I simply disallow email of greater than 5 mb (that was my cutoff
exactly!) - email is not ideal for large file transfers for a number of
reasons, so I discourage it.
However, if you need to allow larger emails, then I'm not certain how
different your situation is - ASSP does a significant amount of
filtering (greylisting, etc.) and can actually do virus scanning as well
and much more efficiently since it only scans the first X number of
bytes of an email (but not compressed archives). Any thorough
anti-virus scan (that I am aware of) will risk time outs for really
large files that get to them. ClamSMTP is very thorough (using clamAV
to do the scanning, including archives and so on) so it needs to be
carefully configured and has the potential to cause problems.
ASSP is great for anti-spam since it scans the first X bytes (I have
mine set to 15k) of a mail and then simply refuses it (sending a SPAM
error to the sender) if it is determined to be SPAM, significantly
lowering the overhead associated with SPAM scanning. The accuracy I
have had once properly configured is exceptional (98-99%) - in ASSP
whitelisting is very important and automated which helps a lot. I
prefer it over Spam Assassin myself.
Jeff
John Kielkopf wrote:
>Jeff Buehler wrote:
>
>
>
>> Hi John -
>>
>>I use clamSMTP - it is c based proxy that is very lightweight and easy
>>to use. I also use ASSP in front of this for anti-spam (so sender ->
>>ASSP -> clamSMTP -> XMail -> sendee). As it turns out, after testing,
>>the emails didn't even reach my anti-virus because ASSP blocked all of
>>the attachments, but I am reasonably certain that it would have caught
>>all of them regardless - I have had great success with clamSMTP.
>>
>>Jeff
>>
>>
>>
>Are you stripping all attachments with ASSP? If not, how does clamSMTP
>react to large (>5MB) attachments? Does it just not scan them, or does
>it risk a time-out?
>
>I currently use a combination of blacklisting and greylisting (and of
>course some white listing) in a pre-data filter, so actually very few
>viruses do make it to the scanner. Though some aggressive viruses have
>managed to pound their way through the greylist before they end up on a
>blacklist.
>
>clamSMTP would require me to do all my antispam with something like
>ASSP, as you've suggested, and possibly complicate things like shutting
>off antispam and/or antivirus at a per user level (something we do quite
>often) - but it is something to think about.
>
>Still, the perfectionist in me still wants to get my script working well
>(and fast - many of our users tend to send large attachments via email).
> Moving AV back to a mailproc.tab filter and scanning off-line may be
>what I have to do.
>
>--John
>
>-
>To unsubscribe from this list: send the line "unsubscribe xmail" in
>the body of a message to [EMAIL PROTECTED]
>For general help: send the line "help" in the body of a message to
>[EMAIL PROTECTED]
>
>
>
>
--
Buehler Technologies
19 Circle Drive - San Rafael, CA 94901
415.459.4677 - [EMAIL PROTECTED]
-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]
