Re: Spam and Viruses, Vandalism-l, the Mailing List from Hell.

2007-01-27 Thread Martin McCormick
Paul Schmehl writes:
> Uvscan is McAfee's antivirus product. Did you install it? There's a conf
> file in the files directory of that port. It defines AVSCANNER as "/usr/
> local/bin/uvscan". That would require that you have McAfee Antivirus for
> FreeBSD installed. If this machine handles lots of mail, I wouldn't 
> suggest
> you use that. Uvscan launches a shell for each time it's called, and it
> will suck a lot of cpu and memory (based on our extensive comparison
> testing.)

Thank you very much.  I was a little fuzzy about how the
mcAfee product with its data base got there or what it looked
like, etc.

It is probably not worth the extra load to have
antivirus-milter on there although I see now that had mcAfee
been there, it would have probably done its job.

I am the only major inbound Email account on that system,
but it is a rather busy workhorse for our group and is already
busy enough that one notices slowdowns at times and, when we
check, it is all legitimate.  In this business, paranoia is a virtue.

Again, thanks for your help.

Martin McCormick WB5AGZ  Stillwater, OK 
Systems Engineer
OSU Information Technology Department Network Operations Group
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"


Re: Spam and Viruses, Vandalism-l, the Mailing List from Hell.

2007-01-26 Thread Paul Schmehl
--On January 26, 2007 10:16:57 PM -0600 Martin McCormick 
<[EMAIL PROTECTED]> wrote:



Has anyone gotten the port
/usr/ports/mail/antivirus-milter to work?

The system in question runs FreeBSD5.4 with sendmail and
bogofilter.  Bogofilter is excellent at helping sort messages in
to spam or other folders if you generate a large wordlist.

One category of junkmail, however, is not true spam.  It
is more a form of hacking in that it tries to implant viruses
like Johny Appleseed only this guy is Johny weedseed.

I got antivirus-milter to make and install but it
immediately failed when started:

antivirus[53446]: externalcommand()
failed to execve() /system/av/decullotage/uvscan

Uvscan is McAfee's antivirus product.  Did you install it?  There's a conf 
file in the files directory of that port.  It defines AVSCANNER as 
"/usr/local/bin/uvscan".  That would require that you have McAfee 
Antivirus for FreeBSD installed.  If this machine handles lots of mail, I 
wouldn't suggest you use that.  Uvscan launches a shell for each time it's 
called, and it will suck a lot of cpu and memory (based on our extensive 
comparison testing.)


I would recommend that you install either clamav (security/clamav) or your 
school's commercial product *if* it has a daemon for FreeBSD.  If it's a 
shell program like McAfee, I would *not* recommend it.


Once you have the av product installed, edit the conf file appropriately 
and you should be up and running.  You'll find the conf file in 
/usr/local/etc.


Paul Schmehl ([EMAIL PROTECTED])
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/