Server Side Virus Scanning Options? 46
Unknown Relic asks: "Because of the number of virii which are propagated through email, and the tendancy for some users to open executable attachments no matter what they are told, we have decided to seek out a server side solution. We are currently running Linux with qmail on the server side, and while a we have found a couple of products which may fit the bill, I wanted to hear about the experiences and recommendations of slashdotters on this subject. Do you or your company make use of a server side virus scanning engine, Open Source or otherwise, and if so what are your impressions?"
Re:Virii the word _does not exis_t. Read why. tsar (Score:1)
And it's definitely not offtopic. The word that the article is about is right in the main article.
Anyway, I noticed that you used the word "trolls" in your article above. That would be "trollii".
Unpopular, but... (Score:3, Interesting)
The company I work for has a twofold solution which has effectively stopped *anything* from getting through to our system. I haven't seen a virus make it through since it's been implemented.
On the top half, we have an intermediate company called Big Fish scan our e-mail as it comes through, and then it passes it on to our Exchange server. On the Exchange server, we're running Norton Antivirus for Exchange.
The added benefit of the intermediate company, is that they also effectively remove 99% of all spam, and all of my normal e-mail gets through. They save all discarded e-mails so you can see how good of a job it does - so far, it's been perfect.
Re:Unpopular, but... (Score:1)
Messagelabs [messagelabs.com] and Network associates [nai.com].
No Viruses, Viri, virii or virus from e-mail since we implemented them.
Re:Unpopular, but... (Score:2)
McAfee (Score:2, Interesting)
(Hmm, and it's linux-based. Coincidence? I didn't think so...
Mailscanner (Score:3, Interesting)
Re:Mailscanner (Score:1)
We also use mailscanner [mailscanner.info] here at Southampton (unsurprisingly, given that it's developed locally). It's a capable piece of software, and has a sizeable number of installations worldwide (the maintainer's current conservative underestimate is 7000-8000 sites with a throughput of around 3.5 billion messages per day).
A truly effective method of stopping incomming... (Score:2, Funny)
In the last couple of years many companies have discovered a truly effective method of stopping incomming viruses and spam.
They stopped forwarding money to their ISP's
Define your objectives (Score:4, Informative)
the tendancy for some users to open executable attachments no matter what they are told
There's two parts to that:
The simplest solution is to strip all executable attachments. Save them somewhere and add a piece of text to the mail saying
Attachment 'blah.exe' stripped for virus protection. To get a copy of this attachment please call the helpdesk and quote 'Attachment Id: 44591'
It's a bit painful, but it stops people from randomly clicking on attachments.
If they need the file they can call the helpdesk and they can release it for them. It tends to work.
You can also throw in the first point of "some users", and have this based on user.
It depends on how you want to balance the factors of:
A Solution exists (Score:2)
A virus scanning solution that provides the kind of functionality that you suggest is already out there... However rather than just stripping all attachments, it virus scans them, but also strips any attachments that attempt to hide the fact that they are really executables eg. britney.jpeg.exe
The system requires a virus scanner to be installed and I think they recommend sophos which is available for linux. Check it out here [soton.ac.uk]
Amavis and OAV (Score:3, Informative)
Re:Amavis and OAV (Score:1)
I run it on SuSE 7.something on a Compaq DL with sendmail, Cyrus IMAP and SpamAssassin. We only have 300 or so users and it can keep up with that no problem.
I also scan *outgoing* email, which is a bit trickier to set up but is good for legal reasons and for assuring someone that the Klez virus that they received which appeared to come from one of our users actually did not originate from within our network. I would recommend scanning your outgoing mail; it saves a lot of grief.
The only issue we had was the one regarding notification of the apparent sender of the virus; with so many spoofed senders, I just has to turn it off.
Qmail, Sophos, ClamAV, and Spamassassin (Score:4, Informative)
I've been running qmail forever at my place of employment, so when the bosses told me it was finally time to get an anti-Microsoft virus solution on my mail server, I dug around. Everyone seems to be using Sophos, so we went with that. Having used it for just half a month, I am really impressed with it. Easy to update. Fairly quick. I highly recommend it. However, if you do go with it I urge you to look into Sophie.
I'm also using Clam Anti-Virus as a backup. Out of the 3000+ viruses my server has caught so far, only 4 have been caught by ClamAV. Probably don't need it, but hey... anything free is worth keeping around.
I threw spamassassin in there because I was already wasting time scanning -- might as well tag spam. It helps my users filter spam, and they're happier for it. Plus, it gave me stats to throw out there -- nearly 50% of our incoming email that originates off-site email is spam. Scary.
Okay, so here's my setup:
Good luck.
Re:Qmail, Sophos, ClamAV, and Spamassassin (Score:1)
The users won't be smiling then.
Regards,
John
Re:Qmail, Sophos, ClamAV, and Spamassassin (Score:1)
Personally, I'm not too happy with the four second average time, but if it's blocking Microsoft virii... that's time I don't have to spend cleaning up after Klez.
We also use Norton AV for Exchange (don't even
RAV - Reliable Anti-Virus (Score:2)
Give it a whirl.
Re:RAV - Reliable Anti-Virus (Score:1)
1. The anti-spam locks up sendmail on my system, so I just shut it down.
2. When they say two domains, they mean two fully-qualified domains. For example, say you have three servers... smtp.yourdomain.org and imap.yourdomain.org will be protected, but mail.yourdomain.org is screwed. Of course, the licensing is pretty cheap, so whatever.
CyberSoft (Score:2)
If any virus's were detected the original was wrapped as a MIME attachment to a warning message which contained the report by VFIND.
Thus, users could decide what to do about it.
Of course, when we were spammed this made server load go through the roof, it is probably better either to
1) Move the scanning nearer to sendmail so sendmail throttles a bit earlier to save load eating all your CPU
2) Rename
Sam
Several checks... (Score:2)
Like I said, we have not had any worms get through our mail server. However we did have one person download an attachment from an AOL webmail system. She infected herself and some customers but all her attachments were removed before getting back in to our users. ;-) This too can be stopped by using Squid and some rules about downloadable files. There is a simple explanation of this within this [gentoo.org] nice little security manual from Gentoo [gentoo.org]
Sendmail + MIMEDefang + SpamAssassin + McAfee Here (Score:3, Informative)
It has worked like a charm thus far and with graphdefang (a set of scripts that comes with mimedefang) I can view how many messages are discarded, why they are discarded, how many messages are tagged as spam, how many of what type of virii were cleaned, etc.
I have been quite impressed with the McAfee scanner as well. I have heard nightmares from Windows users who have it installed on their workstations, but it seems to work great on the Unix side. It even comes with a perl script you can set to run in your crontab to download the latest virus definition files.
-Lee
trend micro! (Score:1)
sanitizer? (Score:1)
Re:sanitizer? (Score:1)
Our users (about 60 of them) are fine with it, even though it'll catch the odd legit file from time to time if someone names a file "file.latest.pdf" or something. You can disable this behaviour but we've not seen the need so far.
The only criticism I'd have is that bacause it's procmail and perl based, large attachments (those dang users!) do take a while to pass through our little RedHat PII450 sendmail box, but other than that it's wonderful.
JJ
Vexira Mail-Armor (Score:3, Interesting)
It notifies the postmaster and both the sender and receiver when it detects a virus. A cron job runs every night to download the virus definitions. It cost $150 for a school system. The cool thing is that it is licensed by domain, not by # of mailboxes like some products.
Jason
qpsmtpd + clamav (Score:3, Informative)
If cost is even slightly an issue, I can recommend using qpsmtpd [develooper.com] and clamav [elektrapro.com]. The clamav team are pretty fast at adding new virus signatures to their database, and they catch most of the common viruses out there. I've written a qpsmtpd plugin for clamav which you can find here [perl.org].
I can't honestly recommend Sophos for gateway scanning. They are better on the desktop. If you can I would go for NAI [nai.com] who have the best gateway scanning of the commercially available scanners (according to our live tests).
Alternatively, if a 100% guarantee appeals to you, the company I work for, MessageLabs [messagelabs.com] will give you a 100% guarantee against letting through an email virus. We'll also do spam scanning for you. Yes, I'm biased.
RAV (Score:3, Informative)
I've been using RAV Antivirus (specifically their sendmail+libmilter option for linux) to scan my company's mail as it passes through our linux/sendmail mail server. It's done a great job of picking out windows viruses. It's not open-source, but their pricing is very reasonable. I think for scanning 2 domains (their minimum) was $300 initially to purchase it, which comes with 1 year of virus database updates, and $60/year after that to keep getting updates. They don't care about the volume of scanning, just how many email domains you're scanning for. Check them out at http://www.ravantivirus.com.
Re:RAV (Score:1)
Trend Micro (Score:2, Interesting)
So far I have been very happy with Trend Micro. The only down side I have seen is the cost, but it is not as bad as some others.
Anti-Virus (Score:4, Interesting)
I'm in the middle of writing a HOWTO for the LDP concerning virus scanning on linux. (Wish it was done so I can point you to it).
I don't have my research in front of me, so I have to reply off the top of my head here.
If I was going to do this, I would first select one of those programs that mangles attachments. There are solutions that removes attachments entirely, solutions that detach the attachment and move it to a place where it can be accessed by a link in the email, or solutions that change the extension of the file. I'd suggest the latter solution. If any .vbs, .bat, .exe [...etc] files are renamed to .oldextension.txt, everything is fine. You might want to combine this solution with a rule to filter anything along the lines of .jpg.vbs or the like (which is probably a virus). Remember - If you remove attachments or block emails, please send a message to the sender saying you did. This is business email. The $virus_of_the_month might have attached itself to the CEO's quarterly fiscal report.
That being done, then run all emails through a virus scanner. Again, if you detect a virus, mail the sender explaining what you did and what virus was detected. [Btw, put in a disclaimer - some viruses send out false 'from' addresses in their headers]
That should filter incoming email without a problem. For shares, there are scanners that will integrate themselves with Samba, which will scan files whenever they are changed. I have not seen any real-time scanning solution for other file shares methods though.
If anyone has some more information, please drop an email to dasunt[at]hotmail[dot]com. If I use the information, I'll credit you.
sophos and mailscanner (Score:2, Informative)
It was easy to modify the mail messages (plain text and html versions) that were sent to me and to the intended recipients when something was detected. Lots of options, and easy to configure.
drweb (Score:1)