Make documentation clearer on whether a virus scanning are just for e-mails or files also

Submitted by yngens on Sun, 08/19/2018 - 05:05

The entrance sentence on a documentation page on https://www.virtualmin.com/documentation/email/spam-av states:

Virtualmin allows you to enable spam and virus scanning on a per-virtual-server basis, and to configure what happens to email classifies as spam or virus-laden.

However, it is not clear if virus scanning only for emails or virtual servers' file structures also. Throughout years of using Virtualmin I never received any report about detected viruses despite sometimes customer websites get infected. So I am more sure than not that Virtualmin's virus scanning feature is only for emails. I am afraid many users have an impression their websites are covered. So could you please clarify things here: if it does also scan the files then how can we get regular reports? If it not then please fix the wording of the above page and explicitly explain they have to take additional precautions.

Status: 
Closed (fixed)

Comments

Submitted by andreychek on Sun, 08/19/2018 - 10:41

Howdy -- thanks for contacting us!

It is indeed for just email. There aren't many good, free tools for scanning websites for malware on Linux, unfortunately.

Note that the help text within Virtualmin itself clarifies that a bit more. For example, when going into Edit Virtual Server -> Enabled Features, clicking "Spam Scanning" shows help text that includes the following:

When this feature is enabled, email sent to all users of this virtual server will be checked for spam

And the Virus Scanning help includes this:

When this option is enabled in conjuction with Setup spam filtering?, all email to this virtual server will also be checked for viruses.

We'll look into whether the documentation on the website can be further improved though.

Submitted by andreychek on Sun, 08/19/2018 - 10:49

I added a couple of references to it being for email in the docs on the website. We'll look into whether further improvements can be made.

It appears to be clear within Virtualmin itself though, as the help text explains that, and the various Spam and Virus options are located under the "Email Settings" section.

Submitted by yngens on Mon, 08/20/2018 - 08:09

Body: View changes

Thanks for editing the doc page. I wish the feature also scanned files, but that's another issue worth its own issue page, which I am going to create now.

Joe's picture
Submitted by Joe on Mon, 08/20/2018 - 18:48 Pro Licensee

We've discussed building a Webmin module or Virtualmin plugin for security scanning the system and web apps before, but realistically there aren't good tools for doing that task and we obviously aren't in possession of enough free time to implement those tools.

But, if you know of a good Open Source tool for scanning for compromised web apps (which would, I think, be the most useful thing for Virtualmin users), for instance, that'd be useful to know about.