Viruses, Spam and which Webmail is suggested

polarunion · Post by **polarunion** » 2004-04-07 10:48

Ok, I've got it installed now, but how do I protect my server from viruses? Already I've been spammed a couple of viruses and lukily norton has picked it up - however that to me doesn't seem to safe. any add ons or can someone point me in the right direction?

also which webmail is supported? some people have been talking about squirl mail. and what can I do about spam? any suggestions?
Thanks.

polarunion · Post by **polarunion** » 2004-04-07 10:53

sorry, disregard the webmail part of that question.. but will it work in apache?! has anyone tried?

Post by **martin** » 2004-04-07 12:56

Hi,
The currently recommended webmail software is IlohaMail. In a couple of days, a new version of hMailServer will be availible, and then I'll recommend Squirrelmail instead. (The current hMailServer 3.0 alpha doesn't work with Squirrelmail)

Ilohamail (and squirrelmail) works just fine with Apache if you have PHP installed.

polarunion · Post by **polarunion** » 2004-04-07 18:22

thanks martin, but have you any ideas on how to protect myself from viruses and spam with this program. I appologize for being such a newbie here. If I can get everything working shipshape with webmail, spam and virus protection, I'd be more than willing to write you a well articulated manual easy enough for a child to understand..
thanks again.

polarunion · Post by **polarunion** » 2004-04-07 18:40

I just looked into ilohmail and squirlmail. both are unix only unless there is an installer somewhere. until i have time to learn how to set up a linux box - which does take considerable time, has anyone found a complete windows solution for everything that i'm looking for?

characterXero · Post by **characterXero** » 2004-04-07 21:50

Both IlohaMail and Squirrelmail are simply PHP systems. PHP, as we all know, is very cross platform (will run under almost any web server, on almost any OS). So, if you simply have a working web server with PHP installed (Apache with PHP installed as a module is definitely the best setup) it will work. What makes you think they are just Unix?

I run a windows 2000 server with Apache/PHP, MySQL, and Hmailserver all installed and running. I use IhohaMail, and other than some random issues, it works pretty well.

polarunion · Post by **polarunion** » 2004-04-07 23:05

ahhh.. ya know windows users,, if it doesn't come in a .exe and it doesn't do everything for you, you're stumped. thanks i'll read more into it.

but for virus protection!!! any ideas?! i just got a virus from a message and i'm so scared that once in the system it's going to propogate itself all over the place. shall i just post again somewhere else about virus solutions? at least in linux permissions won't allow any virus to penetrate the OS files so you're relatively safer than on windows. i need a serious solution here..

thanks guys you've been a big help so far.

Post by **martin** » 2004-04-08 19:29

Hum.. There is no "built in" support for virus detection. The main problem is that I don't know of any "general" way antivirus software scanns for virus..
What antivirus program are you using?

polarunion · Post by **polarunion** » 2004-04-08 20:35

for now i'm using a free version of AVG. last week was norton, but i'll be honest, neither really suit the function of an email server.
i've been reading a lot about Clam antivirus. i hear it's been very effective on linux boxes, but again, if you're using windowns i'm not sure if this program is compatable. http://clamav.sourceforge.net/.

mcampbell · Post by **mcampbell** » 2004-04-08 22:22

I have us using Norton AV Enterprise edition. It serves us nicely because it not only has real-time file protection but it catches anything that is opened by clients computers and keeps them all up to date whenever a new Virus Def is loaded on the sever. As long as whatever you are using has Real-Time protection and you keep the def. file up to date you shouldn't have any real problems. Even if something does get past the inital email opening the system should see the virus spreading on the network.

polarunion · Post by **polarunion** » 2004-04-09 20:33

there must be a way though to block out the viruses before it even reaches the users inbox. maybe i'm getting too picky here, but i really don't trust norton or any little antivirus program to just pick out the viruses before they start propogating across the system. there must be another way to secure this baby

KennyG · Post by **KennyG** » 2004-04-11 18:19

There is a version of clamav that runs under windows, found it here
http://www.sosdg.org/clamav-win32/index.php.

Haven't tried it yet, or installing it, so if anyone does, please post any tips, suggestions.

I'm testing hmailserver with assp (spam filter) and so far working well together, would be great if clamav is the third piece to the puzzle.

By the way, just installed hmail 3 alpha 4 (just installed over alpha 3) - clean, thanks martin.

Cheers!
Ken

Jason Weir · Post by **Jason Weir** » 2004-04-13 04:33

I just installed clamav for windows, it installed just fine, it seems to work fine. The question I have is, since clamav is not an smtp proxy just a file scanner, where does hmail server keep the mail files and what format are they in.

Post by **martin** » 2004-04-13 18:44

The e-mail files are kept in C:\program files\hmailserver\data.
The files are in simple "e-mail" formats. The actual data sent from the client to the server is stored here. Not the HELO, DATA etc but the actual data in the e-mail. (such as header, attachments etc). Simply an actual email saved on disk.

Is it possible to run Clamav from the command prompt specifying a single file to scan? If so, it would be possible to integrate it with hmailserver so that hmailserver scans files before they are delivered to the user. This would be a better solution than to just let Clamav delete the files. Delete the files would lead to a kind of "corrupt data", since the hmailserver database references the files...

KennyG · Post by **KennyG** » 2004-04-13 22:27

Hi Martin,

Yes, clamav can be setup to listen on a port. The problem is, don't know how to connect to hmailserver. I think there has to be some coding done somewhere in clamav to get to work. Likely similar to sendmail. Unfortunately, I'm not a coder. I wonder is someone wants to take on this task.

Cheers!
Ken

Jason Weir · Post by **Jason Weir** » 2004-04-14 03:57

Martin,

I just did some more testing, ClamAV runs as a standalone daemon on port 3310. For example

telnet localhost 3310
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SCAN c:/mail/virus.pif
c:/mail/virus.pif: W32.Magistr.B FOUND
Connection closed by foreign host.

I would think its fairly easy to add a hook to hmailserver to have clamav check the file for viruses first and possibly replace the attachment with a text file notifying the recipient and sender of the virus.

I'm quite sure you have plenty of free time to implement all the features that us freeloaders want, so get to it...

Thanks
Jason

polarunion · Post by **polarunion** » 2004-05-08 21:39

is there any coders out there willing to takle a clamav/hmail integration to catch viruses in the data folder before they are delivered to their client?! or would there be a way to set up a "scanned folder" so that all successful messages are cleaned and checked before they make it to the data folder for delivery?

It seems like it would be a very easy thing to do. I wish I was a good programmer. I only know a little C. This would make for a nice beta for the next release..

rabbit994 · Post by **rabbit994** » 2004-05-09 00:42

NetShield has a command line scanner. It returns 0 for clean and 4 for infected. Just need a command line scanner to go and if it returns a 4, just have hmail destroy the email. I currently just bit bucket all infected emails, no informing, no stripping attachments, just drop the blasted thing in the trash and put it on the corner to be taken out.

Lechuga · Post by **Lechuga** » 2004-05-09 13:45

Yesterday I found: http://clamwin.sourceforge.net/

And today: http://smtpfilter.sourceforge.net/

Fluffy works as an SMTP proxy; i.e. it sits between the Internet and the mail server. In addition to SPAM filtering it also includes virus scanning. It currently supports AVG and Sophos (there is a free version of AVG).

I've just sent a message to the author of Fluffy to see if he can add support for Clamwin.

nwkit · Post by **nwkit** » 2004-05-10 23:41

anyone tried using fluffy (SMTP proxy) yet?

between fluffy and assp, which one has better spam filtering?

Viruses, Spam and which Webmail is suggested

Viruses, Spam and which Webmail is suggested

Anti-virus

Virus scanning software and SMTP proxy