samba virus wrapper

Bill Moran wmoran at iowna.com
Fri Oct 12 20:24:03 GMT 2001


Barry Smoke wrote:
> 
> o.k...mcafee works great on linux...
> It is our qmail scanner now....
> but, in order to even half assed protect the server, I would have to be
> running a cron job hourly(or sooner) on every samba share.
> 
> Is there any way to queue files written to a samba share, so that they are
> not immediately scanned, but are scanned as soon as possible....then if
> infected, mcafee can clean, and notify the user that wrote the file, or the
> sys admin.  If un-cleanable, send it to /var/infected, or something.

[Thinking out loud ...]
How about a postexec script that writes the new filename to a file in some
sort of spool directory.  A second process (running at high nice, so as not
to slow down server response) continually (or on close intervals) reviews the
spool directory and spawns processes to scan files that have recently been
saved?
A clever perl hacker could probably put this together in concert with the
MacAfee software pretty quickly.
Any takers? Additional suggestions? Reasons why this wouldn't work?

-- 
"Where's the robot to pat you on the back?"




More information about the samba mailing list