[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Anti Virus for Debian

Bradley M Alexander wrote:

On Tue, Feb 20, 2001 at 01:59:20PM +1000, Mario Zuppini wrote:

I would also like to know of virus scanners especially for mail servers ie
that will work on a SPARC ???

there are a few that work under i386 ie like amavris etc can be found on
but nothing will work under a sparc

As a quick and dirty option, you can use procmail to filter. Depending on
your security posture and thread environment, you can filter on
multi-extension vbs files (e.g. AnnaKournikova.jpg.vbs), all VBS files, exe
files, or any combination. You could filter them to a quarantine area, then
peruse them at your leisure.

The best one I've read was using procmail to replace every attachment ending with .vbs to .vbs.txt -- this way every VB script will be opened in Notepad. If someone really wants to execute it, she should be able to change the ending. Of course this can also be done for other scripting languages. Unfortunately I don't have the procmail line at hand and my sed is more than limited.

The advantage is that nothing gets lost this way. And users who don't know to handle the endings shouldn't execute scripts IMHO ;-)

Of course EXEs are not that elegant to solve and probably your manager will complain if she can't see the nice comic a friend has sent her since you replaced the ending with .ex_ :-( If that happens: send a program showing a black screen and beeping, fiddle around for an hour while the program is running, always mourning about the bad, bad hackers (yes: hackers -- always use the terms of your clients). Maybe this helps ;-) Or just say it is a security feature of your mail server (which it is), but don't tell anyone that you set it up yourself.


Reply to: