VFS Virus Scanner idea...

[Mathew McKernan]

Hi all,

You may also like to know that not all client software scans network access
files by default. For example in InnoculateIT and VET by Computer
Associates, the resident scanner does not scan files off the server. You
must disable that "feature" if you want to scan files that you access over
the LAN. Basically CA guesses that all servers have anti virus software on
them and that they check the files before clients get it. We did have anti
virus software on our 2000 PDC until it started to cause _major_ problems
with our database system (Informix UniVerse).

Thanks

Mathew McKernan
Linux and Security Administrator
IT Services Department
Caroline Chisholm Catholic College
Braybook, VIC, Australia
www.cccc.vic.edu.au
+61 3 92965311

----- Original Message -----
From: "Rainer Link" <rainer at openantivirus.org>
To: <bdavids1 at gmu.edu>
Cc: <samba-technical at samba.org>
Sent: Tuesday, September 17, 2002 5:53 PM
Subject: Re: VFS Virus Scanner idea...


> On Thu, Sep 12, 2002 at 04:47:58PM -0400, bdavids1 at gmu.edu wrote:
>
> > Point #2 - Server side anti-virus is a good thing, but is not a
> > substitute for client side anti-virus.  Don't think for a moment that
> > you're safe from viruses because your server is running AV software.
>
> I'm a friend of the client-server based virus protection approach,
> that's one of the main reasons why I wrote samba-vscan (which I actually
> don't need on my own, as I don't have any windows clients at all). And,
> uhm, virus scanning has never a detection rate of 100%.
>
> > Point #3 - In some ways I think server side anti-virus is pointless.
> > It does prevent the sharing of viruses through the server, which is
> > where it *is* useful.  At the same time, if the goal is to prevent
> > viruses from wiping out the data you have on your servers, server side
> > AV doesn't protect you.  Any connected workstation can get infected
> > with a virus that deletes every server based file it has authorization
> > to delete.  Thus the server side AV only gives the illusion of
> > protection.
>
> Hum, client-based av software won't help here in all cases (think of a
> new virus). One big part of anti-virus strateg must be backups :) [which
> does not mean backups are only needed because of viruses - data loss
> because of hardware failure or by mistake are much more frequent].
> Another important part is user education, but this is beyond the scope
> of this mailing list.
>
> best regards,
> Rainer Link
>