Bradley M Alexander wrote:
On Tue, Feb 20, 2001 at 01:59:20PM +1000, Mario Zuppini wrote:I would also like to know of virus scanners especially for mail servers ie sendmail that will work on a SPARC ??? there are a few that work under i386 ie like amavris etc can be found on freshmeat.net but nothing will work under a sparcAs a quick and dirty option, you can use procmail to filter. Depending on your security posture and thread environment, you can filter on multi-extension vbs files (e.g. AnnaKournikova.jpg.vbs), all VBS files, exe files, or any combination. You could filter them to a quarantine area, then peruse them at your leisure.
The best one I've read was using procmail to replace every attachment ending with .vbs to .vbs.txt -- this way every VB script will be opened in Notepad. If someone really wants to execute it, she should be able to change the ending. Of course this can also be done for other scripting languages. Unfortunately I don't have the procmail line at hand and my sed is more than limited.
The advantage is that nothing gets lost this way. And users who don't know to handle the endings shouldn't execute scripts IMHO ;-)
Of course EXEs are not that elegant to solve and probably your manager will complain if she can't see the nice comic a friend has sent her since you replaced the ending with .ex_ :-( If that happens: send a program showing a black screen and beeping, fiddle around for an hour while the program is running, always mourning about the bad, bad hackers (yes: hackers -- always use the terms of your clients). Maybe this helps ;-) Or just say it is a security feature of your mail server (which it is), but don't tell anyone that you set it up yourself.
Peter