Slashdot Mirror
Server Side Virus Scanning Options?
Unknown Relic asks: "Because of the number of virii which are propagated through email, and the tendancy for some users to open executable attachments no matter what they are told, we have decided to seek out a server side solution. We are currently running Linux with qmail on the server side, and while a we have found a couple of products which may fit the bill, I wanted to hear about the experiences and recommendations of slashdotters on this subject. Do you or your company make use of a server side virus scanning engine, Open Source or otherwise, and if so what are your impressions?"
The company I work for has a twofold solution which has effectively stopped *anything* from getting through to our system. I haven't seen a virus make it through since it's been implemented.
On the top half, we have an intermediate company called Big Fish scan our e-mail as it comes through, and then it passes it on to our Exchange server. On the Exchange server, we're running Norton Antivirus for Exchange.
The added benefit of the intermediate company, is that they also effectively remove 99% of all spam, and all of my normal e-mail gets through. They save all discarded e-mails so you can see how good of a job it does - so far, it's been perfect.
I'm using mailscanner with exim, it strips out any evil javascript or any attachments that are executable. This seems to work for me.
the tendancy for some users to open executable attachments no matter what they are told
There's two parts to that:
The simplest solution is to strip all executable attachments. Save them somewhere and add a piece of text to the mail saying
Attachment 'blah.exe' stripped for virus protection. To get a copy of this attachment please call the helpdesk and quote 'Attachment Id: 44591'
It's a bit painful, but it stops people from randomly clicking on attachments.
If they need the file they can call the helpdesk and they can release it for them. It tends to work.
You can also throw in the first point of "some users", and have this based on user.
It depends on how you want to balance the factors of:
- Risk of letting a virus through
- Risk of false-positives
- Annoyance to users
- Cost to implement
- Cost to run
You really need to think about those, and come up with a solution that's right for your organisation.Read more of this story at Slashdot.Read more of this story at Slashdot.Read more of this story at Slashdot.
Check out Amavis and Open AntiVirus. I've got them working under courier with some mods with great results. Plus the whole thing is free!
I've been running qmail forever at my place of employment, so when the bosses told me it was finally time to get an anti-Microsoft virus solution on my mail server, I dug around. Everyone seems to be using Sophos, so we went with that. Having used it for just half a month, I am really impressed with it. Easy to update. Fairly quick. I highly recommend it. However, if you do go with it I urge you to look into Sophie.
I'm also using Clam Anti-Virus as a backup. Out of the 3000+ viruses my server has caught so far, only 4 have been caught by ClamAV. Probably don't need it, but hey... anything free is worth keeping around.
I threw spamassassin in there because I was already wasting time scanning -- might as well tag spam. It helps my users filter spam, and they're happier for it. Plus, it gave me stats to throw out there -- nearly 50% of our incoming email that originates off-site email is spam. Scary.
Okay, so here's my setup:
- qmail-scanner
- Sophos (SAVI) + Sophie
- ClamAV (I need to write/find a client like Sophie for it -- it has the daemon, just no client)
- Spamassassin
I'm very happy with our results. My server scans upwards of 20000+ messages a day with the average time of ~4 seconds per message. I could probably get it to scan faster if I dropped ClamAV, which is the slowest piece of the puzzle right now. At any rate, I set it all up in less than a day. Everything was well documented.Good luck.
Without you I'm one step closer to happiness without violence.
I just (as in 2 days ago) set up a sendmail box for about 6,000 accounts which is running sendmail plus the MIMEDefang milter. MIMEDefang strips out invalid attachments (we have a policy not to accept .exe's and a few other files), strips out messages with invalid headers and a few other things, calls McAfee uvscan, and then runs anything left through spamassassin.
It has worked like a charm thus far and with graphdefang (a set of scripts that comes with mimedefang) I can view how many messages are discarded, why they are discarded, how many messages are tagged as spam, how many of what type of virii were cleaned, etc.
I have been quite impressed with the McAfee scanner as well. I have heard nightmares from Windows users who have it installed on their workstations, but it seems to work great on the Unix side. It even comes with a perl script you can set to run in your crontab to download the latest virus definition files.
-Lee
-----BEGIN GEEK CODE BLOCK----- Version: 3.12 GIT d? s: a-- C++++ UL++++ P++ L+++ E- W++ N o-- K- w--- O- M+ V PS+ P
We started using Vexira (http://www.centralcommand.com) Mail-Armor this year. We use Debian/Exim for about 8000 users for a school system. The setup was very simple. Mail-Armor listens on the SMTP port and does real-time scanning of every message that goes through. It then passes the message on to the "real" SMTP server running on a non-standard port. We were initially worried about whether it could keep up with our traffic, but it has been flawless so far. It uses two processes: one listes on the SMTP port and does the scanning while the other processes the queue and passes the messages on to Exim.
It notifies the postmaster and both the sender and receiver when it detects a virus. A cron job runs every night to download the virus definitions. It cost $150 for a school system. The cool thing is that it is licensed by domain, not by # of mailboxes like some products.
Jason
"FORMAT C:" - Kills bugs dead!
[Disclaimer: I work in AV]
If cost is even slightly an issue, I can recommend using qpsmtpd and clamav. The clamav team are pretty fast at adding new virus signatures to their database, and they catch most of the common viruses out there. I've written a qpsmtpd plugin for clamav which you can find here.
I can't honestly recommend Sophos for gateway scanning. They are better on the desktop. If you can I would go for NAI who have the best gateway scanning of the commercially available scanners (according to our live tests).
Alternatively, if a 100% guarantee appeals to you, the company I work for, MessageLabs will give you a 100% guarantee against letting through an email virus. We'll also do spam scanning for you. Yes, I'm biased.
Matt. Want XML + Apache + Stylesheets? Get AxKit.
I've been using RAV Antivirus (specifically their sendmail+libmilter option for linux) to scan my company's mail as it passes through our linux/sendmail mail server. It's done a great job of picking out windows viruses. It's not open-source, but their pricing is very reasonable. I think for scanning 2 domains (their minimum) was $300 initially to purchase it, which comes with 1 year of virus database updates, and $60/year after that to keep getting updates. They don't care about the volume of scanning, just how many email domains you're scanning for. Check them out at http://www.ravantivirus.com.
11*43+456^2
I'm in the middle of writing a HOWTO for the LDP concerning virus scanning on linux. (Wish it was done so I can point you to it).
I don't have my research in front of me, so I have to reply off the top of my head here.
If I was going to do this, I would first select one of those programs that mangles attachments. There are solutions that removes attachments entirely, solutions that detach the attachment and move it to a place where it can be accessed by a link in the email, or solutions that change the extension of the file. I'd suggest the latter solution. If any .vbs, .bat, .exe [...etc] files are renamed to .oldextension.txt, everything is fine. You might want to combine this solution with a rule to filter anything along the lines of .jpg.vbs or the like (which is probably a virus). Remember - If you remove attachments or block emails, please send a message to the sender saying you did. This is business email. The $virus_of_the_month might have attached itself to the CEO's quarterly fiscal report.
That being done, then run all emails through a virus scanner. Again, if you detect a virus, mail the sender explaining what you did and what virus was detected. [Btw, put in a disclaimer - some viruses send out false 'from' addresses in their headers]
That should filter incoming email without a problem. For shares, there are scanners that will integrate themselves with Samba, which will scan files whenever they are changed. I have not seen any real-time scanning solution for other file shares methods though.
If anyone has some more information, please drop an email to dasunt[at]hotmail[dot]com. If I use the information, I'll credit you.