Bradley M Alexander wrote:
> On Tue, Feb 20, 2001 at 01:59:20PM +1000, Mario Zuppini wrote:
>
>> I would also like to know of virus scanners especially for mail servers ie
>> sendmail
>> that will work on a SPARC ???
>>
>> there are a few that work under i386 ie like amavris etc can be found on
>> freshmeat.net
>> but nothing will work under a sparc
>
>
> As a quick and dirty option, you can use procmail to filter. Depending on
> your security posture and thread environment, you can filter on
> multi-extension vbs files (e.g. AnnaKournikova.jpg.vbs), all VBS files, exe
> files, or any combination. You could filter them to a quarantine area, then
> peruse them at your leisure.
The best one I've read was using procmail to replace every attachment
ending with .vbs to .vbs.txt -- this way every VB script will be opened
in Notepad. If someone really wants to execute it, she should be able to
change the ending. Of course this can also be done for other scripting
languages. Unfortunately I don't have the procmail line at hand and my
sed is more than limited.
The advantage is that nothing gets lost this way. And users who don't
know to handle the endings shouldn't execute scripts IMHO ;-)
Of course EXEs are not that elegant to solve and probably your manager
will complain if she can't see the nice comic a friend has sent her
since you replaced the ending with .ex_ :-( If that happens: send a
program showing a black screen and beeping, fiddle around for an hour
while the program is running, always mourning about the bad, bad hackers
(yes: hackers -- always use the terms of your clients). Maybe this helps
;-) Or just say it is a security feature of your mail server (which it
is), but don't tell anyone that you set it up yourself.
Peter
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
