[PLUGIN] EN-ClamAV - ClamAV Interface for DirectAdmin

MaXi32 · Aug 2, 2020

PS: I saw a new version of clamav 0.102.4 released last month but it has not been included yet in the DA custombuild. This has a security update. @DirectAdmin Support

ClamAV 0.102.4 security patch released

ClamAV 0.102.4 is out now. Users can head over to clamav.net/downloads to download the release materials. ClamAV 0.102.4 is a bug patc...

blog.clamav.net

idatahost · Aug 24, 2020

Thanks for nice plugin but not working for me.
My php version 7.4 and not working the plugin. I reinstall it several times. I also run this command

# cd /usr/local/directadmin/custombuild
# ./build update
# ./build set ioncube yes
# ./build ioncube

Bellow's error displaying
" Site error: the ionCube PHP Loader needs to be installed. This is a widely used PHP extension for running ionCube protected PHP code, website security and malware blocking. Please visit get-loader.ioncube.com for install assistance. "

Any instruction to install it?

idatahost · Aug 26, 2020

SmaragdnaDolina said:
SOLVED.

A completely different issue.

The plugin could not find the correct directory.

The ClamAV package includes a php.ini file pointing to loader files for 4 versions of php. I had not noticed that in the beginning, I used the wizard to install.

Since the plugin was then complaining that ioncube was not installed, I proceeded to install it.

But the plugin was reading its own php.ini file and could not find ioncube.

Now that I put the correct directory in, it is finally working.

Could you please tell me where and what you edited?

StreamerCloud · Oct 7, 2020

FYI, but this plugin is working great and configures nicely.

Really the only modification needed was the ionCube loader situation. I am running php7.4 and found it easier to:

Download ionCube from https://www.ioncube.com/loaders.php
Unzip and upload files ioncube_loader_lin_7.4.so and ioncube_loader_lin_7.4_ts.so to /usr/local/directadmin/plugins/en-clamav

Then add:

Code:

zend_extension = "/usr/local/directadmin/plugins/en-clamav/ioncube_loader_lin_7.4.so"

at the bottom of /usr/local/directadmin/plugins/en-clamav/php.ini

Plugin UI came right up.

allisonjclark · Oct 12, 2020

I have installed it and everything seems to be working but can't find logs,
How do I check scan logs ?

Active8 · Oct 27, 2020

Did someone noticed that this plugin send a mail to the maker with your server + ip info?
I saw it luckily because it was frozen in que

Code:

1kXQmA-001Zba-C8-H
root 0 0
<[email protected]>
1603812042 0
-received_time_usec .376129
-active_hostname de4.aserver.com
-ident root
-received_protocol local
-aclm _uid 1
0
-aclm _username 4
root
-body_linecount 20
-max_received_linelength 70
-auth_id root
-auth_sender [email protected]
-allow_unqualified_recipient
-allow_unqualified_sender
-local
XX
1
[email protected]

201P Received: from root by de4.aserver.com with local (Exim 4.94)
    (envelope-from <[email protected]>)
    id 1kXQmA-001Zba-C8
    for [email protected]; Tue, 27 Oct 2020 16:20:42 +0100
030T To: [email protected]
056  Subject: [PLUGIN] EN-ClamAV - DirectAdmin - New install
019  MIME-Version: 1.0
040  Content-type: text/html; charset=UTF-8
032F From: [email protected]
055I Message-Id: <[email protected]>
038  Date: Tue, 27 Oct 2020 16:20:42 +0100

Code:

html><head></head>
                <body>
                    <strong>EN-ClamAV installed on:</strong><br />
                    OS name: Linux<br />
                    Distribution: CentOS Linux release 8.2.2004 (Core)
<br />
                    Release name (kernel version): 4.18.0-193.19.1.el8_2.x86_64<br />
                    Version information: #1 SMP Mon Sep 14 14:37:00 UTC 2020<br />
                    Machine type: x86_64<br />
                    <br />
                    DA Version: 1.61.5<br />
                    DA SSL: on<br />
                    DA Language: en<br />
                    HOME: /home/admin<br />
                    Host name: de4.aserver.com<br />
                    Host name: de4.aserver.com<br />
                    Server IP: 11.1.1.1<br />
                    Client IP: 2.2.2.2.<br /><br /><br />Ereznet.co.il<br />
                </body>
            </html>

Code:

2020-10-27 16:20:42 Received from [email protected] U=root P=local S=1153 T="[PLUGIN] EN-ClamAV - DirectAdmin - New install"
2020-10-27 16:22:53 H=mail.ereznet.co.il [62.90.39.2] Connection timed out
2020-10-27 16:22:53 [email protected] R=lookuphost T=remote_smtp defer (110): Connection timed out

k1l0b1t · Oct 27, 2020

heh, that's odd

tonymontana · Nov 5, 2020

Hi,

Thank you for great plugin!
I have question about path.
I have to scan all in home/admin folder but how to change scan path for all home folder?

And second question. I try installed ClamAV on second server and after this comand ./build clamav system display error:

../shared/.libs/libshared.a(output.o): In function `logg':
/usr/local/directadmin/custombuild/clamav-0.103.0/shared/output.c:377: undefined reference to `fcntl64'
collect2: error: ld returned 1 exit status
Makefile:643: recipe for target 'clamscan' failed
make[2]: *** [clamscan] Error 1
make[2]: Leaving directory '/usr/local/directadmin/custombuild/clamav-0.103.0/clamscan'
Makefile:861: recipe for target 'all-recursive' failed
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory '/usr/local/directadmin/custombuild/clamav-0.103.0'
Makefile:655: recipe for target 'all' failed
make: *** [all] Error 2

Thank you for replies.

idatahost · Nov 9, 2020

Hi,
En-ClamAV coming up in the menu. But nothing displaying there. anybody can help me?
I added zend extension at the bottom of /usr/local/directadmin/plugins/en-clamav/php.ini
and keep the file in folder.

Thanks in advance.

idatahost · Nov 10, 2020

problem solved. and followed this step:
* delete the plugin from Plugin manager
* Added plugins_allowed_run_as=1 this line in /usr/local/directadmin/conf/directadmin.conf
* From plugin manager again install using this link: https://www.directadmin.ereznet.co.il/en-clamav/en-clamav.tar.gz
* download the ioncube loader and keep both of following files:
ioncube_loader_lin_7.4.so
ioncube_loader_lin_7.4_ts.so
in this location /usr/local/directadmin/plugins/en-clamav/
* edit php.ini file which is located here /usr/local/directadmin/plugins/en-clamav/
and added this line
zend_extension = "/usr/local/directadmin/plugins/en-clamav/ioncube_loader_lin_7.4.so"

mission successful
Thank you for this plugin <3

jca · Nov 10, 2020

I really like this script! Hope source is updated with the ioncube plugin as 7.4 becomes more popular. Do we know if the plug in is still being updated?

Adrian_ · Nov 19, 2020

Active8 said:

Did someone noticed that this plugin send a mail to the maker with your server + ip info?
I saw it luckily because it was frozen in que

Code:

1kXQmA-001Zba-C8-H
root 0 0
<[email protected]>
1603812042 0
-received_time_usec .376129
-active_hostname de4.aserver.com
-ident root
-received_protocol local
-aclm _uid 1
0
-aclm _username 4
root
-body_linecount 20
-max_received_linelength 70
-auth_id root
-auth_sender [email protected]
-allow_unqualified_recipient
-allow_unqualified_sender
-local
XX
1
[email protected]

201P Received: from root by de4.aserver.com with local (Exim 4.94)
    (envelope-from <[email protected]>)
    id 1kXQmA-001Zba-C8
    for [email protected]; Tue, 27 Oct 2020 16:20:42 +0100
030T To: [email protected]
056  Subject: [PLUGIN] EN-ClamAV - DirectAdmin - New install
019  MIME-Version: 1.0
040  Content-type: text/html; charset=UTF-8
032F From: [email protected]
055I Message-Id: <[email protected]>
038  Date: Tue, 27 Oct 2020 16:20:42 +0100

Code:

html><head></head>
                <body>
                    <strong>EN-ClamAV installed on:</strong><br />
                    OS name: Linux<br />
                    Distribution: CentOS Linux release 8.2.2004 (Core)
<br />
                    Release name (kernel version): 4.18.0-193.19.1.el8_2.x86_64<br />
                    Version information: #1 SMP Mon Sep 14 14:37:00 UTC 2020<br />
                    Machine type: x86_64<br />
                    <br />
                    DA Version: 1.61.5<br />
                    DA SSL: on<br />
                    DA Language: en<br />
                    HOME: /home/admin<br />
                    Host name: de4.aserver.com<br />
                    Host name: de4.aserver.com<br />
                    Server IP: 11.1.1.1<br />
                    Client IP: 2.2.2.2.<br /><br /><br />Ereznet.co.il<br />
                </body>
            </html>

Code:

2020-10-27 16:20:42 Received from [email protected] U=root P=local S=1153 T="[PLUGIN] EN-ClamAV - DirectAdmin - New install"
2020-10-27 16:22:53 H=mail.ereznet.co.il [62.90.39.2] Connection timed out
2020-10-27 16:22:53 [email protected] R=lookuphost T=remote_smtp defer (110): Connection timed out

Does this not concern anybody?

factor · Nov 19, 2020

Adrian_ said:
Does this not concern anybody?

Sure it does... But it's a 3rd party plugin. DA doesn't write or control. We assume people can choose to use it or not.

BTW Welcome to the forum

MaXi32 · Aug 22, 2021

Adrian_ said:
Does this not concern anybody?

Active8 said:

Did someone noticed that this plugin send a mail to the maker with your server + ip info?
I saw it luckily because it was frozen in que

Code:

1kXQmA-001Zba-C8-H
root 0 0
<[email protected]>
1603812042 0
-received_time_usec .376129
-active_hostname de4.aserver.com
-ident root
-received_protocol local
-aclm _uid 1
0
-aclm _username 4
root
-body_linecount 20
-max_received_linelength 70
-auth_id root
-auth_sender [email protected]
-allow_unqualified_recipient
-allow_unqualified_sender
-local
XX
1
[email protected]

201P Received: from root by de4.aserver.com with local (Exim 4.94)
    (envelope-from <[email protected]>)
    id 1kXQmA-001Zba-C8
    for [email protected]; Tue, 27 Oct 2020 16:20:42 +0100
030T To: [email protected]
056  Subject: [PLUGIN] EN-ClamAV - DirectAdmin - New install
019  MIME-Version: 1.0
040  Content-type: text/html; charset=UTF-8
032F From: [email protected]
055I Message-Id: <[email protected]>
038  Date: Tue, 27 Oct 2020 16:20:42 +0100

Code:

html><head></head>
                <body>
                    <strong>EN-ClamAV installed on:</strong><br />
                    OS name: Linux<br />
                    Distribution: CentOS Linux release 8.2.2004 (Core)
<br />
                    Release name (kernel version): 4.18.0-193.19.1.el8_2.x86_64<br />
                    Version information: #1 SMP Mon Sep 14 14:37:00 UTC 2020<br />
                    Machine type: x86_64<br />
                    <br />
                    DA Version: 1.61.5<br />
                    DA SSL: on<br />
                    DA Language: en<br />
                    HOME: /home/admin<br />
                    Host name: de4.aserver.com<br />
                    Host name: de4.aserver.com<br />
                    Server IP: 11.1.1.1<br />
                    Client IP: 2.2.2.2.<br /><br /><br />Ereznet.co.il<br />
                </body>
            </html>

Code:

2020-10-27 16:20:42 Received from [email protected] U=root P=local S=1153 T="[PLUGIN] EN-ClamAV - DirectAdmin - New install"
2020-10-27 16:22:53 H=mail.ereznet.co.il [62.90.39.2] Connection timed out
2020-10-27 16:22:53 [email protected] R=lookuphost T=remote_smtp defer (110): Connection timed out

I wrote complain about this plugin before perhaps from the 2nd or 3rd post but I deleted my post because I don't want to hurt the author's feeling (that time nobody care what I was trying to say).

Since now you notice something, I will say this again for security awareness. I remember I told that you will not be able to inspect what the code is about because the source code (the core function) for this plugin is fully encrypted (that is the reason the main requirement to run this script is to install ioncube so it can be decrypted before it can run). I know the main purpose of encrypting the PHP source code with is for protecting his work so nobody can steal his work but someone can use this to actually run malicious code without you know. You know this plugin actually run as root user in your server, and there is high chance this php binary can send your server username and password to attacker... I know he might not do this but he 100% can and you wont notice this because the plugin is written with encrypted PHP source code! So, install this plugin if you trust the author. I will not install this plugin until the source code is published (or decrypted) so that I can inspect what it does.

uzair_scorpion · Nov 26, 2023

guys show blank white screen how to access GUI interface

uzair_scorpion · Nov 26, 2023

DanielP said:
Banners on to works only as admin

as reseller and user they show clam service stopped and na View attachment 2633

showing blank screen white how i can fix

elsevi · Jan 23, 2024

Is this tool functional, safe and active today?

ericosman · Jan 23, 2024

If you have pro pack you dont need this anymore

elsevi · Jan 23, 2024

ericosman said:
If you have pro pack you dont need this anymore

That's not my case.

ravgrg · Sep 26, 2024

What do you mean by pro pack? what is the

ericosman said:
If you have pro pack you dont need this anymore

pro pack?

[PLUGIN] EN-ClamAV - ClamAV Interface for DirectAdmin

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Attachments

Verified User

Verified User

New member

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User