[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [suse-security] AmaVis or InterScan VirusWall



Sven Michels [mailto:sven@xxxxxxxxxx] wrote:
> On Tue, Oct 22, 2002 at 12:14:47PM -0500, Manuel Peña wrote:
> > Hello guys,
> > 
> > I have a big doubt,
> > 
> > When should I use AmaVis or InterScan VirusWall ? What are 
> the differents
> > between both? What is the better?
> 
> i would prefere postfix + amavisd because you can use the power of
> postfix configuration options for filtering mail etc., and after that
> your mail will be scanned by amavisd before the mail will be dropped
> to the users mailbox. amavisd is also known to work with highvolumes
> (5-7 GB Mail an more per day) servers.
> 
I know (and use, in different locations) both products.

First of all, theses are toally different products. Amavis is "only" a
middleware sitting between your mail server and your virus scanning software
(amavis is _not_ a virus scanner!).
Amavis is free.

TrendMicro's InterScan VirusWall (or short ISVW)
(http://www.trendmicro.com/) is an email virus scanner, and also scans HTTP
and FTP traffic, too.
ISVW licenses are per-user licenses. IIRC 100 Users == 5000 EUR/USD.

ISVW (at least their SMTP-forwarding) is a pain IMHO, as you lose at least
the IP of the mail server you receive mail from (it's always localhost).
Beside this, it works well for a customer of mine which is a gay portal and
gets about 100-150 viral/wormed mails every day.

Personally I use amavisd, with AntiVir from H+B EDV (www.hbedv.de), trophie
(http://www.vanja.com/tools/trophie/), an alternative frontend for
TrendMicro's libvsapi shared library, and clamav
(http://clamav.elektrapro.com/), a free scanner which uses OpenAV's
(http://www.openantivirus.org) signatures, but is implemeted in C (openav is
written in Java). All these in different combinations, and they all work
very well.
I must say that amavisd is a really outstanding piece of software, and can
only recommend using it.

If you don't need HTTP/FTP virus scanning, then go with amavisd + some virus
scanner. Which one you chose is up to you; I have no long-term experience
about how fast the OpenAV team is when it comes to new virii/worms.
The OpenAV home page also has links to (at least) a squid filter which can
do http/ftp scanning, and an on access scanner for samba.


Hope that helped you.

Thomas

--
Check the headers for your unsubscription address
For additional commands, e-mail: suse-security-help@xxxxxxxx
Security-related bug reports go to security@xxxxxxx, not here