on-access virusscanning on shares

Robert Sandilands robert at vps.co.za
Thu Jun 10 09:32:29 GMT 1999

On Thu, 10 Jun 1999, Michel wrote:

> Is there anyone who has (successfully) implemented a method of
> on-access virusscanning of files on a samba share?

Theoretically it should be easy. I had a look at the open() code and I
know somebody has written an on-close handler for auditing purposes. The
only problem is that if you interface that with a standard command-line
scanner your throughput will die.

We have considered doing an on-access scanner but our first priority is a
mail-gateway scanner for Linux. We have a very basic command-line scanner
finished. We will most likely impliment a structure which will allow high
mail througput and the same structure will most likely be usable for a
samba on-access scanner. Something in the way httpd works.

> For Linux, I only know of Sophos and McAfee virusscanners but neither
> of them can scan files as they are written or read. Is there possibly
> a hook of some sort in samba for this?

It will not be very practical from a speed perspective.

I'm too brilliant to represent anybody's views or opinions but my own.
   Robert Sandilands - a crackpot engineer and computer prestigitator. 
       	Senior Virus Analyst : CSIR Virus Protection Services
 Tel: +27-12-841-2106, Fax: +27-12-841-4670, Email: robert at vps.co.za

More information about the samba mailing list