Topic: Anti-Spyware/Anti-Virus

[nald]

Hi Contribs,

Is there anyone knows if there is any available anti-virus and anti-spyware for SME?  I do have an SME 6.0.1 acting as my Proxy Server.  I am planning not to install anymore an Anti-Virus and Anti-Virus in each workstation.  It would be a hassle to install an anti-virus and anti-spyware if there is a new worstation inside the network.

If someone has an idea of any anti-virus and anti-spyware that would run in SME then it would be a great help to everyone who has a Proxy Server.

Thanks...

Nald

[cc_skavenger]

there is an addon for clamav...

do a search for antivirus or clamav

[nald]

Hi cc_skavenger,

I do already install the anti-virus link to
http://sme.swerts-knudsen.dk/index.html?frame=http%3A//sme.swerts-knudsen.dk/howtos/howto_22.htm

According to this link, it only check the e-mails for viruses.

To give you a summary on our network.  We do have plenty of computers connected to the network.  Each PC has its own anti-virus protection.  We installed an AVG anti-virus.  Our current problem is SPYWARE.  I don't want to install each pc an Anti-spyware application. Is there any tools to block any spyware before it passes to our proxy server?  I do already install Squidguard which is for content filtering but it seems it doesn't block site that has spyware and popups.  I do find an Openlist database of Spywares and i don't know how to add that one inside our Proxy Server...
Can you help with this one...Thanks...

Regards,
Nald

[Tib]

nald

If you have a look at his other howto's you will also find a spam filter there.

I have been using it for over a year now with no problems at all.

Regards,

Tib

[nald]

Tib,

I think Spam Filter is only for E-mails....  It will scan all incoming e-mails and check if it is a spam or not.  What i am trying to ask is that the proxy will block a certain site that has spyware before it reach to the workstation...  

We could compare to our own computers that has its own anti-spyware, an example is Microsoft Anti-Spyware.  It has a real-time protection.  It will block a certain sites that has a spyware or pop-ups or ads.  

Why not install an Anti-Spyware in Proxy coz all our workstation will pass to our Proxy to access to internet then it will block sites that has a spyware.

Is there any tool that we can install inside my Proxy Server?  Or i really need to install each PC an Anti-Spyware?

Nald

[Zaphar]

If you install the dansguardian plugin and configure it correctly you will see a dramatic drop in spyware adware. Set it to block executable and archive files and it will block most spyware installs. If macros viruses are a problem you can block documents that can contain those also. I think that should suit your needs.

[nald]

Zaphar,

Thanks so much... Installing dansguardian suit my needs.   I can block spyware sites manually.  All i need to do is to search for database that has a list of spywares sites and paste them in the bannedsitelist.  

Nald

[albatroz]

Not an easy task, good luck

Zaphar,

Thanks so much... Installing dansguardian suit my needs.   I can block spyware sites manually.  All i need to do is to search for database that has a list of spywares sites and paste them in the bannedsitelist.  

Nald

[raem]

http://mirror.contribs.org/smeserver/contribs/rmitchell/smeserver/howto/dansguardian%20instal%20&%20configure%20HOWTO%20for%20sme%20server.htm

[nald]

Ray,

I already install the dansguardian. I followed all the procedure which you wrote.  It really works...  However i got confuse on how to place the update of "squidguard blacklists".  How am i going to do it? What command line am i going to write in '/etc/cron.weekly/dansguardian' file?

Thanks...

Nald

[raem]

nald

> However i got confuse on how to place the update of "squidguard blacklists".  

What bit don't you understand (from the HOWTO) ?


Using squidguard blocking rules

If you wish to make dansguardian use squidguard blocking rules & have them updated weekly then ad the following to the /etc/cron.weekly/dansguardian file mentioned above

Please check the location of the blacklists is still current, if necessary search Google on "squidGuard blacklists" to find a current location.


cd /etc/dansguardian

rm -r blacklists.tar.gz

wget -qnv http://ftp.teledanmark.no/pub/www/proxy/squidGuard/contrib/blacklists.tar.gz -O blacklists.tar.gz

tar -zxf blacklists.tar.gz

chown -R root.root blacklists

chmod -R 640 blacklists

find blacklists -name new\* -exec rm {} \;

rm blacklists/README

chmod ug+x blacklists

chmod ug+x blacklists/*


Enabling logrotation

To enable the weekly rotation of dansguardian logs, do the following.

cd /etc/cron.weekly

more dansguardian

Add the following lines

# logrotation script for dansguardian

exec /etc/dansguardian/logrotation

Ctrl o

To save

Ctrl x

To exit

[nald]

Ray,

I do understand already.  I was a little bit confused on placing the script that is written below.  Actually I did it manually.  So i think in updating the blacklists, i need to place the script in /etc/cron.weekly/dansguardian file so that my server will be the one to update automatically than doing it manually.
_____________________________________________________
cd /etc/dansguardian

rm -r blacklists.tar.gz

wget -qnv http://ftp.teledanmark.no/pub/www/proxy/squidGuard/contrib/blacklists.tar.gz -O blacklists.tar.gz

tar -zxf blacklists.tar.gz

chown -R root.root blacklists

chmod -R 640 blacklists

find blacklists -name new\* -exec rm {} \;

rm blacklists/README

chmod ug+x blacklists

chmod ug+x blacklists/*
______________________________________________________

Last one thing, do i need to configure the /etc/cron.weekly/dansguardian file into an executable file?

Thanks so much...

Nald

[raem]

nald

> ....i need to place the script
> in /etc/cron.weekly/dansguardian file so that my
> server will be the one to update automatically....


Correct


> ....do i need to configure the
> /etc/cron.weekly/dansguardian file into an
> executable file?


Nothing extra to do, it should run as is.