LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 10-05-2012, 02:03 AM   #1
garion
Member
 
Registered: Nov 2003
Posts: 35

Rep: Reputation: 15
Combining ClamAV and commercial AV software


To increase the chances of catching all of the viruses my boss would like to couple a commercial AV software.

I inherited this system and have no idea where to start looking. We are running Postfix on one machine and it sends mail to Amavis on another machines running Spamassassin and ClamAV. After processing the mail is sent back to the first server.

Is it even possible to connect multiple AV products? If so, where exactly do I need to look for the right place to add the second AV scanner?
 
Old 10-05-2012, 07:20 PM   #2
amani
Senior Member
 
Registered: Jul 2006
Location: Kolkata, India
Distribution: 64-bit GNU/Linux, Kubuntu64, Fedora QA, Slackware,
Posts: 2,758

Rep: Reputation: Disabled
Just schedule the scans or write a daemon for additional scans.
 
Old 10-06-2012, 12:06 AM   #3
John VV
Guru
 
Registered: Aug 2005
Posts: 13,051

Rep: Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740
from my personal experience ClamAV is better at finding NEW threats than Norton or McAfee
the clam database is normally 8 to 12 hours faster than the big company's
and finds things that people PAY Norton NOT to find like there thinly disguised " child safety trackers"

but if you MUST spend cash for something you do not need .....
contact Norton or McAfee about running there Microsoft windows virus scanners on whatever linux install this is

but you ARE better off spending the cash inhouse

install and run SQUID for intrusion detection

ClamAV on the mail servers on a cron job
( or BETTER as a daemon)

KEEP the servers UP TO DATE
 
Old 10-06-2012, 04:27 AM   #4
garion
Member
 
Registered: Nov 2003
Posts: 35

Original Poster
Rep: Reputation: 15
ClamAV is already running as a daemon on our Spam-Virus server. We have a cronjob that runs every six hours to update the signatures. Perhaps overkill, but that's what the boss wants.

The problem is that in this particular instance it took two days for ClamAV to update their signature files after I submitted an example, although TrendMicro (used by one of our customers) could already identify it. McAfee which our internal IT has on our MS-Exchange server was also identifying it before ClamAV. My boss does not want that to happen again. So, we either use ClamAV *plus* a commercial product or we use *only* the commercial product.

As I said in the original post "I inherited this system and have no idea where to start looking." So I either figure out how to *add* a commercial product to the existing system or figure out how to integrate the commercial product without ClamAV. A third alternative, which my boss mention some time ago, is to replace the entire construct (from postfix to spamassassin to ClamAV) with MS-Exchange and a commercial virus/spam scanner. Those are my choices.
 
Old 10-06-2012, 05:52 AM   #5
John VV
Guru
 
Registered: Aug 2005
Posts: 13,051

Rep: Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740Reputation: 1740
Quote:

As I said in the original post "I inherited this system and have no idea where to start looking." So I either figure out how to *add* a commercial product to the existing system or figure out how to integrate the commercial product without ClamAV.
the very first thing i would do is make 100% sure that the operating system that is running the mail server and the rest is UP TO DATE and a current version of the OS

it would do no good if it were say.... RHEL4.9
or a not licensed version of RHEL 5 or 6
or what ever os that this is

once up to date
then contact a for pay like Norton or trend or whom ever about running their product on your server
most have a linux version that will run on linux to LOOK for Microsoft viruses IN THE MAIL
but MS viruses do not run on a linux OS -- they can not .


however

ClamAV
rkhumter
chrootkit
and a running squid ISD on a up to date OS is VERY safe
if RHEL 5 or 6 have SE enabled and set to ENFORCING

but if your boss WANTS to through cash in the trash can ...........


you DO know that NO and i do mean NO av software will detect better than about 25 % on a unknown virus


Quote:
The problem is that in this particular instance it took two days for ClamAV to update their signature files after I submitted an example
very odd ?
Normally they are FASTER at getting out a NEW sig for a NEW virus

you say that freshclam runs in a cron job every 30 min. ( over kill )
daily or twice daily would do

and you DO have the clam daemon service RESTARTING after EVERY update

so for every 30 min
freshclam is ran
then the daemon is ALSO restarting
 
1 members found this post helpful.
Old 10-06-2012, 06:57 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,457
Blog Entries: 54

Rep: Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897
Quote:
Originally Posted by amani View Post
Just schedule the scans
I wonder how that would help the OP if he explicitly mentions running a MTA?..


Quote:
Originally Posted by amani View Post
or write a daemon for additional scans.
Do you even know or read about what Amavis does? And if you don't, then what would be the value of such "advice"?


Quote:
Originally Posted by John VV View Post
from my personal experience ClamAV is better at finding NEW threats than Norton or McAfee the clam database is normally 8 to 12 hours faster than the big company's
Could I ask you to back that up with objective references?


Quote:
Originally Posted by John VV View Post
and finds things that people PAY Norton NOT to find like there thinly disguised " child safety trackers"
Same here but with emphasis on the people paying part? TIA.


Quote:
Originally Posted by garion View Post
Is it even possible to connect multiple AV products? If so, where exactly do I need to look for the right place to add the second AV scanner?
http://www.amavis.org/#features-virus explicitly says "includes support for approx. 40 AV scanners off-the shelf (see file amavisd.conf, variable @av_scanners, for the list);".
 
1 members found this post helpful.
Old 10-06-2012, 10:18 AM   #7
garion
Member
 
Registered: Nov 2003
Posts: 35

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by unSpawn View Post
http://www.amavis.org/#features-virus explicitly says "includes support for approx. 40 AV scanners off-the shelf (see file amavisd.conf, variable @av_scanners, for the list);".
Arrgh! I was looking for amavis.conf!

Thanks!
 
Old 10-06-2012, 11:53 AM   #8
amani
Senior Member
 
Registered: Jul 2006
Location: Kolkata, India
Distribution: 64-bit GNU/Linux, Kubuntu64, Fedora QA, Slackware,
Posts: 2,758

Rep: Reputation: Disabled
Quote:
Originally Posted by unSpawn View Post


Do you even know or read about what Amavis does? And if you don't, then what would be the value of such "advice"?
I assumed that OP had done everything possible with the tools mentioned and I do not know of a better one.
 
  


Reply

Tags
av, clamav, commercial, scanner


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: When Worlds Collide: Combining GPL and Proprietary Software LXer Syndicated Linux News 0 02-13-2009 03:30 AM
LXer: Bruce Perens: Combining GPL and Proprietary Software LXer Syndicated Linux News 0 02-10-2009 05:11 PM
LXer: Webtop software development: Combining the desktop and the Internet LXer Syndicated Linux News 0 04-16-2007 07:17 AM
What commercial software comes with Mandriva Club? General Mandriva 6 08-29-2005 08:07 PM
Commercial Software and The Devil newb2nix Programming 1 07-28-2005 10:12 PM


All times are GMT -5. The time now is 08:49 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration