Subject: [fwtk-users] Re: Email filtering at the firewall

From: Steve Sandau <[email-masked]>
Date: Tue, 04 Dec 2001 20:59:05 -0500

Last issue of the Linux Journal had an issue on scanning attachments.
Since, as I understand it, smap uses a temporary "holding" directory
(right?), the sheme described in this article might work well.

The author describes the system of scripts he wrote that, in conjunction
with uvscan (McAffee?), decodes and scans attachments with extensions
that are in a predefined list. Sounded good to me, but I have all my
email on one server with just sendmail doing the receiving...

Ken Long wrote:
> 
> Ok, it has become painfully obvious that I can't depend on my users to
> scan attachments before running them. Can anyone recommend a product to
> scan email and block certain extensions that works with smap/sendmail on
> Linux?
> 
> TIA,
> Ken Long
> Lectrosonics, Inc.
> 
> ---
> You are currently subscribed to fwtk-users as: [email-masked]
> To unsubscribe send a blank email to [email-masked]

-- 
Steve Sandau
[email-masked]

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Steve Sandau <[email-masked]>
Date: Thu, 06 Dec 2001 22:55:09 -0500

I don't know whether it was on this list or another, but someone
recently suggested inflex as a solution ot this type of problem. I
downloaded it, installed it on my desktop linux box and found it so easy
to understand and configure (and uninstall) that I installed it on my
production server the next day.

I caught the first virus-ridden attachment 45 minutes after I installed
it. I don't have virus detection software installed on the email server,
I just block certain types of attachments. (If anyone is sending me a
.vbs I don't want it in *any* case!) It works like a charm.

FWIW...

Ted Keller wrote:
> 
> I have used in the past some code based on libmilter.  If you do a search
> on libmilter using your favorite search engine, you should be able to find
> a number of references that will provide the desired filtering through
> sendmail.  These have in the past been quite effective.
> 
> ted keller
> 
> On Tue, 4 Dec 2001, Ken Long wrote:
> 
> > You are currently subscribed to fwtk-users as: [email-masked]

-- 
Steve Sandau
[email-masked]

---

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 27 Mar 2002 11:54:01 -0500

> email on one server with just sendmail doing the receiving...

That was brought to my attention.  AMaViS [A Mail Virus Scanner] can
also do this.  Works best with recent versions of 'sendmail', that
implement "milter"s [mail filters] or with 'postfix'.  I have to admit
that after installing the last version of 'sendmail', I am tempted to
become a fan of 'postfix', sight unseen.

www.amavis.org
www.sendmail.org
www.milter.org
www.postfix.org			[detect a pattern?]

Suggest that you do this on a separate virus-scanning machine.

Yes, 'uvscan' is McAffee's Unix Virus Scanner.

Joe Yao				[email-masked] - Joseph S. D. Yao
OSIS Center Systems Support					EMT-B
-----------------------------------------------------------------------
   This message is not an official statement of OSIS Center policies.

---

---

From: "Michael St. Laurent" <[email-masked]>
Date: Wed, 27 Mar 2002 09:00:54 -0800

Aren't there some opensource virus scanners available?  Are they any good?

-- 
Michael St. Laurent
Hartwell Corporation

> -----Original Message-----
> From: Joseph S D Yao [mailto:[email-masked]] 
> Sent: Wednesday, March 27, 2002 8:54 AM
> To: fwtk-users
> Subject: [fwtk-users] Re: Email filtering at the firewall
> 
> 
www.amavis.org
www.sendmail.org
www.milter.org

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 27 Mar 2002 12:14:33 -0500

> Aren't there some opensource virus scanners available?  Are they any good?

AMaViS.  Yes.  Security mailing lists use it.  Seems to be good and
improving.

--
Joe Yao				[email-masked] - Joseph S. D. Yao
OSIS Center Systems Support					EMT-B
-----------------------------------------------------------------------
	    PLEASE ... send or Cc: all "OSIS Systems Support"
		     mail to [email-masked]
-----------------------------------------------------------------------
   This message is not an official statement of OSIS Center policies.

---

---

From: "Michael St. Laurent" <[email-masked]>
Date: Wed, 27 Mar 2002 09:21:03 -0800

Well, AMaViS _uses_ a virus scanner to scan email.  I was asking about the
scanner itself.

-- 
Michael St. Laurent
Hartwell Corporation

> Sent: Wednesday, March 27, 2002 9:15 AM
> To: fwtk-users

---

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 27 Mar 2002 12:33:12 -0500

> Well, AMaViS _uses_ a virus scanner to scan email.  I was asking about the

Good point, and thanks for the distinction.

Yes, AMaViS' job is disassembling the MIMEd and UUencoded messages, and
calling the actual virus scanner on the parts.

I don't know of any reliable open source virus scanner.  Since it takes
some large amount of effort to maintain virus data tables, I suspect
that you will not find any good "free [as in free beer]" virus scanners.

[Isn't this current mailing list turnaround awesome?  ;-)]

---

---

From: [email-masked]
Date: Wed, 27 Mar 2002 20:54:12 +0300

I think running untrusted binaries (as i see antivirus software) on the 
firewall machine itself is damn bad idea.

The proper way is to write a thing that will communicate with, say, milter
filters.

> > scan email and block certain extensions that works with smap/sendmail on

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

---

From: [email-masked]
Date: Wed, 27 Mar 2002 20:57:49 +0300

It still requires some third-party binary to run.

                                     _     _  _  _  _      _  _

---

---

From: [email-masked]
Date: Wed, 27 Mar 2002 21:00:04 +0300

Having no opensource engines out there really makes me wonder (keeping databases
commercially available that would be nice idea)

                                     _     _  _  _  _      _  _

---

---

From: Tony Gale <[email-masked]>
Date: 27 Mar 2002 17:53:02 +0000

> calling the actual virus scanner on the parts.

If you haven't looked at RAV antivirus I suggest you give it a go,
there's a free trial. Supports:

Sendmail
Qmail
Postfix
CommuniGate Pro
Exim

Not free, but not expensive either.

Don't now if it'll work with the smap/sendmail conbination; i use qmail.

-tony

---