[Mimedefang] mimedefang and clamav

David F. Skoll dfs at roaringpenguin.com
Wed Apr 6 14:58:13 EDT 2005


Speedy Sweedy wrote:

> I want to perform a virus scan of incoming mail before I call the larger
> overhead process of mimedefang.  I am currently using clamav-milter,
> works great... by itself!

What percentage of your total e-mail volume consists of viruses?
On our server, about 1% of all e-mail messages are viruses.

This means that 99% of the time, we'd end up calling MIMEDefang anyway.
I think you'll find that it's just as efficient to integrate Clam using
MIMEDefang, because 99% of the time, it makes no difference, and the 1% of
the time when it makes a difference, the difference is extremely small.

Also, there is a security advantage to callimg Clam from MIMEDefang, because
MIMEDefang can pass it both the raw MIME message and the unpacked message
parts.  This makes it harder for malformed MIME viruses to slip through because
they'd have to exploit bugs in *both* MIME::Tools and ClamAV's MIME parser.

Regards,

David.



More information about the MIMEDefang mailing list