Slashdot Mirror
Best Antivirus Options for a Mailserver?
CSIP asks: "I am setting up a small mailserver, with ~500 users, across 80 domains. I'm planning to use qmail-scanner and an antivirus scanner to block incoming viruses. I would prefer to use ClamAV, however I've read conflicting reports on its effectiveness. The commercial scanners appear to detect 99.X% however they are licensed per-user, which at 500+ users becomes quite the annual bill.
What is everyone's experience with ClamAV? Are their other commercial scanners that allow you to license on a per-server basis?" The best indicator of quality for a virus scanner is the information in its virus database. How do ClamAV's virus definitions compare to commercial scanners, like McAfee's?
Using a fuzzy checksum tool like DCC to block similarly worded messages. It will catch both spams and viruses.
Most viruses spread so quickly that the AV tools' databases are inevitably out of date and ineffective.
While you are at it you might as well suggest converting it all to postal mail, and irridating it to prevent the spread of anthrax.
I don't know how many virus signatures it detects, but I can say that our company of only 30 ppl has yet to receive a virus through Clam.
We did have Norton AV/Exchange running when we used exchange as a front line server. It was also pretty good about viruses except for the first day of CodeRed I believe where it was 1/2 after the first emails showed up. We only paid once and the updates never seemed to discontinue after the year, so maybe its just support/assurance that you're paying for. Consult the contract if in doubt.
Bye!
Now, granted, with 500 users, I'm going to assume that is not an option for you as people likely send files back and forth via email quite often.
Still, I just wanted to point out that blocking email with attachments is probably the most effective antivirus option for a mailserver, though certainly not the best solution.
There's a good post detailing the ClamAV vs. Commercial question...
To paraphrase, ClamAV's database is generally at least a few days ahead of sophos and sometimes weeks...
ClamAV was written from the ground-up to do mail scanning, so it should be better than commercial scanners that try to be everything to everyone...
The ClamAV client is great for scanning email, but it is best used with another scan engine, such as amavis-ng.
I own a company that uses the ClamAV+Amavis-ng configuration internally and implements the solution for clients. We've never seen a virus come through the system yet.
When you combine these tools with SpamAssassin you have a fairlyy "safe" email system.
~.Evanrude
Not recommending anything in particular, but you can chain together different tools to filter more completely than a single line of defense both against viruses and against spam.
IIRC, at MyCorp, Exchange servers are insulated from the outside by both PerlMX and Tumbleweed.
"Provided by the management for your protection."
I also run a mailserver, but for a company of 50ish, over a dozen or so domains.
At first I converted it from exim to qmail with qmail-scanner, then replaced qmail-smtpd with qpsmtpd.
As we already have licencing for f-prot I used that, but it soon failed to pick up a variant of Swen. So I simple added the clamav plugin and stopped the variant (gibe) dead.
I probably should build some stats on which scanner detects what, but we've only had a few netsky variants before one or the other updated.
With at least the first and second netsky variants it was f-prot which updated first.
If it's a picture or a word document from a friend or colleague then they'll probably end up viewing it in their browser and if it's a binary, provided it came from a trusted source, they can download it (make sure to give them an option to delete it if they'll feel it isn't benign). If it's something they don't recognize and/or from someone they don't recognize, they're going to be a bit more cautious. The idea is that the extra step prevents people who open all attachements without thinking or, worse yet, run email clients which allow attachments to rape their computer without their knowing, from harming themselves.
If anyone complains, tell them this is the email version of "Are you sure you want to delete that file?" -- it's a pause that forces reflection that may end up saving them grief. They'll learn to live with the added step and eventually, they'll be glad it's there to protect them.
Using clamAV in combination with qmail (using qmail-scanner and the qmail-queue patch) on a debian box. It's caught a bunch of viruses (most recently all of these stupid doom variants), though I don't know how quickly the definitions are updated. I would imagine that is where the concern would be. I also wouldn't know if viruses made it through, as I run linux on my workstations/laptop. I only installed clamAV to help protect others using my mail server. I haven't heard any complaints so far, though.
It has a very similar licencing scheme to what RAV used to offer (before they were bought out by The Evil Empire. They license by domain, with a maximum of 3000 users.
.deb or whatever other package format your distro uses with the help of Alien). And you could always use it together with ClamAV, to doule-check your mail messages for viruses.
It integrates easily with any MTA (works as a proxy), including my favorite qmail. Runs over Linux and various *BSD's. I've succesfully installed it over Debian (even thought only RPM packages are provided - they can be easily converted to
They also offer an antivirus solution for Samba servers, which provides real-time scanning and blocking of files when opened/closed from the network. It comes with a fixed price for server with an unlimited number of users and shares to protect.
The recomendation may com from a little closer - my company is a Vexira Reseller. But all in all it's a good solution and IMHO it has the most convenient licencing scheme.
For more info visit: Vexira Website.
Regards,
Articulos para gente geek: Poleras, linux, libros y mas
Make sure your mail-server-based AV scanner can check inside attachments that are archives (zip, etc.), and not just individual documents. Many of the latest attachment-based viruses reside inside compressed archives. Also make sure it can tell the difference between an attached file's extension, and it's real format, as sometimes they're sent out with deliberately-incorrect file extensions to get around the more stupid AV scanners.
MyDoom reduced our productivity by 10%.
The ______ Agenda
The biggest reason I have to use ClamAV is because almost no one else supports OS X. I didn't find any besides ClamAV that weren't a all-in-one mail server, which I'm not going to bother with.
If Vexira would have supported OS X when I was looking, I would have bought it.
I've had reasonably good luck with ClamAV. I've found that effectiveness tends to depend on configuration (which I'll get back to).
Some people say that the ironclad test of an A/V app is the number of virus definitions listed. In ClamAV's case (per FreshClam's log output), there are 20372 signatures in the DB. IMO, the number of definitions doesn't really mean much. In my experience, the most important stuff to protect against are the recent outbreaks -- where mail servers are inundated with worm-laiden email. In this case, it's really a matter of how soon the definitions are updated. Generally, I tend to see definitions updated within 12-48 hours of a reported outbreak. Combine this with your update frequency to figure out your expopsure period.
There will be an exposure period regardless of which A/V software you run. Some will have greater average periods than others. Don't rely on marketing information to figure this out. It's a bunch of crap. Real world experience is what counts here -- if you've got lots of experience with these, great. If not, try to find someone who knows their stuff who can give you a good idea for what's what with different apps. I haven't used a ton of these, so I can't give you any ironclad data.
Your configuration will tend to be your greatest asset/worst enemy in terms of finding the best A/V setup for your particular needs. For example -- I automatically block certain types of attachments via qmail-scanner. There's no reason for them -- and they're not worth the risk. I block any attachment with the following extensions (I'm sure that this is not perfect, but whatever): .vbs, lnk, scr, wsh, hta, pif, exe, bat, com, sct, chm, cmd, crt, hlp, hta, isp, pcd, reg, shs, and js. These attachments are all allowed inside of an archive (which ClamAV scan), but I'm willing to roll the dice on exposure to those, since screwing up and opening the attachment is no longer as simple as a single mouseclick.
Finally, I also run client-side A/V. These just aren't as reliable as server-side protection -- users always find wonky things to do with/to their computers...but I like to think of this is a last line of defense. Furthermore, users also tend to check their personal email from work. If you have the hardware to handle it, it might be worth your while to have your users forward their personal email through your service to cover your butt (or enact a policy forbidding users from checking personal email at work)...just be careful about discoverability of their personal email if it comes through your work email (IANAL).
Overall, I'm satisfied with ClamAV/Qmail-Scanner. I'm running it on a system designed for 1000 users (in its current hardware/software configuration) -- scalable to up to about 3000 users. Currently, we're running with around 150 users...in about 2 months, we'll have our new HR/payroll system up which will allow us to add accounts for the rest of our 750 employees (long story). We'll see how good it is once I have a larger userbase to work with. However, my favorite part about ClamAV (and this is the real selling point) is the lack of per-seat fees associated with most commercial AV products. This is the same reason we chose not to use Exchange...those fees are hefty!
-Turkey
We use multiple front end postfix systems with the amavis-spamassassin-clam combo to hand off to a backend Imail server (which could be any backend mail server really), servicing several thousand domains and tens of thousands of end users in those domains. With the auto-updating features setup to check in hourly, we usually have the definitions for the latest worm on the system before it really starts hitting critical mass. When the Mydoom worm (worm.sco.x) came out, the definitions on our servers were updated on the 25th of January, the worm seemed to really start pounding things on the 26th and 27th. Monday morning, it had blocked 10k+ of the little bandit before any had gotten through and I got to read about the unhappy griping of the Norton AV users who hadn't gotten updated in time. It was a case where if we'd used anything but clam, we'd probably have had to deal with plenty of whiney end users (and who wants that?). Now, I'm still not 100% sold on clam, I'll sing its praises, but I'm not going to just use it just yet (so it takes me 6-12 months for me to trust something, call me paranoid). On the actual back end mail server, I'm still using declude to tie into f-prot's scanner. However, since setting up clam, I don't think there's been a single virus that's made it through (going on 5 months now) for it to catch. As Martha would say, "It's a good thing".
With the recent bagle and somefool worms, I was seeing lots of catches by amavis-clam, but it didn't handle the encrypted zips correctly (though word on the mailing lists are there are mods/updates that can be made to start handling them right. I'm just gonna dump all zips for now, those pesky users dont deserve 'em anyways). To answer the original question though? Is Clam ready for primetime? I think so, but erring on the side of caution and having another layer of virus checks in there can't hurt . . . either way, you'll need to keep tabs on it for the next 'catch you by surprise' variant that even the commercial products aren't responding to in time; the more users you are supporting, the higher the probability that you are going to be the one dealing with an account that was one of the first to receive the newest worm . . .
No server based AV solution I know of will stop the latest wave of random password zip viruses. That is because the AV program cannot scan inside the zip file. I've posted a patch to the clamav-users mailing list that marks all password-encrypted zip files as suspect and thus can be quarantined for manual extaction and scanning if desired.
Right now I'm quarantining (with mimedefang and the patched clamav) all encrypted zip files. So far it's 100% hit rate, with no false positives. Unfortunately, ClamAV developers haven't said how they plan to deal with these password zip files.
Overall, once I patched clamav, I was more than pleased. Over the last 2 months Clamav working through mimedefang has saved us from almost all the viruses coming into our server. Updates are daily or more and I have a cron auto-updating them on the hour.
The beauty of having an open source AV was made clear to me today as I modified ClamAV to detect the encrypted zip files. Even though this is more of a stop-gap measure, with any other closed-source program I would have been completely at the vendor/developer's mercy.
That said, using clamav in conjunction with other AV programs in a stack fashion would give you even more coverage if you were worried.
Even if you use pine, you still get tons of junk mail generated by viruses. All those messages must be manually deleted. Depending on various factors, you can get more or less junk virmail, and it's frustrating to delete them by hand. Better let the AV do that for you.
Please don't use a scanner that "quarantines" e-mails that require admin intervention to get back. One of my prior employers created such a beast for their e-mail system, and it would even quarantine e-mails I send to co-workers. The admins of course have slow turn-around times. It ended up easier to use the telephone or FTP, defeating the original convenience and usefulness of e-mail. Even further, it would quarantine totally legitimate stuff from mailing lists. Really crappy stuff.
IMO, it is better to have suspicious e-mail diverted to a "Dangerous, Be Careful" folder with a big Skull-and-Bones air about it, so I can ignore the virus scanner altogether to get at important e-mails.
Also, don't use Windows. Of course, you already knew that, right?
Vote in November. You won't regret it.
We use a Fortinet FG-60 to scan for viruses at the network layer. This has the advantage of also scanning HTTP, VPN, POP3, IMAP, SMTP and FTP traffic and strips the viruses from those streams before it hits your network!
These devices provide VPN support as well as full firewall features. The Fortinet devices start at $500 USD and go all the way up to data center class devices costing >$40,000 USD. Very easy configuration. Worth the cost.
Arf!
- How do virus definitions get into the database? Yes, they depend on community support. But what stops someone from submitting a fake virus signature that will block legitimate email?
- There's the disturbing use of strcpy and strcat in the ClamAV source code. I don't like running software that uses such constructs as root.
Any information on these two issues would be greatly appreciated.I'm not sure if this is a good solution for 500+ usres, but at the company I work for, we use SuSE OpenExchange in combination with Antivir (www.antivir.de) . We've only got about 25-30 users, though.
SuSE OpenExchange's default spamassassin rules are really, really good. I had to make a minor adjustment to one of the rules - and after that it has had zero false positives in addition to taking care of over 99% of the spam we receive. The last month it has blocked about 1500 spam messages to me alone - and not let a single one through. With *zero* false positives. Other employees have the same experience.
I'm not sure if I would recomend using qmail anymore. I tended to love qmail, and has set up qmail based solutions for five different companies. qmail doensn't reject mail to invalid addresses in-smtp-session though (at least not by default), and insteads returns the message afterwards. With all the spoofed mail from:'s, with guessed mail to:'s -- this creates far too many bounce messages in todays virus-ladden environment.
"Rune Kristian Viken" - http://www.nwo.no - arca
I run clamd under daemontools. Crashes take it down for a few seconds at most. Check out this guide
on my mailgateway, as they both can miss the odd one.
I tend to find Clam updates faster, but Sophos's updates need less corrections..
I glue them together with MailScanner (www.mailscanner.info) which also allows men to pop in SpamAssassin to the mix.
On the desktop I use Norton's AV solution so give me a third layer of defence..
Belt and braces.....