Which antivirus - for a mail server

[oldboy47]

Intrigued and encouraged by the many posts regarding AV software but not sure that they are suitable for a mail server.

Would be grateful for members views please.

[Moby-Dick]

for a mail server you want something that potentially looks at the mail flow as well as the underlying OS. We use Macafee for the Os and Forefront for Exchange to do the AV side of that ( in addition to postini filtering for external mail )

[chinny]

We've been using McAfee GroupShield with Exchange for a good few years - just sits there doing it's thing. We run a couple of filtering MTAs in front of that - they're running multiple engines (Clam and Kaspersky) to hopefully pick everything out before it reaches Exchange.

I'd recommend multiple engines if you can, less chance of anything being missed by a single vendor.

[Steve]

I use amavis on my VPS.

[badass]

We have mcaffee at the mail gateway and Trend 10 on the exchange server.

[ChaosSystem]

You need the server/mail version of antivirus packages to scan email servers at the mailbox level.

I used to run a Barracuda Spam Firewall at the gateway, this handled spam and viruses from external sources.
On the Exchange side, I used Trend Scanmail which was mainly to stop internal users infecting each other.

[peterb]

Clamav integrates well with postfix.

[kopite]

I`ve been using clamav for a few years on my mail server with no problems.

Config for Exim and postfix are both pretty easy.

[Spud1]

how much do you want to spend?

Linux or windows?

Server editions of most of the big/best ones like f-secure are very expensive, but there are a few smaller companies with decent scanning engines that are much cheaper - MailEnable for example is what I used for many years, and its about £140 for the server version.

ClamAV is one free option if you don't mind doing a fair bit of configuration - but be mindful that its fared poorly in tests and isn't really a good option if you are going to use the server commercially. Ask yourself if an open source security product is really a good idea (it just isn't).

[peterb]

<--snip

Ask yourself if an open source security product is really a good idea (it just isn't).

Why?!! An open soiurce product that is open to peer review can be as secure (if not more so) than a closed source proprietary product.

Linux SE (for example) can be configured as a multilevel secure operatiing system.

The security weaknesses in any OS or application lies as much in the (mis) configuration as it does on the coding.

[1stRaven]

We've been using McAfee GroupShield with Exchange for a good few years - just sits there doing it's thing. We run a couple of filtering MTAs in front of that - they're running multiple engines (Clam and Kaspersky) to hopefully pick everything out before it reaches Exchange.

I'd recommend multiple engines if you can, less chance of anything being missed by a single vendor.

+ 1 on the multiple engines. We use groupshield on all our mail servers, sitting alongside McAfee VirusScan Enterprise for the OS Cover. Before that, the mail goes our 3 levels of AV scanners at anti spam managed solution and then gets scanned for AV by the firewall.

Never had a virus get through that lot though we pick up around 8 mails a day (out of 3500) which are sent with viruses.

[Splash]

Why?!! An open soiurce product that is open to peer review can be as secure (if not more so) than a closed source proprietary product.

Linux SE (for example) can be configured as a multilevel secure operatiing system.

The security weaknesses in any OS or application lies as much in the (mis) configuration as it does on the coding.

Agreed. I'd be very much intereste in your logic Spud1, especially as I've worked with IT management in the past who share that mindset and it might help me understand the idea that proprietary software is more secure than open source in future.

[watercooled]

I can sort of understand a proprietary AV being better purely because the company behind it throw far more money at the databases than an open source project would. I strongly disagree about software in general though, that's proved itself time after time over the years...