Preliminary questions on alternate anti-virus engine and signature updates frequency

[skosner]

Hi,

Currently considering a pfSense UTM, given its great reputation, but just wondering about two things before installing and wading thru it.

1. Given that squid uses the clamav engine, which is allegedly weak, is it easy to swap in a different anti-virus engine, instead of using clamav?

2. To confirm that all security components are frequently updated, can someone provide that last two dates that signatures/rules were updated for ids, malware, web filtering, and any other security related components?

Thank you very much

[stephenw10]

It's not easy to use a different AV engine. In fact I'm not aware of anyone having ever done it. It's certainly well outside anything supported.

However 'weak' ClamAV may or may not be it doesn't make a huge difference anyway because that only scans what Squid is caching and that's only http or https if you have enabled full bump mode. This is probably how most malware is transmitted but certainly not all. It is simple to enable it though.

You can set the update intervals for pulling signatures. Here I have it set to 24hrs:

Steve