2
Cyren x Message Sniffer
Question asked by Rafael Grecco - 7/3/2023 at 6:15 AM
Answered
Hi!

I'm planning on replacing my current antispam server (linux gateway based on spam assassin).

Since Cyren was not available anymore, I was going to use Message Sniffer. Now that Cyren is available again, I am not sure which product I should use.

There are 3 products: Cyren Antispam, Cyren Antivirus and Mesage Sniffer.

I don't understand why Cyren has 2 different products. A single product to filter spam and virus makes more sense... does that mean that Message Sniffer filters spam and virus, since it doesn't offer different solutions?

Now a question for people have have tested both solutions: which solution do you think is better at filtering spam?

Thanks!

16 Replies

Reply to Thread
1
  1. Message Sniffer filter ONLY spam, no antivirus
  2. Cyren Antispam filter ONLY spam , no antivirus
  3. Cyren Antivirus filter ONLY zero-hour viruses (it doesn't filter actual viruses at all, it's only a tool that MIGHT help you ONLY with new unknown viruses...)

In my experience, none of the 3 products is very effective...
SmarterTools would be better off abandoning all three and looking for a partnership with someone better (e.g. BitDefender, Kaspersky, Sophos, Fortinet or someone else...)

Basically, all three products are near garbage.

Either way, though, they're better than nothing...
Gabriele Maoret - Head of SysAdmins at SERSIS Currently manages 6 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 5 on-premise for customers who prefer to have their mail server in-house)
1
Tim Uzzanti Replied
Employee Post
Cyren is avaliable again.  More information will be released shortly on how it came about.

The approaches related to SPAM and Virus significant different but there can be some cross over and Message Sniffer can help with Virus's as well but its primary focus is SPAM.

Cyren and Message Sniffer are both good but when you combine them along with the SPAM features we provide in SmarterMail, you can achieve great things!

For Virus, I would use ClamAV and Defender which is already available in SmarterMail. 
Tim Uzzanti CEO SmarterTools Inc. www.smartertools.com
0
Sabatino Replied
Thanks Tim
But I remind you that window defender makes false positives in a pseudo-random way. I wrote it over and over again, even via ticket. It was confirmed to me by the development team. It seems to be necessary to do a double scan with windows defender but at the moment this functionality is not there. Then it becomes unusable. We can't start checking for false positives manually.
Look at this post

For antivirus clamav + secureinfo update is a great choice
Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
0
Tim Uzzanti Replied
Employee Post Marked As Answer
Yes, I remember your comments and your name and info is one of our Jira items related to Windows Defender :) 

If you haven't retested you should because a number of changes were made to that area!  You can also disable Windows Defender, ClamAV does a decent job as well but the combination of Windows Defender and ClamAV is pretty good.

Thanks,

Tim
Tim Uzzanti CEO SmarterTools Inc. www.smartertools.com
0
Sabatino Replied
I certainly will.
At the moment I use the 8451

I will update in september, for me june to september is maximum workload on mail server and not time for new releases

Thank you
Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
0
Rafael Grecco Replied
Thank you very much for the responses!

@Gabriele, I see you are very active on these forums. What do you currently use for spam filtering?
1
I'm using Fortinet FortiMail (VM onpremise version), that is very good, but also expensive...

Now I'm starting to take a look at rSpamd to understand if it can be a good solution
Gabriele Maoret - Head of SysAdmins at SERSIS Currently manages 6 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 5 on-premise for customers who prefer to have their mail server in-house)
0
Bradley Higgs Replied
Hi Tim, our Cyren Premium Antispam license has lapsed and we wish to renew it, is this possible now?  How do we do this?

--update-- 
Think i figured it out, adding Cyren to our existing license now. :)

--update--
How to activate Cyren in Smartermail now?

--update--
Solution:
--Smartermail > Licensing > Re-activate smartermail license > fixed--
1
Douglas Foster Replied
Any product(s) can be put in front of SnarterMail as an incoming gateway.  I use three.   Filtering of  unauthenticated mail, arriving from the Internet, requires different strategies than filtering authentucated mail from your users.   Consequently, use of an incoming gateway has many benefits    Don't make your security depend only on the features embedded in SmarterMail. 
0
Rafael Grecco Replied
Douglas, I agree with you.

I'm currently using antispam servers as incoming gateways, but they are getting outdated. I need a new solution that is easy to use and configure - I manage a ISP and don't have the time to keep analysing and configuring antispam systems, so I need something that is as close as possible to plug and play... The problem is that most antispam gateways are really expensive. That's why I'm looking at Smartermail's partners, because of it's ease of use and affordable price.
1
Douglas Foster Replied
I have surveyed a lot of commercial products and found that none of them provide adequate solutions for sender authentication.   So I recommend a customizable environment for that function (Declude, Declude Reboot, Postfix, Python email module).  Then you can use an inexpensive appliance like Barracuda for proprietary content filtering.    
Good and cheap requires liberal quantities of elbow grease.
0
Hi Rafael!

I can suggest you 2 commercial AntiSpam solutions that work very well (even if both are a bit expensive...) which, once you learn how to use them correctly, are almost "set it and forget" (you will only have to take care of doing the first configuration for each new domain you add):

  1. Fortinet FortiMail (which is what I'm using now)
  2. LibraEsva (I've seen other people I know use it and it works really well, maybe more than FortiMail, but it's also more expensive...)
Gabriele Maoret - Head of SysAdmins at SERSIS Currently manages 6 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 5 on-premise for customers who prefer to have their mail server in-house)
0
Rafael Grecco Replied
Douglas and Gabriele, thank you both for the recommendations!
0
Sabatino Replied
I'll tell you my experience.
I don't have a big server
281 domains
1400 mailboxes

30,000 incoming messages per day on average

15% identified as medium and high spam

greylisting enabled

message sniffer + cyren antispam

I randomly monitor high spam and almost never see false positives
I don't see that many false negatives either

regarding the antivirus cyren zero our intervenes very little.

clamav update it with secureinfo adding the following db


Customers are satisfied, no one complains about excessive spam.

At the moment I don't need to increase the filtering.

Greylisting is a bit aggressive because it slows down deliveries, but I think it does its job. On some domains I disable it at the request of the customer.

An approach has always left me in doubt and I've always promised myself to go deeper but then I've never done it

Greylist Weight Threshold

Greylisting relies on the ip/sender pair telling the sending server I'm busy. And this happens before the smtp session allows the actual sending of the message.

But the spam score is calculated by analyzing the whole message and this happens after the message is received and after the smtp session is closed. So, I don't understand.
Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
0
Sabatino Replied
I add that maybe what I'm missing is setting the clamav (freshclam) update once an hour.


But I haven't found how to do it

It seems to me that now it does it once a day
Sabatino Traini Chief Information Officer Genial s.r.l. Martinsicuro - Italy
1
Rafael Grecco Replied
Thank you Sabatino!

Reply to Thread