Slashdot Mirror
Symantec Security Gateway vs. Custom Linux Box?
michaelr asks: "I run several email-based discussion lists. While only members of the lists are allowed to post, I've lately had problems with viruses as they often impersonate the members (or the members themselves are infected). I've identified two solutions: either build a Linux box running SMTP-based antivirus software, or purchase something like the Symantec Gateway Security which includes AV among lots of other things. The street price makes it a little more expensive that a Linux box + AV software, but it seems to be zero maintenance. The problem: the Symantec device is new, and before I place my trust in it, I'd like to know: has anyone had any experience with it, or should I just build the equivalent myself?"
Personally I prefer to do things myself, but you can't do everything all time. So the real question is, if this box comes with support (and what quality that support has), rather the question if you can trust it now. Just like your home made solution, it will have bugs and will need patches/upgrades etc. If you have a channel to report problems to, and they fix it for a resonable subscription price, then go for it. You should also ask, for how long the support will be available (1 year, 10 years, ...).
I have had success setting up OpenBSD with Postfix and RAV.
OpenBSD - Free operating system, similar to Linux if that's your primary exposure to UNIX-like environments. OpenBSD doesn't have all the bells and whistles of Linux, but on the flip side it doesn't have the baggage either. It is very well suited to setting up a secure server. The built in firewalling, IMHO, is one of the things that sets OpenBSD apart from all the others. It's a snap to firewall an OpenBSD server and there are plenty of example configs out there to get you started.
Postfix - Sorry, Sendmail just gives me fits. I don't want to have to have a reference in front of me while configuring my MTA. I know enough about SMTP to make intelligent decisions if my options are put in front of me in English. Postfix does this. Not to mention it is free, it is fast, it is secure and it is a drop-in replacement for Sendmail.
RAV - This is not free software, but it works very well with all of the software named above. RAV is an antivirus program that is called by Postfix. It's very fast, and very effective.
Since you're running a mailing list server, you might want to do some creative de-miming to further increase the effectiveness of your efforts. Other than GPG signatures, most MIME is unwanted anyway.
You'll get 3 hours advance notice of worms like the SQL Slammer...
Ok wtf is this crap doing on slashdot?
At one of my last jobs I used this setup:
Linux + Sendmail + Amavis + Sophos
Once I had it setup I could completely forget about it. Setting up the Amavis with sendmail was a trick, but I had a homebrew sendmail.cf file because of some complications with our mail setup. Once that was done, I signed up for sophos email alerts. From that mail I setup a script to be run when ever one of those mails came through to go out to sophos' website and get the update.
All in all, we never got an email virus coming into our network after that through this box.
Norris/Palin 2012
Fact: We deserve leaders who can kick your ass and field dress your carcass.
The Symantec firewall formerly was known as "Raptor Firewall" or "Axent Raptor Firewall". It is a hybrid firerwall with quite a number of transparent security proxies, whereas Linux machines "only" do stateful plus maybe (standard) proxies for only a limited number of protocols. For a class overview see http://wyae.de/secure_gateway/gateways.php
In my experience the Raptor is(was) quite good and not really comparable to a custom linux machine or off-the-shelf linux firewall (e.g. Astaro) - though I like the latter, too. It's playing in a completely different (IMHO higher) class.
The Raptor's SPs are among most stringent I know of - but can be a real pain to pass through for nearly-compatible stuff. The Notes SMTP gate was infamous for being rejected by Raptor because of RFC-noncompliance...
Apropos "maintenance-free": no forewall is maintenance-free. Never. You'll always have to have a look at the logs, at unusual behavious, etc. The only difference here is wether you have to care about building software patches yourself or to have a company do that for you. But the load of necessary maintenance work still is to be done. If you ignore that, you'll pay the price, probably earlier than later...
Works very well
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
I subscribe to a couple of lists that use Stripmime. Basically, it enforces plaintext-only semantics on list postings. All .exes
vanish, it tries to convert HTML to text, and numerous other
impediments to clear, straightforward, communication are deep-sixed. The license
appears
to be an Old-BSD model (w/advertising clause), and
the author warns it's not so hot on foreign
character sets.
Nonetheless, it's certainly a major goodness in my eyes, and you needn't change anything else about your setup.
The site also points to a program called Demime, which I'm unacquainted with.
I refuse to believe corporations are people until Texas executes one. -- desert rain on http://www.dailykos.com/user/
I am biased but I personally do not trust anything that comes from symantec. haven't for a long time. At my last company I deployed 2 layers of virus protection with postfix+amavis. The mail hub(all inbound mail would come through here first) ran sophos antivirus, the mail leafs ran mcafee antivirus. And yes there were a very small selection of cases when mcafee caught something sophos could not(maybe less then 0.02%). I could never determine if sophos caught something that mcafee could not since when detected the message was immediately blocked. the mail leafs only recieved mail from local users, who, after initial deployment & detection of a few viruses on the internal network never sent out another virus again while I was there. Both Mcafee and Sophos, and others I'm sure have pricing for "server-only" configurations. Mcafee and sophos are kind enough to give you a bunch of different platforms. e.g. ~8 different variants of linux and unix instead of licensing it JUST for linux or JUST for solaris or JUST for freebsd. Sophos goes further last I checked when you license the server version I think they include ALL server OSs, whereas with mcafee my licensing agreement was for UNIX only. Though the more restricted license did reduce the cost quite a bit. And when I say UNIX i mean all UNIX and Linux variants they support.
then I used MRTG to graph virus incidents.
You can use sendmail, MailScanner and the a/v software of your choice (this guy used the linux stand-alone client of mcaffee). Total cost, minus time to set it up, is the price of a stand-alone a/v scanner (under $40). A/v datafile updates can be scripted, so no effort is required from you. You can even plug in SpamAssassin and do some anti-spam stuff.
;)
Never underestimate the power of open source
Since they have the lion's share of the enterprise AV market, and make both Linux and Solaris SMTP scrubbing tools, go with them.
I want to delete my account but Slashdot doesn't allow it.
Hey.
We have 1000 users on our GroupWise postoffice. We used to use a certain third-party tool (Guinevere) to do av scanning and attachment blocking.
Well, when klez came along, that box would regularly bluescreen and just generally pee itself.
Sooooooo,
We redeployed a couple of old (266 mhz) machines as mail exchangers running sendmail and mimedefang. (http://www.roaringpenguin.com/mimedefang/) Works like a charm. MimeDefang is totaly configurable and integrates with sendmail via libmilter.
On a slow day, we process about 1500 messages. On top of that, we block a couple hundred atachments based on file type, most of which are klez and variants.
I am in the process of testing integration with mc'fee's uvscan. I can tell you it works great. We did, of course, throw a little bit more hardware at the problem (a pair of Dell Poweredge 350s) because it has been recognised as a "critical service" and besides, I _really_ don't feel comfortable trusing both my primary and secondary mail exchangers to a couple of aging ppros.
John
See subject. If you need a pointy-clicky GUI for managing messages that have been isolated because they contain a virus, then perhaps add Webmin w/ FileManager to the list. That gets you most of the way.
The Symantec Gateway Security box is actually a Linux box itself but it is EXPENSIVE and not nearly as flexible as a 'homebrew' solution. And it is overkill for doing just mail filtering. I would only suggest the GS if you think that down the road you would like to do IDS, content filtering of web-traffic, etc etc and the people who will be maintaining your setup are not comfortable with Unix.
nuff said! 6 domains, content filtering, anti-virus. Security, performance, reliability in a Celeron900 and 3Gb of filtered mail daily
_________________________________________________
john hardin's procmail sanitizer
www.impsec.org or something. Ok so its more than 4 words. shoot me.
Check Point's Website