[TriLUG] email content filtering

[Jon Carnes]

For an enthusiastic description of MailScanner and how to install it:
 http://www.linuxsecurity.com/articles/server_security_article-5098.html

The mailscanner main page is:
  http://www.sng.ecs.soton.ac.uk/mailscanner/

There is a writeup of how to front-end Exchange (or any other
mailserver) using Mailscanner off the main page.  It also has a link to
the mail archives.

Mailscanner is *not* a virus scanner. It is an application that lets you
use your purchased virus scanner to scan your incoming (and outgoing)
email. You will need an installed virus scanner for Mailscanner to work.
If you also want it to scan for spam, you will have to pre-install
SpamAssassin as well.
 
Mailscanner will work with most popular Virus scanners. Note, there is
an opensource virus scanner for Linux but you should really use a
commercial scanner.  I used McAfee's, though Sophos seems to have the
loyalest following among Mailscanner users.

Your corporation probably has a site license for its virus scanning. 
That license should include a scanner for Linux.

On Mon, 2002-09-02 at 13:42, William Ward wrote:
> Jon,
> 
> I looked at the SpamAssassin website and found some of the technical 
> detail you may be referring to.  Sounds like the sort of thing we need 
> to try out at my company, hopefully before Brightmail appears and sucks 
> up some more capital/expense.
> 
> Two questions:
> 1.  You mention a mail scanner list.  Where could I find archives for 
> this list, if you don't mind?  I'd like to read through them and see 
> how much trouble I can get into creating a test box.
> 2.  You also mentioned a solution for virus scanning?  Is this a Linux 
> open source product, or a commercial product for Linux?  We're also 
> using Trend VirusWall for our malicious code filtering, and its a 
> headache to administer.
> 
> To the rest of the list:
> I think it'd be great to hear what some of you other mail admins have 
> done to implement spam/virus filters in your mail handlers to prevent 
> the end-user folks from popping open each attachment that slides down 
> the pipe.  My goal is to see what open source/free software solutions I 
> can use to replace costly and unreliable commercial solutions we 
> currently use.  In the process maybe I can cut back on the amount of 
> pointless overhead one of my poor admin peers has to do on a daily 
> basis.
> 
> Thanks,
> Bill
> 
> 
> On Sunday, September 1, 2002, at 05:34 PM, Jon Carnes wrote:
> 
> > I ran SpamAssassin as a daemon on an older PC (650Mhz, 768Mb RAM) and 
> > it
> > easily handled 8,000 emails/day.  I estimate that if we raised the RAM
> > to a full 1Gb then the box could easily have handled three times that
> > amount of mail. There were around 180 individual accounts, and probably
> > 500 corporate alias/group accounts.
> >
> > Folks on the Mail Scanner list report scanning up-wards of 250,000
> > emails/day on their systems, and in this case they are scanning both 
> > for
> > viruses and for spam.
> >
> > If you overload a system that is running SpamAssassin by throwing too
> > much mail at it, then the mail will simply queue up. Normal latency 
> > (for
> > the system I set up at my former employer) added an average of 5 
> > seconds
> > to incoming email.  Of course you only test incoming email... The peak
> > latency was around 25 minutes - with the peak occurring late at night.
> >
> > SpamAssassin is really quite amazing.  We've talked about it on this
> > list before, so I won't repeat the details again, but if you want more
> > info, drop me line and I'll be happy to describe how it works in detail
> > for you.
> 
> _______________________________________________
> TriLUG mailing list
>     http://www.trilug.org/mailman/listinfo/trilug
> TriLUG Organizational FAQ:
>     http://www.trilug.org/~lovelace/faq/TriLUG-faq.html