on-access virusscanning on shares

[Robert Sandilands]

On Thu, 10 Jun 1999, Michel wrote:

> Is there anyone who has (successfully) implemented a method of
> on-access virusscanning of files on a samba share?

Theoretically it should be easy. I had a look at the open() code and I
know somebody has written an on-close handler for auditing purposes. The
only problem is that if you interface that with a standard command-line
scanner your throughput will die.

We have considered doing an on-access scanner but our first priority is a
mail-gateway scanner for Linux. We have a very basic command-line scanner
finished. We will most likely impliment a structure which will allow high
mail througput and the same structure will most likely be usable for a
samba on-access scanner. Something in the way httpd works.

> For Linux, I only know of Sophos and McAfee virusscanners but neither
> of them can scan files as they are written or read. Is there possibly
> a hook of some sort in samba for this?

It will not be very practical from a speed perspective.

_________________________________________________________________________
I'm too brilliant to represent anybody's views or opinions but my own.
-------------------------------------------------------------------------
   Robert Sandilands - a crackpot engineer and computer prestigitator. 
       	Senior Virus Analyst : CSIR Virus Protection Services
 Tel: +27-12-841-2106, Fax: +27-12-841-4670, Email: robert at vps.co.za
-------------------------------------------------------------------------