Administrator's Guide - Kerio Software Archive

17.4 Server responses to detection of a virus or a damaged/encrypted attachmentinstead of the Native protocol. For this reason, it is necessary to switch the protocol using theConfiguration → Protocol → ICAP option in the SAVSE settings..Clam AntiVirusKerio MailServer supports Clam AV for Linux, Mac OS X and Windows.Warning: Clam AV is available in two basic versions for Windows, but only Clam AVfor Windows can be used (aka ClamAV-win32). Version ClamWin Antivirus is not supportedby Kerio MailServer). Clam AV for Windows can be downloaded for free athttp://www.sosdg.org/.To make cooperation of Clam AV with Kerio MailServer function properly, the following requirementsmust be met:• Communication of the antivirus and Kerio MailServer must be maintained over a networksocket (this can be set in the antivirus configuration file).• In the Kerio MailServer’s administration console (Configuration → Content Filter → Antivirus→ the Options button) in the antivirus settings (see figure 17.2), set an IP address and a portfor traffic. If Clam AV is running on the same computer as Kerio MailServer, it is notnecessary to change default settings.• On Linux operating systems, Kerio MailServer is always running under the root user. IfClam AV is installed on the same computer as Kerio MailServer but it is running underanother user, the UseStreamOutLocalhost item in the antivirus configuration in the administrationconsole (Configuration → Content Filter → Antivirus → the Options button) mustbe set to the 1 value.Figure 17.2Options for Clam AntiVirusNote: Updates of the virus database must be set by using the Freshclam utility.17.4 Server responses to detection of a virus or a damaged/encryptedattachmentThe Kerio MailServer administrator can set a detailed course of action for the mailserver ifa virus or a damaged attachment is detected in an email. Use the Action tab to set this.199