Free savi software for linux

mod_savi is a Sophos Virus-Scanning integration module.

This allows files delivered by the web server to be scanned for viruses in real time.

mod_savi came about as part of a mail gateway virus scanning implementation. We had chosen amavis as the integration glue between our MTA and the virus scanner. Unfortunately, amavis spawned a new virus-scanning process for every mail message. Clearly, this is extremely inefficient and undesirable, particularly under heavy load.

Preferably, a virus-scanning engine could remain resident and be called as necessary. While some projects along these lines already existed, none was quite what I was looking for.

Ideally, such an implementation should be:

* robust/reliable
* portable
* secure
* scalable
* fast
* load-adjusting within resource limits


From an abstract point of view, it seemed the Apache web server satisfied all of these criteria. It is well-tuned and highly reliable. It undergoes considerable auditing and has been ported to many platforms. It is designed to service many requests efficiently, and automatically grows or shrinks according to load, but has the ability to specify hard limits to prevent resource exhaustion. Plus, it has a modular API that allows
flexible extensions. Rather than trying to reinvent a wheel, it seemed that integrating virus scanning into Apache would solve the problem elegantly.

At this point, all the module does if virus scanning is enabled is return an X-SAVI-Status header containing one of the following values:

clean
infected[;< virus_name >]+
error;

By setting the web server document root to the location of the files to be virus-scanned and issuing a HEAD request for a given file, a client can quickly and efficiently determine whether it contains a virus.

While the current implementation is intended mainly for use in a mail gateway virus-scanning configuration, it could easily be extended to perform more general web/virus-related tasks. Possible extensions of this module could include refusal to deliver a virus-infected file, automatic cleaning of files as they are delivered, or scanning of uploaded files.

Installation:

In order to successfully compile and use mod_savi, you must have already acquired and installed the Sophos Anti-Virus software and API. Information about these products can be found at

http://www.sophos.com/products/software/

Move the savi subdirectory of the mod_savi distribution to the apache/src/modules directory. For example:

cd /path/to/mod_savi
tar cf - savi | (cd /path/to/apache/src/modules && tar xf -)

If you are using the Apache Autoconf-style Interface (APACI), supply the option --activate-module=src/modules/savi/mod_savi.c to configure. Otherwise, edit the Configuration file and add the line

AddModule modules/savi/mod_savi.o

Sophie is a daemon which uses libsavi library from Sophos anti-virus vendor.
On startup, Sophie initializes SAVI (Sophos Anti-Virus Interface), loads virus patterns into memory, opens local UNIX domain socket, and waits for someone to connect and instructs it which path to scan. Since it is loaded in RAM, scanning is very fast. Of course, speed of scanning also depends on SAVI settings and size of the file.
Sophie was initially created for use with Virge, a mail virus/attachment scanning tool. Because of that, not all SAVI features are implemented in Sophie. My intention was not to create a tool that does the same job as sweep (Sophos tools), but to make fast and efficient tool that can detect virus - but not remove it or make XLS report on it (heh - this was a stupid joke, I presume ;).
At this point, some of the features (that have been requested) are implemented. Some are not, and might never be. So, please, when asking me to add things in Sophie, keep in mind that Sophie was created for Virge, not to be used as a virus scanning tool for a workstation.
This is how Sophie works:
Initializes SAVI inteface, and loads virus patterns
Creates a local UNIX socket (/var/run/sophie, by default)
Waits for someone to connect to the socket, and send path(s) on the local filesystem which need to be scanned
Sophie then forks a process, scans the path(s), and if virus is found, it stops scanning and returns result (1:virusname)
If no viruses were found, it just returns 0
Sophie then goes back to sleep...
Since virus patterns are always in memory, scanning is fast (fast in startup, not fast in execution :) and takes much less resources. For one run, it probably doesnt make a difference if you will use Sophie of Sweep. However, if you have a program (local mail delivery agent, for example) that needs to scan every few seconds/minutes - things are way different.
The difference I am talking about is not in scanning itself - when scanning is in progress, Sophie is little involved in it. Scanning speed depends on the SAVI setup, and on the size of the file being scanned (and if it is an archive, there might be hundreds, even thousands of files inside). However, the initialization of the engine is what count in this case.
Enhancements:
- etc/sophie.savi is now set with SAVI default. Names/values are set as to default SAVI settings from SetConfigDefaults(pSAVI) call.
- 28 new SAVI options added to etc/sophie.savi file. Options were taken with SAVI 3.77.
- Check for nanosleep before including rt library
- "Grp" options fix in sophie_init.c. Thanks to Markus Stumpf for spotting it.