Re: ServerProtect v Officescan client on server? by Les
Les
Mon May 03 09:26:31 CDT 2004
Hi Geoff,
Exchange gets the first crack at incoming email. So any actions that
exchange is set to perform will take precedence. If you have attachment
blocking set in Exchange, then Scanmail will never see them. At this level,
attachments are blocked because of their extension, not because they are or
are not virus infected.
If an attachment type is not blocked by exchange, either because exchange is
not configured to block that particular file type, or becasue it's not
configure to block *an* file type, exchange delivers it to the mail store.
As part of this delivery process, Scanmail inspects the email. If it matches
a virus definition, then scanmail takes whatever action you configured.
Note that scanmail can also block attachments based on file type, so there
is an overlap between exchange and scanmail capabilities. You may elect to
configure exchange to allow all attachments, and configure scanmail
attachment handling instead. The advantage may be that you now have one
point of configuration for attachment blocking and virus scanning.
eManager is yet another layer of email inspection, nothing to do with
attachments nor virus - allthough it can have an effect. After exchange has
accepted the email, and attempts to deliver it to the mail store, eManager
inspects the emai. If it matches it's spam settings, then it takes the
action you configured. So if that action happens to be delete, then it ends
there.
Your line of defense might look like this:
a) SMTP filters for valid A/D recipients, blank senders, etc. If a match
exists, email is rejected. If not rejected, delivery to the mail store is
initiated.
b) Exchange can strip attachments, or not.
c) eManager filters item for a spam setting match, if exists, eManager takes
configured action.
d) Scanmail filters item against virus definition, if match, takes
configured action. Optionally, if Exchange is not blocking attachments,
scanmail can take configured action on attachments.
e) if the email and/or attachments make it through the above, then they are
deliverd to the store.
f) Use the junk mail filter in Outlook. With updated junk filters (office
update), it's fairly effective at eliminating unwanted email that makes it
into the mail store.
g) when the recipient receives the attachment, they save to disk. Officescan
gets a shot at it at this point, but as it's using the same definitions as
scanmail it's unlikely to find anything different.
Note: I haven't seen eManager definitions update automatically; I don't know
why and haven't taken it up with Trend yet. But eManager should be updated,
perhaps once a week. Manual updates succeed.
Some other related configurations may help reduce the amount of email
generated as a result of spam and viruses.
a) disable NDRs.
b) disable blocked attachment, virus, and spam notifications by email to all
parties, with the possible exception of your own Administrator/postmaster.
You can enable event logging instead.
c) Use Trend's quarantine capabilities, and configure automatic maintenance
so the quarantied files don't build up indefinately. Then you can recover
email and/or an attachment within a reasonable time limit, should you feel
the need to.
I did post a walkthrough of the configuration steps a couple of weeks ago,
perhaps a google search will find it.
--
Les Connor [SBS MVP]
-------------------------------------
SBS Rocks !
"Geoff Cox" <geoff.cox@minusspam.freeuk.com> wrote in message
news:v4ja90dijnj52fpf53ght5p17j5p0ucsj7@4ax.com...
> On Sun, 2 May 2004 08:33:32 -0500, "Les Connor [SBS MVP]"
> <les.connor@DEL.cfive.ca> wrote:
>
> >Hi Geoff,
> >
> >I'm not sure I understand your question, I don't have any virus. Are you
> >saying you are infected with Netsky, and want to clean up ? I haven't had
> >any reason or opportunity to use the Trend damage cleanup, but if you are
> >infected this might be a good opportunity.
>
> Les,
>
> Apologies - muddled thinking on my part. What I meant was that I am
> getitng email alerts that Scanmail has deleted Netsky.P loaded emails
> and I was wondering how you would react if you received such messages.
>
> I see for example that Scanmail sees an attachment called message.scr
> so I have configured Scanmail to block *.scr attachments. Is this the
> best approach?
>
> I believe e-Manager acts before emails get to Scanmail? Can e-Manager
> block/delete attachments before they get to Scanmail?
>
> Cheers
>
> Geoff
>
>
>
>
> >
> >I do use eManager, and it is good. That is spam control though, not A/V -
> >allthough it does have some bearing depending of how you configure it.
>