Re: [vchkpw] Log all email per domain antivirus that notifies recipients
Hi, most - if not all - of your requirements are met by my QMVC (http://www.fehcom.de/qmail/qmvc.html). At 14:14 22.09.04 -0500, you wrote: Two issues: 1) Using qmail vpopmail, what methods are available to log all inbound and outbound email PER VIRTUAL DOMAIN? Inbound is trivial, outbound can be done via a 2nd Qmail instance. 2) We also need a way to notify the recipient of an email that contained a virus that the infected email was destroyed, and that it came from [EMAIL PROTECTED] with a subject line of whatever it was. QMVC allows per-domain specific filter/configuratoin profiles and message templates. We have a law firm that wants to record all their communications in both directions. We are capturing inbound emails by appending [EMAIL PROTECTED] to the end of everyones .qmail file. What's missing is a way to capture the outbound emails. Texas courts are currently in the process of requiring attorneys to use email to file and update their cases. They are using email as though it was a guaranteed delivery mechanism even though we all know it isn't. This pilot project is expected to go nationwide soon. When the courts send out an email containing a virus (they use Windows boxes), the normal thing for a receiving MTA's virus checker to do is silently throw that email away and not notify anyone. In this case however, that email has legal ramifications so that either we have to let the infected email pass thru the server, extract only the infected portion of the email leaving the rest intact (no idea how to do that), or throw it away but notify the recipient of what was done. The subject line of these emails contains a case number that could be used as follow up by the receiving clerk at the law firm. We currently use qscanq to call clamav for the heavy lifting, but that approach doesn't offer a way to notify anyone of what happened to an infected email - at least not any way I know of. clamav is is natively support by QMVC. We'd like solutions that have per virtual domain granularity so other domains on the box don't have to do things the same way. With QMVC you have - per virtual-domain configuration, - per virtual-domain processing + logging, archiving of logfiles, - per virtual-domain analysis, QMVC html'ized logfiles can be make public. Suggestions? See above. regards. --eh. Dr. Erwin Hoffmann | FEHCom | http://www.fehcom.de/ Wiener Weg 8, 50858 Cologne | T: +49 221 484 4923 | F: ...24
Re: [vchkpw] Log all email per domain antivirus that notifies recipients
Erwin Hoffmann wrote: Hi, most - if not all - of your requirements are met by my QMVC (http://www.fehcom.de/qmail/qmvc.html). Inbound is trivial, outbound can be done via a 2nd Qmail instance. Umm.. Excuse me, but both inbound and outbound logging are already covered by stock qmail (http://cr.yp.to/qmail/faq/admin.html#copies) Whatever he will use as a MDA to check if the messages will be actualy stored to the logging account or just ignored is his choice, either it be procmail/maildrop/qmvc whatever :) And simscan 1.0 has support for per-domain avir/spam. yeah. -- +---+ | Kiril Todorov + System::Network Administrator | +---+ | /* waiting... dreaming... wishing... */ | +---+
Re: [vchkpw] Log all email per domain antivirus that notifies recipients
Hi, At 11:43 23.09.04 +0300, you wrote: Erwin Hoffmann wrote: Hi, most - if not all - of your requirements are met by my QMVC (http://www.fehcom.de/qmail/qmvc.html). Inbound is trivial, outbound can be done via a 2nd Qmail instance. Umm.. Excuse me, but both inbound and outbound logging are already covered by stock qmail (http://cr.yp.to/qmail/faq/admin.html#copies) If you look again at the URL you mentioned and compare it with: http://www.fehcom.de/qmail/qmvc/qmvclog_20030102.html you will realize that logging != logging (sorry for the bad math). Whatever he will use as a MDA to check if the messages will be actualy stored to the logging account or just ignored is his choice, either it be procmail/maildrop/qmvc whatever :) And simscan 1.0 has support for per-domain avir/spam. yeah. Have to have a lookt at it. regards. --eh. Dr. Erwin Hoffmann | FEHCom | http://www.fehcom.de/ Wiener Weg 8, 50858 Cologne | T: +49 221 484 4923 | F: ...24
Re: [vchkpw] Log all email per domain antivirus that notifies recipients
Thank you to all that replied. I'll take a look at qmail-scanner, simscan and QMVC as suggested. In case someone follows this thread in the future, I want to mention that I used the technique referenced via http://cr.yp.to/qmail/faq/admin.html#copies successfully for years. Then I decided to implement virtual domains via vpopmail, and couldn't make it work in the virtual environment, even to a single log for all domains. I don't recall all the tests I ran, but I eventually gave up trying to make it work. There's no logic that I can find to make it support a log per virtual domain in any case. Because the sender of the infected mails is the Texas Court system, normal logic rules don't apply. If the courts have a record of sending a particular email, they record it as successfully contacting the attorneys for the case. If the receiving MTA trashes that email due to a virus, and some court date is missed or document isn't filed as a result, the courts are blameless. Therefore, only something that warns the recipient (clerk @ attorney's office) is of any value, and that warning MUST at a minimum contain the Subject: line as that's the only identifier for what case is involved. If there were a way of eliminating only that portion of the email payload that was infected, and allowing the remainder to hit the recipients inbox, that would be the best solution. Rebuilding an email of only the clean portions isn't something that exists as far as I'm aware. As an aside, how would you like being on the receiving end of this set up? Your case is before the courts, and a virus or anything else disrupts the flow of email. You are, in effect, guilty because something didn't happen as it should have because the courts have declared that email is a guaranteed delivery mechanism. This system is coming to your state, as Texas was used as the test site. This idea is so bad that foreign governments are also likely to pick it up. -- Bill Gradwohl [EMAIL PROTECTED] http://www.ycc.com SPAMstomper Protected email
[vchkpw] Log all email per domain antivirus that notifies recipients
Two issues: 1) Using qmail vpopmail, what methods are available to log all inbound and outbound email PER VIRTUAL DOMAIN? 2) We also need a way to notify the recipient of an email that contained a virus that the infected email was destroyed, and that it came from [EMAIL PROTECTED] with a subject line of whatever it was. We have a law firm that wants to record all their communications in both directions. We are capturing inbound emails by appending [EMAIL PROTECTED] to the end of everyones .qmail file. What's missing is a way to capture the outbound emails. Texas courts are currently in the process of requiring attorneys to use email to file and update their cases. They are using email as though it was a guaranteed delivery mechanism even though we all know it isn't. This pilot project is expected to go nationwide soon. When the courts send out an email containing a virus (they use Windows boxes), the normal thing for a receiving MTA's virus checker to do is silently throw that email away and not notify anyone. In this case however, that email has legal ramifications so that either we have to let the infected email pass thru the server, extract only the infected portion of the email leaving the rest intact (no idea how to do that), or throw it away but notify the recipient of what was done. The subject line of these emails contains a case number that could be used as follow up by the receiving clerk at the law firm. We currently use qscanq to call clamav for the heavy lifting, but that approach doesn't offer a way to notify anyone of what happened to an infected email - at least not any way I know of. We'd like solutions that have per virtual domain granularity so other domains on the box don't have to do things the same way. Suggestions? -- Bill Gradwohl [EMAIL PROTECTED] http://www.ycc.com
Re: [vchkpw] Log all email per domain antivirus that notifies recipients
qmail-scanner can be configured to notify the sender and the recipient of the infected email. On Wed, 22 Sep 2004 14:14:29 -0500, Bill Gradwohl [EMAIL PROTECTED] wrote: Two issues: 1) Using qmail vpopmail, what methods are available to log all inbound and outbound email PER VIRTUAL DOMAIN? 2) We also need a way to notify the recipient of an email that contained a virus that the infected email was destroyed, and that it came from [EMAIL PROTECTED] with a subject line of whatever it was. We have a law firm that wants to record all their communications in both directions. We are capturing inbound emails by appending [EMAIL PROTECTED] to the end of everyones .qmail file. What's missing is a way to capture the outbound emails. Texas courts are currently in the process of requiring attorneys to use email to file and update their cases. They are using email as though it was a guaranteed delivery mechanism even though we all know it isn't. This pilot project is expected to go nationwide soon. When the courts send out an email containing a virus (they use Windows boxes), the normal thing for a receiving MTA's virus checker to do is silently throw that email away and not notify anyone. In this case however, that email has legal ramifications so that either we have to let the infected email pass thru the server, extract only the infected portion of the email leaving the rest intact (no idea how to do that), or throw it away but notify the recipient of what was done. The subject line of these emails contains a case number that could be used as follow up by the receiving clerk at the law firm. We currently use qscanq to call clamav for the heavy lifting, but that approach doesn't offer a way to notify anyone of what happened to an infected email - at least not any way I know of. We'd like solutions that have per virtual domain granularity so other domains on the box don't have to do things the same way. Suggestions? -- Bill Gradwohl [EMAIL PROTECTED] http://www.ycc.com
Re: [vchkpw] Log all email per domain antivirus that notifies recipients
On Wednesday 22 September 2004 02:14 pm, Bill Gradwohl wrote: Two issues: 1) Using qmail vpopmail, what methods are available to log all inbound and outbound email PER VIRTUAL DOMAIN? 2) We also need a way to notify the recipient of an email that contained a virus that the infected email was destroyed, and that it came from [EMAIL PROTECTED] with a subject line of whatever it was. We have a law firm that wants to record all their communications in both directions. We are capturing inbound emails by appending [EMAIL PROTECTED] to the end of everyones .qmail file. What's missing is a way to capture the outbound emails. Texas courts are currently in the process of requiring attorneys to use email to file and update their cases. They are using email as though it was a guaranteed delivery mechanism even though we all know it isn't. This pilot project is expected to go nationwide soon. When the courts send out an email containing a virus (they use Windows boxes), the normal thing for a receiving MTA's virus checker to do is silently throw that email away and not notify anyone. In this case however, that email has legal ramifications so that either we have to let the infected email pass thru the server, extract only the infected portion of the email leaving the rest intact (no idea how to do that), or throw it away but notify the recipient of what was done. The subject line of these emails contains a case number that could be used as follow up by the receiving clerk at the law firm. We currently use qscanq to call clamav for the heavy lifting, but that approach doesn't offer a way to notify anyone of what happened to an infected email - at least not any way I know of. We'd like solutions that have per virtual domain granularity so other domains on the box don't have to do things the same way. Suggestions? simscan might be able to do it. It has per domain support for clamav and spamassassin. A virus causes clamav-simscan-qmail-smtpd to tell the sender MTA to send a bounce message back to the sender with a virus warning message. This is via the standard smtp protocol. simscan would need some clean message code to send through the de-infected message. ripmime will rip the message, if there is an un-rip message program we could problaby write the code. We also might be able to cobble up some code to email a report to someone. Ken Jones Ken Jones
Re: [vchkpw] Log all email per domain antivirus that notifies recipients
On Wednesday 22 September 2004 02:14 pm, Bill Gradwohl wrote: Two issues: 1) Using qmail vpopmail, what methods are available to log all inbound and outbound email PER VIRTUAL DOMAIN? http://cr.yp.to/qmail/faq/admin.html#copies 2) We also need a way to notify the recipient of an email that contained a virus that the infected email was destroyed, and that it came from [EMAIL PROTECTED] with a subject line of whatever it was. [snip] When the courts send out an email containing a virus [...] This never happens. However, qmail-scanner can be configured for different notifications. I, personally, use --notify admin, and the admin address is a virus notification dropbox that I check occasionally. If you're using qmail-scanner, I highly recommend to NOT notify anyone other than 'admin'.. because if you notify the sender, you're just spamming an innocent party, and if you notify the recipient, since they have little to no knowledge about how internet mail works, they might freak out and think that someone has stolen their email address or whatnot. Things such as virus notifications are best left to those with a clue. -Jeremy -- Jeremy Kitchen ++ Systems Administrator ++ Inter7 Internet Technologies, Inc. [EMAIL PROTECTED] ++ www.inter7.com ++ 866.528.3530 ++ 815.776.9465 int'l kitchen @ #qmail #gentoo on EFnet ++ scriptkitchen.com/qmail GnuPG Key ID: 481BF7E2 ++ scriptkitchen.com/kitchen.asc pgpc51TYLvJAl.pgp Description: PGP signature
RE: [vchkpw] Spamassassin + Clamav Antivirus + vpopmail
On Mon, 2004-01-26 at 15:57, Tom Walsh wrote: I know qmail-scanner.pl, but is this a fast method ? Meanwhile.. My Spamassassin needs aproximately 10 seconds for scanning one message. Is this the normal duration ? I use a known spam message as a test bed for tuning performance of our SpamAssassin installation. You can run: cat /path/to/known/spam/message | spamassassin -D you should be using spamc and not spamassassin. spamd/spamc is a much better combination, especially on heavily loaded servers. -Jeremy -- Jeremy Kitchen Systems Administrator [EMAIL PROTECTED] Kitchen @ #qmail on EFNet - Join the party! . Inter7 Internet Technologies, Inc. www.inter7.com 866.528.3530 toll free 847.492.0470 int'l 847.492.0632 fax GNUPG key ID: 93BDD6CE
RE: [vchkpw] Spamassassin + Clamav Antivirus + vpopmail
On Mon, 2004-01-26 at 15:57, Tom Walsh wrote: I know qmail-scanner.pl, but is this a fast method ? Meanwhile.. My Spamassassin needs aproximately 10 seconds for scanning one message. Is this the normal duration ? I use a known spam message as a test bed for tuning performance of our SpamAssassin installation. You can run: cat /path/to/known/spam/message | spamassassin -D you should be using spamc and not spamassassin. spamd/spamc is a much better combination, especially on heavily loaded servers. Jeremy, While you are completely right spamc/spamd are a better combination for performance, there are no debugging abilities in spamc/spamd where as there are many debugging functionalities in the standalone spamassassin script. The purpose of my example was to help troubleshoot a slow spamassassin installation, not to provide a working solution to the problem. I stand by the fact that running spamassassin with the -D comamndline switch is an effective method of testing spamassassin and the various checks that SA performs. Tom Walsh Network Administrator http://www.ala.net/
Re: [vchkpw] Spamassassin + Clamav Antivirus + vpopmail
On Wednesday 28 January 2004 08:07 am, Tom Walsh wrote: [snip] You can run: cat /path/to/known/spam/message | spamassassin -D you should be using spamc and not spamassassin. spamd/spamc is a much better combination, especially on heavily loaded servers. Jeremy, While you are completely right spamc/spamd are a better combination for performance, there are no debugging abilities in spamc/spamd where as there are many debugging functionalities in the standalone spamassassin script. The purpose of my example was to help troubleshoot a slow spamassassin installation, not to provide a working solution to the problem. I stand by the fact that running spamassassin with the -D comamndline switch is an effective method of testing spamassassin and the various checks that SA performs. While that is certainly true, telling spamd to run in the foreground (not adding -d), and to turn on debugging -D is an option, and I'm not sure that it differs at all from running spamassassin -D. From man spamd: NAME spamd - daemonized version of spamassassin SYNOPSIS spamd [options] Options: [snip] -d, --daemonizeDaemonize [snip] -D, --debugPrint debugging messages [snip] -Mark
RE: [vchkpw] Spamassassin + Clamav Antivirus + vpopmail
If anybody is interested in some of the performance tweaks we have made to SA, please let me know. Due to the response I got from this post... I have created a down and dirty SA config page... Please keep in mind these are only configuration tweaks... Not actually changes to the SA software. As always SA is limited by your CPU first, Memory second, and network connection third. Anyways here are the tweaks web page: http://www.expresshosting.net/howto/sa.html Tom Walsh
[vchkpw] Spamassassin + Clamav Antivirus + vpopmail
Hi people ! I want to install Spamassassin and Clam Antivirus with vpopmail ! Do you suggest any high speed scanning tool ? I know qmail-scanner.pl, but is this a fast method ? Meanwhile.. My Spamassassin needs aproximately 10 seconds for scanning one message. Is this the normal duration ? My homegrown Mailserver uses vpopmail/qmail and has about 200 Mails per day :) Thanks very much, knom.
Re: [vchkpw] Spamassassin + Clamav Antivirus + vpopmail
On Monday 26 January 2004 3:22 pm, knom wrote: Hi people ! I want to install Spamassassin and Clam Antivirus with vpopmail ! Do you suggest any high speed scanning tool ? I know qmail-scanner.pl, but is this a fast method ? Meanwhile.. My Spamassassin needs aproximately 10 seconds for scanning one message. Is this the normal duration ? My homegrown Mailserver uses vpopmail/qmail and has about 200 Mails per day :) Thanks very much, knom. I just tested qscanq about 1 hour ago and it's working great. Written in C. http://budney.homeunix.net:8080/users/budney/software/qscanq/index.html You can configure it the use clamdscan. Works great. Ken Jones
RE: [vchkpw] Spamassassin + Clamav Antivirus + vpopmail
I know qmail-scanner.pl, but is this a fast method ? Meanwhile.. My Spamassassin needs aproximately 10 seconds for scanning one message. Is this the normal duration ? I use a known spam message as a test bed for tuning performance of our SpamAssassin installation. You can run: cat /path/to/known/spam/message | spamassassin -D Review the output of this command to determine which processes are taking so long. More than likely you are making DNS calls to RBLs that aren't responding in a timely fashion or are using another service (pyzor, which we have had disabled since December) that is slow to return a response. With proper tuning your SpamAssassin can be made to scan messages in under .6 seconds with a full battary of external tests. (This is even on a 1GHz 512MB AMD Athlon machine.) If anybody is interested in some of the performance tweaks we have made to SA, please let me know. Tom Walsh Network Administrator http://www.ala.net/
Re: [vchkpw] Spamassassin + Clamav Antivirus + vpopmail
Tom Walsh wrote: I know qmail-scanner.pl, but is this a fast method ? Meanwhile.. My Spamassassin needs aproximately 10 seconds for scanning one message. Is this the normal duration ? I use a known spam message as a test bed for tuning performance of our SpamAssassin installation. You can run: cat /path/to/known/spam/message | spamassassin -D Review the output of this command to determine which processes are taking so long. More than likely you are making DNS calls to RBLs that aren't responding in a timely fashion or are using another service (pyzor, which we have had disabled since December) that is slow to return a response. With proper tuning your SpamAssassin can be made to scan messages in under .6 seconds with a full battary of external tests. (This is even on a 1GHz 512MB AMD Athlon machine.) If anybody is interested in some of the performance tweaks we have made to SA, please let me know. Tom Walsh Network Administrator http://www.ala.net/ I would be interested in that. I have been looking at ways to speed up SA's working speed. X-Istence
Re: [vchkpw] Spamassassin + Clamav Antivirus + vpopmail
Hello, qmail-scanner-queue.pl runs spamassassin, razor2, pyzor, clamav, and its own internal scanner, as well as doing rbl lookups, in under 1 second per message, usually about .8 seconds for me. The 10 second delay as someone pointed out is the default timeout for rbl lookups. I had this problem and I recently groomed my rblsmtpd list. I was using servers that were down. The following list may use some services that are a little agressive, though I now have no (known) issues with valid mails being bounced, but in combination with spamassassin, as well as an address known to many spammers (used to get 80+ per day), a few spams make it into my inbox per week. More info about these hosts can be found through their websites. Also, by following /var/log/qmail/smtpd/current, you can follow rblsmtpd's actions, for debugging, etc. FYI: (live, fast responding rbl hosts as of 1/26/03) snip /usr/local/bin/rblsmtpd \ -r sbl-xbl.spamhaus.org \ -r blackholes.mail-abuse.org \ -r list.dsbl.org \ -r bl.spamcop.net \ -r relays.ordb.org \ -r dnsbl.ahbl.org \ /var/qmail/bin/qmail-smtpd \ snip Regards, Alex Martin http://www.rettc.com knom wrote: Hi people ! I want to install Spamassassin and Clam Antivirus with vpopmail ! Do you suggest any high speed scanning tool ? I know qmail-scanner.pl, but is this a fast method ? Meanwhile.. My Spamassassin needs aproximately 10 seconds for scanning one message. Is this the normal duration ? My homegrown Mailserver uses vpopmail/qmail and has about 200 Mails per day :) Thanks very much, knom.
[vchkpw] Panda Antivirus + qmail
hi all, I have qmail+vpopmail+sqwebmail on my server. i have downloaded panda antivirus for linux(Which is free ;-)) i want that all the mails should be scanned by the server. Also, i want the vpopmail to have an option of online scan of attachments. Does any one has similiar experience. Also, if anyone knows any other antivirus software for linux which is free to use can be updated, plz do mail me abt the same. Thanks in advance Tanmaya
Re: [vchkpw] Panda Antivirus + qmail
hi Does ClamAV provides updated virus definitions for new viruses? Regards, Tanmaya - Original Message - From: Rick Macdougall [EMAIL PROTECTED] To: Tanmaya Anand [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Sunday, September 14, 2003 9:18 PM Subject: Re: [vchkpw] Panda Antivirus + qmail Hi, ClamAV - http://clamav.sourceforge.net/ Qmail-Scanner - http://qmail-scanner.sourceforge.net/ Oh and Panda is not free, or at least I do not see a free version on their website. Regards, Rick Tanmaya Anand wrote: hi all, I have qmail+vpopmail+sqwebmail on my server. i have downloaded panda antivirus for linux(Which is free ;-)) i want that all the mails should be scanned by the server. Also, i want the vpopmail to have an option of online scan of attachments. Does any one has similiar experience. Also, if anyone knows any other antivirus software for linux which is free to use can be updated, plz do mail me abt the same. Thanks in advance Tanmaya
Re: [vchkpw] Panda Antivirus + qmail
Yes, here is the link for the freeware linux version: http://www.pandasoftware.es/es/linux/linuxdown.asp Damn, I've just realized it was in spanishif anyone need help with it click on Acepto el acuerdo de licencia helps :) - Original Message - From: Rick Macdougall [EMAIL PROTECTED] To: Tanmaya Anand [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Sunday, September 14, 2003 5:48 PM Subject: Re: [vchkpw] Panda Antivirus + qmail Hi, ClamAV - http://clamav.sourceforge.net/ Qmail-Scanner - http://qmail-scanner.sourceforge.net/ Oh and Panda is not free, or at least I do not see a free version on their website. Regards, Rick Tanmaya Anand wrote: hi all, I have qmail+vpopmail+sqwebmail on my server. i have downloaded panda antivirus for linux(Which is free ;-)) i want that all the mails should be scanned by the server. Also, i want the vpopmail to have an option of online scan of attachments. Does any one has similiar experience. Also, if anyone knows any other antivirus software for linux which is free to use can be updated, plz do mail me abt the same. Thanks in advance Tanmaya
RE: [vchkpw] Panda Antivirus + qmail
They sure do. Shane -Original Message- From: Tanmaya Anand [mailto:[EMAIL PROTECTED] Sent: Monday, 15 September 2003 12:06 AM To: Rick Macdougall; [EMAIL PROTECTED] Subject: Re: [vchkpw] Panda Antivirus + qmail hi Does ClamAV provides updated virus definitions for new viruses? Regards, Tanmaya - Original Message - From: Rick Macdougall [EMAIL PROTECTED] To: Tanmaya Anand [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Sunday, September 14, 2003 9:18 PM Subject: Re: [vchkpw] Panda Antivirus + qmail Hi, ClamAV - http://clamav.sourceforge.net/ Qmail-Scanner - http://qmail-scanner.sourceforge.net/ Oh and Panda is not free, or at least I do not see a free version on their website. Regards, Rick Tanmaya Anand wrote: hi all, I have qmail+vpopmail+sqwebmail on my server. i have downloaded panda antivirus for linux(Which is free ;-)) i want that all the mails should be scanned by the server. Also, i want the vpopmail to have an option of online scan of attachments. Does any one has similiar experience. Also, if anyone knows any other antivirus software for linux which is free to use can be updated, plz do mail me abt the same. Thanks in advance Tanmaya
Re: [vchkpw] Panda Antivirus + qmail
If anyone is interested...even though this is offtopicthe english link is here: http://www.pandasoftware.com/download/linux/linux.asp Trey Yes, here is the link for the freeware linux version: http://www.pandasoftware.es/es/linux/linuxdown.asp Damn, I've just realized it was in spanishif anyone need help with it click on Acepto el acuerdo de licencia helps :) - Original Message - From: Rick Macdougall [EMAIL PROTECTED] To: Tanmaya Anand [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Sunday, September 14, 2003 5:48 PM Subject: Re: [vchkpw] Panda Antivirus + qmail Hi, ClamAV - http://clamav.sourceforge.net/ Qmail-Scanner - http://qmail-scanner.sourceforge.net/ Oh and Panda is not free, or at least I do not see a free version on their website. Regards, Rick Tanmaya Anand wrote: hi all, I have qmail+vpopmail+sqwebmail on my server. i have downloaded panda antivirus for linux(Which is free ;-)) i want that all the mails should be scanned by the server. Also, i want the vpopmail to have an option of online scan of attachments. Does any one has similiar experience. Also, if anyone knows any other antivirus software for linux which is free to use can be updated, plz do mail me abt the same. Thanks in advance Tanmaya
Re: [vchkpw] Antivirus Scanner
www.messagewall.org i use it as mail relay, and its very good, it has basic spam filter, and nativly reads openantivirus definition files. (check out the MW faq for AV updates, as openantivirus is a bit slow, MW hourly compiles a combined definition file from OpenAntivirus and ClamAV's databases) Regards Kris At 03:37 PM 6/11/2003 +, you wrote: Hi guys, do anyone know a good antivirus scanner that can be installed on linux but not directly in the machine with the email server? and that works with qmail+vpopmail? eg: Firewall---Antivirus Mail scanner---Qmail+Vpopmail Mailserver Thanks again -- Cream[DONut] - www.donut.dk www.nethouse2000.dk - admin
Re: [vchkpw] Antivirus Scanner
Thanks to everyone, I will check all the options. Your help is always appreciated :) My configuration of the qmail-scanner is in the same machine, I wasn't aware it could be separated too... still my boss wants something more. Take care everyone.
[vchkpw] Antivirus Scanner
Hi guys, do anyone know a good antivirus scanner that can be installed on linux but not directly in the machine with the email server? and that works with qmail+vpopmail? eg: Firewall---Antivirus Mail scanner---Qmail+Vpopmail Mailserver Thanks again --
Re: [vchkpw] Antivirus Scanner
Qmail-Scanner works well and gives you the ability to incorporate SPAM filtering On Wed, 2003-06-11 at 11:37, Guillermo Villasana Cardoza wrote: Hi guys, do anyone know a good antivirus scanner that can be installed on linux but not directly in the machine with the email server? and that works with qmail+vpopmail? eg: Firewall---Antivirus Mail scanner---Qmail+Vpopmail Mailserver Thanks again -- Ron Culler
Re: [vchkpw] Antivirus Scanner
Yes I know that, but I do need to have the scanner in one machine and the mail program in another, and qmail-scanner although it does stop a lot of virus, it is not enough for me. (which by the way I am also using) I have seen the bitdefender, has anyone used that one? or also I have seen the panda software. Still I am not sure that panda works with qmail. Thanks Qmail-Scanner works well and gives you the ability to incorporate SPAM filtering On Wed, 2003-06-11 at 11:37, Guillermo Villasana Cardoza wrote: Hi guys, do anyone know a good antivirus scanner that can be installed on linux but not directly in the machine with the email server? and that works with qmail+vpopmail? eg: Firewall---Antivirus Mail scanner---Qmail+Vpopmail Mailserver Thanks again -- Ron Culler
Re: [vchkpw] Antivirus Scanner
Don't know if it would work for you, but we use qmail-scanner to call spamd/spamc for the spam tagging and have the spamd run on another machine. For the virus scanning, it calls sophie (which uses the Sophos engine) and it also supports networking, so we run it on another machine. Trey Nolen Yes I know that, but I do need to have the scanner in one machine and the mail program in another, and qmail-scanner although it does stop a lot of virus, it is not enough for me. (which by the way I am also using) I have seen the bitdefender, has anyone used that one? or also I have seen the panda software. Still I am not sure that panda works with qmail. Thanks Qmail-Scanner works well and gives you the ability to incorporate SPAM filtering On Wed, 2003-06-11 at 11:37, Guillermo Villasana Cardoza wrote: Hi guys, do anyone know a good antivirus scanner that can be installed on linux but not directly in the machine with the email server? and that works with qmail+vpopmail? eg: Firewall---Antivirus Mail scanner---Qmail+Vpopmail Mailserver Thanks again -- Ron Culler
Re: [vchkpw] Antivirus Scanner
Hi, Clamav works great with QS and that is what we are using on our mail servers. http://clamav.elektrapro.com/ Regards, Rick Guillermo Villasana Cardoza wrote: Yes I know that, but I do need to have the scanner in one machine and the mail program in another, and qmail-scanner although it does stop a lot of virus, it is not enough for me. (which by the way I am also using) I have seen the bitdefender, has anyone used that one? or also I have seen the panda software. Still I am not sure that panda works with qmail. Thanks Qmail-Scanner works well and gives you the ability to incorporate SPAM filtering On Wed, 2003-06-11 at 11:37, Guillermo Villasana Cardoza wrote: Hi guys, do anyone know a good antivirus scanner that can be installed on linux but not directly in the machine with the email server? and that works with qmail+vpopmail? eg: Firewall---Antivirus Mail scanner---Qmail+Vpopmail Mailserver Thanks again -- Ron Culler
Re: [vchkpw] Antivirus Scanner
You can run an Anti-Virus and Anti-Spam gateway with a lower MX value than your real mail server. The gateway filters, cleans, and deals with bounces. Good mail is passed onto your mail server. You can have multiple gateways at the same MX if you _really_ need to. qmail-scanner with clam-av and spamassassin is a nice combo that has also been well documented. Guillermo Villasana Cardoza wrote: Yes I know that, but I do need to have the scanner in one machine and the mail program in another, and qmail-scanner although it does stop a lot of virus, it is not enough for me. (which by the way I am also using) I have seen the bitdefender, has anyone used that one? or also I have seen the panda software. Still I am not sure that panda works with qmail. Thanks Qmail-Scanner works well and gives you the ability to incorporate SPAM filtering On Wed, 2003-06-11 at 11:37, Guillermo Villasana Cardoza wrote: Hi guys, do anyone know a good antivirus scanner that can be installed on linux but not directly in the machine with the email server? and that works with qmail+vpopmail? eg: Firewall---Antivirus Mail scanner---Qmail+Vpopmail Mailserver Thanks again -- Ron Culler
antivirus + vadduser
how to install antivirus ... i already install amavis and change qmail-local and qmail-remote with scanmails , but i can't send email :( anybody can tell me how to install amavis on qmail+vpopmail ? how to execute vadduser with account nobody ? because i want to run adduser via web with php thank in advanced ./tio
Re: antivirus + vadduser
On Thursday, October 25, 2001, at 09:07 PM, adhitiyo k wrote: how to install antivirus ... i already install amavis and change qmail-local and qmail-remote with scanmails , but i can't send email :( anybody can tell me how to install amavis on qmail+vpopmail ? how to execute vadduser with account nobody ? because i want to run adduser via web with php I don't know about amavis.. but there are very straightforward instructions for using qmail-scanner here: http://qmail-scanner.sourceforge.net Many people on this list use it successfully with qmail. Cheers, Bill Shupp
Re: antivirus server software
What virus scanner app do you use, then? And on what OS? (I think the only one which is any good on FreeBSD would be Kaspersky AVP). The Linux version appears to have a demo (which only scans, but that would be enough on a server, but for FreeBSD, there doesn't seem to be any demo ;-) oh, I should note that also DrWEB also works on Linux FreeBSD. At least, I'm now using it on FreeBSD -- results good enough. Price about $500 / year.
Antivirus scanning ~vpopmail/domains/xxx.com/$USER/Maildir/new/*
Hi, I am looking for an easy-to-use Antivirus for qmail running vpopmail. I would like to scan mails stored in user's Maildir's. Thank you
Re: Antivirus scanning ~vpopmail/domains/xxx.com/$USER/Maildir/new/*
Hi, Try qmail-queue-scanner, it will scan mails (in addition to a virus scanner) before they reach the maildir's, which is more secure. Florent #-Hi, #-I am looking for an easy-to-use Antivirus for qmail running vpopmail. I #-would like to scan mails stored in user's Maildir's. #-Thank you #- #- #-
Re: Antivirus scanning ~vpopmail/domains/xxx.com/$USER/Maildir/new/*
We're working on a filtering/virus scanning solution as we speak. We believe it will be available Jan/Feb as a stable release. Development is at http://www.inter7.com/eps. The filtering/scanning code has not been added to the development release just yet. zyrtaf wrote: Hi, I am looking for an easy-to-use Antivirus for qmail running vpopmail. I would like to scan mails stored in user's Maildir's. Thank you -- [EMAIL PROTECTED] Inter7 Internet Technologies, Inc. www.inter7.coom - 847-492-0470 Prices at http://www.inter7.com/prices
qmail-queue patch for Kaspersky Antivirus
I thought somebody could be interested in this. And don't forget to allow
scanning /var/qmail/queue in defUnix.prf. You don't have to recompile
anything but qmail-queue for scanning, (if you don't need more friedly error
message known viruses found) I hope somebody will find it usefull.
Copyright on avp-client.c is unknown since I heavily ripped
AvpDaemonClient.c example in AVP distribution which is without any
copyright explicitly written (I could rewrite it from scratch in case
somebody will need it ;-).
O.
// Program to test daemon scanning.
#include stdio.h
#include stdlib.h
#include string.h
#include unistd.h
#include sys/stat.h
#include sys/types.h
#include sys/socket.h
#include sys/un.h// struct sockaddr_un
#include sys/file.h
#include time.h
#include stdarg.h
#include paths.h
#include errno.h
// ... Cfg pathnames
#define AVP_NODE_DIR /var/run
#define AVP_NODE_DIR_MODE 0777
#define AVP_NODE_PID AVP_NODE_DIR /AvpPid
#define AVP_NODE_LOG AVP_NODE_DIR /AvpLog
#define AVP_NODE_CTL AVP_NODE_DIR /AvpCtl\0\0\0
char *NodePid=AVP_NODE_PID;
char *NodeCtl=AVP_NODE_CTL;
static int AvpFile=-1;
struct sockaddr_un AvpAddr;
int AvpConnect(void) {
if(AvpFile==-1)
{
bzero((char *)AvpAddr,sizeof(AvpAddr));
AvpAddr.sun_family=AF_UNIX;
strcpy(AvpAddr.sun_path,NodeCtl);
if((AvpFile=socket(AF_UNIX,SOCK_STREAM,0))0)
return -1;
}
if(AvpFile!=-1 connect(AvpFile,(struct sockaddr *)(AvpAddr),sizeof(AvpAddr.sun_family)+strlen(NodeCtl))=0) {
return 0;
}
return -1;
}
void AvpClose(void) {
(void)close(AvpFile);
AvpFile=-1;
}
int AvpScan(const char *file)
{
char buftoscan[2048];
time_t now;
long uintbuf=0;
int len;
// build the message
(void)time(now);
len = snprintf(buftoscan, 2047, 0%.15s:%s, ctime(now)+4, file);
if(write(AvpFile,buftoscan,len+1)=0)
{
if(read(AvpFile,(char*)uintbuf,2) == -1) return -2;
return (uintbuf0xff)-0x30;
}
return -1;
}
--- /usr/home/ondrej/Projects/qmail/qmail-1.03/Makefile Tue May 8 15:29:43 2001
+++ /usr/home/ondrej/Projects/qmail/qmail-queue-avp/Makefile Sun Jul 29 15:24:05 2001
@@ -1446,10 +1446,10 @@
nroff -man qmail-qstat.8 qmail-qstat.0
qmail-queue: \
-load qmail-queue.o triggerpull.o fmtqfn.o now.o date822fmt.o \
+load qmail-queue.o avp-client.o triggerpull.o fmtqfn.o now.o date822fmt.o \
datetime.a seek.a ndelay.a open.a sig.a alloc.a substdio.a error.a \
str.a fs.a auto_qmail.o auto_split.o auto_uids.o
- ./load qmail-queue triggerpull.o fmtqfn.o now.o \
+ ./load qmail-queue avp-client.o triggerpull.o fmtqfn.o now.o \
date822fmt.o datetime.a seek.a ndelay.a open.a sig.a \
alloc.a substdio.a error.a str.a fs.a auto_qmail.o \
auto_split.o auto_uids.o
@@ -1463,6 +1463,10 @@
alloc.h substdio.h datetime.h now.h datetime.h triggerpull.h extra.h \
auto_qmail.h auto_uids.h date822fmt.h fmtqfn.h
./compile qmail-queue.c
+
+avp-client.o: \
+compile avp-client.c
+ ./compile avp-client.c
qmail-queue-log: \
load qmail-queue-log.o triggerpull.o fmtqfn.o now.o date822fmt.o \
--- qmail.c~ Sun Jul 29 16:13:34 2001
+++ qmail.c Sun Jul 29 16:07:30 2001
@@ -97,6 +97,7 @@
case 115: /* compatibility */
case 11: return Denvelope address too long for qq (#5.1.3);
case 31: return Dmail server permanently rejected message (#5.3.0);
+ case 32: return Dknown viruses were found (#5.3.0);
case 51: return Zqq out of memory (#4.3.0);
case 52: return Zqq timeout (#4.3.0);
case 53: return Zqq write error or disk full (#4.3.0);
--- /usr/home/ondrej/Projects/qmail/qmail-1.03/qmail-queue.c Tue Nov 21 00:44:57 2000
+++ /usr/home/ondrej/Projects/qmail/qmail-queue-avp/qmail-queue.c Sun Jul 29 16:12:02 2001
@@ -36,10 +36,13 @@
char *messfn;
char *todofn;
char *intdfn;
+char *scanfn;
+int scanlen;
int messfd;
int intdfd;
int flagmademess = 0;
int flagmadeintd = 0;
+int scanres;
void cleanup()
{
@@ -58,6 +61,7 @@
void die(e) int e; { _exit(e); }
void die_write() { cleanup(); die(53); }
void die_read() { cleanup(); die(54); }
+void die_virus() { cleanup(); die(32); }
void sigalrm() { /* thou shalt not clean up here */ die(52); }
void sigbug() { die(81); }
@@ -202,6 +206,16 @@
if (substdio_flush(ssout) == -1) die_write();
if (fsync(messfd) == -1) die_write();
+
+ if (AvpConnect() == 0) // Pokud se neprikonektime, budeme to tise ignorovat
+ {
+ scanlen = strlen(auto_qmail)+strlen(messfn)+8;
+ scanfn = alloc(scanlen);
+ snprintf(scanfn, scanlen, %s/%s/%s, auto_qmail, queue, messfn);
+ if ((scanres = AvpScan(scanfn)) != 0) die_virus();
+ alloc_free(scanfn);
+ AvpClose();
+ }
intdfd = open_excl(intdfn);
if (intdfd == -1) die(65);
--
Ondej Sur [EMAIL PROTECTED]Globe Internet s.r.o. http://globe.cz/
Tel: +420235365000 Fax: +420235365009 Plnikova 1, 162 00 Praha 6
GPG fingerprint: CC91 8F02 8CDE 911A 933F AE52 F4E6 6A7C C20D F273
Re: Antivirus
Kris von Mach [EMAIL PROTECTED] writes: Ondrej, I use AVP from kaspersky's lab as well with vpopmail and qmail. But I didn't need a patch to accomplish this. They have included a qmail-queue daemon, in the package. I was never really able to make supplied qmail-queue to work. And it seemed to me that this is not only my problem, so I wrote mine. What does this patch do? Does it replace the daemon they include? Yes, it replace theirs qmail-queue program. It is quite simple, but it works ;-) (at least for me). Thouse shell (perl, shell etc.) scripts using external scanners was too much to handle (we are handling about 5k domains with 20k+ mailboxes) and system was heavily overloaded, after using this patch (it is not so configurable etc.) system is ok. This patch will connect between linking file from tmp/ to new/, check the file (via socket) and in case it found infection, it will delete message and bounce it back (recepient is not notified). -- Ondej Sur [EMAIL PROTECTED]Globe Internet s.r.o. http://globe.cz/ Tel: +420235365000 Fax: +420235365009 Plnikova 1, 162 00 Praha 6 GPG fingerprint: CC91 8F02 8CDE 911A 933F AE52 F4E6 6A7C C20D F273
Re: Antivirus
Ondrej, I use AVP from kaspersky's lab as well with vpopmail and qmail. But I didn't need a patch to accomplish this. They have included a qmail-queue daemon, in the package. What does this patch do? Does it replace the daemon they include? __ Kris. At 06:00 PM 5/2/2001 +0200, you wrote: file://c:\eudora-dev\attach\Untitled.ems 0880.00022f2a564.jpgfile://c:\eudora-dev\attach\Untitled.ems 0880.0002 Untitled.ems -- Ondøej Surý [EMAIL PROTECTED] Globe Internet s.r.o. http://globe.cz/ Tel: +420235365000 Fax: +420235365009 Plánièkova 1, 162 00 Praha 6 GPG fingerprint: CC91 8F02 8CDE 911A 933F AE52 F4E6 6A7C C20D F273 attachment: 2f2a564.jpg
Antivirus
Hi, I am looking for a good antivirus, working with vpopmail,maildir,... I saw some but I think they only work with ~/Mailbox Any URL would be really apreciated thanks
Re: Antivirus
http://qmail-scanner.sourceforge.net/ Ciao, Roman Serbski mailto:[EMAIL PROTECTED] - Original Message - From: "Dimitri SZAJMAN" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, April 05, 2001 4:42 PM Subject: Antivirus Hi, I am looking for a good antivirus, working with vpopmail,maildir,... I saw some but I think they only work with ~/Mailbox Any URL would be really apreciated thanks
antivirus
Hi, Do you know an antivirus that will work with qmail in order to scan all the emails that are going thru my server, incoming and outgoing. 10x Ciprian Iftode, Professional Systems Romania str. Moara de Foc, nr.35, et.5, Iasi, 6600 tel/fax: +40-32-219907
AntiVirus
Hi everybody... I have qmail vpopmail running on Linux machine and I was thinking on installing an antivirus on my mailserver, does anyone have any suggestions about this issue?! Thanks for your time V.
Re: AntiVirus
anomy-sanitizer-1.28.tar.gz look for that...it is free. On Fri, 1 Dec 2000, Visar Emini wrote: Date: Fri, 1 Dec 2000 17:47:49 +0100 From: Visar Emini [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: AntiVirus Hi everybody... I have qmail vpopmail running on Linux machine and I was thinking on installing an antivirus on my mailserver, does anyone have any suggestions about this issue?! Thanks for your time V.
