Comments on: Virus Mails Galore! http://blog.ramereth.net/2005/05/04/virus-mails-galore/ Where ever you go, there you are Fri, 04 Jul 2008 04:43:02 +0000 http://wordpress.org/?v=2.3.1 By: Mark http://blog.ramereth.net/2005/05/04/virus-mails-galore/#comment-17 Mark Fri, 06 May 2005 14:51:46 +0000 http://blog.ramereth.net/2005/05/04/virus-mails-galore/#comment-17 Clamav is great, but is a huge resource hog. I highly recommend a distributed setup like Inbound Mail ^ |-> smtp spooler/clamav/spam assassin | | | |------------------------------> IMAP+SSL/mailboxes | | |-> smtp spooler/clamav/spam assassin Clamav is great, but is a huge resource hog. I highly recommend a distributed setup like

Inbound Mail
^
|-> smtp spooler/clamav/spam assassin
| |
| |——————————> IMAP+SSL/mailboxes
| |
|-> smtp spooler/clamav/spam assassin

]]> By: ramereth http://blog.ramereth.net/2005/05/04/virus-mails-galore/#comment-16 ramereth Wed, 04 May 2005 15:21:05 +0000 http://blog.ramereth.net/2005/05/04/virus-mails-galore/#comment-16 We're going to leave this optional as much as we can so you can use procmail to say what you want to do with it. I really haven't had much experience with clamav yet, but a few of our infra dudes have so we'll probably try something simliar to your approach. We’re going to leave this optional as much as we can so you can use procmail to say what you want to do with it. I really haven’t had much experience with clamav yet, but a few of our infra dudes have so we’ll probably try something simliar to your approach.

]]> By: slarti http://blog.ramereth.net/2005/05/04/virus-mails-galore/#comment-15 slarti Wed, 04 May 2005 15:18:47 +0000 http://blog.ramereth.net/2005/05/04/virus-mails-galore/#comment-15 ClamAV provides a daemon, similar to SpamAssassin's spamd, that should reduce system load a *little*. I haven't done any serious tests, but I should guess that just checksumming attached files against a list of viruses is going to be a lot less intensive than, say, the bayesian analysis of SpamAssassin. Also, how would you set this up? Done before delivery to mailboxes, or leave it up to the users and let them set it up in their procmailrc or similar? mail-filter/clamassassin has a USE flag for using clamd that would be perfect for the latter. It provides a spamassassin-like interface for clamav. It's possible to call clamdscan from procmailrc and use it that way, but it's a bit of a pain. ClamAV provides a daemon, similar to SpamAssassin’s spamd, that should reduce system load a *little*. I haven’t done any serious tests, but I should guess that just checksumming attached files against a list of viruses is going to be a lot less intensive than, say, the bayesian analysis of SpamAssassin.

Also, how would you set this up? Done before delivery to mailboxes, or leave it up to the users and let them set it up in their procmailrc or similar?

mail-filter/clamassassin has a USE flag for using clamd that would be perfect for the latter. It provides a spamassassin-like interface for clamav. It’s possible to call clamdscan from procmailrc and use it that way, but it’s a bit of a pain.

]]>