Bruno Negrão
2005-05-31 21:50:46 UTC
Hi guys,
As a result from my previous discussion, now appeared this question: What
are the advantages/disadvantages in enabling attachment blocking when
clamav scanner is active?
I think the idea behind when the Simscan Guide
(http://qmailwiki.org/Simscan/Guide) says that we could disable ripmime
when using Clamav is, once you have clamav scanner enabled and blocking the
attachments with virus, you wouldn't need to enable attachment blocking
once clamav would already blocking the bad e-mails.
But for me, even with clamav enabled the attachement blocking is still
useful:
- 1) In the case a new and undetectable virus appears (this is not rare),
is good to be blocking the "always bad" file attachments, like .pif, .scr,
.com, .bat, and even .exe. For the majority of the users, they'll never
send/receive these files for working reasons. At least with the companys
that have domains in my ISP, I blindly blocked these files and i didn't
have any complaint. Then, in the case of a new virus that spreads through
one of these extensions, my clients won't be at risk.
- 2) I supposed (i'm really not sure about it) that calling ripmime and
blocking the e-mail by simply checking its attachment extension was faster
than calling clamdscan to scan the attachment for viruses. If this
supposition is right, this would be another advantage in using attachment
blocking, even with clamav enabled.
Can someone point some disadvantages or more advantages that I don't know?
Thank you,
-------------------------------------------------
Bruno Negrao - Network Manager
Engepel Teleinformática. 55-31-34812311
Belo Horizonte, MG, Brazil
As a result from my previous discussion, now appeared this question: What
are the advantages/disadvantages in enabling attachment blocking when
clamav scanner is active?
I think the idea behind when the Simscan Guide
(http://qmailwiki.org/Simscan/Guide) says that we could disable ripmime
when using Clamav is, once you have clamav scanner enabled and blocking the
attachments with virus, you wouldn't need to enable attachment blocking
once clamav would already blocking the bad e-mails.
But for me, even with clamav enabled the attachement blocking is still
useful:
- 1) In the case a new and undetectable virus appears (this is not rare),
is good to be blocking the "always bad" file attachments, like .pif, .scr,
.com, .bat, and even .exe. For the majority of the users, they'll never
send/receive these files for working reasons. At least with the companys
that have domains in my ISP, I blindly blocked these files and i didn't
have any complaint. Then, in the case of a new virus that spreads through
one of these extensions, my clients won't be at risk.
- 2) I supposed (i'm really not sure about it) that calling ripmime and
blocking the e-mail by simply checking its attachment extension was faster
than calling clamdscan to scan the attachment for viruses. If this
supposition is right, this would be another advantage in using attachment
blocking, even with clamav enabled.
Can someone point some disadvantages or more advantages that I don't know?
Thank you,
-------------------------------------------------
Bruno Negrao - Network Manager
Engepel Teleinformática. 55-31-34812311
Belo Horizonte, MG, Brazil