Re: [Devil-linux-develop] New feature request: HAVP (HTTP Antivirus Proxy)

[Kari M. <ka...@tr...>]

Bruce Smith wrote:
>>>Has anyone actually tried the program?
>>>I'd like to hear how well it really works (or not).
>>
>>Sorry, I cannot help here.

...except now I can :-)

I've been running havp as a stand-alone proxy (i.e. no caching), both=20
v0.70 and v0.71.  They run flawlessly.

The program is really simple: just one executable, some configuration=20
files etc.  Next I'm planning to move those files onto DL to see how it=20
works.  An executable compiled under 2.6.12-kernel Gentoo box executes=20
nicely on v1.2.3 DL -- how well it works, is a matter of testing.

http://www.server-side.de/
http://www.server-side.de/ideas.html
http://www.server-side.de/download/linuxtag2005.pdf

...are some URLs one should see through if interested in HAVP.

Especially the .pdf was revealing, as I like to the architecture of=20
products I''m using.

> I was just thinking it'd be nice to hear from someone who's actually
> used it before we go to the work of including it in DL.  To make sure i=
t
> works as advertised, etc.   :-)

So, it works.

The box I've been running havp also has Squid happily on the side.
So far they are separate; ports 3128 and 8080.
When I go into production, I'm planning to use

client/browser -> Squid -> HAVP -> Squid -> Web Server

as the data flow due to the reasons described in=20
http://www.server-side.de/ideas.html

>>>Also, looking at the docs, it appears that it does not work directly
>>>with squid, but it's a standalone proxy server and squid can be setup =
to
>>>proxy it's traffic through it.  Not the best way to integrate it with
>>>Squid, IMO.

True, but given we actually have to support ClamAV, there currently only=20
are DansGuardian (with it's non-optimal licensing) and HAVP, which is GPL=
.

>>True, but this gives the option not to cache, but just filter/check for=
=20
>>viruses, and you can get by without Squid.

> I'd still rather have it be part of squid. =20

With HAVP you have the choice, w/ or w/o.

Currently there are few rather minor quircks regarding HAVP and DL=20
integration:

HAVP always wants to install to /usr/local, with configuration under=20
/usr/local/etc/havp; it really should support '--prefix=3D/' for DL -- if=
=20
it did, the integrating HAVP into DL would be next to automatic

HAVP also wants a partition with mandatory locks for its virus checking.
It defaults to use a partition in /var/tmp/havp.  You can use ramdisk,=20
but it is not alwaus a good option.  I'm not sure if using the squid=20
partiton would help here...?

One nice feature: HAVP uses LibClamav, so you don't need clamd,=20
freshclam is enough. So, you can disable clamd in /etc/init.d/clamav by=20
commenting out line "loadproc $DAEMON $PARAMETER".

I use squid sometimes when I
> don't want to cache.  i.e  If I want to enforce authentication, or if I
> want to create usage logs.  I've even installed squid on a standalone
> workstation and pointed the browsers to localhost.  For some reason the
> browsers seem to run faster when going through squid, instead of using
> their own cache (weird, I know).
>=20
>=20
>>>I'm curious why you picked this one over the others listed?=20
>>
>>Good question :-)
>=20
>=20
> Yeah, it seemed to me like it'd be a good idea to compare all the
> options before choosing one to be included in DL.  And it's also be nic=
e
> to talk to someone who's used it to make sure it runs.  :-)
>=20
> It looks like you compared the features below and found the best fit fo=
r
> DL.  Are you offering to provide us a patch to add HAVP, or is this a
> feature request?
>=20
> If you're going to provide us a patch, please burn a CD and test it out
> before you submit the patch.   :-)
>=20
>  - BS
>=20
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net email is Sponsored by the Better Software Conference & EXPO
> September 19-22, 2005 * San Francisco, CA * Development Lifecycle Pract=
ices
> Agile & Plan-Driven Development * Managing Projects & Teams * Testing &=
 QA
> Security * Process Improvement & Measurement * http://www.sqe.com/bsce5=
sf
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>=20




Terveisin/With kind regards/Med h=E4lsningar/Lugupidamisega,

Kari Mattsson
Trivore Corp.