Mailscanner

[tolstoy]

Has anyone tried Mailscanner from freshmeat yet? I have to say, I've had it running for about half a day on my mail gateway and am loving it. In reality, I'm not as interested in the virus scanning ability as I am it's ability to strip attachments by extension. Has anyone else run it? Is there anything I should be warned about? If not, I suggest anyone running a linux mail gateway to check it out. It's nabbed that pesky "humorous game" virus a dozen times in the few hours since I've had it up before the virus has actually made it to my clients to that great virus propogator "Outlook."

[Blaqb0x]

I was just thinking of buying rantivirus from

http://www.rantivirus.com

it's about $300 for 2 domains.

but MailScanner looks almost as good and cheaper.

The only thing im not sure about is the virus updating. Ive read alittle but it seems that you need sophos or mcafee for this. Im going to try it out though.

Any more suggestions?

thanx

[tolstoy]

I was just thinking of buying rantivirus from

http://www.rantivirus.com

it's about $300 for 2 domains.

but MailScanner looks almost as good and cheaper.

The only thing im not sure about is the virus updating. Ive read alittle but it seems that you need sophos or mcafee for this. Im going to try it out though.

Any more suggestions?

thanx

I have installed both mcaffee and Sophos. So far it looks like Mailscanner will autoupdate Sophos for you every evening. I talked at length to a Sophos rep and he seemed to think that Mailscanner by far beat their own product MailMonitor. He claimed that the only thing their product had going for it was that they had corporate support, when most opensource products do not. But he had me poke about Mailscanner for a bit and was very impressed. In fact, he even asked me if I was using it before I said I was or that I even had it on a mail server. My guess is that Sophos gets a lot of business from Mailscanner for their *nix customers.

My only caveat is this: both mcaffe and Sophos are trial editions and will expire. So far I like Sophos better as it has caught viruses that flew by mcaffee undetected. (I actually updated mcafee and used it to scan a copy of the W32.Klez virus, which it failed to detect). But the licensing on a mail server is for Sophos expensive, about $75 per mail box. And this is a reoccuring annual subscription. So if you are going to buy sophos licensing, do not admit to it being on a mail server. Tell them it is on a stand alone work station for one user and save your self thousands. AFAIK, they won't know the difference.

For my purposes, I am going to stop using all antivirus functions of Mailscanner and simply use it to strip and quarrenten any attachements with a executable extensions, or a double extension (like .doc.vbs)

We have a number of Norton AV servers on our network updating and sweeping our desktops, so hopefully anything that Mailscanner fails to strip, Norton AV will pick up. I work at a school, so I'm used to seeing 100+ viruses a week. In the past year, we've cut this number to about half a dozen per week, but nevertheless, some virusus will always fly under the radar. What can you do?

[Blaqb0x]

$75 per mailbox! How can they charge such an outrageous price for something that doesn't guarantee 100% success.
I work for a small department at a university and we get norton corperate edition for $4 per machine/year! that's cheap and scans more than just a incoming/outgoing mail.

Yea I think Ill skip the sophos/mcafee and just deny .exe and double extensions. that will probably get rid of most problems.

How do you like the spam feature? Configuration/success at catching spam, etc

thanx

[tolstoy]

I haven't tried the spam feature yet, but will probably look at it more when school is out and I have more free time. As for the Sophos licensing, I have a feeling that they do it so they do not lose revenue by Mailscanner being used over their product on nix platforms. Like I said, if you don't let Sophos know you are putting on a mailserver (just say you want it on one RH workstation) they probably won't know the difference. So far Sophos has been pretty good at updating itself and catching viruses. At the end of the month, I'll let the trial edition expire and will diable Sophos, but if you can get it cheap, go for it.

One question, do you run exchange? Do you have Norton CE protecting a mail server, clients or both? We run CE here, but I'd rather viruses get quarenteened at the mail gateway before they have a chance to my onto my LAN (which was what I liked about the Sophos/Mailscanner combo).

When I talked to Sophos, they gave me a price of about $3500 anually for 450 users, which is waaaaaay too much for me to even consider.

[Blaqb0x]

Im running norton on the clients only.

stopping viruses at the mail gateway is so much better, but neither suffice in stopping viruses completely by themselves.