4:29 a.m.
Hello all,
Has anyone got a simple walkthrough for configuring clamd and getting it
working with systemd on F17?
I am getting lost in the myriad of <SERVICE> and PID (etc. etc.) things
I have to change and .conf files I have to edit and move...
In particular, what am I supposed to do with
the /usr/lib/systemd/system/clamd@.service file?
On previous Fedora installs (pre F15) I used to use this excellent
script which took all the pain out of setup:
http://blog.christophersmart.com/2009/12/17/script-for-configuring-clamav...
if that's line-wrapped try this:
http://tinyurl.com/clamdscript
but I am not confident that this script will now properly configure
systemd now that I am rebuilding a F17 server.
Any hints, tips, guides, handholding, or smacks on the head gratefully
received...
Thanks
Mark
3:41 p.m.
On 9/19/2012 3:21 PM, Daniel J Walsh wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/19/2012 07:36 AM, Bill Shirley wrote:
> On 9/19/2012 5:47 AM, Arthur Dent wrote:
>>> "What tells it that it is a "scan" service? That bit of the
puzzle
>>> seems to be missing..."
>>>
>>> Whatever is the parameter after the @ and before the dot becomes %i
>>> in the service file. Look at the service file: [Unit] Description =
>>> clamd scanner (%i) daemon After = syslog.target nss-lookup.target
>>> network.target
>>>
>>> [Service] Type = simple ExecStart = /usr/sbin/clamd -c
>>> /etc/clamd.d/%i.conf --nofork=yes Restart = on-failure PrivateTmp =
>>> true
>>>
>>> so clamd(a)scan.service invokes clamd with the scan.conf file as it's
>>> configuration file. This way you can have multiple clamd services each
>>> using a different config file. Just create another config file in
>>> /etc/clamd.d/my_config.conf and: ln -s
>>> /lib/systemd/system/clamd@.service
>>> /etc/systemd/system/clamd(a)my_config.service
>>>
>>> You should have the /etc/clamd.d/scan.conf I think:
>>>
>>> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
>>> clamav-scanner-0.97.5-1700.fc17.noarch
>> Thank you Bill for a helpful and, more importantly, informative reply. I
>> think this will not only help me to solve my problem but, even better,
>> help me to understand where I was going wrong.
>>
>> As before, I don't have access to the machine right now, so i will try
>> when I get home to work through this and get it right.
>>
>> I will once again report back later...
>>
>> Thanks again. Your help is much appreciated.
>>
>> Mark
>>
>>
> You mentioned scanning email. I run clamav-milter and stop the virus at
> smtp time. You may find this helpful:
>
> [root@moses clamav]# rpm -qa | grep clam | sort
> clamav-data-0.97.5-1700.fc17.noarch
> clamav-filesystem-0.97.5-1700.fc17.noarch
> clamav-lib-0.97.5-1700.fc17.x86_64 clamav-milter-0.97.5-1700.fc17.x86_64
> clamav-milter-systemd-0.97.5-1700.fc17.noarch
> clamav-scanner-0.97.5-1700.fc17.noarch
> clamav-scanner-systemd-0.97.5-1700.fc17.noarch
> clamav-server-0.97.5-1700.fc17.x86_64
> clamav-server-systemd-0.97.5-1700.fc17.noarch
> clamav-update-0.97.5-1700.fc17.x86_64
>
> For clamav-milter, I had to add clamilt to the postfix group (usermod -a
> -G postfix clamilt): [root@moses clamav]# egrep 'post|clam' /etc/group
> mail:x:12:postfix postfix:x:89:clamilt postdrop:x:90:
> clamscan:x:987:clamilt clamilt:x:988:postfix clamupdate:x:989:
>
>
> Add to the end of /etc/mail/clamav-milter.conf: # my stuff # be sure to
> comment out above: Example
>
> ClamdSocket unix:/var/run/clamd.scan/clamd.sock MilterSocket
> /var/run/clamav-milter/clamav-milter.socket ##MilterSocket
> inet:3381 # usermod -a -G postfix clamilt MilterSocketGroup postfix
> MilterSocketMode 660
>
> OnInfected Reject AddHeader Replace
>
> #LogFile /var/log/clamav-milter.log #LogFileMaxSize
> 1M #LogTime yes LogSyslog yes LogFacility
> LOG_MAIL #LogVerbose no LogClean Basic
> LogInfected Full
>
> Add to postfix's main.cf: # usermod -a -G clamilt postfix smtpd_milters =
> unix:/var/run/clamav-milter/clamav-milter.socket #milter_default_action =
> accept milter_default_action = tempfail
>
> I can't remember if I had to create the directory, but here is that info:
> [root@moses clamav]# ldpz /var/run/clamav-milter/clamav-milter.socket
> drwxr-xr-x. root root system_u:object_r:var_t:s0 /var
> lrwxrwxrwx. root root system_u:object_r:var_run_t:s0 /var/run ->
> ../run drwx--x---. clamilt clamilt system_u:object_r:clamd_var_run_t:s0
> /var/run/clamav-milter srw-rw----. clamilt postfix
> system_u:object_r:clamd_var_run_t:s0
> /var/run/clamav-milter/clamav-milter.socket
>
>
> For clamav, to avoid selinux problems issue command: setsebool -P
> clamd_use_jit on
>
> Add to end of scan.conf: # my stuff # be sure to commend out above:
> Example
>
> #LogFile /var/log/clamav/clamd.scan #LogFacility
> LOG_MAIL LogFacility LOG_DAEMON ExtendedDetectionInfo yes
> LocalSocket /var/run/clamd.scan/clamd.sock #LocalSocketGroup
> virusgroup #LocalSocketMode 660 FixStaleSocket yes
> CrossFilesystems no ExcludePath ^/proc/ ExcludePath
> ^/sys/ ExcludePath ^/fuse/ ExcludePath ^/backup/
> ExcludePath ^/bacula/ SelfCheck 3600
>
>
> And finally freshclam, add to the end of freshclam.conf: # my stuff
> LogFacility LOG_DAEMON DatabaseMirror db.US.clamav.net TestDatabases yes
>
>
> Note in all the clamav configuration file there is a line: Example that has
> to be commented out for the service to run.
>
> Don't forget to systemctl enable these to services: [root@moses clamav]#
> systemctl is-active clamav-milter.service active [root@moses clamav]#
> systemctl is-active clamd(a)scan.service active
>
> Hope this helps, Bill
>
>
>
Is this the default setting for clamd now? clamd_use_jit on Should we turn
this on by default?
selinux errors with clamd. When I ran audit2allow it said to set
this
boolean to eliminate the errors.
Bill
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBaG0sACgkQrlYvE4MpobPBpgCeO3g4C646kE7btcoipQcHR2q5
1vsAoKoQMCzHCCqHS3EgD+sx0cs9QiJZ
=eM1e
-----END PGP SIGNATURE-----
I can't speak for everyone else, but with my setup,
I was getting
4 p.m.
On 9/19/2012 3:36 PM, Arthur Dent wrote:
On Wed, 2012-09-19 at 10:47 +0100, Arthur Dent wrote:
>> "What tells it that it is a "scan" service? That bit of the puzzle
seems
>> to be missing..."
>>
>> Whatever is the parameter after the @ and before the dot becomes %i in
>> the service file. Look at the service file:
>> [Unit]
>> Description = clamd scanner (%i) daemon
>> After = syslog.target nss-lookup.target network.target
>>
>> [Service]
>> Type = simple
>> ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes
>> Restart = on-failure
>> PrivateTmp = true
>>
>> so clamd(a)scan.service invokes clamd with the scan.conf file as it's
>> configuration file.
>> This way you can have multiple clamd services each using a different
>> config file. Just create another config file in
>> /etc/clamd.d/my_config.conf and:
>> ln -s /lib/systemd/system/clamd@.service
>> /etc/systemd/system/clamd(a)my_config.service
>>
>> You should have the /etc/clamd.d/scan.conf I think:
>>
>> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
>> clamav-scanner-0.97.5-1700.fc17.noarch
> Thank you Bill for a helpful and, more importantly, informative reply. I
> think this will not only help me to solve my problem but, even better,
> help me to understand where I was going wrong.
>
> As before, I don't have access to the machine right now, so i will try
> when I get home to work through this and get it right.
>
> I will once again report back later...
Well... Progress!
Because I have done so much tinkering and editing of configs (and had
previously even tried the script I mentioned earlier) I was unsure as to
what should be where, so I blitzed every clam* package with yum erase,
ran updatedb and then deleted any and all clam* files and directories
still left. I also deleted the clam* users that had been created
(including a "clamd user that I had created myself), and then
reinstalled the lot.
A quick edit of the freshclam configs and the /etc/clamd.d/scan.conf
file and a call to systemctl enable clamd(a)scan.service and systemctl
start clamd(a)scan.service and I am up and running!
Thank you so much.
All is not _quite_ perfect however. In calling clamdscan from my script
(itself called from procmail) I get the error:
ERROR: Can't parse clamd configuration file /etc/clamd.conf
Note the config file and location. In order to get it to work (which it
does), I need to declare clamdscan in my script as:
"/bin/clamdscan -c/etc/clamd.d/scan.conf"
So where does it default to /etc/clamd.conf ? I have grepped the whole
of /etc/* and can't find a reference to this location, and there is
no /etc/sysconfig/clamd as there used to be.
I think this is the last remaining mystery. After I have solved this I
will be a very happy bunny!
Thank you again.
Mark
/etc/clamd.conf is the old location for the config file. With the
flexibility of systemd allowing multiple daemons running, I think the
packager changed things to use /etc/clam.d/scan.conf but didn't catch
this change for clamdscan.
I also run a Mandriva mail server that uses procmail to deliver mail.
Here is a snippet of my IMAP recipe:
:0
VIRUS=| clamdscan --no-summary --stdout - | cut -d' ' -f2 -
:0
* VIRUS ?? !^Can\'t
{
:0
* VIRUS ?? !^OK
{
:0
SUBJECT=| egrep '^Subject:' - | sed -e 's/Subject: //' -
:0 fw
| formail -i "Subject: [VIRUS: ${VIRUS}] ${SUBJECT}" -I
"X-Clamav-Virus-Detected: Yes, ${VIRUS}"
:0
$DEFAULT.SystemFolders.Infected/
}
:0Efw
| formail -b -f -t -I "X-Clamav-Virus-Detected: No"
}
To be honest, I don't remember what all the commands do except when it
detects a spam email it puts it in a different directory
($DEFAULT.SystemFolders.Infected/). This Mandriva server uses
/etc/clamd.conf.
Bill
2:36 p.m.
On Wed, 2012-09-19 at 10:47 +0100, Arthur Dent wrote:
> "What tells it that it is a "scan" service? That
bit of the puzzle seems
> to be missing..."
>
> Whatever is the parameter after the @ and before the dot becomes %i in
> the service file. Look at the service file:
> [Unit]
> Description = clamd scanner (%i) daemon
> After = syslog.target nss-lookup.target network.target
>
> [Service]
> Type = simple
> ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes
> Restart = on-failure
> PrivateTmp = true
>
> so clamd(a)scan.service invokes clamd with the scan.conf file as it's
> configuration file.
> This way you can have multiple clamd services each using a different
> config file. Just create another config file in
> /etc/clamd.d/my_config.conf and:
> ln -s /lib/systemd/system/clamd@.service
> /etc/systemd/system/clamd(a)my_config.service
>
> You should have the /etc/clamd.d/scan.conf I think:
>
> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
> clamav-scanner-0.97.5-1700.fc17.noarch
Thank you Bill for a helpful and, more importantly, informative reply. I
think this will not only help me to solve my problem but, even better,
help me to understand where I was going wrong.
As before, I don't have access to the machine right now, so i will try
when I get home to work through this and get it right.
I will once again report back later...
Well... Progress!
Because I have done so much tinkering and editing of configs (and had
previously even tried the script I mentioned earlier) I was unsure as to
what should be where, so I blitzed every clam* package with yum erase,
ran updatedb and then deleted any and all clam* files and directories
still left. I also deleted the clam* users that had been created
(including a "clamd user that I had created myself), and then
reinstalled the lot.
A quick edit of the freshclam configs and the /etc/clamd.d/scan.conf
file and a call to systemctl enable clamd(a)scan.service and systemctl
start clamd(a)scan.service and I am up and running!
Thank you so much.
All is not _quite_ perfect however. In calling clamdscan from my script
(itself called from procmail) I get the error:
ERROR: Can't parse clamd configuration file /etc/clamd.conf
Note the config file and location. In order to get it to work (which it
does), I need to declare clamdscan in my script as:
"/bin/clamdscan -c/etc/clamd.d/scan.conf"
So where does it default to /etc/clamd.conf ? I have grepped the whole
of /etc/* and can't find a reference to this location, and there is
no /etc/sysconfig/clamd as there used to be.
I think this is the last remaining mystery. After I have solved this I
will be a very happy bunny!
Thank you again.
Mark
11:36 a.m.
On Tue, 2012-09-18 at 09:56 +0100, Arthur Dent wrote:
> Arthur Dent pise:
>> On Mon, 2012-09-17 at 11:04 +0200, Zdenek Pytela wrote:
>> > Arthur Dent pise:
>> > > Hello all,
>> > >
>> > > Has anyone got a simple walkthrough for configuring clamd and
>> getting it
>> > > working with systemd on F17?
>> > >
>> > > I am getting lost in the myriad of <SERVICE> and PID (etc.
etc.)
>> things
>> > > I have to change and .conf files I have to edit and move...
>> > >
>> > > In particular, what am I supposed to do with
>> > > the /usr/lib/systemd/system/clamd@.service file?
>> > Not to touch ;-). Just run
>> > systemctl enable clamd.scan.service
>> > systemctl start clamd.scan.service
>>
>> Hi - Thanks for that, but I'm afraid that was one of the very many
>> things I tried. It didn't work.
>>
>> # systemctl enable clamd.scan.service
>> Failed to issue method call: No such file or directory
>>
>> What tells it that it is a "scan" service? That bit of the puzzle
seems
>> to be missing...
> The main question is: what do you want to do? Just check files on
> disk or check them when they are uploaded on a webserver or check incoming
> and outcoming mail? Then, do you want continous updates of virus database
> or
> just update rpm packages?
I do use clamav for occasional file scanning, but the primary reason for
this install to to scan incoming email. I have a procmail recipe which
uses clamd to scan and filter mail. I have freshclam running via cron and
I also use the sane-security 3rd party signatures.
> You most probably need to install clamav (+its dependencies) and
> clamav-update, maybe also clamav-scanner with clamav-scanner-systemd which
> contains the .service file. But I am just guessing. There are 19 clamav
> related packages.
I am at work at the moment I and I can no longer SSH into my F17 box (the
BOFH sysadmin here has blocked all "non-essential" inbound and outboud
ports - but I am working on him to get my access back!) so I can't check,
but I think I have installed all the required packages with the possible
exception of clamav-scanner-systemd. When I get home I will check that
out. I think that may be the cause of my problem.
Thanks! I will report back...
Well sadly no joy...
# yum install clamav-scanner-systemd
# systemctl enable clamd.scan.service
Failed to issue method call: No such file or directory
# rpm -qa | grep clam
clamav-server-systemd-0.97.5-1700.fc17.noarch
clamav-update-0.97.5-1700.fc17.i686
clamav-filesystem-0.97.5-1700.fc17.noarch
clamav-lib-0.97.5-1700.fc17.i686
clamav-scanner-systemd-0.97.5-1700.fc17.noarch
clamav-unofficial-sigs-3.7.1-7.fc17.noarch
clamav-0.97.5-1700.fc17.i686
clamav-data-0.97.5-1700.fc17.noarch
clamav-scanner-0.97.5-1700.fc17.noarch
clamav-server-0.97.5-1700.fc17.i686
Anything else I should have?
Any other ideas?
Thanks again...
Mark
9:38 a.m.
On 9/19/2012 5:54 PM, Arthur Dent wrote:
> On Wed, 2012-09-19 at 17:00 -0400, Bill Shirley wrote:
>> On 9/19/2012 3:36 PM, Arthur Dent wrote:
>>
>>> On Wed, 2012-09-19 at 10:47 +0100, Arthur Dent wrote:
>>>
> [snip] useful recipe (similar to mine). The thing is, for me
"clamdscan
> --no-summary --stdout" won't work. I need to tell it explicitly where
> the config file is. I have this in my script:
> CLAMSCAN="/bin/clamdscan -c/etc/clamd.d/scan.conf"
> CLAMSCANOPT="--no-summary --stdout"
>
> and call it with ${CLAMSCAN} ${CLAMSCANOPT} - < ${MSGTMP}
>
> The same thing happens on the command line:
> # clamdscan -V
> ERROR: Can't parse clamd configuration file /etc/clamd.conf
> # clamdscan -c /etc/clamd.d/scan.conf -V
> ClamAV 0.97.5/15376/Wed Sep 19 19:35:38 2012
>
> Any ideas?
>
Yes, I would just symlink it.
ln -s /etc/clamd.d/scan.conf /etc/clamd.conf
That sound you can hear?
It's my head thumping on the table! Doh! Why didn't I think of that?
Especially as I used exactly the same technique to solve a similar problem
a couple of months ago...
Thanks for jogging my memory. It will work of course, but it still feels a
bit of a kludge. Zdenek Pytela has pointed out that it does indeed seem to
be hardcoded so I think I might report it as a bug.
Thank you once again. I think I am all sorted now!
Cheers!
Mark
4:47 a.m.
Arthur Dent pise:
On Wed, 2012-09-19 at 17:00 -0400, Bill Shirley wrote:
>
> On 9/19/2012 3:36 PM, Arthur Dent wrote:
>
> > On Wed, 2012-09-19 at 10:47 +0100, Arthur Dent wrote:
> >
> > All is not _quite_ perfect however. In calling clamdscan from my script
> > (itself called from procmail) I get the error:
> > ERROR: Can't parse clamd configuration file /etc/clamd.conf
> >
> > Note the config file and location. In order to get it to work (which it
> > does), I need to declare clamdscan in my script as:
> > "/bin/clamdscan -c/etc/clamd.d/scan.conf"
> >
> > So where does it default to /etc/clamd.conf ? I have grepped the whole
> > of /etc/* and can't find a reference to this location, and there is
> > no /etc/sysconfig/clamd as there used to be.
> >
> > I think this is the last remaining mystery. After I have solved this I
> > will be a very happy bunny!
> /etc/clamd.conf is the old location for the config file. With the
> flexibility of systemd allowing multiple daemons running, I think the
> packager changed things to use /etc/clam.d/scan.conf but didn't catch
> this change for clamdscan.
Yes I know that /etc/clamd.conf is the old location. What I can't work
out is why it still thinks that's where it is. Is it hard-coded
somewhere?
> I also run a Mandriva mail server that uses procmail to deliver mail.
> Here is a snippet of my IMAP recipe:
> :0
> VIRUS=| clamdscan --no-summary --stdout - | cut -d' ' -f2 -
>
[snip] useful recipe (similar to mine). The thing is, for me "clamdscan
--no-summary --stdout" won't work. I need to tell it explicitly where
the config file is. I have this in my script:
CLAMSCAN="/bin/clamdscan -c/etc/clamd.d/scan.conf"
CLAMSCANOPT="--no-summary --stdout"
and call it with ${CLAMSCAN} ${CLAMSCANOPT} - < ${MSGTMP}
The same thing happens on the command line:
# clamdscan -V
ERROR: Can't parse clamd configuration file /etc/clamd.conf
# clamdscan -c /etc/clamd.d/scan.conf -V
ClamAV 0.97.5/15376/Wed Sep 19 19:35:38 2012
Any ideas?
Definitely it is hardcoded:
strings /bin/clamdscan
...
/etc/clamd.conf
...
or
strace -e open,stat -o /tmp/clamscan.strace clamdscan -V
...
open("/etc/clamd.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
...
I guess that you can file a bug because the application doesn't work properly.
--
--Zdenek Pytela, <pytela(a)phil.muni.cz>
4:10 a.m.
On 9/20/2012 5:02 AM, Zdenek Pytela wrote:
Arthur Dent pise:
> Well sadly no joy...
>
> # yum install clamav-scanner-systemd
>
> # systemctl enable clamd.scan.service
> Failed to issue method call: No such file or directory
Just for the record: there are differences between f16 and f17, the
f16's /lib/systemd/system/clamd.scan.service from clamav-scanner-systemd
changed to
/lib/systemd/system/clamd(a)scan.service from clamav-scanner-systemd and
clamd@.service from clamav-server-systemd which is called by the former one
in f 17 - sorry for confusing.
The scanning service calls executable
/usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes
The config file /etc/clamd.d/scan.conf should be adjusted to your needs.
Thanks for pointing that out. I hadn't notice the difference. I have a
F16 server also and:
[root@elvis ~]# systemctl is-active clamd.scan.service
active
Bill
4:02 a.m.
Arthur Dent pise:
Well sadly no joy...
# yum install clamav-scanner-systemd
# systemctl enable clamd.scan.service
Failed to issue method call: No such file or directory
Just for the record: there
are differences between f16 and f17, the
f16's /lib/systemd/system/clamd.scan.service from clamav-scanner-systemd
changed to
/lib/systemd/system/clamd(a)scan.service from clamav-scanner-systemd and
clamd@.service from clamav-server-systemd which is called by the former one
in f 17 - sorry for confusing.
The scanning service calls executable
/usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes
The config file /etc/clamd.d/scan.conf should be adjusted to your needs.
--
--Zdenek Pytela, <pytela(a)phil.muni.cz>
4:10 p.m.
Well had you changed any default settings in clamd to turn on JIT or
does it
come with JIT turned on by default?
I must have. My best guess is the TestDatabases
in freshclam.conf:
# my stuff
LogFacility LOG_DAEMON
DatabaseMirror db.US.clamav.net
TestDatabases yes
Bill
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBaMGAACgkQrlYvE4MpobO1hQCgu6O9WCIZ2byEgkkFX09ophHd
0bwAoLJkGJxgx1IWrqpumUEs4M7FHJih
=pzaT
-----END PGP SIGNATURE-----
5:10 p.m.
On 9/19/2012 5:54 PM, Arthur Dent wrote:
On Wed, 2012-09-19 at 17:00 -0400, Bill Shirley wrote:
> On 9/19/2012 3:36 PM, Arthur Dent wrote:
>
>> On Wed, 2012-09-19 at 10:47 +0100, Arthur Dent wrote:
>> All is not _quite_ perfect however. In calling clamdscan from my script
>> (itself called from procmail) I get the error:
>> ERROR: Can't parse clamd configuration file /etc/clamd.conf
>>
>> Note the config file and location. In order to get it to work (which it
>> does), I need to declare clamdscan in my script as:
>> "/bin/clamdscan -c/etc/clamd.d/scan.conf"
>>
>> So where does it default to /etc/clamd.conf ? I have grepped the whole
>> of /etc/* and can't find a reference to this location, and there is
>> no /etc/sysconfig/clamd as there used to be.
>>
>> I think this is the last remaining mystery. After I have solved this I
>> will be a very happy bunny!
> /etc/clamd.conf is the old location for the config file. With the
> flexibility of systemd allowing multiple daemons running, I think the
> packager changed things to use /etc/clam.d/scan.conf but didn't catch
> this change for clamdscan.
Yes I know that /etc/clamd.conf is the old location. What I can't work
out is why it still thinks that's where it is. Is it hard-coded
somewhere?
> I also run a Mandriva mail server that uses procmail to deliver mail.
> Here is a snippet of my IMAP recipe:
> :0
> VIRUS=| clamdscan --no-summary --stdout - | cut -d' ' -f2 -
>
[snip] useful recipe (similar to mine). The thing is, for me "clamdscan
--no-summary --stdout" won't work. I need to tell it explicitly where
the config file is. I have this in my script:
CLAMSCAN="/bin/clamdscan -c/etc/clamd.d/scan.conf"
CLAMSCANOPT="--no-summary --stdout"
and call it with ${CLAMSCAN} ${CLAMSCANOPT} - < ${MSGTMP}
The same thing happens on the command line:
# clamdscan -V
ERROR: Can't parse clamd configuration file /etc/clamd.conf
# clamdscan -c /etc/clamd.d/scan.conf -V
ClamAV 0.97.5/15376/Wed Sep 19 19:35:38 2012
Any ideas?
Thanks (yet) again...
Mark
Yes, I would just symlink it.
ln -s /etc/clamd.d/scan.conf /etc/clamd.conf
Bill
4:54 p.m.
On Wed, 2012-09-19 at 17:00 -0400, Bill Shirley wrote:
On 9/19/2012 3:36 PM, Arthur Dent wrote:
> On Wed, 2012-09-19 at 10:47 +0100, Arthur Dent wrote:
>
> All is not _quite_ perfect however. In calling clamdscan from my script
> (itself called from procmail) I get the error:
> ERROR: Can't parse clamd configuration file /etc/clamd.conf
>
> Note the config file and location. In order to get it to work (which it
> does), I need to declare clamdscan in my script as:
> "/bin/clamdscan -c/etc/clamd.d/scan.conf"
>
> So where does it default to /etc/clamd.conf ? I have grepped the whole
> of /etc/* and can't find a reference to this location, and there is
> no /etc/sysconfig/clamd as there used to be.
>
> I think this is the last remaining mystery. After I have solved this I
> will be a very happy bunny!
/etc/clamd.conf is the old location for the config file. With the
flexibility of systemd allowing multiple daemons running, I think the
packager changed things to use /etc/clam.d/scan.conf but didn't catch
this change for clamdscan.
Yes I know that /etc/clamd.conf is the old location. What I can't work
out is why it still thinks that's where it is. Is it hard-coded
somewhere?
I also run a Mandriva mail server that uses procmail to deliver
mail.
Here is a snippet of my IMAP recipe:
:0
VIRUS=| clamdscan --no-summary --stdout - | cut -d' ' -f2 -
[snip] useful recipe (similar to mine). The thing is, for me "clamdscan
--no-summary --stdout" won't work. I need to tell it explicitly where
the config file is. I have this in my script:
CLAMSCAN="/bin/clamdscan -c/etc/clamd.d/scan.conf"
CLAMSCANOPT="--no-summary --stdout"
and call it with ${CLAMSCAN} ${CLAMSCANOPT} - < ${MSGTMP}
The same thing happens on the command line:
# clamdscan -V
ERROR: Can't parse clamd configuration file /etc/clamd.conf
# clamdscan -c /etc/clamd.d/scan.conf -V
ClamAV 0.97.5/15376/Wed Sep 19 19:35:38 2012
Any ideas?
Thanks (yet) again...
Mark
3:51 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/19/2012 04:41 PM, Bill Shirley wrote:
On 9/19/2012 3:21 PM, Daniel J Walsh wrote: On 09/19/2012 07:36 AM, Bill
Shirley wrote:
>>> On 9/19/2012 5:47 AM, Arthur Dent wrote:
>>>>> "What tells it that it is a "scan" service? That bit
of the
>>>>> puzzle seems to be missing..."
>>>>>
>>>>> Whatever is the parameter after the @ and before the dot becomes
>>>>> %i in the service file. Look at the service file: [Unit]
>>>>> Description = clamd scanner (%i) daemon After = syslog.target
>>>>> nss-lookup.target network.target
>>>>>
>>>>> [Service] Type = simple ExecStart = /usr/sbin/clamd -c
>>>>> /etc/clamd.d/%i.conf --nofork=yes Restart = on-failure PrivateTmp
>>>>> = true
>>>>>
>>>>> so clamd(a)scan.service invokes clamd with the scan.conf file as
>>>>> it's configuration file. This way you can have multiple clamd
>>>>> services each using a different config file. Just create another
>>>>> config file in /etc/clamd.d/my_config.conf and: ln -s
>>>>> /lib/systemd/system/clamd@.service
>>>>> /etc/systemd/system/clamd(a)my_config.service
>>>>>
>>>>> You should have the /etc/clamd.d/scan.conf I think:
>>>>>
>>>>> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
>>>>> clamav-scanner-0.97.5-1700.fc17.noarch
>>>> Thank you Bill for a helpful and, more importantly, informative
>>>> reply. I think this will not only help me to solve my problem but,
>>>> even better, help me to understand where I was going wrong.
>>>>
>>>> As before, I don't have access to the machine right now, so i will
>>>> try when I get home to work through this and get it right.
>>>>
>>>> I will once again report back later...
>>>>
>>>> Thanks again. Your help is much appreciated.
>>>>
>>>> Mark
>>>>
>>>>
>>> You mentioned scanning email. I run clamav-milter and stop the virus
>>> at smtp time. You may find this helpful:
>>>
>>> [root@moses clamav]# rpm -qa | grep clam | sort
>>> clamav-data-0.97.5-1700.fc17.noarch
>>> clamav-filesystem-0.97.5-1700.fc17.noarch
>>> clamav-lib-0.97.5-1700.fc17.x86_64
>>> clamav-milter-0.97.5-1700.fc17.x86_64
>>> clamav-milter-systemd-0.97.5-1700.fc17.noarch
>>> clamav-scanner-0.97.5-1700.fc17.noarch
>>> clamav-scanner-systemd-0.97.5-1700.fc17.noarch
>>> clamav-server-0.97.5-1700.fc17.x86_64
>>> clamav-server-systemd-0.97.5-1700.fc17.noarch
>>> clamav-update-0.97.5-1700.fc17.x86_64
>>>
>>> For clamav-milter, I had to add clamilt to the postfix group (usermod
>>> -a -G postfix clamilt): [root@moses clamav]# egrep 'post|clam'
>>> /etc/group mail:x:12:postfix postfix:x:89:clamilt postdrop:x:90:
>>> clamscan:x:987:clamilt clamilt:x:988:postfix clamupdate:x:989:
>>>
>>>
>>> Add to the end of /etc/mail/clamav-milter.conf: # my stuff # be sure
>>> to comment out above: Example
>>>
>>> ClamdSocket unix:/var/run/clamd.scan/clamd.sock
>>> MilterSocket /var/run/clamav-milter/clamav-milter.socket
>>> ##MilterSocket inet:3381 # usermod -a -G postfix clamilt
>>> MilterSocketGroup postfix MilterSocketMode 660
>>>
>>> OnInfected Reject AddHeader Replace
>>>
>>> #LogFile /var/log/clamav-milter.log #LogFileMaxSize 1M
>>> #LogTime yes LogSyslog yes LogFacility
>>> LOG_MAIL #LogVerbose no LogClean Basic
>>> LogInfected Full
>>>
>>> Add to postfix's main.cf: # usermod -a -G clamilt postfix
>>> smtpd_milters = unix:/var/run/clamav-milter/clamav-milter.socket
>>> #milter_default_action = accept milter_default_action = tempfail
>>>
>>> I can't remember if I had to create the directory, but here is that
>>> info: [root@moses clamav]# ldpz
>>> /var/run/clamav-milter/clamav-milter.socket drwxr-xr-x. root root
>>> system_u:object_r:var_t:s0 /var lrwxrwxrwx. root root
>>> system_u:object_r:var_run_t:s0 /var/run -> ../run drwx--x---. clamilt
>>> clamilt system_u:object_r:clamd_var_run_t:s0 /var/run/clamav-milter
>>> srw-rw----. clamilt postfix system_u:object_r:clamd_var_run_t:s0
>>> /var/run/clamav-milter/clamav-milter.socket
>>>
>>>
>>> For clamav, to avoid selinux problems issue command: setsebool -P
>>> clamd_use_jit on
>>>
>>> Add to end of scan.conf: # my stuff # be sure to commend out above:
>>> Example
>>>
>>> #LogFile /var/log/clamav/clamd.scan #LogFacility
>>> LOG_MAIL LogFacility LOG_DAEMON ExtendedDetectionInfo
>>> yes LocalSocket /var/run/clamd.scan/clamd.sock
>>> #LocalSocketGroup virusgroup #LocalSocketMode 660
>>> FixStaleSocket yes CrossFilesystems no ExcludePath
>>> ^/proc/ ExcludePath ^/sys/ ExcludePath ^/fuse/
>>> ExcludePath ^/backup/ ExcludePath ^/bacula/
>>> SelfCheck 3600
>>>
>>>
>>> And finally freshclam, add to the end of freshclam.conf: # my stuff
>>> LogFacility LOG_DAEMON DatabaseMirror db.US.clamav.net TestDatabases
>>> yes
>>>
>>>
>>> Note in all the clamav configuration file there is a line: Example
>>> that has to be commented out for the service to run.
>>>
>>> Don't forget to systemctl enable these to services: [root@moses
>>> clamav]# systemctl is-active clamav-milter.service active [root@moses
>>> clamav]# systemctl is-active clamd(a)scan.service active
>>>
>>> Hope this helps, Bill
>>>
>>>
>>>
Is this the default setting for clamd now? clamd_use_jit on Should we
turn this on by default? I can't speak for everyone else, but with my
setup, I was getting selinux errors with clamd. When I ran audit2allow it
said to set this boolean to eliminate the errors.
Bill
Well had you changed any default settings in clamd to turn on JIT or does it
come with JIT turned on by default?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBaMGAACgkQrlYvE4MpobO1hQCgu6O9WCIZ2byEgkkFX09ophHd
0bwAoLJkGJxgx1IWrqpumUEs4M7FHJih
=pzaT
-----END PGP SIGNATURE-----
2:21 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/19/2012 07:36 AM, Bill Shirley wrote:
On 9/19/2012 5:47 AM, Arthur Dent wrote:
>> "What tells it that it is a "scan" service? That bit of the
puzzle
>> seems to be missing..."
>>
>> Whatever is the parameter after the @ and before the dot becomes %i
>> in the service file. Look at the service file: [Unit] Description =
>> clamd scanner (%i) daemon After = syslog.target nss-lookup.target
>> network.target
>>
>> [Service] Type = simple ExecStart = /usr/sbin/clamd -c
>> /etc/clamd.d/%i.conf --nofork=yes Restart = on-failure PrivateTmp =
>> true
>>
>> so clamd(a)scan.service invokes clamd with the scan.conf file as it's
>> configuration file. This way you can have multiple clamd services each
>> using a different config file. Just create another config file in
>> /etc/clamd.d/my_config.conf and: ln -s
>> /lib/systemd/system/clamd@.service
>> /etc/systemd/system/clamd(a)my_config.service
>>
>> You should have the /etc/clamd.d/scan.conf I think:
>>
>> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
>> clamav-scanner-0.97.5-1700.fc17.noarch
> Thank you Bill for a helpful and, more importantly, informative reply. I
> think this will not only help me to solve my problem but, even better,
> help me to understand where I was going wrong.
>
> As before, I don't have access to the machine right now, so i will try
> when I get home to work through this and get it right.
>
> I will once again report back later...
>
> Thanks again. Your help is much appreciated.
>
> Mark
>
>
You mentioned scanning email. I run clamav-milter and stop the virus at
smtp time. You may find this helpful:
[root@moses clamav]# rpm -qa | grep clam | sort
clamav-data-0.97.5-1700.fc17.noarch
clamav-filesystem-0.97.5-1700.fc17.noarch
clamav-lib-0.97.5-1700.fc17.x86_64 clamav-milter-0.97.5-1700.fc17.x86_64
clamav-milter-systemd-0.97.5-1700.fc17.noarch
clamav-scanner-0.97.5-1700.fc17.noarch
clamav-scanner-systemd-0.97.5-1700.fc17.noarch
clamav-server-0.97.5-1700.fc17.x86_64
clamav-server-systemd-0.97.5-1700.fc17.noarch
clamav-update-0.97.5-1700.fc17.x86_64
For clamav-milter, I had to add clamilt to the postfix group (usermod -a
-G postfix clamilt): [root@moses clamav]# egrep 'post|clam' /etc/group
mail:x:12:postfix postfix:x:89:clamilt postdrop:x:90:
clamscan:x:987:clamilt clamilt:x:988:postfix clamupdate:x:989:
Add to the end of /etc/mail/clamav-milter.conf: # my stuff # be sure to
comment out above: Example
ClamdSocket unix:/var/run/clamd.scan/clamd.sock MilterSocket
/var/run/clamav-milter/clamav-milter.socket ##MilterSocket
inet:3381 # usermod -a -G postfix clamilt MilterSocketGroup postfix
MilterSocketMode 660
OnInfected Reject AddHeader Replace
#LogFile /var/log/clamav-milter.log #LogFileMaxSize
1M #LogTime yes LogSyslog yes LogFacility
LOG_MAIL #LogVerbose no LogClean Basic
LogInfected Full
Add to postfix's main.cf: # usermod -a -G clamilt postfix smtpd_milters =
unix:/var/run/clamav-milter/clamav-milter.socket #milter_default_action =
accept milter_default_action = tempfail
I can't remember if I had to create the directory, but here is that info:
[root@moses clamav]# ldpz /var/run/clamav-milter/clamav-milter.socket
drwxr-xr-x. root root system_u:object_r:var_t:s0 /var
lrwxrwxrwx. root root system_u:object_r:var_run_t:s0 /var/run ->
../run drwx--x---. clamilt clamilt system_u:object_r:clamd_var_run_t:s0
/var/run/clamav-milter srw-rw----. clamilt postfix
system_u:object_r:clamd_var_run_t:s0
/var/run/clamav-milter/clamav-milter.socket
For clamav, to avoid selinux problems issue command: setsebool -P
clamd_use_jit on
Add to end of scan.conf: # my stuff # be sure to commend out above:
Example
#LogFile /var/log/clamav/clamd.scan #LogFacility
LOG_MAIL LogFacility LOG_DAEMON ExtendedDetectionInfo yes
LocalSocket /var/run/clamd.scan/clamd.sock #LocalSocketGroup
virusgroup #LocalSocketMode 660 FixStaleSocket yes
CrossFilesystems no ExcludePath ^/proc/ ExcludePath
^/sys/ ExcludePath ^/fuse/ ExcludePath ^/backup/
ExcludePath ^/bacula/ SelfCheck 3600
And finally freshclam, add to the end of freshclam.conf: # my stuff
LogFacility LOG_DAEMON DatabaseMirror db.US.clamav.net TestDatabases yes
Note in all the clamav configuration file there is a line: Example that has
to be commented out for the service to run.
Don't forget to systemctl enable these to services: [root@moses clamav]#
systemctl is-active clamav-milter.service active [root@moses clamav]#
systemctl is-active clamd(a)scan.service active
Hope this helps, Bill
Is this the default setting for clamd now? clamd_use_jit on Should we turn
this on by default?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBaG0sACgkQrlYvE4MpobPBpgCeO3g4C646kE7btcoipQcHR2q5
1vsAoKoQMCzHCCqHS3EgD+sx0cs9QiJZ
=eM1e
-----END PGP SIGNATURE-----
9:24 a.m.
On 9/19/2012 5:47 AM, Arthur Dent wrote:
>> "What tells it that it is a "scan" service? That bit of the
puzzle
>> seems
>> to be missing..."
>>
>> Whatever is the parameter after the @ and before the dot becomes %i in
>> the service file. Look at the service file:
>> [Unit]
>> Description = clamd scanner (%i) daemon
>> After = syslog.target nss-lookup.target network.target
>>
>> [Service]
>> Type = simple
>> ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes
>> Restart = on-failure
>> PrivateTmp = true
>>
>> so clamd(a)scan.service invokes clamd with the scan.conf file as it's
>> configuration file.
>> This way you can have multiple clamd services each using a different
>> config file. Just create another config file in
>> /etc/clamd.d/my_config.conf and:
>> ln -s /lib/systemd/system/clamd@.service
>> /etc/systemd/system/clamd(a)my_config.service
>>
>> You should have the /etc/clamd.d/scan.conf I think:
>>
>> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
>> clamav-scanner-0.97.5-1700.fc17.noarch
> Thank you Bill for a helpful and, more importantly, informative reply. I
> think this will not only help me to solve my problem but, even better,
> help me to understand where I was going wrong.
>
> As before, I don't have access to the machine right now, so i will try
> when I get home to work through this and get it right.
>
> I will once again report back later...
>
> Thanks again. Your help is much appreciated.
>
> Mark
>
>
You mentioned scanning email. I run clamav-milter and stop the virus at
smtp time. You may find this helpful:
[Snip of some very useful stuff]
Thanks (again!) Bill,
That is very interesting. I have to say however, that my machine is a
simple home system serving web and mail for me and my family only.
I collect mail from (several) ISPs using fetchmail and then procmail to
scan (clamd and spamd) and filter into folders.
I am on a dynamic IP address so, whilst I know it is not impossible,
running my own SMTP operation is more work than I wish to take on at this
time. I have thought about this, but I think it will have to be an
iteresting project for when I retire - in about 10yrs time... (unless you
can convice me otherwise!)
Thanks again
Mark
6:36 a.m.
On 9/19/2012 5:47 AM, Arthur Dent wrote:
> "What tells it that it is a "scan" service? That
bit of the puzzle seems
> to be missing..."
>
> Whatever is the parameter after the @ and before the dot becomes %i in
> the service file. Look at the service file:
> [Unit]
> Description = clamd scanner (%i) daemon
> After = syslog.target nss-lookup.target network.target
>
> [Service]
> Type = simple
> ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes
> Restart = on-failure
> PrivateTmp = true
>
> so clamd(a)scan.service invokes clamd with the scan.conf file as it's
> configuration file.
> This way you can have multiple clamd services each using a different
> config file. Just create another config file in
> /etc/clamd.d/my_config.conf and:
> ln -s /lib/systemd/system/clamd@.service
> /etc/systemd/system/clamd(a)my_config.service
>
> You should have the /etc/clamd.d/scan.conf I think:
>
> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
> clamav-scanner-0.97.5-1700.fc17.noarch
Thank you Bill for a helpful and, more importantly, informative reply. I
think this will not only help me to solve my problem but, even better,
help me to understand where I was going wrong.
As before, I don't have access to the machine right now, so i will try
when I get home to work through this and get it right.
I will once again report back later...
Thanks again. Your help is much appreciated.
Mark
You mentioned scanning email. I run clamav-milter and stop the virus at
smtp time. You may find this helpful:
[root@moses clamav]# rpm -qa | grep clam | sort
clamav-data-0.97.5-1700.fc17.noarch
clamav-filesystem-0.97.5-1700.fc17.noarch
clamav-lib-0.97.5-1700.fc17.x86_64
clamav-milter-0.97.5-1700.fc17.x86_64
clamav-milter-systemd-0.97.5-1700.fc17.noarch
clamav-scanner-0.97.5-1700.fc17.noarch
clamav-scanner-systemd-0.97.5-1700.fc17.noarch
clamav-server-0.97.5-1700.fc17.x86_64
clamav-server-systemd-0.97.5-1700.fc17.noarch
clamav-update-0.97.5-1700.fc17.x86_64
For clamav-milter, I had to add clamilt to the postfix group (usermod -a
-G postfix clamilt):
[root@moses clamav]# egrep 'post|clam' /etc/group
mail:x:12:postfix
postfix:x:89:clamilt
postdrop:x:90:
clamscan:x:987:clamilt
clamilt:x:988:postfix
clamupdate:x:989:
Add to the end of /etc/mail/clamav-milter.conf:
# my stuff
# be sure to comment out above: Example
ClamdSocket unix:/var/run/clamd.scan/clamd.sock
MilterSocket /var/run/clamav-milter/clamav-milter.socket
##MilterSocket inet:3381
# usermod -a -G postfix clamilt
MilterSocketGroup postfix
MilterSocketMode 660
OnInfected Reject
AddHeader Replace
#LogFile /var/log/clamav-milter.log
#LogFileMaxSize 1M
#LogTime yes
LogSyslog yes
LogFacility LOG_MAIL
#LogVerbose no
LogClean Basic
LogInfected Full
Add to postfix's main.cf:
# usermod -a -G clamilt postfix
smtpd_milters = unix:/var/run/clamav-milter/clamav-milter.socket
#milter_default_action = accept
milter_default_action = tempfail
I can't remember if I had to create the directory, but here is that info:
[root@moses clamav]# ldpz /var/run/clamav-milter/clamav-milter.socket
drwxr-xr-x. root root system_u:object_r:var_t:s0 /var
lrwxrwxrwx. root root system_u:object_r:var_run_t:s0 /var/run ->
../run
drwx--x---. clamilt clamilt system_u:object_r:clamd_var_run_t:s0
/var/run/clamav-milter
srw-rw----. clamilt postfix system_u:object_r:clamd_var_run_t:s0
/var/run/clamav-milter/clamav-milter.socket
For clamav, to avoid selinux problems issue command:
setsebool -P clamd_use_jit on
Add to end of scan.conf:
# my stuff
# be sure to commend out above: Example
#LogFile /var/log/clamav/clamd.scan
#LogFacility LOG_MAIL
LogFacility LOG_DAEMON
ExtendedDetectionInfo yes
LocalSocket /var/run/clamd.scan/clamd.sock
#LocalSocketGroup virusgroup
#LocalSocketMode 660
FixStaleSocket yes
CrossFilesystems no
ExcludePath ^/proc/
ExcludePath ^/sys/
ExcludePath ^/fuse/
ExcludePath ^/backup/
ExcludePath ^/bacula/
SelfCheck 3600
And finally freshclam, add to the end of freshclam.conf:
# my stuff
LogFacility LOG_DAEMON
DatabaseMirror db.US.clamav.net
TestDatabases yes
Note in all the clamav configuration file there is a line:
Example
that has to be commented out for the service to run.
Don't forget to systemctl enable these to services:
[root@moses clamav]# systemctl is-active clamav-milter.service
active
[root@moses clamav]# systemctl is-active clamd(a)scan.service
active
Hope this helps,
Bill
4:47 a.m.
"What tells it that it is a "scan" service? That bit
of the puzzle seems
to be missing..."
Whatever is the parameter after the @ and before the dot becomes %i in
the service file. Look at the service file:
[Unit]
Description = clamd scanner (%i) daemon
After = syslog.target nss-lookup.target network.target
[Service]
Type = simple
ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes
Restart = on-failure
PrivateTmp = true
so clamd(a)scan.service invokes clamd with the scan.conf file as it's
configuration file.
This way you can have multiple clamd services each using a different
config file. Just create another config file in
/etc/clamd.d/my_config.conf and:
ln -s /lib/systemd/system/clamd@.service
/etc/systemd/system/clamd(a)my_config.service
You should have the /etc/clamd.d/scan.conf I think:
[root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
clamav-scanner-0.97.5-1700.fc17.noarch
Thank you Bill for a helpful and, more importantly, informative reply. I
think this will not only help me to solve my problem but, even better,
help me to understand where I was going wrong.
As before, I don't have access to the machine right now, so i will try
when I get home to work through this and get it right.
I will once again report back later...
Thanks again. Your help is much appreciated.
Mark
5:45 p.m.
It's not clamd.scan.service. It's clamd(a)scan.service.
[root@moses shorewall]# systemctl is-active clamd(a)scan.service
active
On 9/17/2012 5:04 AM, Zdenek Pytela wrote:
Arthur Dent pise:
> Hello all,
>
> Has anyone got a simple walkthrough for configuring clamd and getting it
> working with systemd on F17?
>
> I am getting lost in the myriad of <SERVICE> and PID (etc. etc.) things
> I have to change and .conf files I have to edit and move...
>
> In particular, what am I supposed to do with
> the /usr/lib/systemd/system/clamd@.service file?
Not to touch ;-). Just run
systemctl enable clamd.scan.service
systemctl start clamd.scan.service
> On previous Fedora installs (pre F15) I used to use this excellent
> script which took all the pain out of setup:
>
http://blog.christophersmart.com/2009/12/17/script-for-configuring-clamav...
>
> if that's line-wrapped try this:
> http://tinyurl.com/clamdscript
>
> but I am not confident that this script will now properly configure
> systemd now that I am rebuilding a F17 server.
>
> Any hints, tips, guides, handholding, or smacks on the head gratefully
> received...
The script should be adapted for 17 convention, but generally
it might (?) work. Commands like chkconfig are redirected, paths like
/var/run have apropriate links.
I have my clamav service working without any hacking but configuring
/etc/freshclam.conf and possibly (in one case) the /etc/clamd.d/* files.
5:39 p.m.
"What tells it that it is a "scan" service? That bit of the puzzle seems
to be missing..."
Whatever is the parameter after the @ and before the dot becomes %i in
the service file. Look at the service file:
[Unit]
Description = clamd scanner (%i) daemon
After = syslog.target nss-lookup.target network.target
[Service]
Type = simple
ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf --nofork=yes
Restart = on-failure
PrivateTmp = true
so clamd(a)scan.service invokes clamd with the scan.conf file as it's
configuration file.
This way you can have multiple clamd services each using a different
config file. Just create another config file in
/etc/clamd.d/my_config.conf and:
ln -s /lib/systemd/system/clamd@.service
/etc/systemd/system/clamd(a)my_config.service
You should have the /etc/clamd.d/scan.conf I think:
[root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
clamav-scanner-0.97.5-1700.fc17.noarch
Bill
3:56 a.m.
Arthur Dent pise:
> On Mon, 2012-09-17 at 11:04 +0200, Zdenek Pytela wrote:
> > Arthur Dent pise:
> > > Hello all,
> > >
> > > Has anyone got a simple walkthrough for configuring clamd and
> getting it
> > > working with systemd on F17?
> > >
> > > I am getting lost in the myriad of <SERVICE> and PID (etc. etc.)
> things
> > > I have to change and .conf files I have to edit and move...
> > >
> > > In particular, what am I supposed to do with
> > > the /usr/lib/systemd/system/clamd@.service file?
> > Not to touch ;-). Just run
> > systemctl enable clamd.scan.service
> > systemctl start clamd.scan.service
>
> Hi - Thanks for that, but I'm afraid that was one of the very many
> things I tried. It didn't work.
>
> # systemctl enable clamd.scan.service
> Failed to issue method call: No such file or directory
>
> What tells it that it is a "scan" service? That bit of the puzzle seems
> to be missing...
The main question is: what do you want to do? Just check files on
disk or check them when they are uploaded on a webserver or check incoming
and outcoming mail? Then, do you want continous updates of virus database
or
just update rpm packages?
I do use clamav for occasional file scanning, but the primary reason for
this install to to scan incoming email. I have a procmail recipe which
uses clamd to scan and filter mail. I have freshclam running via cron and
I also use the sane-security 3rd party signatures.
You most probably need to install clamav (+its dependencies) and
clamav-update, maybe also clamav-scanner with clamav-scanner-systemd which
contains the .service file. But I am just guessing. There are 19 clamav
related packages.
I am at work at the moment I and I can no longer SSH into my F17 box (the
BOFH sysadmin here has blocked all "non-essential" inbound and outboud
ports - but I am working on him to get my access back!) so I can't check,
but I think I have installed all the required packages with the possible
exception of clamav-scanner-systemd. When I get home I will check that
out. I think that may be the cause of my problem.
Thanks! I will report back...
Mark
2:56 a.m.
On 16/09/12 10:29, Arthur Dent wrote:
On previous Fedora installs (pre F15) I used to use this excellent
script which took all the pain out of setup:
http://blog.christophersmart.com/2009/12/17/script-for-configuring-clamav...
I have used this on F17/F18/Rawhide,
there are some caveats though.
rw permissions, making sure both freshclam-clamd.conf,
clamav.conf both have the same database path.
Some others can't remember of the top of my head.
--
Regards,
Frank
"Jack of all, fubars"
2:45 a.m.
Arthur Dent pise:
On Mon, 2012-09-17 at 11:04 +0200, Zdenek Pytela wrote:
> Arthur Dent pise:
> > Hello all,
> >
> > Has anyone got a simple walkthrough for configuring clamd and getting it
> > working with systemd on F17?
> >
> > I am getting lost in the myriad of <SERVICE> and PID (etc. etc.) things
> > I have to change and .conf files I have to edit and move...
> >
> > In particular, what am I supposed to do with
> > the /usr/lib/systemd/system/clamd@.service file?
> Not to touch ;-). Just run
> systemctl enable clamd.scan.service
> systemctl start clamd.scan.service
Hi - Thanks for that, but I'm afraid that was one of the very many
things I tried. It didn't work.
# systemctl enable clamd.scan.service
Failed to issue method call: No such file or directory
What tells it that it is a "scan" service? That bit of the puzzle seems
to be missing...
The main question is: what do you want to do? Just check files
on
disk or check them when they are uploaded on a webserver or check incoming
and outcoming mail? Then, do you want continous updates of virus database or
just update rpm packages?
You most probably need to install clamav (+its dependencies) and
clamav-update, maybe also clamav-scanner with clamav-scanner-systemd which
contains the .service file. But I am just guessing. There are 19 clamav
related packages.
--
--Zdenek Pytela, <pytela(a)phil.muni.cz>
11:38 a.m.
On Mon, 2012-09-17 at 11:04 +0200, Zdenek Pytela wrote:
Arthur Dent pise:
> Hello all,
>
> Has anyone got a simple walkthrough for configuring clamd and getting it
> working with systemd on F17?
>
> I am getting lost in the myriad of <SERVICE> and PID (etc. etc.) things
> I have to change and .conf files I have to edit and move...
>
> In particular, what am I supposed to do with
> the /usr/lib/systemd/system/clamd@.service file?
Not to touch ;-). Just run
systemctl enable clamd.scan.service
systemctl start clamd.scan.service
Hi - Thanks for that, but I'm afraid that was one of the very many
things I tried. It didn't work.
# systemctl enable clamd.scan.service
Failed to issue method call: No such file or directory
What tells it that it is a "scan" service? That bit of the puzzle seems
to be missing...
Any ideas?
Thanks again
Mark
8:58 a.m.
Arthur Dent pise:
I have done nothing, but install and configure clamav (scanner +
server)
and my logs are full of these:
=======================8<===============================================
LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory:
Permission denied
LibClamAV Warning: Bytecode: disabling JIT because SELinux is preventing
'execmem'
access.
Run 'setsebool -P clamd_use_jit on'.
=======================8<===============================================
I haven't had a chance to run the setsebool yet (I can't get access to the
machine from work at the moment)
Are there any other bools I should set while I'm at it?
semanage boolean
-l|grep clam
clamscan_read_user_content (off , off) Allow clamscan to read user content
clamscan_can_scan_system (off , off) Allow clamscan to non security files on a
system
clamd_use_jit (on , on) Allow clamd to use JIT compiler
but consult your clamd_selinux(8) man page first.
--
--Zdenek Pytela, <pytela(a)phil.muni.cz>
8:54 a.m.
>>>>
>> Is this the default setting for clamd now? clamd_use_jit on Should we
>> turn this on by default?
> On a fresh install there is
>
> # Bytecode mode # # This option has been set to 'ForceInterpreter' in
> Fedora due to # security concerns by default. You might need to enable
> the # 'clamd_use_jit' SELinux boolean after setting this option to the #
> more efficient 'ForceJIT' value. # # Default: ForceInterpreter
> #ByteCodeMode ForceInterpreter
>
> We didn't change this, but had to change clamd_use_jit --> on.
>
Then I would open a bug with clamd.
I have done nothing, but install and configure clamav (scanner + server)
and my logs are full of these:
=======================8<===============================================
LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory:
Permission denied
LibClamAV Warning: Bytecode: disabling JIT because SELinux is preventing
'execmem'
access.
Run 'setsebool -P clamd_use_jit on'.
=======================8<===============================================
I haven't had a chance to run the setsebool yet (I can't get access to the
machine from work at the moment)
Are there any other bools I should set while I'm at it?
Mark
8:43 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/20/2012 05:38 AM, Zdenek Pytela wrote:
Daniel J Walsh pise:
> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>
> On 09/19/2012 07:36 AM, Bill Shirley wrote:
>>
>> On 9/19/2012 5:47 AM, Arthur Dent wrote:
>>>> "What tells it that it is a "scan" service? That bit of
the puzzle
>>>> seems to be missing..."
>>>>
>>>> Whatever is the parameter after the @ and before the dot becomes
>>>> %i in the service file. Look at the service file: [Unit]
>>>> Description = clamd scanner (%i) daemon After = syslog.target
>>>> nss-lookup.target network.target
>>>>
>>>> [Service] Type = simple ExecStart = /usr/sbin/clamd -c
>>>> /etc/clamd.d/%i.conf --nofork=yes Restart = on-failure PrivateTmp
>>>> = true
>>>>
>>>> so clamd(a)scan.service invokes clamd with the scan.conf file as it's
>>>> configuration file. This way you can have multiple clamd services
>>>> each using a different config file. Just create another config
>>>> file in /etc/clamd.d/my_config.conf and: ln -s
>>>> /lib/systemd/system/clamd@.service
>>>> /etc/systemd/system/clamd(a)my_config.service
>>>>
>>>> You should have the /etc/clamd.d/scan.conf I think:
>>>>
>>>> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
>>>> clamav-scanner-0.97.5-1700.fc17.noarch
>>> Thank you Bill for a helpful and, more importantly, informative
>>> reply. I think this will not only help me to solve my problem but,
>>> even better, help me to understand where I was going wrong.
>>>
>>> As before, I don't have access to the machine right now, so i will
>>> try when I get home to work through this and get it right.
>>>
>>> I will once again report back later...
>>>
>>> Thanks again. Your help is much appreciated.
>>>
>>> Mark
>>>
>>>
>>
>> You mentioned scanning email. I run clamav-milter and stop the virus
>> at smtp time. You may find this helpful:
>>
>> [root@moses clamav]# rpm -qa | grep clam | sort
>> clamav-data-0.97.5-1700.fc17.noarch
>> clamav-filesystem-0.97.5-1700.fc17.noarch
>> clamav-lib-0.97.5-1700.fc17.x86_64
>> clamav-milter-0.97.5-1700.fc17.x86_64
>> clamav-milter-systemd-0.97.5-1700.fc17.noarch
>> clamav-scanner-0.97.5-1700.fc17.noarch
>> clamav-scanner-systemd-0.97.5-1700.fc17.noarch
>> clamav-server-0.97.5-1700.fc17.x86_64
>> clamav-server-systemd-0.97.5-1700.fc17.noarch
>> clamav-update-0.97.5-1700.fc17.x86_64
>>
>> For clamav-milter, I had to add clamilt to the postfix group (usermod
>> -a -G postfix clamilt): [root@moses clamav]# egrep 'post|clam'
>> /etc/group mail:x:12:postfix postfix:x:89:clamilt postdrop:x:90:
>> clamscan:x:987:clamilt clamilt:x:988:postfix clamupdate:x:989:
>>
>>
>> Add to the end of /etc/mail/clamav-milter.conf: # my stuff # be sure
>> to comment out above: Example
>>
>> ClamdSocket unix:/var/run/clamd.scan/clamd.sock
>> MilterSocket /var/run/clamav-milter/clamav-milter.socket
>> ##MilterSocket inet:3381 # usermod -a -G postfix clamilt
>> MilterSocketGroup postfix MilterSocketMode 660
>>
>> OnInfected Reject AddHeader Replace
>>
>> #LogFile /var/log/clamav-milter.log #LogFileMaxSize 1M
>> #LogTime yes LogSyslog yes LogFacility
>> LOG_MAIL #LogVerbose no LogClean Basic
>> LogInfected Full
>>
>> Add to postfix's main.cf: # usermod -a -G clamilt postfix smtpd_milters
>> = unix:/var/run/clamav-milter/clamav-milter.socket
>> #milter_default_action = accept milter_default_action = tempfail
>>
>> I can't remember if I had to create the directory, but here is that
>> info: [root@moses clamav]# ldpz
>> /var/run/clamav-milter/clamav-milter.socket drwxr-xr-x. root root
>> system_u:object_r:var_t:s0 /var lrwxrwxrwx. root root
>> system_u:object_r:var_run_t:s0 /var/run -> ../run drwx--x---. clamilt
>> clamilt system_u:object_r:clamd_var_run_t:s0 /var/run/clamav-milter
>> srw-rw----. clamilt postfix system_u:object_r:clamd_var_run_t:s0
>> /var/run/clamav-milter/clamav-milter.socket
>>
>>
>> For clamav, to avoid selinux problems issue command: setsebool -P
>> clamd_use_jit on
>>
>> Add to end of scan.conf: # my stuff # be sure to commend out above:
>> Example
>>
>> #LogFile /var/log/clamav/clamd.scan #LogFacility
>> LOG_MAIL LogFacility LOG_DAEMON ExtendedDetectionInfo yes
>> LocalSocket /var/run/clamd.scan/clamd.sock
>> #LocalSocketGroup virusgroup #LocalSocketMode 660 FixStaleSocket
>> yes CrossFilesystems no ExcludePath ^/proc/
>> ExcludePath ^/sys/ ExcludePath ^/fuse/ ExcludePath
>> ^/backup/ ExcludePath ^/bacula/ SelfCheck
>> 3600
>>
>>
>> And finally freshclam, add to the end of freshclam.conf: # my stuff
>> LogFacility LOG_DAEMON DatabaseMirror db.US.clamav.net TestDatabases
>> yes
>>
>>
>> Note in all the clamav configuration file there is a line: Example that
>> has to be commented out for the service to run.
>>
>> Don't forget to systemctl enable these to services: [root@moses
>> clamav]# systemctl is-active clamav-milter.service active [root@moses
>> clamav]# systemctl is-active clamd(a)scan.service active
>>
>> Hope this helps, Bill
>>
>>
>>
> Is this the default setting for clamd now? clamd_use_jit on Should we
> turn this on by default?
On a fresh install there is
# Bytecode mode # # This option has been set to 'ForceInterpreter' in
Fedora due to # security concerns by default. You might need to enable
the # 'clamd_use_jit' SELinux boolean after setting this option to the #
more efficient 'ForceJIT' value. # # Default: ForceInterpreter
#ByteCodeMode ForceInterpreter
We didn't change this, but had to change clamd_use_jit --> on.
Then I would open a bug with clamd.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBcbuYACgkQrlYvE4MpobPwDQCfToC2oaJq+AkeqdoD2J9rPNus
uqcAoKQU6AAhhpUGqe+6LhSXPklNYgiS
=I0DO
-----END PGP SIGNATURE-----
4:23 a.m.
>
> On 9/19/2012 5:54 PM, Arthur Dent wrote:
[snip]
Thanks for jogging my memory. It will work of course, but it still
feels a
bit of a kludge. Zdenek Pytela has pointed out that it does indeed seem to
be hardcoded so I think I might report it as a bug.
https://bugzilla.redhat.com/show_bug.cgi?id=859339
4:38 a.m.
Daniel J Walsh pise:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/19/2012 07:36 AM, Bill Shirley wrote:
>
> On 9/19/2012 5:47 AM, Arthur Dent wrote:
>>> "What tells it that it is a "scan" service? That bit of the
puzzle
>>> seems to be missing..."
>>>
>>> Whatever is the parameter after the @ and before the dot becomes %i
>>> in the service file. Look at the service file: [Unit] Description =
>>> clamd scanner (%i) daemon After = syslog.target nss-lookup.target
>>> network.target
>>>
>>> [Service] Type = simple ExecStart = /usr/sbin/clamd -c
>>> /etc/clamd.d/%i.conf --nofork=yes Restart = on-failure PrivateTmp =
>>> true
>>>
>>> so clamd(a)scan.service invokes clamd with the scan.conf file as it's
>>> configuration file. This way you can have multiple clamd services each
>>> using a different config file. Just create another config file in
>>> /etc/clamd.d/my_config.conf and: ln -s
>>> /lib/systemd/system/clamd@.service
>>> /etc/systemd/system/clamd(a)my_config.service
>>>
>>> You should have the /etc/clamd.d/scan.conf I think:
>>>
>>> [root@moses shorewall]# rpm -qf /etc/clamd.d/scan.conf
>>> clamav-scanner-0.97.5-1700.fc17.noarch
>> Thank you Bill for a helpful and, more importantly, informative reply. I
>> think this will not only help me to solve my problem but, even better,
>> help me to understand where I was going wrong.
>>
>> As before, I don't have access to the machine right now, so i will try
>> when I get home to work through this and get it right.
>>
>> I will once again report back later...
>>
>> Thanks again. Your help is much appreciated.
>>
>> Mark
>>
>>
>
> You mentioned scanning email. I run clamav-milter and stop the virus at
> smtp time. You may find this helpful:
>
> [root@moses clamav]# rpm -qa | grep clam | sort
> clamav-data-0.97.5-1700.fc17.noarch
> clamav-filesystem-0.97.5-1700.fc17.noarch
> clamav-lib-0.97.5-1700.fc17.x86_64 clamav-milter-0.97.5-1700.fc17.x86_64
> clamav-milter-systemd-0.97.5-1700.fc17.noarch
> clamav-scanner-0.97.5-1700.fc17.noarch
> clamav-scanner-systemd-0.97.5-1700.fc17.noarch
> clamav-server-0.97.5-1700.fc17.x86_64
> clamav-server-systemd-0.97.5-1700.fc17.noarch
> clamav-update-0.97.5-1700.fc17.x86_64
>
> For clamav-milter, I had to add clamilt to the postfix group (usermod -a
> -G postfix clamilt): [root@moses clamav]# egrep 'post|clam' /etc/group
> mail:x:12:postfix postfix:x:89:clamilt postdrop:x:90:
> clamscan:x:987:clamilt clamilt:x:988:postfix clamupdate:x:989:
>
>
> Add to the end of /etc/mail/clamav-milter.conf: # my stuff # be sure to
> comment out above: Example
>
> ClamdSocket unix:/var/run/clamd.scan/clamd.sock MilterSocket
> /var/run/clamav-milter/clamav-milter.socket ##MilterSocket
> inet:3381 # usermod -a -G postfix clamilt MilterSocketGroup postfix
> MilterSocketMode 660
>
> OnInfected Reject AddHeader Replace
>
> #LogFile /var/log/clamav-milter.log #LogFileMaxSize
> 1M #LogTime yes LogSyslog yes LogFacility
> LOG_MAIL #LogVerbose no LogClean Basic
> LogInfected Full
>
> Add to postfix's main.cf: # usermod -a -G clamilt postfix smtpd_milters =
> unix:/var/run/clamav-milter/clamav-milter.socket #milter_default_action =
> accept milter_default_action = tempfail
>
> I can't remember if I had to create the directory, but here is that info:
> [root@moses clamav]# ldpz /var/run/clamav-milter/clamav-milter.socket
> drwxr-xr-x. root root system_u:object_r:var_t:s0 /var
> lrwxrwxrwx. root root system_u:object_r:var_run_t:s0 /var/run ->
> ../run drwx--x---. clamilt clamilt system_u:object_r:clamd_var_run_t:s0
> /var/run/clamav-milter srw-rw----. clamilt postfix
> system_u:object_r:clamd_var_run_t:s0
> /var/run/clamav-milter/clamav-milter.socket
>
>
> For clamav, to avoid selinux problems issue command: setsebool -P
> clamd_use_jit on
>
> Add to end of scan.conf: # my stuff # be sure to commend out above:
> Example
>
> #LogFile /var/log/clamav/clamd.scan #LogFacility
> LOG_MAIL LogFacility LOG_DAEMON ExtendedDetectionInfo yes
> LocalSocket /var/run/clamd.scan/clamd.sock #LocalSocketGroup
> virusgroup #LocalSocketMode 660 FixStaleSocket yes
> CrossFilesystems no ExcludePath ^/proc/ ExcludePath
> ^/sys/ ExcludePath ^/fuse/ ExcludePath ^/backup/
> ExcludePath ^/bacula/ SelfCheck 3600
>
>
> And finally freshclam, add to the end of freshclam.conf: # my stuff
> LogFacility LOG_DAEMON DatabaseMirror db.US.clamav.net TestDatabases yes
>
>
> Note in all the clamav configuration file there is a line: Example that has
> to be commented out for the service to run.
>
> Don't forget to systemctl enable these to services: [root@moses clamav]#
> systemctl is-active clamav-milter.service active [root@moses clamav]#
> systemctl is-active clamd(a)scan.service active
>
> Hope this helps, Bill
>
>
>
Is this the default setting for clamd now? clamd_use_jit on Should we turn
this on by default?
On a fresh install there is
# Bytecode mode
#
# This option has been set to 'ForceInterpreter' in Fedora due to
# security concerns by default. You might need to enable the
# 'clamd_use_jit' SELinux boolean after setting this option to the
# more efficient 'ForceJIT' value.
#
# Default: ForceInterpreter
#ByteCodeMode ForceInterpreter
We didn't change this, but had to change clamd_use_jit --> on.
--
--Zdenek Pytela, <pytela(a)phil.muni.cz>
4:04 a.m.
Arthur Dent pise:
Hello all,
Has anyone got a simple walkthrough for configuring clamd and getting it
working with systemd on F17?
I am getting lost in the myriad of <SERVICE> and PID (etc. etc.) things
I have to change and .conf files I have to edit and move...
In particular, what am I supposed to do with
the /usr/lib/systemd/system/clamd@.service file?
Not to touch ;-). Just run
systemctl enable clamd.scan.service
systemctl start clamd.scan.service
On previous Fedora installs (pre F15) I used to use this excellent
script which took all the pain out of setup:
http://blog.christophersmart.com/2009/12/17/script-for-configuring-clamav...
if that's line-wrapped try this:
http://tinyurl.com/clamdscript
but I am not confident that this script will now properly configure
systemd now that I am rebuilding a F17 server.
Any hints, tips, guides, handholding, or smacks on the head gratefully
received...
The script should be adapted for 17 convention, but generally
it might (?) work. Commands like chkconfig are redirected, paths like
/var/run have apropriate links.
I have my clamav service working without any hacking but configuring
/etc/freshclam.conf and possibly (in one case) the /etc/clamd.d/* files.
--
--Zdenek Pytela, <pytela(a)phil.muni.cz>
4283
days inactive
4291
days old
28 comments
5 participants
participants (5)
-
Arthur Dent -
Bill Shirley -
Daniel J Walsh -
Frank Murphy -
Zdenek Pytela