mcafee uvscan not using /usr/local/uvscan/datfiles/current

[Randal, Phil]

An obvious enhancement to the autoupdate script would be to detect if the
dat files in /usr/local/uvscan are symlinks or not.  If not, recreate
datfiles and link.

That's paranoia, I know, but better safe than sorry.

Cheers,

Phil

---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Tony Finch
> Sent: 29 January 2004 14:17
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: mcafee uvscan not using
> /usr/local/uvscan/datfiles/current
>
>
> Remco Barendse <mailscanner at BARENDSE.TO> wrote:
> >On Wed, 28 Jan 2004, Tony Finch wrote:
> >> Eric Dantan Rzewnicki <rzewnickie at RFA.ORG> wrote:
> >> >
> >> >However it appears that uvscan is being called with old
> dats that exist
> >> >in /usr/local/uvscan/*.dat.
> >>
> >> These should be symlinks to datfiles/current/*.dat
>
> I should probably also note that the autoupdate script will create the
> datfiles directory and set up all the necessary symlinks the
> first time
> it is run. Remove the datfiles directory before running it to get a
> clean setup.
>
>
> >Uhmm, not really You should *not* use any symlinks at all.
>
> You're the first person to mention this problem. If you can pin it
> down more precisely I would be interested -- i.e. steps I can follow
> to reproduce the problem.
>
> I wrote the McAfee update script and I haven't seen any reports of
> viruses slipping through from my users. (30,000 users and over 500,000
> messages per day.)
>
> McAfee is a bit odd about symlinks, but AFAICT it works so long as the
> directory containing the actual uvscan binary contains the
> DAT files, or
> symlinks to the dat files.
>
> Tony.
> --
> f.a.n.finch  <dot at dotat.at>  http://dotat.at/
> MULL OF KINTYRE TO ARDNAMURCHAN POINT: NORTHWEST, BACKING
> WEST OR SOUTHWEST, 5
> OR 6. RISK OF SHOWERS, WINTRY AT FIRST. MAINLY GOOD. MODERATE
> OR ROUGH.
>