PDA

View Full Version : Part 14 clamscan v clamd/clamscand question


ahaer
05-25-2004, 10:59 AM
Newbie question:

Why does QMR do this in step 14??

Now I'm going to throw in a small customization to Clam AV...

mv /usr/bin/clamdscan /usr/bin/clamdscan.orig

ln -s /usr/bin/clamscan /usr/bin/clamdscan



It looks like they are replacing the server (clamd) / client (clamdscan) setup with a direct call to a simple program.

From what little I've read clamd/clamdscan is supposed to be much faster as it loads the virus file only once in the server.

I have been able to undo the customization and use clamd/clamdscan with the following script (/etc/init.d/clamd) that was adapted from http://www.falkotimme.com/howtos/spamassassin_clamav_procmail/index.php (changed /usr/local to /usr and removed --datadir option in start)

Note - This script also runs freshclam as a daemon that checks for updates 10 times a day (-c sets update frequency) so the cron job is not needed anymore...

#!/bin/bash


TMPDIR=/tmp
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin


case "$1" in
start)
echo "Starting ClamAV..."
if [ -S /tmp/clamd ]; then
echo "ClamAV is already running!"
else
/usr/bin/freshclam -d -c 10 -l /var/log/clam-update.log
/usr/sbin/clamd
fi
echo "ClamAV is now up and running!"
;;
stop)
echo "Shutting down ClamAV..."
array=(`ps ax | grep -iw '/usr/bin/freshclam' | grep -iv 'grep' \
| awk '{print $1}' | cut -f1 -d/ | tr '\n' ' '`)
element_count=${#array[@]}
index=0
while [ "$index" -lt "$element_count" ]
do
kill -9 ${array[$index]}
let "index = $index + 1"
done
array=(`ps ax | grep -iw '/usr/sbin/clamd' | grep -iv 'grep' \
| awk '{print $1}' | cut -f1 -d/ | tr '\n' ' '`)
element_count=${#array[@]}
index=0
while [ "$index" -lt "$element_count" ]
do
kill -9 ${array[$index]}
let "index = $index + 1"
done
if [ -S /tmp/clamd ]; then
rm -f /tmp/clamd
fi
echo "ClamAV stopped!"
;;
restart)
$0 stop && sleep 3
$0 start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
esac
exit 0

sean4e
05-28-2004, 04:02 AM
Hi there.

Please refer to my post "Replacing clamdscan with clamscan?" in the General Qmail Discussions Forum. I think you might find it interesting. ;-)

Sean.

tetsuo
05-29-2004, 07:27 PM
Well the idea is good, but I've got a problem. Since I've done it your way, I'm getting something like this?


root@elektra:/usr/local/src/mail_server_project/qmail-scanner-1.22/contrib# ./test_installation.sh -doit
setting QMAILQUEUE to /var/qmail/bin/qmail-scanner-queue.pl for this test...

Sending standard test message - no viruses...
done!

Sending eicar test virus - should be caught by perlscanner module...
X-Antivirus-MYDOMAIN-1.22-st-qms:[elektra10858731876171008] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 2
qmail-inject: fatal: qq temporary problem (#4.3.0)
Bad error. qmail-inject died
root@elektra:/usr/local/src/mail_server_project/qmail-scanner-1.22/contrib#


I suppose that's some qmail-scanner-queue.pl related problem.
Got any ideas what may be wrong?

regards

sean4e
05-31-2004, 06:57 AM
Is clamd running as root? If not go to your clamav.conf file and change "User clamav" to "User root", then you have to restart clamd to make the changes take effect.

tetsuo
06-02-2004, 02:05 PM
Is it safe to run clamv as root ? I've been trying to run it with user "qscand" with no luck... but I'll try root if you say so... but, is it wise to do so?

//EDIT//
Well, after setting clamav user to root it seems to work as you've described.
It is faster :)

sean4e
06-03-2004, 02:48 AM
It does cause some concern for myself as well, and I have incuired about it at the clamav users list. I think it seems pretty safe, because it only allows a connection via localhost or the local unix socket.

If anything comes up, I will post.

Cheers;