Antivirus

[Huge]

Now, before I post my question, just all hold your horses about Unix not needing
anti-virus. I know this. That's not what I'm going to ask!

I need an anti-virus package to run on Unix machines in general, and Solaris
machines in particular, that HOST Windows files! IOW, Samba and NFS servers with
Windows clients.

In particular, I need an AV system that can scan files "on the fly" - that is,
one that scans files as they are read/written, not one that is started manually
and merely scans files in batch mode.

McAfee and Sophos both do packages that do the latter, but these are virtually
useless for what I need.

Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

[Michael Vilain]

Post by Huge
Now, before I post my question, just all hold your horses about Unix not needing
anti-virus. I know this. That's not what I'm going to ask!
I need an anti-virus package to run on Unix machines in general, and Solaris
machines in particular, that HOST Windows files! IOW, Samba and NFS servers with
Windows clients.
In particular, I need an AV system that can scan files "on the fly" - that is,
one that scans files as they are read/written, not one that is started manually
and merely scans files in batch mode.
McAfee and Sophos both do packages that do the latter, but these are virtually
useless for what I need.
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

I don't think there's such a beast for Solaris, so you may want to
explore other hosting options if this is a hard requirement. The best
I've seen is something that scans email as it's processed by sendmail.
I think that's all your going to find on UNIX platforms but I could be
wrong.

Good luck.

[Ewald Ertl]

Hi,

Post by Huge
Now, before I post my question, just all hold your horses about Unix not needing
anti-virus. I know this. That's not what I'm going to ask!
I need an anti-virus package to run on Unix machines in general, and Solaris
machines in particular, that HOST Windows files! IOW, Samba and NFS servers with
Windows clients.
In particular, I need an AV system that can scan files "on the fly" - that is,
one that scans files as they are read/written, not one that is started manually
and merely scans files in batch mode.
McAfee and Sophos both do packages that do the latter, but these are virtually
useless for what I need.
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

I do not know if the product works or is suitable on the solaris platform, but during
the download of antivir ( http://www.free-av.com ) for windows, I saw a version downloadable
for Linux/FreeBSD/OpenBSD/Solaris. Perhaps you want to give it a try.

Ewald

[Huge]

Post by Ewald Ertl
Hi,

Post by Huge
Now, before I post my question, just all hold your horses about Unix not needing
anti-virus. I know this. That's not what I'm going to ask!
I need an anti-virus package to run on Unix machines in general, and Solaris
machines in particular, that HOST Windows files! IOW, Samba and NFS servers with
Windows clients.
In particular, I need an AV system that can scan files "on the fly" - that is,
one that scans files as they are read/written, not one that is started manually
and merely scans files in batch mode.
McAfee and Sophos both do packages that do the latter, but these are virtually
useless for what I need.
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

I do not know if the product works or is suitable on the solaris platform, but during
the download of antivir ( http://www.free-av.com ) for windows, I saw a version downloadable
for Linux/FreeBSD/OpenBSD/Solaris. Perhaps you want to give it a try.

Thanks - I shall look into that.

[Casper H.S. Dik]

Post by Huge
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

One is being build as we speak (check OpenSolaris.org for the new
"VSCAN" service which is part of the overall project to do a better
integrated CIFS service in Solaris, including CIFS specific extensions
to ZFS and virus scanning)

Vscan itself is just a mechanism to allow virusscanners to scan files and
not a virusscanner itself.

Casper

[Huge]

Post by Casper H.S. Dik

Post by Huge
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

One is being build as we speak (check OpenSolaris.org for the new
"VSCAN" service which is part of the overall project to do a better
integrated CIFS service in Solaris, including CIFS specific extensions
to ZFS and virus scanning)

That's splendid news, if a little late for what I need. Thank you.

[Malcolm]

On 18 Nov 2007 16:09:03 GMT

Post by Huge
Now, before I post my question, just all hold your horses about Unix
not needing anti-virus. I know this. That's not what I'm going to ask!
I need an anti-virus package to run on Unix machines in general, and
Solaris machines in particular, that HOST Windows files! IOW, Samba
and NFS servers with Windows clients.
In particular, I need an AV system that can scan files "on the fly" -
that is, one that scans files as they are read/written, not one that
is started manually and merely scans files in batch mode.
McAfee and Sophos both do packages that do the latter, but these are
virtually useless for what I need.
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this
is possible.

http://www.f-prot.com/products/corporate_users/solaris/
http://www.steveo.us/howtos/clamav-mail-howto.html

[Huge]

Post by Malcolm
On 18 Nov 2007 16:09:03 GMT

Post by Huge
Now, before I post my question, just all hold your horses about Unix
not needing anti-virus. I know this. That's not what I'm going to ask!
I need an anti-virus package to run on Unix machines in general, and
Solaris machines in particular, that HOST Windows files! IOW, Samba
and NFS servers with Windows clients.
In particular, I need an AV system that can scan files "on the fly" -
that is, one that scans files as they are read/written, not one that
is started manually and merely scans files in batch mode.
McAfee and Sophos both do packages that do the latter, but these are
virtually useless for what I need.
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this
is possible.

http://www.f-prot.com/products/corporate_users/solaris/
http://www.steveo.us/howtos/clamav-mail-howto.html

Thanks, but the first is a batch mode scanner, the same as a number of others,
and the second is for email servers, which these machines aren't.

But ... one idea that's occured is to use FAM to kick off a batch mode scan.

[Richard B. Gilbert]

Post by Huge
Now, before I post my question, just all hold your horses about Unix not needing
anti-virus. I know this. That's not what I'm going to ask!
I need an anti-virus package to run on Unix machines in general, and Solaris
machines in particular, that HOST Windows files! IOW, Samba and NFS servers with
Windows clients.
In particular, I need an AV system that can scan files "on the fly" - that is,
one that scans files as they are read/written, not one that is started manually
and merely scans files in batch mode.
McAfee and Sophos both do packages that do the latter, but these are virtually
useless for what I need.
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

I have never heard of such a thing! Of course that is not proof of
nonexistence!

But consider that viruses are almost exclusively a PC/Microsoft O/S
problem! Symantec would go broke trying to sell anti virus software to
Solaris users.

I'd say that your best bet is to have a PC, equipped with
Norton/Symantec Anti Virus, scan these file systems daily. A good
firewall and good e-mail filtering by your mail server would also help.

You could contact Symantec and ask if they have any suitable product but
I can't hold out much hope!

Getting the PCs up-to-date on patches also helps; if you close the
vulnerabilities the the virii exploit, they don't spread so far or so
quickly. W/XP needs to be at SP2 and W/2K needs to be at SP4 (at least,
I don't know if they ever came out with another after SP4; I don't have
any W2K systems and haven't been keeping track. W/ME, W/98, and W/95
are pretty much hopeless!!! If you have such systems, replace them!

Keeping people from plugging their laptops into your nice clean network
is also a big win if you can do it!!!

Another big win is to have a Norton Anti-Virus "Server". This will
monitor all the PCs on your network and tell you who is infected and
with what! The PCs all have to be running Norton Anti Virus and be
configured to report to the server.

In spite of being mostly an OpenVMS and Solaris sysadmin, I managed to
do a LOT of anti virus work at my last job; the whole network services
group, of which I was a member, had to pitch in. Since the systems I
was responsible for didn't need much in the way of maintenance or
administration I had time available.

[Thommy M.]

Post by Huge
Now, before I post my question, just all hold your horses about Unix not needing
anti-virus. I know this. That's not what I'm going to ask!
I need an anti-virus package to run on Unix machines in general, and Solaris
machines in particular, that HOST Windows files! IOW, Samba and NFS servers with
Windows clients.
In particular, I need an AV system that can scan files "on the fly" - that is,
one that scans files as they are read/written, not one that is started manually
and merely scans files in batch mode.
McAfee and Sophos both do packages that do the latter, but these are virtually
useless for what I need.
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

Never seen anything like this. But turn the problem to the client side,
they are the ones both are fetching and are affected by the viruses. The
Solaris server is just a stable container for their infected files.

[Mr. G D Geen]

Post by Huge
Now, before I post my question, just all hold your horses about Unix not needing
anti-virus. I know this. That's not what I'm going to ask!
I need an anti-virus package to run on Unix machines in general, and Solaris
machines in particular, that HOST Windows files! IOW, Samba and NFS servers with
Windows clients.
In particular, I need an AV system that can scan files "on the fly" - that is,
one that scans files as they are read/written, not one that is started manually
and merely scans files in batch mode.
McAfee and Sophos both do packages that do the latter, but these are virtually
useless for what I need.
Is there any such thing? Obviously it would have to be hooked into the
filesystem code in a fairly intimate manner - I'm not even sure this is
possible.

You may also take a look at Symantec's Secure Endpoint Protection
<http://edm.symantec.com/endpointsecurity/#section=Home>

[Darren Dunham]

Post by Huge
In particular, I need an AV system that can scan files "on the fly" -
that is, one that scans files as they are read/written, not one that
is started manually and merely scans files in batch mode.

That's going to be pretty difficult for an NFS server. NFS services
happen in the kernel without "opening" files on the server. Unless
there's some kernel support, no user program is going to be aware of
what files are being accessed.

I think more of that support is coming in NFS 4.1, and with Solaris
"File Events Notification", but I'm not certain of the current status.

[Rich Teer]

Post by Huge
I need an anti-virus package to run on Unix machines in general, and Solaris
machines in particular, that HOST Windows files! IOW, Samba and NFS servers with
Windows clients.
In particular, I need an AV system that can scan files "on the fly" - that is,
one that scans files as they are read/written, not one that is started manually
and merely scans files in batch mode.

I've heard good things about ClamAV, so that might be worth a look:

www.clamav.org

HTH,

[Dave Uhring]

I tested it on a mail server after mailing myself a SWEN virus from my
Yahoo account. ClamAV did not detect it.