Koozali.org: home of the SME Server

Obsolete Releases => SME Server 9.x => Topic started by: ElFroggio on June 17, 2015, 05:31:46 PM

Title: ClamAV & scanning
Post by: ElFroggio on June 17, 2015, 05:31:46 PM: Hi,

I have a whole bunch of viruses that go through email and are being caught by the end-user workstation (McAfee).

Is ClamAV scanning the email as they are being received? I also have ClamAV scanning overnight and I have the logs for that (clamd/clamscan.log). The night jobs catch the "night' viruses.

I don't see any clamav setting for scanning incoming emails and where are they stored or deleted?

The night job sends them to /var/spool/clamav/quarantine/ but there is none added during the day, when the end-users are collecting their emails

Thanks

Syv
Title: Re: ClamAV & scanning
Post by: Stefano on June 17, 2015, 05:34:18 PM: is AV scanning enabled in Email web panel in Server-manager?
Title: Re: ClamAV & scanning
Post by: guest22 on June 17, 2015, 05:53:14 PM: Disable 'quarantine' viruses and install the new contrib smeserver-clamav-unofficial-sigs from the FWS repo
Title: Re: ClamAV & scanning
Post by: ElFroggio on June 17, 2015, 06:20:54 PM: Quote from: Stefano on June 17, 2015, 05:34:18 PM
is AV scanning enabled in Email web panel in Server-manager?

Antivirus settings

General Settings
If this option is enabled then the filesystem will be scanned for viruses. A report of any found viruses will be emailed to the administrator.

Code: [Select]
Scan filesystem DAILY Quarantine infected files ENABLED ClamAV and db versions 0.98.7/20576/Wed Jun 17 05:33:21 2015
Is this what you mean?

Thanks

Syv
Title: Re: ClamAV & scanning
Post by: ElFroggio on June 17, 2015, 06:23:04 PM: Quote from: guest22 on June 17, 2015, 05:53:14 PM
Disable 'quarantine' viruses and install the new contrib smeserver-clamav-unofficial-sigs from the FWS repo

I have already installed the unofficial sigs, but

What does "Disable 'quarantine' viruses" do? leave them in the end-user mailbox? Delete them on the fly?

Thanks

Syv
Title: Re: ClamAV & scanning
Post by: guest22 on June 17, 2015, 06:23:51 PM: http://wiki.contribs.org/Email

;-)
Title: Re: ClamAV & scanning
Post by: ElFroggio on June 17, 2015, 06:30:28 PM: Quote from: guest22 on June 17, 2015, 06:23:51 PM
http://wiki.contribs.org/Email

Yes, that was the 1st thing I did and I have read that and I do not see the quarantine, only:

Signatures
Heuristic Scan
Attachment Filtering

Thanks

Syv
Title: Re: ClamAV & scanning
Post by: Stefano on June 17, 2015, 09:27:18 PM: Quote from: ElFroggio on June 17, 2015, 06:20:54 PM
Is this what you mean?

no..

Email -> Email Filtering Settings -> Virus Scanning
Title: Re: ClamAV & scanning
Post by: ElFroggio on June 17, 2015, 09:39:01 PM: Quote from: Stefano on June 17, 2015, 09:27:18 PM
no..

Email -> Email Filtering Settings -> Virus Scanning

Thank you: It was enabled. I will have to monitor the situation more closely.

Thanks

Syv