAV (I need to write/find a client like Sophie for it -- it has the daemon, just no client)
• Spamassassin

I'm very happy with our results. My server scans upwards of 20000+ messages a day with the average time of ~4 seconds per message. I could probably get it to scan faster if I dropped ClamAV, which is the slowest piece of the puzzle right now. At any rate, I set it all up in less than a day. Everything was well documented.

Good luck.

Re:Qmail, Sophos, ClamAV, and Spamassassin

[Anonymous Coward]

It's not "messages" it's messagii. Get it right.

Re:Qmail, Sophos, ClamAV, and Spamassassin

[JohnnyO]

At 4 seconds per message and 20,000 messages, you are using about 93% of your time every day scanning the mail. I hope you can scan multiple messages in parallel, or are planning to get some faster hardware, or you will be soon be buried under a mountain of undelivered, unscanned emails.

The users won't be smiling then.

Regards,
John

Re:Qmail, Sophos, ClamAV, and Spamassassin

[MaufTarkie]

Yeah, it's parallel scanning. The four seconds is the average time -- the box is also doing other things which is taking away CPU time from scanning. My long-term goal is to make the server solely a mail hub, do some spindle-moving, and to write a "sophie/spamc"-style client for ClamAV (or just drop it altogether). That should bring the average time down considerably.

Personally, I'm not too happy with the four second average time, but if it's blocking Microsoft virii... that's time I don't have to spend cleaning up after Klez.

We also use Norton AV for Exchange (don't even /ask/ why we have two separate mail systems), which has 1/10th of the users my server does. Messages on it take longer to scan and deliver (I wish I could give numbers but I don't have access to that information). Since I'm not the NT admin, I'm not sure if that's because the box is set up inefficiently or if it's due to the nature of the relationship between Exchange and Norton.

RAV - Reliable Anti-Virus

[rjamestaylor]

My network is also a Linux-controlled domain running qmail (the E-Smith-Server distribution). We were hit by the "EULA-worm" last week and I decided that it was time to institute server-side controls. Doing a quick search for qmail compatible products I settled on RAV Anti Virus. There's a free 30-day trial for 2 domains. I like it. Very customizable configuration, though proprietary and closed source. It handles spam (to and from us, which is nice), content control (through regexp and/or keywords; for example, "sales projections" to outside domains. . .), and anti-virus protection.

Give it a whirl.

Re:RAV - Reliable Anti-Virus

[darken9999]

My company uses RAV with Sendmail, and it works pretty good. No viruses in the year I've had it running, which is a considerable change from the multiple infections every two months we had before. Two problems, though:

1. The anti-spam locks up sendmail on my system, so I just shut it down.
2. When they say two domains, they mean two fully-qualified domains. For example, say you have three servers... smtp.yourdomain.org and imap.yourdomain.org will be protected, but mail.yourdomain.org is screwed. Of course, the licensing is pretty cheap, so whatever.

CyberSoft

[samjam]

When I worked at bigwig.net we used procmail and CyberSoft's VFIND and recursive archive-scanner.

If any virus's were detected the original was wrapped as a MIME attachment to a warning message which contained the report by VFIND.

Thus, users could decide what to do about it.

Of course, when we were spammed this made server load go through the roof, it is probably better either to

1) Move the scanning nearer to sendmail so sendmail throttles a bit earlier to save load eating all your CPU
2) Rename .scr, .pif, .js etc attachments and warn the user so intelligent users can rename them back.

Sam

Several checks...

[cornice]

There are a number of things I would suggest depending on you risk level. My company used to get hit all the time from mail viruses and worms but I installed Anomy Mail Tools and we have not had a problem since. Anomy will defang and quarantine attachments based on the extension and it will remove harmful javascript. For files that are common and potentially dangerous like Excel and Word files we use the Kaspersky Antivirus to scan the attachment since a simple extension rule won't work.

Like I said, we have not had any worms get through our mail server. However we did have one person download an attachment from an AOL webmail system. She infected herself and some customers but all her attachments were removed before getting back in to our users. ;-) This too can be stopped by using Squid and some rules about downloadable files. There is a simple explanation of this within this nice little security manual from Gentoo

Sendmail + MIMEDefang + SpamAssassin + McAfee Here

[SpaFF]

I just (as in 2 days ago) set up a sendmail box for about 6,000 accounts which is running sendmail plus the MIMEDefang milter. MIMEDefang strips out invalid attachments (we have a policy not to accept .exe's and a few other files), strips out messages with invalid headers and a few other things, calls McAfee uvscan, and then runs anything left through spamassassin.

It has worked like a charm thus far and with graphdefang (a set of scripts that comes with mimedefang) I can view how many messages are discarded, why they are discarded, how many messages are tagged as spam, how many of what type of virii were cleaned, etc.

I have been quite impressed with the McAfee scanner as well. I have heard nightmares from Windows users who have it installed on their workstations, but it seems to work great on the Unix side. It even comes with a perl script you can set to run in your crontab to download the latest virus definition files.

-Lee

trend micro!

[Peartree]

I used to work in the IT Dept at Rankin County (MS). I implemented a mail solution with Linux. One box acted as a mail proxy running TrendMicro VirusWall. The other box that was used for storage ran Sendmail w/ Razor and SpamAssassin. It worked great!

sanitizer?

[joostje]

Nobody uzing sanitizer/a? here?

Re:sanitizer?

[gilgongo]

Yep - we've been using it for almost two years, and have have exactly ZERO virus outbreaks on our network.

Our users (about 60 of them) are fine with it, even though it'll catch the odd legit file from time to time if someone names a file "file.latest.pdf" or something. You can disable this behaviour but we've not seen the need so far.

The only criticism I'd have is that bacause it's procmail and perl based, large attachments (those dang users!) do take a while to pass through our little RedHat PII450 sendmail box, but other than that it's wonderful.

JJ

Get a clue

[Anonymous Coward]

And boxen isn't a word either, but I don't see anyone bitching about its use. Virii is a commonly used slang term when refering to computer viruses. Deal with it.

Re:Get a clue

[Anonymous Coward]

Right, it's boxii.

Vexira Mail-Armor

[JLester]

We started using Vexira (http://www.centralcommand.com) Mail-Armor this year. We use Debian/Exim for about 8000 users for a school system. The setup was very simple. Mail-Armor listens on the SMTP port and does real-time scanning of every message that goes through. It then passes the message on to the "real" SMTP server running on a non-standard port. We were initially worried about whether it could keep up with our traffic, but it has been flawless so far. It uses two processes: one listes on the SMTP port and does the scanning while the other processes the queue and passes the messages on to Exim.

It notifies the postmaster and both the sender and receiver when it detects a virus. A cron job runs every night to download the virus definitions. It cost $150 for a school system. The cool thing is that it is licensed by domain, not by # of mailboxes like some products.

Jason

qpsmtpd + clamav

[Matts]

[Disclaimer: I work in AV]

If cost is even slightly an issue, I can recommend using qpsmtpd and clamav. The clamav team are pretty fast at adding new virus signatures to their database, and they catch most of the common viruses out there. I've written a qpsmtpd plugin for clamav which you can find here.

I can't honestly recommend Sophos for gateway scanning. They are better on the desktop. If you can I would go for NAI who have the best gateway scanning of the commercially available scanners (according to our live tests).

Alternatively, if a 100% guarantee appeals to you, the company I work for, MessageLabs will give you a 100% guarantee against letting through an email virus. We'll also do spam scanning for you. Yes, I'm biased.

RAV

[photon317]

I've been using RAV Antivirus (specifically their sendmail+libmilter option for linux) to scan my company's mail as it passes through our linux/sendmail mail server. It's done a great job of picking out windows viruses. It's not open-source, but their pricing is very reasonable. I think for scanning 2 domains (their minimum) was $300 initially to purchase it, which comes with 1 year of virus database updates, and $60/year after that to keep getting updates. They don't care about the volume of scanning, just how many email domains you're scanning for. Check them out at http://www.ravantivirus.com.

Re:RAV

[iamchris]

I can't agree more. RAV for Qmail is an EXCELLENT product. It is an incredibly simple and seamless integration. The configuration is simple, and the (US) tech support is friendly and knowledgable, IMO. The price is very reasonable, even for the extra domains. The latest version has optional "push" updates so that new virus outbreaks can be taken care of quickly and easily. It melts the standard RAV engine right into the Qmail config be replacing qmail-queue. As a bonus you can use the ravav engine for other scanning jobs.

Trend Micro

[russward662]

We have been using Trend Micro since before I started here. RIght now we have an Exchange 2000 server with Trend Micro installed. We process around 10 million messages a month.

So far I have been very happy with Trend Micro. The only down side I have seen is the cost, but it is not as bad as some others.

political/ethical issues

[Anonymous Coward]

word on the street corners i hang out on is that exim+exiscan+sophie+spamassassin is pretty good for attacking emails at SMTP time.

however, if you're serving a large (40K+?) number of users who fall under an 'anarchic' AUP rather than a 'fascist' AUP they might grumble. alternatively your legal dept might have privacy issues.

notably, it's okay to mess with email originating within your domain but incoming email ought to be treated differently, perhaps. some users (or departments) might want to opt out of your blanket sweeps and look after things themselves.

in this case how do you provide differentiated qualities of service for opt-in and opt-out users? those opting out won't want to have their mail delayed by MTA's that are loaded up checking other emails for viruses or spam.

spam is tricky - tagging with headers is a better option than dropping or bouncing because of the great risk of false positives.

finally, drive home the message that this is just one in a series of defences against viruses and spam, and users should be encouraged to take advantage of site licences to run their own software, in other words watch out for a false sense of security!

hth.
a.c.

For blocking attachments and content scanning

[Anonymous Coward]

Inflex http://www.pldaniels.com/inflex

Anti-Virus

[dasunt]

I'm in the middle of writing a HOWTO for the LDP concerning virus scanning on linux. (Wish it was done so I can point you to it).

I don't have my research in front of me, so I have to reply off the top of my head here.

If I was going to do this, I would first select one of those programs that mangles attachments. There are solutions that removes attachments entirely, solutions that detach the attachment and move it to a place where it can be accessed by a link in the email, or solutions that change the extension of the file. I'd suggest the latter solution. If any .vbs, .bat, .exe [...etc] files are renamed to .oldextension.txt, everything is fine. You might want to combine this solution with a rule to filter anything along the lines of .jpg.vbs or the like (which is probably a virus). Remember - If you remove attachments or block emails, please send a message to the sender saying you did. This is business email. The $virus_of_the_month might have attached itself to the CEO's quarterly fiscal report.

That being done, then run all emails through a virus scanner. Again, if you detect a virus, mail the sender explaining what you did and what virus was detected. [Btw, put in a disclaimer - some viruses send out false 'from' addresses in their headers]

That should filter incoming email without a problem. For shares, there are scanners that will integrate themselves with Samba, which will scan files whenever they are changed. I have not seen any real-time scanning solution for other file shares methods though.

If anyone has some more information, please drop an email to dasunt[at]hotmail[dot]com. If I use the information, I'll credit you.

Re:Virii the word _does not exis_t. Read why. tsar

[PD]

It's not a troll, and it's not offtopic. That article has existed on the internet for a long time, written by someone who was as horrified by the use of virii as I'm sure most of us are.

And it's definitely not offtopic. The word that the article is about is right in the main article.

Anyway, I noticed that you used the word "trolls" in your article above. That would be "trollii". :-)

A Solution exists

[Manic Miner]

A virus scanning solution that provides the kind of functionality that you suggest is already out there... However rather than just stripping all attachments, it virus scans them, but also strips any attachments that attempt to hide the fact that they are really executables eg. britney.jpeg.exe

The system requires a virus scanner to be installed and I think they recommend sophos which is available for linux. Check it out here

sophos and mailscanner

[jmlyle]

I used Sophos and mailscanner on linux to protect our company. They worked great. I had a script get virus updates twice a day from the Sophos site and incorporate them into the scan. Once a month, they sent a CD with an engine update which just dropped in the directory.

It was easy to modify the mail messages (plain text and html versions) that were sent to me and to the intended recipients when something was detected. Lots of options, and easy to configure.

Vexira Anti-Virus

[Anonymous Coward]

Most anti-virus software runs on Windows operating systems (for obvious reasons).

If you're looking for a solution to run on a Linux server (but still check for MS viruses), check out Vexira antivirus. It is inexpensive, automatically updates via cron, unpacks attachments (even multiple levels), and has an integrated virus checker. It can check incoming or outgoing email, or both.

I installed it about 3 weeks ago and I'm very happy with the results. It can be installed as a sendmail "Milter" if you're running a very recent version of sendmail, or as a separate SMTP server that passes the mail along to sendmail via a pipe or a different port (once it's been checked). They have a trial version so you can see if it will work before you buy it.

Most other email virus checkers require a separate program to virus check-- which means you need a MS virus checker that runs under Linux, such as Kaspersky, f-prot, or Sophos.

sendmail, sophos and Mailscanner

[Orac]

We've been using sendmail+sophos at our big customer sites for well over 18 months now, and it's great. We sailed through the various virus storms (Melissa, klez, etc) without a hiccup.

When we get the monthly update CD we need to do three installs. One is the mail server update, one is the file server update, and one is the user update. The user update is easy, because it's done to the file server, and all user workstations simply update themselves from that. WinNT/2k workstations do it in the background via the system service, and the few Win9X workstations do it next time they log in.

Between the monthly installs we use wget and a couple of trivial scripts to go out to their website every 2 hours and pick up the latest virus definition files. These are automatically applied to each installation, so we're never more than 2 hours behind in the latest virus info.

We haven't yet had a situation where we've heard reports of some new virus that isn't already known to both the server and desktop based virus scanning.

Virii the word _does not exist_ -tsarkon-

[Anonymous Coward]

I like you PD, and when I'm not trolling as AC TSARKON I like you. I read your posts. Thanks for your show of Solidarity!!

I hate the Slash crap editors and the pseudo intellectuals infesting this place. I would call for a vote of no confidence and depose Fat Girl Kneel and Commander Ass Taco and others. I would vote for a person like you. But you have a brain. And people with brains have lives/families/jobs/friends. They do not just make love to keyboards, food and jolt cola.

That being said, I wish you to be an editor here, but know that being a troll or making snide, snarky cynical remarks is far more lofty than being an editor.

Impeach Fat Girl Kneel. Impeach Commander Ass Taco. I call for the removal of all Slashdot editors. Slashdot editors take story bait, spell incorrectly, lie, cheat, use fascist Waffen Schulz Stafauffel techniques and censor people. I think of Himmler, Goebbels when I think of editors moderating.

drweb

[mdaitc]

I have to say, i quite like Dr Web[SALD.com is their english mirror]. Although it's written by some Russians, it seems very good. Worth having a look at it. Integrates nicely in MTAs such as postfix, sendmail.