SpamBlocker 4.1 and ClamAV

LawsHosting

LawsHosting

Verified User
Joined
Sep 13, 2008
Messages
2,372
Location
London UK
Since a server's drive crashed, I'm nearly complete..... However, I have ClamAV installed, and when email is received, the exim logs state the clamd.sock:
malware acl condition: clamd: unable to connect to UNIX socket /var/run/clamd/clamd.sock (Permission denied)
Click to expand...

# ls -l /var/run/clamd/
-rw-rw-r-- 1 root root 5 Jul 4 20:43 clamd.pid
srw-rw-rw- 1 root root 0 Jul 4 20:43 clamd.sock
-rw-rw---- 1 clamav clamav 4 Jul 4 19:10 freshclam.pid
Click to expand...
Because it's owned by root?

What is the correct setting:
av_scanner = clamd:/var/run/clamd/clamd.sock
Click to expand...
or
av_scanner = clamd:/var/run/clamd/clamd.sock:127.0.0.1 3310
Click to expand...

The later worked pre-drive crash.

Thanks
 
Last edited:
I know no-one probably hasn't encountered this issue, but will really like to know if the av_scanner directive should be socket:ip:port or just socket.

Thanks.


NB. ClamAV was installed with CB1.2
 
Ok, I'll try that when server is less busy.

Although there seems to conflicting statements, SB4.+ states the socket while that help article states ip:port
 
The code you need obviously depends on how ClamAV is installed. When I wrote SpamBlocker4 there wasn't any standard. There is now, and in the future my code will be written to it.

Jeff
 
Peter Laws said:
I know no-one probably hasn't encountered this issue, but will really like to know if the av_scanner directive should be socket:ip:port or just socket.
Click to expand...

As far as I know it depends on whether you install ClamAv with custombuild or from package system of your OS. In some cases you've got a socket used by default in another cases TCP port.

The custombuild script has the following code:

Code: 
                perl -pi -e 's|Example|#Example|' /etc/clamd.conf
                perl -pi -e 's|#PidFile /var/run/clamd.pid|PidFile /var/run/clamd/clamd.pid|' /etc/clamd.conf
                perl -pi -e 's|#TCPSocket 3310|TCPSocket 3310|' /etc/clamd.conf
                perl -pi -e 's|#TCPAddr 127.0.0.1|TCPAddr 127.0.0.1|' /etc/clamd.conf
                perl -pi -e 's|#LocalSocket /tmp/clamd.socket|LocalSocket /tmp/clamd.socket|' /etc/clamd.conf

so it makes clamav to use sockets.
 
You can either use the socket, but the path you wrote in first post is wrong, the path looking at that code should be /tmp/clamd.socket

Regards
 
SeLLeRoNe said:
You can either use the socket, but the path you wrote in first post is wrong, the path looking at that code should be /tmp/clamd.socket
Click to expand...
If you see, I changed the "LocalSocket" to be in /var/run/clamd/, maybe that's why it complains then
 
X-Antivirus-Scanner: Seems clean. You should still use an Antivirus Scanner
X-Antispam: clean, score=64
X-Antispam-Debug: 64,4,10726,,0,neutral,,0,fn,,0:0:0X-Antivirus: avast! (VPS 130709-2, 09/07/2013), Inbound message
X-Antivirus-Status: Infected
X-Attachment: Photo_10.07.2013_3636981038.zip#2558618164|>Photo_10.07.2013_7689054433.JPG.exe Virus: Win32:Evo-gen [Susp] Deleted
Click to expand...
What, how did that get through as clean? ClamAV failing to scan zip files?

Found this http://community.spiceworks.com/topic/289185-clamav-not-scanning-zip-files


Edit:


ScanArchive yes was commented out but the default is YES (according to the man page).
 
Last edited:
You might want to run this in a root shell:

Code: 
exigrep MessageID /var/log/exim/mainlog

to get related lines from the logs. It might give some clues.
 
nothing stands out
1UwqUV-0003Bs-Oy demime acl condition: base64 line contains illegal character1UwqUV-0003Bs-Oy <= sacramentowrq27 @ vodafone.co.uk H=(inetia.pl) [81.219.156.5] P=esmtp S=28530 [email protected] T="mms Wed, 10 Jul 2013 10:14:56 +0100" from <[email protected]> for sales@xxxx
1UwqUV-0003Bs-Oy => sales <sales@xxxx> F=<sacramentowrq27 @ vodafone.co.uk> R=spamcheck_director T=spamcheck S=28914
2013-07-10 10:15:18 1UwqUV-0003Bs-Oy Completed
Click to expand...
 
That might be a clue, so you might need to google it, as I'm not sure why it happens:

Code: 
demime acl condition: base64 line contains illegal character
 
Well, a few results tell me that (it could be) a MIME issue:
I'm figuring that this virus (blah) has deliberately broken it's mime encoding and Exim has been unable to extract the file to pass to ClamAV. Does this sound right?
Click to expand...

from http://lists.debian.org/debian-user/2004/08/msg00189.html

So, if the attachment has (deliberately) a broken mime, shouldn't Exim check that? If so, discard it? Of course, depends if the exim.conf has that check.

 
You must log in or register to reply here.
Back
Top