Slashdot Mirror
Open Source AV Proxies and Network Scanners?
Zphbeeblbrox asks: "Our Company is looking to set up a central proxy/gateway for several of our Networks. We would like to investigate some of the Open Source Antivirus Proxy solutions and AntiViral Network Scanning, however the information we have on them is rather sketchy. Have any of you had experience setting up DansGuardian with the Clam-AV plugin or similar such solutions. Additionally the mail proxy with Clam-AV solutions? If you have, what advice and recommendations would you have for us. Do they work and should we consider using something like snort-inline to scan our network traffic for viruses? I have found little by way of comparisons or reviews on them so I'm hoping you will be able to share some of your experiences on their effectiveness."
I have ASSP, it integrates with the ClamAV database. World-Wide Stats as well as my own stats indicate it's blocking viruses. Though I still have some viruses get picked up by my Exchange server, however there are a very large number blocked.
Since I have separate AV on my Exchange server, and had it before the ClamAV integration with ASSP, I never bothered to troubleshoot why ASSP misses some of the viruses that it should be catching.
So based on this, I can't say I'd use it as my only mail AV solution, but then again I haven't tried to either.
... MS Intarweb Connection Sharing and XP Firewall.
http://www.spambayes.org/
Works pretty well, we have about 75 users. Doesn't use much of our P2-450 server running Slackware.
I've got my home network set up behind DansGuardian/Squid and I've been VERY pleased with the results. Dansguardian was easy to get running, and I have been able to apply a large blacklist as well as easily configure allowed and blocked sites.
On the email side, I don't run my own mailserver (ISP blocks port 25) but I use fetchmail to grab POP mail from them, then use procmail rules and Smapassassin to kill SPAM. Works pretty darn well.
I've been meaning to write a howto on this, but.... life intervened. If you want to know more about how/why I did this, please email or post a reply.
Regards,
Anomaly
But Herr Heisenberg, how does the electron know when I'm looking?
You mean, other than "apt-get install exim-heavy dansguardian clamav"? (sarge or newer of course...) And configuring them according to the instructions?
It's not hard. Try it. Shouldn't take more than a few hours. Then come back and give us your report later tonight...
I use ClamAV both at work and home. It's great.
My home setup is just a hosted VPS (previously a real box but I got tired of dealing with hardware issues) running email for myself and my family, plus a couple of mailing lists. I'm using amavis-new to apply both SpamAssassin and ClamAV to mails as a content_filter within Postfix.
Work has to be much higher performance - we use a custom LMTP proxy written in Perl which calls out to the clamd clamav daemon and contains a SpamAssassin instance which has been a lot more seriously tuned. We also run local copies of many RBLs (you generally need to pay to do that, but it's worth it for the saved network traffic if you've got enough spam comming in!)
Interestingly, I did some work on the lmtp proxy just last week so that even when the clamd is down (restarts, etc) it will fall back to calling out to 'clamscan' directly on the spool file and parsing the output.
So yes, especially since ClamAV 0.8, it's been very nice and easy to use - the mail scanning is reliable (haven't had a single virus get through into my mail, but I get around 30-50 virus notifications a day from it - I could probably turn them off, but it's nice to see what sort of traffic is floating around).
Bron.
I'd have to ask, what size company are we talking about? What is the present and immediate future computing environment? Most of the answers that you'll see here are going to be from home users or REALLY small shops.
I haven't used Dan's Guardian as yet. So far, most companies that I have seen that want content control are medium sized(100 users and up). The majority of these are Windows shops so the use MS ISA/Symantec, Novell BorderManager/eTrust, or some hardware based firewall/proxy/filter for content control. They "can't be bothered" with hacking together their own solution.
I have numerous smaller companies(100 users) using Squid/ClamAV to protect the surfers and Postfix/ClamAV to protect the email with stellar results. Both solutions work well, are very fast and would likely scale to much higher loads if given the chance. I see no reason to doubt the capabilities of Dan's Guardian either, I just haven't used it in a corporate environment. But, with Dan's Guardian, the antivirus protection is actually from Squid/ClamAV which works great.
From a mial server point of view amavis with clamd have always worked well for me.
For squid proxy servers have a look at viralator or c-icap.
Dunc
--- Who put this sig here? ---
I have numerous smaller companies(100 users) using
The above should have read: smaller companies(less than 100 users)
I can't get it to work even when using tt tags.
On the other hand...closer examination of the "Symantec Antivirus" logs seems to show that no viruses have been detected in the last week (while ClamAV is still showing viruses being caught), where before one or two were slipping through every day or so. Looks like perhaps whatever had been confounding ClamAV before got worked out and updated in the virus pattern data files.
Hacker Public Radio is our Friend
ClamSMTP is what I use. Nice, light and efficient. It does transparent proxying if you need that too.
http://memberwebs.com/nielsen/software/clamsmtp/
Clam AV seems to be the biggest one out there, but if you're using POP3, P3Scan is worth a try...
The friendliest digital photography forums on the net!
We are planning a Squid implementation to proxy web traffic and there are add-ons to scan for viruses, popups, etc. I can't say how well that works just yet, but I'm very confident it will do the job admirably.
Clamav rocks for me on the mail side. Postfix, Amavisd-new, Clamav, SpamAssassin combine to form a very efficient virus and spam filtering/classifying system.
Get them here:
Postfix
Amavisd-New
Clam antivirus
SpamAssassin at CPAN
You would be particularly interested in header_checks, mime_header_checks and body_checks for Postfix.
I can throw myself at the ground, and miss.
That's the combo we're using to filter all messages for a school district (1600 staff accounts, roughly 8000 student accounts, approx 15 domains). 1 server handles all incoming and outgoing mail, and then it sends the messages off to appropriate mail server. Blocks approx 30,000 viruses and 120,000 spam messages each month. Server is a dual-Athlon-MP 2200+ with 3 GB RAM and 400 GB HD in RAID5 running FreeBSD 5.
Configuration was simple, administration is even simpler.
Looking at possibly adding dspam into the mix.
So what will everyone do when ClamAV starts charging a subscription fee for updates like Nessus and Snort started doing?
They can do any of the following:
Pay for it.
Pay Symantec et al.
Start another free project.
I think that what Snort and Nessus are doing is perfectly fair. Nessus seems to be reasonably priced but, I think that Snort is priced too high and will likely cause a rules community to develop, perhaps even a fork.
It does, and the instructions are shockingly clear and cover several distros. I have it set up on Debian.