[ILUG] [OT] Updated Sophos file [was: New Virus warning]

[Kenn Humborg]

> On Fri, 5 May 2000, Kenn Humborg wrote:
> 
> > Sophos have updated this IDE file a few times since.  In case
> > you are having trouble getting through to sophos.com, here
> > are the latest IDEs:
> 
> how well/easy does the sophos scanner integrate with unix mta's? in
> particular sendmail?
> 
> or: could you give a mini-review of it?

I took the Amavis code (www.amavis.org) and hacked it around
a bit to separate the MDA integration from the picking apart
of the message and scanning the bits.  Then I run two sendmail
queues on my mail gateway.

Incoming message (from either direction) are received and 
forwarded to a special mailer (via a wildcard mailertable
entry) which is a shell script that receives the original 
sender and recipients as arguments and the message itself 
on stdin.  If the message scans OK it is re-submitted to 
sendmail (specifying a different sendmail.cf file) that 
sends it on its merry way as normal.

This is with sendmail 8.9.x.  Sendmail 8.10 apparently makes
this easier by providing hooks for filtering all content.
Haven't looked at this yet.

In summary, it's not quite plug-and-play right now with sendmail,
but it's improving.  (Cue Lars' plug for postfix...)

BTW, amavis is a wrapper around a bunch of virus scanners.  At
./configure time it looks for various different scanners and
will happily run multiple scanners over the message.  Good for 
the paranoid among you...

Later,
Kenn