Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a centos5 mail server with over 500 email accounts on it currently running ClamAV for antivirus.

It works well but I was wondering if there is anything that would work better?

share|improve this question
    
If you are satisfied, why change? If you're not, what is it that you find ClamAV lacking? Are you interested in better detection rate, performance, simplicity or ... ? –  joechip Jul 7 '11 at 19:35
    
The main reason I would consider moving from ClamAV, is performance. ClamAV is a great choice, the most flexible option for anything AV GNU/Linux. However at heavy scanning, It is significantly slower then other AV scanners. –  TechZilla Sep 9 '11 at 15:07

1 Answer 1

Better is a relative term.

ClamAV has frequent updates and is targeted to catching malware and phishing attacks. No antivirus is 100% effective, but Clam coupled with tight access restrictions (size of attachments limited, rate limits, log monitoring, exclusion of executable files as attachments, etc.) and a good spam filtering system should be more than enough to keep your mail server running with minimal hassle and average maintenance tasks required.

Commercial AV's will offer little more than just the comfort of having someone to blame if something goes wrong, in my opinion and experience. Even then, unless they specifically support your configuration, they'll blame you or someone else for the problem. Clam has decent UNIX-centric support via the web and mailing lists because it's made for catching this stuff on Linux/FreeBSD-like OS's.

I'd wait and re-evaluate the issue if there are actual operational issues within your organization related to using Clam. Why change it if it's working for you?

In my opinion, again, the key isn't an AV that works "better", but having multiple layers of security. Really there's little concept of viruses today. It's malware. Social engineering. I just got an email yesterday that had me scratching my head to figure out if I knew the person because it had one link to check out about working from home, but it was a couple of paragraphs in well-written English (a red flag when the english is actually more correct than I expect from most people) with a friendly tone about their day and the email address listed wasn't obviously fake. So you need an adequate AV, authentication, spam filtering, server SPF checking, IP blocking against scan attacks, filtering attachments, size limiting, rate limiting, etc. to keep your email server working well, not just relying on a catch-all perfect antivirus.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.