Quoting Simon May ([EMAIL PROTECTED]): > The use of Milters with sendmail is I found the best way to deal with > viruses. > Try http://www.milter.org/ > I'm using panda software perimeter scan for sendmail > http://www.pandasoftware.com/com/downloads/default.asp > Basically, the licence fee covers the virus definitions ... > ----- Original Message ----- > Subject: Re: Re virus scanning emails > > Virus and spam issues are major, especially when a lot of people still > > have users on slow, expensive dialup links. > > > > Collecting a half dozen 20-100kB Klez viruses via pop3 on a 2400bps > > satellite phone link doesn't make people very happy...
Virus scanning can/should be done on reciept of email. POP is about getting mail to the users. Therefore it's off topic of this qpopper list. In that pop is part of general mail, well, so it the use of TCP/IP and if you bring this up on a networking list, it's equally off topic. There are better lists. That said: Sendmail has a Mail Filter API (milter). There are professional Mail Filters out there that perform well (Trend has one; Sendmail, Inc has another (Attachement filter with AV)). Ones that deliver via SMTP are slower and beat on disk, but that may not be an issue for sites with only 50k messages/day. The milter advantage is that it threads heavily. AV engines that listen on a port and can handle this threading don't get hurt by processing 200 messages at a time like the AV engines that save a file to disk, look at them serial and get back to sendmail whenever. The other milter advantage is that it happens during SMTP. So if it's got a virus, then you never accept it (and have to return it). Many AV engines just take mail via SMTP. This means that about ANY MTA can send to it. Sendmail/QMail/Postfix/Exim/SMail/whatever simply relay all mail through the AV box. Bad mails must be returned. My favored strategy for dealing with viruses is to face the fact that almost EVERY email borne virus is, in fact, an OUTLOOK virus. This MUA has a tremendous ability to find attachments in the noise and run them. Mulberry, Eudora, Mozilla, Pine/Windows, etc don't do that.
