RE: [Qmail-scanner-general]autoupdaters -> update_macafee

[Steve Crowder]

Title: RE: [Qmail-scanner-general]autoupdaters -> update_macafee

Hi

 

This is fine, but once a week is not enough IMHO. The quickest that I can recall ever receiving a virus within a company with 120+ users was within 10 minutes of one of the antivirus vendors announcing that a new "ide" was available for download to enable detection of the very same virus. Disinfecting this sort of number of users after being hit with a virus is no fun and is more than sufficient motivation to get a quicker method of installing the new "ide" in time. 

 

I have also seen an instance where a regular FTP update was scheduled half hourly on the hour, an announcement received at 5 minutes past the hour and the new virus being received before the next FTP update.

 

You might want to investigate writing a script that responds to a vendor announcing the availability of a new "ide" or "dat" file or whatever they may be calling it. OK the various vendors all have different lead times in announcing the availability of these files, but they all want to get the new relevant files to their customers as soon as possible. If anyone knows a quicker way of installing it by return of receiving the email announcement I'd like to know.

 

Just my $0.02 worth

---
Steve Crowder
[EMAIL PROTECTED]
 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Willliam Klein
Sent: 18 September 2002 19:58
To: [EMAIL PROTECTED]
Subject: RE: [Qmail-scanner-general]autoupdaters -> update_macafee

 If anyone is interested I update mcafee automatically.  I
 setup a user, I create a .netrc file for them that is:
 machine ftp.nai.com
 login anonymous
 password [EMAIL PROTECTED]
 macdef init $go
 cd /pub/antivirus/datfiles/4.x
 bin
 prompt
 mget dat-*.tar
 close
 bye
 
 I make a sigupdate file that is:
 #!/bin/sh
 mailto="some.body.com"
 tstamp='date'
 hostname='some.domain.com'
 
 ### Get Signature files and clean temp dir
 cd /home/virus/tmp
 rm *
 ftp ftp.nai.com
 
 ### move and unpack
 export output filename='ls dat-*.tar'
 echo $filename
 tar -xf *.tar
 mv *.dat /usr/local/uvscan
 
 
 ### Send email to admin
 export output= '/usr/local/uvscan/uvscan --version'
 mail -s "VIRUS SIGS UPDATED" $mailto <<eoi
 
 Date:  $tstamp
 The virus signatures have been updated on $hostname
 
 $output
 
 eoi
 
 exit 0
 
 Then I make a cron job for the user that runs once a week.
 
 > -----Original Message-----
 > From: [EMAIL PROTECTED]
> >
[mailto:[EMAIL PROTECTED]]On Behalf Of
> Dallas Engelken
> Sent: Wednesday, September 18, 2002 1:27 PM
> To: John McCoy, Jr.
> Cc: [EMAIL PROTECTED]
> Subject: RE: [Qmail-scanner-general]autoupdaters -> update_macafee
>
>
> > What script? I'd like to see it.
> >
> >
> > Thanks, I'll let you know if it works for me.
> >
>
>
> I'm referring to the script that is in
> ../qmail-scanner-1.14/autoupdaters/update_macafee
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by: AMD - Your access to the experts
> on Hammer Technology! Open Source & Linux Developers, register now
> for the AMD Developer Symposium. Code: EX8664
> http://www.developwithamd.com/developerlab
> _______________________________________________
> Qmail-scanner-general mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
>