Sophos Antivirus Plugin for CommuniGate Pro

Note: The Sophos Anti-Virus Plugin is available only for some platforms supported with the CommuniGate Pro server software. Before you order the Sophos Plugin License, make sure that the available versions of the Plugin software run on your CommuniGate Pro Server platform.

---

Download the Sophos Plugins

Sophos antivirus plugins are available for certain platforms only.

Operating System	CPU	Download
		via http	via ftp
Sun Solaris	Sparc
	Intel
Linux (RedHat 6.x/7.x, SuSE)	Intel
	PowerPC (LinuxPPC, YellowDog)	call	call
	Alpha	call	call
Microsoft Windows NT/2000/2003/XP Microsoft Windows 95/98/ME	Intel
FreeBSD 4.x	Intel
SCO UnixWare	Intel
IBM AIX	PowerPC
HP/UX	HPPA
Tru64 (Digital Unix)	Alpha
IBM OS/2	Intel
MacOS X (Darwin)	PowerPC

The current version of the Plugin is 1.8

---

Installing on a Unix System.

• Download the CGPSophos-platform-processor-version.tar.gz Plugin archive file.
• Unpack the Plugin archive with the gtar command (or with the gunzip and tar commands):
    gunzip CGPSophos-*.tar.gz
    tar -xf CGPSophos-*.tar
  The CGPSophos-version directory will be created.
• Enter the CGPSophos directory:
    cd CGPSophos-*
  
• Log in as a super-user (root).
• Launch install.sh script
    ./install.sh
  
• Proceed with Testing the antivirus Plugin.

Instaling the Plugin Manually:

• Create /usr/local/sav directory
    mkdir /usr/local/sav
  
• Move the engine file and the virus database into /usr/local/sav
    mv lib* /usr/local/sav
    mv vdl* /usr/local/sav
  
• Create a directory for the Plugin inside CommuniGate Base directory and move there the Plugin application and add-ons:
    mkdir /var/CommuniGate/CGPSophos
    mv CGPSophos /var/CommuniGate/CGPSophos/
    mv CGPSophos.cfg /var/CommuniGate/CGPSophos/
    mv test.msg /var/CommuniGate/CGPSophos/
    mv *.pl /var/CommuniGate/CGPSophos/
  

  Note: when upgrading, you may want to preserve the contents of the old CGPSophos.cfg file and re-apply your chenges to the new file.

• Create symbolik links for the engine file in /usr/lib/:
  For Solaris, Linux, FreeBSD, UnixWare, Tru64:
    cd /usr/lib
    ln -sf /usr/local/sav/libsavi* libsavi.so.3
    ln -sf libsavi.so.3 libsavi.so
  For HP/UX:
    cd /usr/lib
    ln -sf /usr/local/sav/libsavi* libsavi.sl
  For AIX:
    cd /usr/lib
    ln -sf /usr/local/sav/libsavi* libsavi.a
  
• Create symbolik link for the virus database file:
    cd /usr/local/sav
    ln -sf vdl-*.dat vdl.dat
  

---

Installing on MacOS X System.

• Download the CGPSophos-Darwin-PPC.tgz Plugin archive file.
• Unpack the Plugin archive using any uncompressing utility, or start the Terminal application and use the shell "tar" command:
  tar xzpf CGPSophos-Darwin-PPC.tgz
  The CGPSophos.pkg package directory will be created in the current directory.
• Install the software by double-clicking the CGPSophos.pkg icon. The Plugin software will be installed in the /var/CommuniGate/CGPSophos/ directory, the Sophos Antivirus Engine will be installed into /Library/Frameworks/ directory, and the virus database will be installed into /Library/Application Support/Sophos Anti-Virus/ directory.

  Warning: The installer assumes that the CommuniGate Base direcotry is /var/CommuniGate/. If you moved the Base directory to another location, create the /var/CommuniGate as symbolic link pointing to your custom Base directory.

  Note: If you're upgrading, make sure the old copy of the Plugin (the /var/CommuniGate/CGPSophos/CGPSophos application) is not running. Stop it using CommuniGate Pro WebAdmin interface.

• Proceed with Testing the antivirus Plugin.

---

Installing on Windows System.

• Download the CGPSophos-Win32-Intel.zip Plugin archive file.
• Unpack the Plugin archive with some unzip tool.
    pkunzip CGPSophos-*.zip
  The CGPSophos-version directory will be created.
• Enter the CGPSophos directory:
    cd CGPSophos-*
  
• Launch UpdateRegistry.exe program:
    UpdateRegistry
  
• Create CGPSophos directory for the Plugin inside CommuniGate Base directory and move there the Plugin application and add-ons:
    md "C:\CommuniGate Files\CGPSophos"
    copy *.* "C:\CommuniGate Files\CGPSophos"
  
• Proceed with Testing the antivirus Plugin.

Updating the Windows Registry Manually:

• Launch regedit and create HKEY_LOCAL_MACNINE\Software\Sophos\SweepNT key (or Sweep95 if you're running Windows 95 or 98).

---

Installing on IBM OS/2 System.

• Download the CGPSophos-OS2-Intel.zip Plugin archive file.
• Unpack the Plugin archive with some unzip tool.
    pkunzip CGPSophos-*.zip
  The CGPSophos directory will be created.
• Create CGPSophos directory for the Plugin inside CommuniGate Base directory and move there the Plugin application and add-ons:
    md C:\CommuniGatePro\CGPSophos
    copy CGPSophos\*.* C:\CommuniGatePro\CGPSophos
  
• Proceed with Testing the antivirus Plugin.

Note: if it fails to launch the Plugin you may need to copy DLL files from CGPSophos directory to CGPro Base directory.

---

Testing the antivirus Plugin.

On a Unix System:

• Change the current directory to CommuniGatePro Base directory:
    cd /var/CommuniGate
  
• Launch the CGPSophos application from its directory:
    CGPSophos/CGPSophos
  It will report the Plugin version number, the version number of the antivirus engine, and the version and number of viruses in the current virus definitions database.
  
• Type:
    1 FILE CGPSophos/test.msg
  the Plugin should report that it has found EICAR test file.
• Quit CGPSophos by pressing Ctrl-D.

On Windows and OS/2 Systems:

• Change the current directory to CommuniGatePro Base directory:
    cd "C:\CommuniGate Files"
  
• Launch the CGPSophos.exe application from its directory:
    CGPSophos\CGPSophos.exe
  It will report the Plugin version number, the version number of the antivirus engine, and the version and number of viruses in the current virus definitions database.
  
• Type:
    1 FILE CGPSophos\test.msg
  The Plugin should report that it has found EICAR test file.
• Quit CGPSophos.exe by pressing Ctrl-Z.

---

Integrating the antivirus Plugin with CommuniGate Pro.

Open the General page in the Settings section of the WebAdmin Interface and click the Helpers link. Create the Helper as follows:

The recommended Scanning Rule is as follows:

Note: It's not recommended to scan small messages (less than 2K) because they are unlikely to contain viruses.

Note: If you run the unlicensed version of the Plugin you're limited to one message per hour. Therefore you must not scan all messages because this will just block the mail flow. If you want to see how the Plugin catches viruses, then in the Scanning Rule you should specify more conditions on order to apply the ExternalFilter action only to messages from certain sender (from you) and with certain subject.

---

Updating the virus definitions database.

There are two type of updates: daily updates (*.IDE files) and monthly updates (vdl.dat file and several *.vdb files). The monthly update contains all virus definitions from previous months, so after updating the vdl.dat file you should delete and re-load the daily update files. You can get more information here.

Updating the virus definitions database manually:

On a Unix System:

• Download the latest vdl-x.xx.dat file and *.vdb files form Stalker FTP site.
• Move those files into /usr/local/sav/ directory (into "/Library/Application Support/Sophos Anti-Virus/" for MacOS X System)
• Rename the vdl-x.xx.dat file into vdl.dat or create a symbolic link.
• Download the current *.IDE files from Sophos Web site.
• Move them into /usr/local/sav/ directory (into "/Library/Application Support/Sophos Anti-Virus/IDEs/" for MacOS X System)
• Create update.sig file with any contents in the CGPSophos directory. When the Plugin detect the presence of a file with this name it will re-read the virus database.
    echo >/var/CommuniGate/CGPSophos/update.sig
  

On Windows and OS/2 Systems:

• Download the latest vdl-x.xx.dat file and *.vdb files form Stalker FTP site.
• Move those files into C:\CommuniGate Files\CGPSophos\ directory.
• Rename the vdl-x.xx.dat file into vdl.dat.
• Download current *.IDE files from Sophos Web site.
• Move them into C:\CommuniGate Files\CGPSophos\ directory
• Create update.sig file with any contents in the CGPSophos directory. When the Plugin detect the presence of a file with this name it will re-read the virus database.
    echo abc>"C:\CommuniGate Files\CGPSophos\update.sig"
  

Updating the virus definitions database automatically:

• Launch the monthlyUpdate.pl Perl script:
    perl CGPSophos/monthlyUpdate.pl
  
• Launch the dailyUpdate.pl Perl script:
    perl CGPSophos/dailyUpdate.pl
  

You can download the latest update scripts from here:

Script	CPU	Download
		via http	via ftp
monthlyUpdate.pl	Any
dailyUpdate.pl	Any

Note: The above scripts require some modules your Perl installation may have missing. So you may need to download and install the required Perl modules from www.cpan.org site.

To automate launching of the above scripts on Unix systems you can use cron daemon, see more info in 'man cron' and 'man 5 crontab' output.
The recommended crontab entry is as follows:

#minute hour    mday    month   wday    who     command
0       3,15    *       *       *       root    /var/CommuniGate/CGPSophos/SophosUpdate.sh
0       2       *       *       1       root    /var/CommuniGate/CGPSophos/SophosUpdate.sh -m
#launch the daily update at 3am and 3pm every day
#launch the monthly update at 2am every Monday

#!/bin/sh
SOPHOS_PATH="/var/CommuniGate/CGPSophos"
MAILER_CMD="/usr/bin/mail -s 'Sophos Update Report'"
REPORT_ADR="postmaster"
( \
if [ "$1" = -m ]; then
 echo "Launching Sophos monthly update..."
 perl ${SOPHOS_PATH}/monthlyUpdate.pl 2>&1
fi
echo "Launching Sophos daily update..."
perl ${SOPHOS_PATH}/dailyUpdate.pl 2>&1
) | eval ${MAILER_CMD} ${REPORT_ADR}

---

Configuring the Plugin.

On startup the Sophos Plugin reads the contents of the CGPSophos.cfg file from the current directory. The format of the file data elements is described in http://www.stalker.com/CommuniGatePro/Data.html. The description of the data elements you may find in the CGPSophos.cfg file. The default CGPSophos.cfg is available here.

It is safe to view and edit the CGPSophos.cfg file while the Plugin is running. After you made a change to the CGPSophos.cfg, to make the Plugin to recognize the changes you can do one of the following:

• Restart the Plugin via CommuniGate Pro WebAdmin interface.
• Apply 'kill -HUP' to the CGPSophos process (in Unix).
• Create CGPSophos/hup.sig signal file with any contents. The Plugin will delete that file automatically.

---

Licensing

The Sophos Plugin requires a separate License. Without the license you are limited to 1 message per hour.