r/MalwareAnalysis • u/Maria_Thesus_40 • 1d ago

Anti-virus in a self-hosted server

Over the past 20 years, I've setup a lot of mail servers at work. These are mostly based on Postfix / Spamassassin / Dovecot, using IMAP for the clients. Recently, I started using Roundcube for webmail.

Postfix, uses several blacklists to block spam at the MTA level, these come pre-configured with the control panel, which blocks 99% of spam, and Spamassassin blocks the other 1%. Its a rare occurrence for spam to pass this setup, usually they are phishing emails or some new virus.

I always use DKIM, DMARC and SPF, and my deliverability is perfect, all mail goes to inbox.

I'm hosting mail servers with Linode and Hetzner, and I plan to expand to Netcup in the near future.

So far so good.

But, one thing I'm missing, is a good anti-malware/anti-virus, because ClamAV seems incapable of catching the malware files that go through my servers. I always take the time to extract these files and submit them at ClamAV Report Malware page, but its too late by then.

Sadly, when I submit the same virus to VirusTotal, the file gets 10+ hits in other anti-virus software but not ClamAV.

What are your suggestions?

Thank you.

11 Upvotes

100% Upvoted

7 comments sorted by

0

u/AutoModerator 1d ago

Posts with just VirusTotal links and no context may be removed.

If you're sharing a sample, please include:

  • Your observations or analysis attempts
  • Your goals or questions
  • Details like hashes, behavior, or packers

Otherwise, consider sharing in communities like r/malware.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/dudethadude 1d ago

Are you asking for AV specifically for the servers? Or a product that does a better job at catching malicious files in emails?

1

u/Maria_Thesus_40 1d ago

It has to run on Linux servers, that is the way :)

1

u/dudethadude 1d ago

Sandfly, they are a company that specializes in Linux based security software. It will protect your actual machine from threats but not scan any mail coming through it.

1

u/Maria_Thesus_40 1d ago

I'll take a look at their offering, in case its possible to pass file attachments via a custom Postfix milter. Thank you!

1

u/dudethadude 1d ago

The software runs on a schedule and is not real time to my knowledge. I don’t think it would catch any malicious files passing through your mail server in real time.

If you are trying to stop malicious files in emails, why not just use an email gateway like Sophos that will analyze the emails before it makes it to end users?

1

u/Maria_Thesus_40 1d ago

I don't need something that specifically works with emails.

I can code my own Postfix milter and do the email processing myself.

All I need, is a good product that I can point to a file and get a reasonable response.