Re: [cobalt-users] F-prot config question - Upgrade F-prot with Mailscanner

[Larry Smith <lesmith@xxxxxxxxx>]

On Tuesday 19 August 2003 16:48, David Lucas wrote:
> For me it is time for another solution.  I updated everything as instructed
> and the virus scanner no longer works.  Mailscanner thankfully is catching
> attachments and has deleted over 500 so far today.
>
> Does anyone else have a viable inexpensive solution to antivirus
> scanning.  One that is not too hard to update.
>
> Thanks for any help
> David
> At 07:31 PM 8/8/2003, you wrote:
> > > Mailscanner does not like the new f-prot and had to work out the new
> >"flags"
> > > to make those two talk nicely.  Am going to run it over the weekend on
> >this
> > > one box and will see what happens before saying too much else.

>>((Bassi starts here))
> >If you wish to upgrade to the new f-prot, you will need a revised sweep.pl
> >file for it to work with mailscanner.
> >http://www.raqateers.com/downloads/sweep.doc
> >Download that and rename it to sweep.pl and backup and replace the
> > existing sweep.pl file
> >Backup the old f-prot directory and install the new f-prot making sure you
> >copy the file f-protwrapper to the new f-prot directory.
> >Finally, remove autoupdate  from /etc/cron.daily/ and replace it with
> >"check-updates.pl" from the f-prot tools directory.
> >Restart Mailscanner ...  /etc/rc.d/init.d/mailscanner restart
> >Thats it. If you get stuck or I havent explained that too well .. let me
> >know
> >Bassi

David,

  Understand your frustration, but it would help if we knew "what" was not 
working or if f-prot is not running at all, or what.  I have loaded several 
"racks" full of boxes and each one is up and appears to be running fine (yes, 
I send a "virus" message to myself on each box to test).

 Steve's new sweep.pl superceeded the modifications I was doing so I dropped 
that part entirely - made a tar archive of the new f-prot from his (and my 
own updates to the updates process) simply load that on each server....

 As Steve mentioned, if there are problems you need to let someone know and I 
am certain someone here can help.

 First step would be to simply run "f-prot /etc/passwd" as root on the box and 
see what answer you get.  Mine says:

<quote>
f-prot /etc/passwd
Virus scanning report  -  19 August 2003 @ 17:24

F-PROT ANTIVIRUS
Program version: 4.1.1
Engine version: 3.13.3

VIRUS SIGNATURE FILES
SIGN.DEF created 19 August 2003
SIGN2.DEF created 19 August 2003
MACRO.DEF created 18 August 2003

Search: /etc/passwd
Action: Report only
Files: Attempt to identify files
Switches: <none>


Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 1

Time: 0:00

No viruses or suspicious files/boot sectors were found.
</quote>

-- 
Larry Smith
SysAd ECSIS.NET
sysad@xxxxxxxxx