Sendmail Antivirus/Attachment Filtering

[azizshamim]

Hi,

I've installed Spamassassin, and have read the postings with the tips and tricks for it. I'm still getting tons of spam, especially the SOBER email virus that is going around now. I was wondering if there was a server-side email antivirus solution that people are using that they would recommend.

I've been working on this for a while, and I'm stumped. I'm not very familiar with sendmail, and the filter stuff at the end of sendmail.cf is beyond me.

Thanks in advance for the help,

Aziz Shamim

[Chris]

Hi Aziz,

Unfortunately, SpamAssassin is not foolproof. As soon as a new spam filter is invented, spammers make it their point to defeat them. You can try lowering the threshhold from the default level of 5. Beware that this can cause some false positives.

As for viruses, you can use a couple of methods. There are some fairly easy procmail rules that can eliminate attachments of certain size and/or certain length.
See: http://www.hardhathosting.com/community/forums/showthread.php?t=50

You can use these rules to delete the messages, pipe them to a temp file, or even pipe them to a mail spool file. For example, we at Hardhat have a rule in our procmailrc file that says if the spam level is greater than 8, we send the message to a special honeypot email spool. Once a week, we check this email address and make sure nothing legit snuck thru.

Another method is to use clamav antivirus software which checks each email message for viruses. This is not easy software to install and can cause high server loads if you receive a lot of email. We do install this for clients for a small fee. If you are interested, please let us know thru a support ticket.
https://www.hardhathosting.com/helpdesk/

I hope this helps...

[dynamite]

How often does the Spam Assassin filter get updated?

And if we did have you guys install ClamAV, would you set it up for automatic updates for us?

Thanks!