|
UPDATE: Since I wrote this HOWTO, I found there
is a very simple way to fix the file permission issues without performing
all the user changes and file ownership changes I have listed below in
the original HOWTO.
The original HOWTO may however still provide insight into other clamd.conf and freshclam.conf
configuration options. One requirement for a successful installation is 'AllowSupplementaryGroups yes' must be included in clamd.conf. Another requirement is the value after CONTSCAN in amavisd.conf must match the LocalSocket parameter in clamd.conf (change amavisd.conf if it does not). A third requirement is TCPSocket cannot be used simultaneously with LocalSocket so TCPSocket must be commented out and LocalSocket must be enabled. The group that your amavisd-new user belongs to must also have write privileges to the amavisd-new user's home directory and subdirectories. This step should have been done during the installation of amavisd-new, and would consist of doing something similar to chmod -R 750 /var/amavis or chmod -R 750 /var/lib/amavis (adjust path as needed). Once you have ClamAV installed and the clamav user and clamav group have been created and the above requirements have been met, all you may need to do is make the user "clamav" a member of the same group that the amavisd-new user belongs to. Your amavisd-new user likely belongs to the "amavis" or "vscan" group. If that is the case you would issue the command:
gpasswd -a clamav amavis
You can test that clamav now belongs to both groups by issuing the command "groups clamav". The command above may not bring the desired result on some systems, so as an alternative you can directly edit /etc/group (use vigr if it's installed and you are familiar with vi commands)
and manually add the user "clamav" to the "amavis" or "vscan" group:
amavis:x:104:clamav
As a third alternate, you could (for example) possibly use usermod -G amavis clamav but if you do, be very careful that you
use an upper case "G" or you will have a mess to fix. Then, of course,
stop and restart clamd and amavisd (amavisd-new), or simply reboot
(if appropriate). Send a
test virus
through and read the log files.
I suggest downloading eicar.com.txt, renaming it to eicar.txt and then attaching it to the email.
Give it a try. If it doesn't work, try the other "change owner and ownership"
method outlined in the original HOWTO below.
Also consider that SELinux or AppArmor may interfere with the way clamd and amavisd-new work
together. If you use SELinux or AppArmor I leave it up to you to solve that problem.
This document assumes the reader knows to comment out "@bypass_virus_checks_*" to
enable virus scanning
(and to also uncomment the "ClamAV-clamd" code in the @av_scanners section). One last note:
in at least one version of the 0.90 release, it can take several minutes for clamd to create
the Unix socket. If you are using a 0.90 version, please allow several minutes for creation
of the clamd socket once clamd is started. Better yet, upgrade to the latest version. If using
Debian etch stable 0.90.1, read this.
|
updatedb and then
locate clam | more and locate .cvd to
find where the
files are located. If you would like to move some of the data files that ClamAV uses
(the ones that are referred to in the configuration files) you can create new
directories and move the files there provided you also make the changes in the
configuration files and change the ownership of the new directories (and the files
contained therein).
/etc/clamav/clamd.conf with your favorite editor.LocalSocket /var/run/clamav/clamd.ctl/etc/amavis/amavisd.conf
['Clam Antivirus-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
The text illustrated above must match the LocalSocket parameter you found in clamd.conf./etc/clamav/clamd.conf)LocalSocket /var/run/clamav/clamd.ctl User clamav LogFile /var/log/clamav/clamav.log PidFile /var/run/clamav/clamd.pid DatabaseDirectory /var/lib/clamav/We need to edit this file and change:
User clamav
User amavis
/var/run/clamav/var/log/clamav/var/lib/clamav/var/log/clamav directory.LogFile parameter reads something like LogFile /var/log/clamav.log/var/log directory!!!!!chown amavis:amavis /var/log/clamav.logchown -R amavis:amavis /var/run/clamavchown -R amavis:amavis /var/lib/clamavchown -R amavis:amavis /var/log/clamav/etc/clamav/freshclam.confDatabaseOwner clamav UpdateLogFile /var/log/clamav/freshclam.logChange the DatabaseOwner to amavis (or whatever your amavis user is named) and make a note of the location of the log file.
freshclam.log is not in its own clamav directory
then only change ownership of the freshclam.log file, not the entire directory.
In our case, we already changed the ownership of the /var/log/clamav directory and
all it's contents, so we don't have any more to do here.
Your system may differ, so you may need to change ownership./etc/logrotate.d/clamav-daemon (controls the clamav.log)/etc/logrotate.d/clamav-freshclam (controls the freshclam.log)/etc/logrotate.d/clamav-daemon on my system are:
create 640 clamav adm
/etc/init.d/clamav-daemon reload > /dev/null
Edit this file and change:create 640 clamav admcreate 640 amavis adm/etc/init.d/clamav-daemon reload)/etc/logrotate.d/clamav-freshclam
create 640 clamav adm
/etc/init.d/clamav-freshclam reload > /dev/null
Edit this file and change:create 640 clamav admcreate 640 amavis adm/etc/init.d/clamav-daemon reload)
in order for the daemon to read it's new configuration. Your system will probably differ here.
At any rate, you need to stop and restart the clamd process. /etc/init.d/clamav-freshclam reload)LocalSocket /var/run/clamav/clamd.ctl FixStaleSocket true User amavis # user can be clamav if clamav is a member of amavis group AllowSupplementaryGroups true ScanMail true ScanArchive true ArchiveMaxRecursion 5 ArchiveMaxFiles 1000 ArchiveMaxFileSize 21M ArchiveMaxCompressionRatio 250 ArchiveLimitMemoryUsage false ArchiveBlockEncrypted false MaxDirectoryRecursion 15 FollowDirectorySymlinks false FollowFileSymlinks false ReadTimeout 180 MaxThreads 12 MaxConnectionQueueLength 15 StreamMaxLength 10M LogSyslog false LogFacility LOG_LOCAL6 LogClean false LogVerbose false PidFile /var/run/clamav/clamd.pid DatabaseDirectory /var/lib/clamav TemporaryDirectory /tmp SelfCheck 3600 Foreground false Debug false ScanPE true ScanOLE2 true ScanHTML true DetectBrokenExecutables false MailFollowURLs false ArchiveBlockMax false ExitOnOOM false LeaveTemporaryFiles false AlgorithmicDetection true ScanELF true NodalCoreAcceleration false IdleTimeout 30 MailMaxRecursion 64 PhishingSignatures true LogFile /var/log/clamav/clamav.log LogTime true LogFileUnlock false LogFileMaxSize 0 # only appropriate because I use logrotate
DatabaseOwner amavis # owner can be clamav if clamav is a member of amavis group UpdateLogFile /var/log/clamav/freshclam.log LogVerbose false LogSyslog false LogFacility LOG_LOCAL6 LogFileMaxSize 0 # only appropriate because I use logrotate Foreground false Debug false MaxAttempts 5 DatabaseDirectory /var/lib/clamav/ DNSDatabaseInfo current.cvd.clamav.net AllowSupplementaryGroups true PidFile /var/run/clamav/freshclam.pid ConnectTimeout 30 ReceiveTimeout 30 ScriptedUpdates yes NotifyClamd /etc/clamav/clamd.conf DatabaseMirror db.local.clamav.net DatabaseMirror database.clamav.net DatabaseMirror db.us.clamav.net
/var/log/clamav/clamav.log {
rotate 12
weekly
compress
delaycompress
create 640 amavis adm
postrotate
/etc/init.d/clamav-daemon reload-log > /dev/null
endscript
}
/etc/logrotate.d/clamav-freshclam:
/var/log/clamav/freshclam.log {
rotate 12
weekly
compress
delaycompress
create 640 amavis adm
postrotate
/etc/init.d/clamav-freshclam reload-log > /dev/null
endscript
}
The /etc/init.d/clamav-daemon
and /etc/init.d/clamav-freshclam startup scripts are specific to Debian.
LogFile /tmp/clamd.log PidFile /var/run/clamd.pid LocalSocket /tmp/clamd DatabaseDirectory /var/lib/clamav User amavisWe will set parameters in /etc/freshclam.conf to:
UpdateLogFile /var/log/freshclam.log DatabaseOwner amavisWe will edit amavisd.conf to match the LocalSocket parameter above:
['Clam Antivirus-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/tmp/clamd"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
Now we will change ownership of the files: Note that if this is a new installation, we may need to "touch" the log files
and the /var/lib/clamav directory may have to be created.touch /tmp/clamd.log touch /var/log/freshclam.log chown amavis:amavis /tmp/clamd.log chown amavis:amavis /var/log/freshclam.log chown amavis:amavis /tmp/clamd mkdir /var/lib/clamav chown -R amavis:amavis /var/lib/clamavI started up clamd and looked in the clamd.log and got:
mkdir /var/run/clamavchown amavis:amavis /var/run/clamavPidFile /var/run/clamav/clamd.pid
/usr/local/src/clamav-X.XX/contrib/init
directory (or similar location) for those.
If you don't find one there that serves your purpose, Google around for others.
For example:MM * * * * amavis /usr/local/bin/freshclam --quiet./configure --with-user=amavis --with-group=amavis --sysconfdir=/etc/clamav --with-dbdir=/var/lib/clamavI think the /directory/file setup examples given in the beginning are more logical.