[squid-users] Squid -> VirusWall: to catch a virus

Two test set ups:

    #1 Browser -> (3128) Squid -> (8080) VirusWall -> Internet

    #2 Browser -> (8080) VirusWall -> Internet

Configuration:
   Squid 2.4S2 and Trend InterScan VirusWall 3.6, on Solaris 5.7.

In #1, Squid talks to the VirusWall scan engine on port 8080,
and the VirusWall's purpose is to check the web page content
for viruses. When handed back off to Squid, the cache that
accumulates should be clean of viruses, if the VirusWall is
doing its job.

There is a test site,

        http://www.eicar.com/anti_virus_test_file.htm

with test files that have no viruses, but they do have content
where the virus engine and trips over certain patterns. The
test files are at the bottom of the page -

eicar.com
eicar.com.txt
eicar_com.zip
eicarcom2.zip

Using Test Case #1, all but eicar_com.zip are intercepted by
the Trend IS VirusWall. The eicar_com.zip file, instead, causes
a download or save it disk box - which means that VW has failed.

In Test Case #2, without Squid, and directly via the VW, all
test cases are intercepted by the VW software.

Is there a squid.conf configuration that I need to tweak? I'm
at a loss for this. I don't think I had a problem with Squid 2.3.

deb
Received on Wed Oct 03 2001 - 19:27:55 MDT