Vispan | Vispan |
|
VispanCurrent version 3.1.219 September 2009 DonateIf you find this software useful and would like to make a donation please follow the link below. DonateDownloadLatest Stable Release Beta Release InstallationTo install, download the zipped tar file. Unpack it - this will create a directory called Vispan-x.x (where x are the version numbers). Go into the directory and type:perl Makefile.PL make install This will install the necessary files into your system. If necessary it will amend your crontab to add an entry to call the script. Please note that the config file will be installed into /etc. If it already exists then it will be upgraded and a backup copy made of the original file. You should check that the upgraded file contains the correct settings. UPGRADING - the latest version should read the stats in from your existing file, however, this code has not been extensively tested and no guarantees are made about the accuracy of the resulting statistics. Dependencies
Example For an example of the output see http://www.while.org.uk/vispanSupportThere is now a Discussion Forum for Vispan. To report a problem please login and use the support system. If you do not have an account please register for one.DescriptionVispan is a PERL script which analyses the mail log file to produce useful statistics. It requires MailScanner to provide the necessary log file entries. The virus list is dependent on the virus scanner you have installed. In order to detect the spam correctly it is strongly recommended to use SpamAssassin with MailScanner The script can also use heuristics in the senders of the spam emails and can then automatically add them to the sendmail access file which will cause further mails to be rejected. After a definable period of time they will be removed from the access file and once again allowed to send mail to you. The heuristics provide an escalation mechanism so that when an IP address is removed from the block then a grace period is started. If that IP sends any spam during that period it will escalate and block the IP for twice the previous block time. For example using the default settings: I believe that this is superior to the RBLs that are maintained since you have control over them and it is specific to the behaviour of your particular mail server UsageVispan is usually called via the cron mechanism - an entry is created at install time to do this. Note that the time interval set by the cron job should not be changed since Vispan uses this to perform some calculations. Changing the run interval in the cron job will cause some very weird results. There are command line options as follows:
Config fileThe Vispan.conf file contains configuration information which you should change to suite your requirements as follows:
ChangelogVispan-3-1-1 * Add facility to allow the Whitelist to be specified in a separate file. * Added feature to display email addresses rejected by smf-sav * Added feature to display email addresses that have been rejected by smf-sav * Added feature to display email addresses that have been rejected by smf-sav * Correct the link in teh footer. * Take the tab out of the cron file and change permissions. * Change the default setting for UseRBL to 0. Vispan-3-0-0 * Corrected the code when there are no maillog entries for the interval. This caused a blank value to be stored for the current file position. * Added RBL support * Added RBL support * Provide the detailed statistics including the load. * Moved the setting of the time field to earlier so that graphs are generated correctly on heavily loaded systems. * [no log message] * Only add entry in whitelist if name lookup succeeds. * Correct missing Vispan:: entries Vispan-2-0-4 * Added packaging information to ensure that the modules don't get confused with other packages. * Added packaging information to ensure that the modules don't get confused with other packages. * [no log message] * [no log message] * Added facility to allow whitelist to be specified by domain name as well as IP address. * Added fixes from Aaron Moore for virus scanner lines and numcols. * Modified whitelist code ton allow domain names to be used as well. * Added percentages to the cache hit reports. * Added the analysis and reporting of cache hits which was added in MailScanner V4.50 * Changed the order of the details on the spam page so that blocked IPs are at the top. * Added functionality to allow whitelist to contain FQDN as well as IP addresses. * Changed code so that if virus scanning is not enabled the count of messages and size still works. * Changed comment about sophosSAVI to make the SAVI uppercase * Corrected typo in variable definition. * Added a command line option of -v to get the version numbers of the virus scanners. * Added check to make sure that the virus scanner specified in the config file is valid. Vispan-2-0-2 * Change the blocktime from hours to minutes to allow shorter block periods. * Added support for the version number of McAfee virus scanner. * Amended the whereis path so that the executable MailScanner is detected correctly. * Changed locking mechanism to detect stale lock files and remove them. * Correct the reporting of IP addresses which would have been blocked except that they are in the whitelist. This resulted in the spam page showing an undefined level. Vispan-2-0-1 * Corrected typo - added missing comma. * Changed version number * Add check to make sure that the size of a message is greater than 0. * Added config option for the path for whereis command to search. * Changed version number. * Added support for the version number in McAfee. * Changed the regex for Clam since on Linux systems, the log line ends in a space but on Solaris it doesn't! * Added support for version number in Antivir. Also tidied up the search string. * Format the y-axis values to be more readable for large values. * IPTables block should block the destination port 25 not the source port 25. Vispan-2-0 * Tidied up the graph x axis labels * Changed version number * Added config option to specify the location of the whereis command. * Added config option to specify where the iptables command is. * Only send email when the IP address has actually been blocked - not when it has been detected as a candidate to be blocked but is whitelisted. * Added code to support blocking using iptables Vispan-1-5-5 * Changed Version number * Bug: 49 - Corrected the code which handles the -r option. It wasn't removing the IP address since the data wasn't loaded before the call to remove the IP address. Vispan-1-5-4 * Bug: 47 - added facility to specify header and/or footer HTML files. Specifying a footer file will prevent the W3C logo from appearing since it is not possible to guarantee that the included files contain valid XHTML. * Bug: 45 - added config option for sendmail logging text. * Remove the printing of unknown log entries - this was really a debug feature * Changed the detection string for F-Secure to cope with the change in output. * Corrected the code for the optional GeoIP changes. * Made the GeoIP functions dependent on a configuration setting. So if people don't have the GeoIP library loaded they can still use Vispan. * Update version number. * Added command line option to remove IPs from the blocked list. * Corrected the storing of theday values so that the day average graphs are generated correctly. * Corrected the typo in the Print routine from > to < * Added a dependency on the version of MakeMaker to the makefile. * Bug: 46 - Fixed the problem of the invalid index when starting with a clean install. * Added code to detect what graphics file format is supported and produce that type of graph. Vispan-1-5-3 * [no log message] * Change to reflect the version number reporting change in ClamAV * Corrected the initialisation of stats on various boundaries * Make day average graph x axis labels start correctly. * Bug 44: Prevented IPs which are whitelisted in MailScanner from being added to the blocked list. * Correct a divide by 0 error if there were no mails in an interval. * Corrected the HTML to access the right graphs * Sorted out the reporting of the average message delay. * Changes to add the graphs page. * Corrected code for rolling up the average spam score. * Added code to report the average spam score for spam and highspam in the interval reports. * Tidied up the documentation. * Automatically generate the ChangeLog file from the CVS log when the distribution is built. * No need for ChangeLog to be in the CVS * Change to reduce the font size of the summary tables on the index page. * Corrected the path to the default css file. Removed the leading slash. Vispan-1-5-2 * Added commenting to the subroutines * Correct the reporting of blocked IPs * Corrected the code for the number of blocked IPs * Tidied up the code to make sure everything is reported correctly. * Remove spurious > from spam listing. * Correct the CSS for visited links. * Tidied up the use of CSS values. * Added summary graphs for load, mail, delay and queue. Also tidied up the HTML to make it XHTML 1.0 conformant. * removed temporary print statement. * Moved the storage of the IP addresses into the dat file. Reformatted the spam output to include colours to show more detail. Changed the link to dnsstuff as the openrbl one no longer worked. * Corrected the code to use the access list. * Added routines to detect if an IP address already exists in the access file. If so don't add it. Also change the display of blocked IPs to show those that have reached the block limit but have not been blocked. * Added vispan.css to the manifest * Added the css file. Changed the way the version number is picked up. * Added Licence file. * Tidied up HTML to produce valid code. Removed unnecessary MRTG config options. Removed absolute path names. * Remove hardcoded path. * No longer use MRTG so remove the file and amend the others accordingly. * Added support for Postfix * Changes to support the multiple history pages. * Added support for Trend and various changes for historical stats. * Minor changes for the historical data. * Made major changes to layout. Also incorported changes from Wayne Fox * Made sure that the thumbs dir was created if it didn't exist. * Change version number for build. * Added the dependency on Net::CIDR * Updated the version number. * Added the facility to list IPs in the whitelist by Ip address, range or CIDR format. * Made Vispan more Unix generic for system load. Also limited virus lists to the value of DisplayTop * Added check for non existent temp file and also changed the tempfile location to /tmp Virus lists are now only listed to the value of DisplayTop. Whitelisted entries are counted. * Updated install * Modified the installation to create a cron file in /etc/crond.d * Tidied up some of the output. * Updated version number and corrected minor problems. * Fixed the bug in the virus counting which meant that the total virus count only worked if the Use Heuristics options was set to 1. * Correct the installation of the cron entry to include 0 minutes. Vispan-1-2 * Added comment to indicate how to specify multiple scanners. * Change version number; correct install location; * Correct the virus count reporting and also make the installation easier * Updated the MANIFEST to include the Makefile.PL and MANIFEST files. * Added the perl makemaker files for ease of installation and distribution Vispan-1-1 * Added functionality to block persistent virus sources. * Updated comment in conf file relating to scanners. * Added support to log the update time for multiple scanners. * Added support to report on more than one virus scanner. * Added feature to log multiple virus scanners. * Added mailing facility Added support for ClamAVmodule Added high scoring spam stats Fixed bug which meant that if you turned on Log Non Spam it would block legitimate senders. Added facility to configure the number of emails before a host is added to the access list. * Corrected bug which meant that IPs were reported as blocked when they hadn't been added to the access db. * Changed version number Vispan-1-0 * Added instructions on how to setup crontab. I still need to figure how to do it automatically even if there is something currently in the users crontab. --Joe * Added support for Antivir. * Added support for eTrust * Corrected minor typos etc. start * Imported files * Initial revision Contact the Author. |
