Topic: [SOLVED][ClamAV] suppress checking ibay?

[piran]

How may I suppress ClamAV's checking of a particular ibay?
For instance would one of the templates
/etc/e-smith/templates/etc/clamd.conf/
achieve this suppression or must I use a new specific template?

[postedit] Summary http://forums.contribs.org/index.php?topic=34047.msg146180#msg146180

[Gaston94]

Hi,
Clamav scan is led by some configuration options, have a look at this

Code: [Select]

[root@sme94 ~]# /sbin/e-smith/db configuration getprop clamav FilesystemScanExclude
/proc,/sys,/usr/share,/var
so you can add any other paths :

Code: [Select]


[root@sme94 ~]# db configuration setprop clamav FilesystemScanExclude \
/proc,/sys,/usr/share,/var, \
/home/e-smith/files/ibays/iso, \
/home/e-smith/files/ibays/archive

for instance will prevent these ibays to be scanned

G.

[piran]

My thanks, otherwise it takes more than 5 days work from one CPU...;~)

[william_syd]

Is there someway this can be used to exclude every users junkmail folder ?

[piran]

Not solved after all;~/

Just missed the midnight check so I implemented a ClamAV run manually.

Code: [Select]

[root@teri /]# clamscan -r /home --quiet
ClamAV was still running in the morning (should take about 10mins?).

Code: [Select]

[root@teri /]# db configuration getprop clamav FilesystemScanExclude
/proc,/sys,/usr/share,/var,/mnt,/home/e-smith/files/ibays
As the suppress checking of ibays apparently didn't work, cannot guarantee
the suppress checking of /mnt is working either (messes up backups).

Is the manual implementation of ClamAV different from what runs normally?

In case this is needed...

Code: [Select]

[root@teri /]# config show clamav
clamav=service
    ArchiveBlockEncrypted=no
    ArchiveBlockMax=no
    ArchiveMaxCompressionRatio=300
    ArchiveMaxFileSize=15M
    ArchiveMaxFiles=1500
    ArchiveMaxRecursion=8
    Checks=24
    DNSDatabaseInfo=current.cvd.clamav.net
    DatabaseMirror=db.local.clamav.net
    Debug=no
    DetectBrokenExecutables=no
    FilesystemScan=daily
    FilesystemScanExclude=/proc,/sys,/usr/share,/var,/mnt,/home/e-smith/files/ibays
    FilesystemScanFilesystems=/
    FilesystemScanReportTo=admin
    Foreground=yes
    HTTPProxyPassword=
    HTTPProxyPort=
    HTTPProxyServer=
    HTTPProxyUsername=
    IdleTimeout=60
    LeaveTemporaryFiles=no
    LogClean=no
    LogFileUnlock=yes
    LogTime=no
    LogVerbose=yes
    MaxAttempts=6
    MaxConnectionQueueLength=30
    MaxDirectoryRecursion=20
    MaxThreads=20
    Quarantine=disabled
    QuarantineDirectory=/var/spool/clamav/quarantine
    ReadTimeout=300
    ScanArchive=yes
    ScanHTML=yes
    ScanMail=yes
    ScanOLE2=yes
    ScanPE=yes
    ScanRAR=no
    SelfCheck=1800
    ShowProxySettings=no
    ShowUpdateSettings=no
    SignaturesUpdated=unknown
    UpdateNonOfficeHrs=disabled
    UpdateOfficeHrs=disabled
    UpdateWeekend=disabled
    status=enabled
[root@teri /]#


[william_syd]

Did you expand the template after changing the database?

Code: [Select]

/sbin/e-smith/expand-template /etc/clamd.conf

The contents of /etc/clamd.conf will give you a better idea of what clamd will be doing than the db values.

Code: [Select]

[root@tiger ~]# more /etc/clamd.conf
#------------------------------------------------------------
#              !!DO NOT MODIFY THIS FILE!!
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at http://wiki.contribs.org/development/
#
# Copyright (C) 1999-2006 Mitel Networks Corporation
#------------------------------------------------------------
#ArchiveBlockEncrypted
#ArchiveBlockMax
ArchiveMaxCompressionRatio 300
ArchiveMaxFileSize 15M
ArchiveMaxFiles 1500
ArchiveMaxRecursion 8
DatabaseDirectory /var/clamav
#Debug
#DetectBrokenExecutables
FixStaleSocket
Foreground
IdleTimeout 60
#LeaveTemporaryFiles
LocalSocket /var/clamav/clamd.socket
#LogClean
LogFile /dev/stderr
LogFileMaxSize 0
LogFileUnlock
#LogTime
LogVerbose
MaxConnectionQueueLength 30
MaxDirectoryRecursion 20
MaxThreads 20
ReadTimeout 300
ScanArchive
ScanHTML

#ScanMail

ScanOLE2
ScanPE
#ScanRAR

SelfCheck 1800
# Close the connection if this limit is exceeded.
StreamMaxLength 25M
#TCPAddr 127.0.0.1
#TCPSocket 3310
TemporaryDirectory /var/tmp
User clamav
AllowSupplementaryGroups
[root@tiger ~]#


[piran]

No, I ran this afterwards...

Code: [Select]

signal-event clamav-update
...but it was really only a guess,
I thought this command was the 'new expand'.
Will try over again.

[piran]

I cannot see any suppress directory information in

Code: [Select]

/etc/clamd.conf
whether this is before or after running either

Code: [Select]

signal-event clamav-update

Code: [Select]

/sbin/e-smith/expand-template /etc/clamd.conf
The db get command shows my suppress directory information:

Code: [Select]

[root@teri etc]# db configuration getprop clamav FilesystemScanExclude
/proc,/sys,/usr/share,/var,/mnt,/home/e-smith/files/ibays
[root@teri etc]#
Unfortunately ClamAV doesn't take a blind bit of notice, running

Code: [Select]

clamscan -r /home
and viewing the checking live I see ClamAV running through the ibays;~/

[william_syd]

Hi,
Clamav scan is led by some configuration options, have a look at this

Code: [Select]

[root@sme94 ~]# /sbin/e-smith/db configuration getprop clamav FilesystemScanExclude
/proc,/sys,/usr/share,/var
so you can add any other paths :

Code: [Select]


[root@sme94 ~]# db configuration setprop clamav FilesystemScanExclude \
/proc,/sys,/usr/share,/var, \
/home/e-smith/files/ibays/iso, \
/home/e-smith/files/ibays/archive

for instance will prevent these ibays to be scanned

G.

Which template fragment uses the property FilesystemScanExclude?

[Gaston94]

well, William,

Which template fragment uses the property FilesystemScanExclude?

You are definitely right
It does not look like corresponding to any thing. Butwhy is it in the db config parameters

From clamd.conf I retrieve the "ClamukoExcludePath" directive which should be the correct one.

@piran,
could you check the below commands and advice ?

Code: [Select]

# mkdir -p /etc/e-smith/templates-custom/etc/clamd.conf
# cat > /etc/e-smith/templates/etc/clamd.conf/ClamukoExcludePath
{
# Set the exclude paths. All subdirectories are also excluded.
    "ClamukoExcludePath /home/e-smith/files/ibays";
}
^D ## this is a Control-D keystroke
# /sbin/e-smith/expand-template /etc/clamd.conf
# /sbin/e-smith/signal-event clamav-update

(check after pasting that you have no control characters in the file ...)

G.[/code]

[Gaston94]

double post

[piran]

Scratching head;~)
Followed instructions (I think).
There is nothing in the mkdir file area.
But the contents of /etc/e-smith/templates/etc/clamd.conf/ClamukoExcludePath
consist only of...
{
# Set the exclude paths. All subdirectories are also excluded.
    "ClamukoExcludePath /home/e-smith/files/ibays";
}
...and nothing else.
Template expanded.
Signal evented.
Manual run of ClamAV still goes through the ibays.

[william_syd]

From clamd.conf I retrieve the "ClamukoExcludePath" directive which should be the correct one.

@piran,
could you check the below commands and advice ?

Code: [Select]

# mkdir -p /etc/e-smith/templates-custom/etc/clamd.conf
# cat > /etc/e-smith/templates/etc/clamd.conf/ClamukoExcludePath
{
# Set the exclude paths. All subdirectories are also excluded.
    "ClamukoExcludePath /home/e-smith/files/ibays";
}
^D ## this is a Control-D keystroke
# /sbin/e-smith/expand-template /etc/clamd.conf
# /sbin/e-smith/signal-event clamav-update

(check after pasting that you have no control characters in the file ...)

G.[/code]

Clamuko..  Hmm. Appears to be some sort of 'on access' scanning... not a scheduled file system scan.

I could be wrong.

[piran]

Code: [Select]




[root@teri etc]# config show clamav
clamav=service
    ArchiveBlockEncrypted=no
    ArchiveBlockMax=no
    ArchiveMaxCompressionRatio=300
    ArchiveMaxFileSize=15M
    ArchiveMaxFiles=1500
    ArchiveMaxRecursion=8
    Checks=24
    DNSDatabaseInfo=current.cvd.clamav.net
    DatabaseMirror=db.local.clamav.net
    Debug=no
    DetectBrokenExecutables=no
    FilesystemScan=daily
    FilesystemScanExclude=/proc,/sys,/usr/share,/var,/mnt,/home/e-smith/files/ibays
    FilesystemScanFilesystems=/
    FilesystemScanReportTo=admin
    Foreground=yes
    HTTPProxyPassword=
    HTTPProxyPort=
    HTTPProxyServer=
    HTTPProxyUsername=
    IdleTimeout=60
    LeaveTemporaryFiles=no
    LogClean=no
    LogFileUnlock=yes
    LogTime=no
    LogVerbose=yes
    MaxAttempts=6
    MaxConnectionQueueLength=30
    MaxDirectoryRecursion=20
    MaxThreads=20
    Quarantine=disabled
    QuarantineDirectory=/var/spool/clamav/quarantine
    ReadTimeout=300
    ScanArchive=yes
    ScanHTML=yes
    ScanMail=yes
    ScanOLE2=yes
    ScanPE=yes
    ScanRAR=no
    SelfCheck=1800
    ShowProxySettings=no
    ShowUpdateSettings=no
    SignaturesUpdated=unknown
    UpdateNonOfficeHrs=disabled
    UpdateOfficeHrs=disabled
    UpdateWeekend=disabled
    status=enabled
[root@teri etc]# pico clamd.conf
[root@teri etc]#

#------------------------------------------------------------
#              !!DO NOT MODIFY THIS FILE!!
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at http://wiki.contribs.org/development/
#
# Copyright (C) 1999-2006 Mitel Networks Corporation
#------------------------------------------------------------
#ArchiveBlockEncrypted
#ArchiveBlockMax
ArchiveMaxCompressionRatio 300
ArchiveMaxFileSize 15M
ArchiveMaxFiles 1500
ArchiveMaxRecursion 8
ClamukoExcludePath /home/e-smith/files/ibays
DatabaseDirectory /var/clamav
#Debug
#DetectBrokenExecutables
FixStaleSocket
Foreground
IdleTimeout 60
#LeaveTemporaryFiles
LocalSocket /var/clamav/clamd.socket
#LogClean
LogFile /dev/stderr
LogFileMaxSize 0
LogFileUnlock
#LogTime
LogVerbose
MaxConnectionQueueLength 30
MaxDirectoryRecursion 20
MaxThreads 20
ReadTimeout 300
ScanArchive
ScanHTML

ScanMail

ScanOLE2
ScanPE
#ScanRAR

SelfCheck 1800
# Close the connection if this limit is exceeded.
StreamMaxLength 25M
#TCPAddr 127.0.0.1
#TCPSocket 3310
TemporaryDirectory /var/tmp
User clamav
AllowSupplementaryGroups


[piran]

The two reporting areas seem different.
ie one comments out scans of RAR (#ScanRAR)
the other ScanRAR=no
but last night I saw some warning text about
RAR checking (something about levels or versions).
Config areas not matched or synchronised?