Date: Fri, 31 Mar 2000 10:49:21 +0900 (JST) From: Steve Frampton <frampton@j-com.co.jp> To: Multiple recipients of list SAMBA <samba@samba.org> Subject: PC Virus scanning on *nix side? Message-ID: <Pine.LNX.4.21.0003311046390.7302-100000@firewall.j-com.co.jp> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi: I'm just wondering what some of you are using for virus scanners -- a scan of all of our shares indicated the presence of several viruses. It would be nice if our Samba server (running on Linux) could do periodic scans and then take some kind of corrective action (clean/remove virus or at least e-mail the administrator). Cheers... - --------------< LINUX: The choice of a GNU generation. >-------------- Steve Frampton <frampton@j-com.co.jp> Japan Communications, Inc. Software Developer/Systems Administrator http://www.j-com.co.jp/ GNU Privacy Guard ID: D055EBC5 (see http://www.gnupg.org for details) GNU-PG Fingerprint: EEFB F03D 29B6 07E8 AF73 EF6A 9A72 F1F5 D055 EBC5 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE45AQjmnLx9dBV68URAoacAJ9vvAGuAa3tc/zzLeNAGSQf2eVcEwCeK+Q3 t74jSb5oiKjDzHEaMr6Ws+E=sILH -----END PGP SIGNATURE----- Steve, We use Mcafee Netshield for Solaris (2.6 and 2.7). It is also available for Linux and FreeBSD. Mcafee keeps it very up-to-date and it works very well and is very quick. We scan approx 1 million files every night with it and it has served us well. Logging and cleaning/isolation of infected files works very well. The software is very configurable. Works well in a two-tier approach to virus control. ie On the PC and on the server. Regards, Scott. __________________________________ Scott Lawson Systems Manager Department Of Information Services St. George's Hospital Medical School Tooting London SW17 0RE UK P: 44 (0)181 725 2896 F: 44 (0)181 725 3583 mailto:s.lawson@sghms.ac.uk http://www.sghms.ac.uk __________________________________
Hi, I use Sophos Antivirus on the companies Solaris 2.6 samba server and our Mandrake Linux 6.0 MARS-NWE server. Sophos has both a server and client side to it. It works very well. You get monthly updates on CD and you can also subscribe to their email virus notification system. You will then be notified when they have created a new virus identification file that you can use to update your server between monthly updates. These Virus IDE files tend to come out at a rate of about 3 or 4 a week. Stuart Jeffery PC Systems Administrator CarnaudMetalbox Engineering -----Original Message----- From: Steve Frampton [mailto:frampton@j-com.co.jp] Sent: 01 April 2000 08:30 To: Multiple recipients of list SAMBA Subject: PC Virus scanning on *nix side? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi: I'm just wondering what some of you are using for virus scanners -- a scan of all of our shares indicated the presence of several viruses. It would be nice if our Samba server (running on Linux) could do periodic scans and then take some kind of corrective action (clean/remove virus or at least e-mail the administrator). Cheers... - --------------< LINUX: The choice of a GNU generation. >-------------- Steve Frampton <frampton@j-com.co.jp> Japan Communications, Inc. Software Developer/Systems Administrator http://www.j-com.co.jp/ GNU Privacy Guard ID: D055EBC5 (see http://www.gnupg.org for details) GNU-PG Fingerprint: EEFB F03D 29B6 07E8 AF73 EF6A 9A72 F1F5 D055 EBC5 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE45AQjmnLx9dBV68URAoacAJ9vvAGuAa3tc/zzLeNAGSQf2eVcEwCeK+Q3 t74jSb5oiKjDzHEaMr6Ws+E=sILH -----END PGP SIGNATURE-----
Whoops, send a reaction too soon. It was the old 3.x-script.
The new one seems to work (but sometimes fails, maybe because too many users
are logged in at NAI). It's a little bit better, because it only retrieves
the complete 2Meg-DAT-archive file if it's newer.
But i'm not a good *nix-script-writer, i bet there are better ones, with
error-checking.
New one looks like this:
#!/bin/sh
#
# New update script, McAfee 4.x
#
# Timo, jan. 2000
#
# Get directory-listing
lynx -dump ftp://ftp.nai.com/pub/antivirus/datfiles/4.x >nai.ls
#
# Extract filename
cat nai.ls | grep 'ftp://ftp.nai.com' | grep .tar | cut -c 7- >nai.fn
#
# Check wheter it's newer than the existing one
if (cmp nai.fn old.fn); then
echo No new dat-archive
else
# Backup old archive
echo Backup old dat...
mv -f dat-latest.tar dat-old.tar
cp -u nai.fn old.fn
#
# Get .tar - file
echo Retrieving new dat...
lynx -dump `cat nai.fn` >dat-latest.tar
#
# Untar and copy them
echo Untarring and installing...
tar -xf dat-latest.tar
cp -av *.dat /usr/local/uvscan
#
# Report version info
/usr/local/bin/uvscan --version
fi
> -----Original Message-----
> From: Dirk Allard [mailto:dirk@daniel.materials.uni-wuppertal.de]On
> Behalf Of Dirk Allard
> Sent: maandag 10 april 2000 13:11
> To: Timo Gatsonides
> Subject: RE: PC Virus scanning on *nix side?
>
>
> On Tue, 04 Apr 2000, you wrote:
>
> Hi,
>
> > If you want to filter your (send)mail automagically, have a look at
> >
> > http://satan.oih.rwth-aachen.de/AMaViS/
>
> unfortunatley this does not work with exim...
>
> > And McAfee is easy to update as well,
> > just put something like this in a crontab:
>
> Do you have an update for this script? The webpage seems to be dead.
>
> Dirk
> --
> Dirk Allard
>
> BUGH Wuppertal - Polymere Materialien
> email dirk@materials.uni-wuppertal.de
> Tel +49-202-4393873
> Fax +49-202-4393880
>