Virus Protection For GroupWise

In February of 2002 I co-authored a Novell Connection Magazine article on virus protection and GroupWise.

This article not only deals with solutions for keeping viruses out, but also solutions for dealing with viruses that may have already entered the GroupWise system.

Since the time that I wrote this article, GroupWise third-parties have really stepped up to the plate and provided increasingly more sophisticated virus (and spam) protection solutions. Following is a list of virus/spam solutions created to protect GroupWise:

• Three different flavors of virus solutions from GWAVA
• Another solution called GWGUARDIAN from The Messaging Architects GWTOOLS

Virus protection requires a layered approach. The solutions listed above are just one of your layers. Any good system is going to have both workstation and server-based virus protection. But don’t bother trying to have your server-based virus protection scanning the GroupWise system. Messages and data in a GroupWise system cannot be scanned in their native format. So I highly recommend that you configure your server-based virus protection not to scan the GroupWise system. In fact, several times I have seen server-based A/V agents cause problems when they scan the GroupWise system.

The Gaping Hole in Virus Protection

There is one gaping hole for viruses that many customers are not aware of: GroupWise WebAccess. NOTE:

GWAVA has created a product to combat this vulnerability. It's called "WASP". I've personally implemented the software, and it works great! I recommend you give it a look.

The majority of GroupWise systems that use WebAccess run WebAccess on the NetWare platform. To ensure that a WebAccess user does not send a virus into your GroupWise system, you must have an Anti-Virus agent running on the NetWare web server. But get this: some virus-protection agents that run on the NetWare only scan files that come in through a web server.

So picture this...

• You have a NetWare 6 server running Apache hosting your WebAccess Application.
• The server is running McAfee
• A user logs in and attaches a file to a message. The file has a virus. It’s placed by the WebAccess Application in the SYS:NOVELL\WEBACCESS\TEMP directory while the user composes their message.
• The McAfee A/V agent isn’t even aware of the virus, when the user clicks on send, the virus is in your GroupWise system.
• There are two vendors that I am aware of that do scan viruses, even when they come through a web server: Inoculan and Sophos. The Novell Connection Magazine article mentioned earlier explains how my customers have implemented Inoculan to protect their WebAccess sessions.

GWAVA has created a product to combat this vulnerability. It's called "WASP". I've personally implemented the software, and it works great! I recommend you give it a look.