Re: Problem with cyrus and deleting a message with a virus.

[Additive GmbH System Admin]

Mark London schrieb:

Hi - We are running uvscan, and it will delete a cyrus message file that
contains a virus.  Of course, cyrus doesn't know that the message is deleted,
so it still shows that message, albeit it shows up as being from Unknown with
(no subject).  The problem is that this message can't be deleted, no matter
what method the user tries.  The only solution we have found is to replace the
deleted message with a dummy file, and then it can be deleted.  We can't be
the only one having this problem.  Do other people run virus scanning
software, like uvscan, on their server?  Thanks. -   Mark
      

If you're messing around with the internal data stores of a program, and
then you get upset when the program doesn't work, I'd say that you've
created your own problem.
    

I'm not messing with it, uvscan is doing it.  Is there a better software
alternative that will delete viruses on the server?  Are we the only people
using cyrus that are running virus scanning software on the server?

Btw, I would think cyrus should be able to handle the simple case of a missing
single file.  I should be able to delete a message for which the message file
is already missing.  We're not talking about a complex database file structure
here.  It's a single file with a single message.

  

Did I get you right that you simply run the scanner via cron to delete infected files? Why - if you don't want to put it on a proxy - don't you run amavis together with uvscan when sendmail attempts to deliver the mail locally via cyrus-deliver? This is what we're doing here, and it works really fine. Infected Mails won't reach the cyrus spool area and therefore cause no problem. One thing left: when a user moves a mail into the imap folders from his email client, it could possibly be infected. So we do two things about that: Every user has a server-controlled Anti-Virus System (Symatec AV Corporate) running that makes sure the clients itself are clean. Second is, we run uvscan via cronjob also, but don't let it quarantine oder delete infected files automatically. If it really should find a virus that has stolen itself into a client or the cyrus spool, we delete it manually. This never happened up till now, it's just a second 'Line of Defense' for absolute safety.
Running this system really works quite perfect, never had any problem up till now.

Regards,
Andreas Grimmel