Building an E-mail Virus Detection System for Your Network

The best way to stop the spread of e-mail-based viruses is not to let them into your system.
______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

from ps -A:

3676 ? 00:00:00 smtpfwdd

3678 ? 00:00:00 smtpfwdd

3680 ? 00:00:00 smtpfwdd

3728 ? 00:00:00 smtpfwdd

3729 ? 00:00:00 smtpfwdd

3730 ? 00:00:00 smtpfwdd

3751 ? 00:00:00 smtpfwdd

3752 ? 00:00:00 smtpfwdd

3753 ? 00:00:00 smtpfwdd

Is it regular???

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

I would imagine AntiVir's mail gate program works the best

Re: Building an E-mail Virus Detection System for Your Network

krondor's picture

I noticed a problem with the scanmail and daysumm scripts. If the script doesn't catch a virus all day, daysumm and cron both report the number of emails correctly, but the number of virii always comes up blank. It reads "there were viruses today" not "there were 0 viruses today". I'm using bash 2.05a, I modified the script slightly and now it works. I added the following to both daysumm and scanmail (before it decides to not continue if there is no mail).

# Show a zero if no viruses have been found and

# no virus file is created

zerocheck=$((`cat $etc/virus-log.$date`+0))

if [ $zerocheck -eq 0 ]; then

export virus_total=0

fi

It's kinda rudimentary and returns an error if the file virus-log.$date has yet to be made (the error is cat failing to find the file), but it works and correctly reports a zero. I'm not sure how to clean it up so if you have any suggestions I'd be interested.

Krondor (krondor_99@yahoo.com)

P.S. I also noticed that in daysumm if no emails were processed in one day then it says

the number of emails were:

similar to the problem in reporting the number of viruses, I'm assuming the patch above could be modified to accurately report email.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Trendmicro offers a complete gateway virus scanning package (viruswall). It includes smtp, ftp and http virus scanning on the fly. It has a nice web administration tool. And it runs on Linux, Solaris, HP-UX, Windows.

There's no need to fool around with bash scripts or anything.

Just my 10 cents...

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Thanks for a mostly Good article...

A couple of points....

You assumed that everyone was running a bash2 script and called the list of spooled mail into an array. Bash V2 is required for an array.

A better option would have to use the more generic approach so any bash shell would work "out of the archive" (such as echo `ls * >>SOMETEMPFILE) then use a standard for loop to scan each one in turn (for MAIL in `cat SOMETEMPFILE`; do......)

Mandrake 8.1 fails to run the uvscan program due to an undefined symbol....

It is not due to the library dependencies ( ldconfig -l |less and search for required libs shows them all.)

So... I went about searching for another linux virus scanner with even better licence than that one....

I found a suitable candidate at http://www.f-prot.com They have available a BETA version for linux that is statically linked ( in most cases, a better option cause it should work on most systems).

I will be implementign a simple wget script to get the updated definitions from this site and manage them in a simialr manner to what you presented.

As I chose to run postfix and not sendmail ( I didn't have 2 spare years to learn sendmail!!) and the postfix sendmail wrapper fails to run without the mail system running.

So, I chose to run postfix on a high port and comment out the sendmail -q line of the scanmail script (near the end).

( postfix users, in the /etc/postfix/master.cf find the line that is like

smtp inet n - n - - smtpd

and change smtp in the first column to a high port such as 2525 )

Hope these comments help others to easily set up a mail scanner in their gateway without giving up.

bob@norcom.net.au

query

Anonymous's picture

Dear sir

my uvscan is not cleaning the virus present in the mail.

does uvscan only detects virus but does'nt clean

please reply

yours sincerely

vaibhav

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

While this looks like an interesting project I decided to try out MailScanner. It accomplishes the same thing for a linux server and is a supported application. I had it up in running in only a few minutes. It doesn't require any config changes to sendmail and installs with an rpm.

Currently it supports McAfee or Sophos but more virus packages will be added in the next release.

Re: Bulding a dumb Virus Blocker

Anonymous's picture

Another alternative is to install the procmail security kit and "Defang" anything executable. This also allows you to defang potentially hazardous HTML.

Then, if you have a virus come through mail, and a strong "internet usage policy" restricting the use of executables through e-mail, you've got reason enough to fire the SOB for renaming and executing the virus.

Then again, thats where the desktop virus scan comes into place. Any good admin knows you might block what comes in through your servers, but you've got users who completely disregard policy and check their hotmail accounts from corporate PC's. Of course you then have the option to integrate squid with a virus scanner and eliminate most everything except the dial out accounts which stll should get caught under the desktop scanner.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

This is definitely a pretty slick setup but I'm wondering why a script was needed. Doesn't the virus scanner have the ability to check all incoming and outgoing mail for viruses before processing?

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Well, perhaps an even better way is to use a decent MTA, like qmail or postfix, together with something like junkfilter (or a bold .procmailrc file). I can filter all the email... including the usual viruses... =;)

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Well, it's good idea to use H+BEDV Team products: AntiVir for Linux and AVMailGate to protect file- and email server from virus attacks. But these products have some problems with old versions of Linux, glibc/libc5. They are free.

Another cool things are KAV - Kaspersky Anti-Virus and KAVKeeper for sendmail/qmail. Installation and configuration of these products is not so clear, but it works good enough. The last products is not free...

Running it now, i'm protecting my email users from any viruses...

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Be careful, AntiVir for Linux is free only for personal use! You have to purchase a license otherwise.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

We are currently testing MailScanner (also free). It will only run a mailserver using sendmail or Exim. It will use a commercial virusscanner Sophos or McAfee. The installation is real simple. I had it up and running in 30 min.

http://www.sng.ecs.soton.ac.uk/mailscanner/

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

is this working for qmail (qmail-smtpd) ? should i change qmail-smtpd with ur smtpd ?

thanks

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Have you tried qmail-scanner? http://qmail-scanner.sourceforge.net/

I'm currently running two mail servers with qmail-ldap + qmail-scanner + AVP (a commercial antivirus). All incoming and outgoing mail is scanned for viruses, and in case a virus is found, the system blocks it and sends alert e-mails to the sender of the infected mail, the recipient(s) and the sysadm(s).

If you're running qmail, you should also take a good look at http://www.lifewithqmail.org.

--

Vicente Aguilar vjaguilar@renr.es

real issue poor business planning

Anonymous's picture

Um, perhaps there's a problem in the business process;

am I the only one who sees a conflict:

| Recently I spent two hours cleaning the MTX and

| Navidad viruses off of a user's machine.

(note, just 1 user)

...

| Being a mid-sized business, we did not have it in our

| budget this year to buy an antivirus suite off the shelf

Um, Hello!? Maybe if you didn't have to hire many admins

cause they waste their time cleaning up users' machines...

Oh never mind.

40 hours a year saved pays for many commercial products.

Re: real issue poor business planning

Anonymous's picture

Yeah, and you could afford even more commercial software if you didn't have any employees at all. Great idea.

Re: real issue poor business planning

Anonymous's picture

So you save money by not having a Net Admin and buy Netshield or some such.

One question, who the hell is going to install and maintain a virus protection suite at a "mid-sized" business? The CEO?

I'm glad to know that Warren Buffet surfs this website.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

You need to have a version of Bash capable of doing arrays. Grab the latest off of metalab to be safe.

Also, add the -i switch to the grep calls to make the searches case insensitive.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

As you are using McAfee Linux Virus Scanner. You may need to look at the License.txt file.

b. Server-Mode. You may use the Software on

a Client Device as a server ("Server")

within a multi-user or networked

environment ("Server-Mode") only if such use

is permitted in the applicable price list or

product packaging for the Software. A

separate license is required for each Client

Device or "seat" that may connect to the

Server at any time, regardless of whether

such licensed Client Devices or seats are

concurrently connected to, accessing or

using the Software. Use of software or

hardware that reduces the number of Client

Devices or seats directly accessing or

utilizing the Software (e.g., "multiplexing"

or "pooling" software or hardware) does not

reduce the number of licenses required

(i.e., the required number of licenses

would equal the number of distinct inputs to

the multiplexing or pooling software or

hardware "front end"). If the number of

Client Devices or seats that can connect to

the Software can exceed the number of

licenses you have obtained, then you must

have a reasonable mechanism in place to

ensure that your use of the Software does

not exceed the use limits specified for the

licenses you have obtained. This license

authorizes you to make or download one copy

of the Documentation for each Client Device

or seat that is licensed, provided that

each such copy contains all of the

Documentation's proprietary notices.

I am using it with amavis Bash Script. I contacted Priority Data who stated that I would require a license for each user that it delivered mail for. Also the license is subscription for 2 years. You get the right to use the software for 2 years where then you must renew your subscription.

Regards Ger

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Great article, I'm trying this right now (sinds last night 03:30 AM ;-) in our company gateway/firewall. Do you think about setting up a site about this? It should be worth it!

Some minor notes:

You should leave out the extra space after '/var/spool/smtpd/' in the line "mkdir -p /var/spool/smtpd/ {etc,bin,incoming,outgoing,quarantine}" (for enhanced easy of copy/paste ;).

The scanmail script doesn't work on the Bash 1.14 that was installed with RedHat 6.2. Had to install Bash2, maybe you could note that in the instructions. :-)

The files in "ftp://ftp.ssc.com/pub/lj/listings/issue92/4882.tgz" are DOS style CR-LF-ed. It wasn't much fun to convert that to Unix style.

Great stuff and thanks!

Thimo Jansen

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

I also have installed bash2 to support arrays - i'm am not an experience linux user - but Bash 1.14.x is still the default shell being used to run 'scanmail'. Have tryed upgrading Bash 1.14.x but it doesn't work for me.

Anyone know a way around this would appreciate the help.

Apart from that have enjoyed setting this up, and have persuaded other members of our it department give it a chance [as a replacement for our current Mailsweeper on NT4.0 soloution] if we can get it up and running for a while.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

One word: dos2unix :)

Re: Scanmail script doesn't work on Bash 1.14

Anonymous's picture

Could someone make changes to scanmail script so it will work on Bash 1.14 ?

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

:-( uvscan doesn't work in debian/woody. It generates a "uvscan: error while loading shared libraries: libstdc++.so.2.8: cannot open shared object file: No such file or directory" error.

Even after running ldconfig as root

RE: Building an E-mail Virus Detection System for Your Network

hexenmaster's picture

The trick is to install an old .deb package of libstdc++ of debian/potato !

Download it from ftp.debian.org

ftp://ftp.debian.org/debian-archive/dists/potato/main/binary-i386/oldlib...

and install it !

dpkg -i libstdc++2.8_2.90.29-2.deb

Everythings is working now !

Good luck !

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

I had the same problem. Tried to solve it by making symlinks from some other libraries to libstdc++.so.2.8, but it did not help.

Finally I got uvscan working by downloading an rpm containing libstdc++.so.2.8 and then copying thelibstdc++.so.2.8 file to /usr/lib.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

try this..

wget http://download.sourceforge.net/debian/dists/potato/main/binary-i386/old...

dpkg -i libstdc++2.8_2.90.29-2.deb

new url

Anonymous's picture

you have to load it from the debian page...:

wget ftp://ftp.debian.org/debian-archive/dists/slink/main/binary-i386/oldlibs...

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

You are an absolute star!!

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

:-) EXCELLENT! Thank you. It's working like a charm now!

Free antivirus in sendmail 8.9

Anonymous's picture

I want to setup free antivirus for redhat 6.2 (sendmail 8.9). Most viruses are generating from client (out look ). How to prevent them ?

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

did you have libstdc2.8++ packages or smthng like that?

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

I had the same error on RedHat and used compat0libs**something.RPM and it worked

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Nope, the 2.8 libraries were used in slink (I think). I've got a potato based system and 2.8 libraries aren't available for it either (well they are but they'll break a lot of software if installed)

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Another method which I like (because I wrote it :-) is at http://www.roaringpenguin.com/mimedefang/ This uses the "milter" API of Sendmail 8.12, and is quite efficient and very flexible.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

An alternative way is to use Amavis (www.amavis.org) plus a virus scanner. It works for me nicely.

Re: Building an E-mail Virus Detection System for Your Network

Anonymous's picture

Hehe, thanks :) Just three remarks.

First of all, I've wrote a patch for the old AMaViS script (the shell script version, not amavis-perl/amavisd) to work with smtpd/smptfwdd in 1999/2000, see http://www.computer-networking.de/~link/security/amavis-patch-old.php3#r...

But, hum, the Juniper stuff isn't in active development AFAIK anymore and I'd prefer postfix for a SMTP gateway.

Second, and more important, please do not use metamail, as it can not handle MIME multipart/alternative messages. See http://www.amavis.org/security/asa-2000-1.txt for details. I'd recommend to use either reformime or ripmime instead.

And, hum, we already have several eMail scanning solutions, see cvsweb.openantivirus.org/mini-faq, av-unix_e.txt, section 2.3 :-)

Webinar
One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Webinar
Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix