Can't install DansGuardian Antivirus plugin

Issues related to software problems.
Strato
Posts: 22
Joined: 2008/01/20 17:57:01

Re: Can't install DansGuardian Antivirus plugin

Post by Strato » 2008/05/28 11:19:53

I don't get it...

I started from scratch, just installed the rpmforge.rpm and did yum install clamd, and clamd still refuses to start, with the same error message : "can't open directory /var/clamav" (which exists nevertheless!).

Can it be problems of users? I'm doing all this as root...

NedSlider
Forum Moderator
Posts: 2897
Joined: 2005/10/28 13:11:50
Location: UK

Re: Can't install DansGuardian Antivirus plugin

Post by NedSlider » 2008/05/28 11:23:36

[quote]
Strato wrote:
I don't get it...

I started from scratch, just installed the rpmforge.rpm and did yum install clamd, and clamd still refuses to start, with the same error message : "can't open directory /var/clamav" (which exists nevertheless!).

Can it be problems of users? I'm doing all this as root...[/quote]

Start by posting your clamd.conf

What user is clamd running under, and does that user have the appropriate permissions? If you installed from RPMForge then clamd normally runs under the uid/gid of clamav.

Strato
Posts: 22
Joined: 2008/01/20 17:57:01

Re: Can't install DansGuardian Antivirus plugin

Post by Strato » 2008/05/28 11:38:39

[quote]
NedSlider wrote:

Start by posting your clamd.conf[/quote]
I didn't touch it...

##
## Example config file for the Clam AV daemon
## Please read the clamd.conf(5) manual before editing this file.
##


# Comment or remove the line below.
#Example

# Uncomment this option to enable logging.
# LogFile must be writable for the user running daemon.
# A full path is required.
# Default: disabled
LogFile /var/log/clamav/clamd.log

# By default the log file is locked for writing - the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run
# the daemon with --config-file option).
# This option disables log file locking.
# Default: no
#LogFileUnlock yes

# Maximum size of the log file.
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 1M
LogFileMaxSize 0

# Log time with each message.
# Default: no
LogTime yes

# Also log clean files. Useful in debugging but drastically increases the
# log size.
# Default: no
#LogClean yes

# Use system logger (can work together with LogFile).
# Default: no
LogSyslog yes

# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
# Default: LOG_LOCAL6
#LogFacility LOG_MAIL

# Enable verbose logging.
# Default: no
#LogVerbose yes

# This option allows you to save a process identifier of the listening
# daemon (main thread).
# Default: disabled
PidFile /var/run/clamav/clamd.pid

# Optional path to the global temporary directory.
# Default: system specific (usually /tmp or /var/tmp).
TemporaryDirectory /var/tmp

# Path to the database directory.
# Default: hardcoded (depends on installation options)
DatabaseDirectory /var/clamav

# The daemon works in a local OR a network mode. Due to security reasons we
# recommend the local mode.

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
LocalSocket /tmp/clamd.socket

# Remove stale socket after unclean shutdown.
# Default: yes
FixStaleSocket yes

# TCP port address.
# Default: no
TCPSocket 3310

# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
# Default: no
TCPAddr 127.0.0.1

# Maximum length the queue of pending connections may grow to.
# Default: 15
MaxConnectionQueueLength 30

# Clamd uses FTP-like protocol to receive data from remote clients.
# If you are using clamav-milter to balance load between remote clamd daemons
# on firewall servers you may need to tune the options below.

# Close the connection when the data size limit is exceeded.
# The value should match your MTA's limit for a maximum attachment size.
# Default: 10M
#StreamMaxLength 20M

# Limit port range.
# Default: 1024
#StreamMinPort 30000
# Default: 2048
#StreamMaxPort 32000

# Maximum number of threads running at the same time.
# Default: 10
MaxThreads 50

# Waiting for data from a client socket will timeout after this time (seconds).
# Value of 0 disables the timeout.
# Default: 120
ReadTimeout 300

# Waiting for a new job will timeout after this time (seconds).
# Default: 30
#IdleTimeout 60

# Maximum depth directories are scanned at.
# Default: 15
#MaxDirectoryRecursion 20

# Follow directory symlinks.
# Default: no
#FollowDirectorySymlinks yes

# Follow regular file symlinks.
# Default: no
#FollowFileSymlinks yes

# Perform a database check.
# Default: 1800 (30 min)
#SelfCheck 600

# Execute a command when virus is found. In the command string %v will
# be replaced with the virus name.
# Default: no
#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"

# Run as another user (clamd must be started by root for this option to work)
# Default: don't drop privileges
User clamav

# Initialize supplementary group access (clamd must be started by root).
# Default: no
AllowSupplementaryGroups yes

# Stop daemon when libclamav reports out of memory condition.
#ExitOnOOM yes

# Don't fork into background.
# Default: no
#Foreground yes

# Enable debug messages in libclamav.
# Default: no
#Debug yes

# Do not remove temporary files (for debug purposes).
# Default: no
#LeaveTemporaryFiles yes

# Detect Possibly Unwanted Applications.
# Default: no
#DetectPUA yes

# In some cases (eg. complex malware, exploits in graphic files, and others),
# ClamAV uses special algorithms to provide accurate detection. This option
# controls the algorithmic detection.
# Default: yes
#AlgorithmicDetection yes


##
## Executable files
##

# PE stands for Portable Executable - it's an executable file format used
# in all 32 and 64-bit versions of Windows operating systems. This option allows
# ClamAV to perform a deeper analysis of executable files and it's also
# required for decompression of popular executable packers such as UPX, FSG,
# and Petite.
# Default: yes
ScanPE yes

# Executable and Linking Format is a standard format for UN*X executables.
# This option allows you to control the scanning of ELF files.
# Default: yes
ScanELF yes

# With this option clamav will try to detect broken executables (both PE and
# ELF) and mark them as Broken.Executable.
# Default: no
DetectBrokenExecutables yes


##
## Documents
##

# This option enables scanning of OLE2 files, such as Microsoft Office
# documents and .msi files.
# Default: yes
ScanOLE2 yes

# This option enables scanning within PDF files.
# Default: no
#ScanPDF yes


##
## Mail files
##

# Enable internal e-mail scanner.
# Default: yes
ScanMail yes

# If an email contains URLs ClamAV can download and scan them.
# WARNING: This option may open your system to a DoS attack.
# Never use it on loaded servers.
# Default: no
#MailFollowURLs no

# With this option enabled ClamAV will try to detect phishing attempts by using
# signatures.
# Default: yes
#PhishingSignatures yes

# Scan URLs found in mails for phishing attempts using heuristics.
# Default: yes
#PhishingScanURLs yes

# Always block SSL mismatches in URLs, even if the URL isn't in the database.
# This can lead to false positives.
#
# Default: no
#PhishingAlwaysBlockSSLMismatch no

# Always block cloaked URLs, even if URL isn't in database.
# This can lead to false positives.
#
# Default: no
#PhishingAlwaysBlockCloak no


##
## HTML
##

# Perform HTML normalisation and decryption of MS Script Encoder code.
# Default: yes
#ScanHTML yes


##
## Archives
##

# ClamAV can scan within archives and compressed files.
# Default: yes
ScanArchive yes

# Use slower but memory efficient decompression algorithm.
# only affects the bzip2 decompressor.
# Default: no
#ArchiveLimitMemoryUsage yes

# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
# Default: no
ArchiveBlockEncrypted no


##
## Limits
##

# The options below protect your system against Denial of Service attacks
# using archive bombs.

# This option sets the maximum amount of data to be scanned for each input file.
# Archives and other containers are recursively extracted and scanned up to this
# value.
# Value of 0 disables the limit
# Note: disabling this limit or setting it too high may result in severe damage
# to the system.
# Default: 100M
#MaxScanSize 150M

# Files larger than this limit won't be scanned. Affects the input file itself
# as well as files contained inside it (when the input file is an archive, a
# document or some other kind of container).
# Value of 0 disables the limit.
# Note: disabling this limit or setting it too high may result in severe damage
# to the system.
# Default: 25M
#MaxFileSize 30M

# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
# file, all files within it will also be scanned. This options specifies how
# deeply the process should be continued.
# Note: disabling this limit or setting it too high may result in severe damage
# to the system.
# Value of 0 disables the limit.
# Default: 16
#MaxRecursion 10

# Number of files to be scanned within an archive, a document, or any other
# container file.
# Value of 0 disables the limit.
# Note: disabling this limit or setting it too high may result in severe damage
# to the system.
# Default: 10000
#MaxFiles 15000


##
## Clamuko settings
## WARNING: This is experimental software. It is very likely it will hang
## up your system!!!
##

# Enable Clamuko. Dazuko (/dev/dazuko) must be configured and running.
# Default: no
#ClamukoScanOnAccess yes

# Set access mask for Clamuko.
# Default: no
#ClamukoScanOnOpen yes
#ClamukoScanOnClose yes
#ClamukoScanOnExec yes

# Set the include paths (all files inside them will be scanned). You can have
# multiple ClamukoIncludePath directives but each directory must be added
# in a seperate line.
# Default: disabled
#ClamukoIncludePath /home
#ClamukoIncludePath /students

# Set the exclude paths. All subdirectories are also excluded.
# Default: disabled
#ClamukoExcludePath /home/bofh

# Don't scan files larger than ClamukoMaxFileSize
# Value of 0 disables the limit.
# Default: 5M
#ClamukoMaxFileSize 10M

[quote]
NedSlider wrote:
What user is clamd running under, and does that user have the appropriate permissions? If you installed from RPMForge then clamd normally runs under the uid/gid of clamav.[/quote]
I have no idea how to find out which user clamd should run under... Sorry.

NedSlider
Forum Moderator
Posts: 2897
Joined: 2005/10/28 13:11:50
Location: UK

Re: Can't install DansGuardian Antivirus plugin

Post by NedSlider » 2008/05/28 12:18:29

[quote]
Strato wrote:

[quote]
NedSlider wrote:
What user is clamd running under, and does that user have the appropriate permissions? If you installed from RPMForge then clamd normally runs under the uid/gid of clamav.[/quote]
I have no idea how to find out which user clamd should run under... Sorry.[/quote]

Try this:

[code]cat /etc/passwd | grep clam[/code]

Also, are you connecting to clam on a UNIX socket or TCP port, as you appear to have both configured in your clamd.conf file which can sometimes cause problems.

Strato
Posts: 22
Joined: 2008/01/20 17:57:01

Re: Can't install DansGuardian Antivirus plugin

Post by Strato » 2008/05/28 12:24:27

[quote]
NedSlider wrote:

Try this:

[code]cat /etc/passwd | grep clam[/code][/quote]
clamav:x:100:101:Calm Anti Virus Checker:/var/clamav:/sbin/nologin[/quote]

[quote]
NedSlider wrote:

Also, are you connecting to clam on a UNIX socket or TCP port, as you appear to have both configured in your clamd.conf file which can sometimes cause problems.[/quote]
I don't know. All I'm doing is "yum -y install clamd" and then "service clamd start", and I have this error message I gave previously...

NedSlider
Forum Moderator
Posts: 2897
Joined: 2005/10/28 13:11:50
Location: UK

Re: Can't install DansGuardian Antivirus plugin

Post by NedSlider » 2008/05/28 13:24:04

[quote]
Strato wrote:
[quote]
NedSlider wrote:

Try this:

[code]cat /etc/passwd | grep clam[/code][/quote]
clamav:x:100:101:Calm Anti Virus Checker:/var/clamav:/sbin/nologin[/quote]
[/quote]

OK, so now check the permissions on /var/clamav and check the user clamav has the appropriate rights to that directory.

[quote]
Strato wrote:
[quote]
NedSlider wrote:

Also, are you connecting to clam on a UNIX socket or TCP port, as you appear to have both configured in your clamd.conf file which can sometimes cause problems.[/quote]
I don't know. All I'm doing is "yum -y install clamd" and then "service clamd start", and I have this error message I gave previously...[/quote]

Well, what process is binding or trying to bind to clam? Look at how that process or service is configured and configure clam accordingly. The clamav user may also need to be a member of that process' user group. Sorry, I'm not familiar with dansguardian so you're going to need to provide some information and troubleshooting to get it working.

Strato
Posts: 22
Joined: 2008/01/20 17:57:01

Re: Can't install DansGuardian Antivirus plugin

Post by Strato » 2008/05/28 14:46:39

[quote]
NedSlider wrote:

OK, so now check the permissions on /var/clamav and check the user clamav has the appropriate rights to that directory.[/quote]
My teacher told me to try "chmod 777 /var", but it doesn't change anything.

I tried (again) to start from scratch. From a virgin CentOS distribution with just the VMware Tools installed (because, yes, it's a virtual machine), I do the following :
- cd /var/usr
- wget http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
- rpm -Uvh rpmforge-release-0.3.6-1.el5.rf.i386.rpm
- yum -y install clamd
- chkconfig clamd on
- service clamd start

And, again, same error message...

I guess there's a lot of super CentOS experts here, so does anyone can tell me the [u]exact[/u] procedure to make clamd work?

gerald_clark
Posts: 10642
Joined: 2005/08/05 15:19:54
Location: Northern Illinois, USA

Re: Can't install DansGuardian Antivirus plugin

Post by gerald_clark » 2008/05/28 17:34:33

Do you have selinux enabled?
Since this was CentOS 4 source recompiled for CentOS 5,
perhaps the selinux configuration needs to be changed.

Strato
Posts: 22
Joined: 2008/01/20 17:57:01

Re: Can't install DansGuardian Antivirus plugin

Post by Strato » 2008/05/28 17:59:28

[quote]
gerald_clark wrote:
Do you have selinux enabled?
Since this was CentOS 4 source recompiled for CentOS 5,
perhaps the selinux configuration needs to be changed.[/quote]
No it's not enabled. But anyway the recompiled Dansguardian-Antivirus can't work as long as clamd refuses to start...

Strato
Posts: 22
Joined: 2008/01/20 17:57:01

Re: Can't install DansGuardian Antivirus plugin

Post by Strato » 2008/05/28 19:03:10

Sorry I talked too fast. I honestly a thing such as SELinux would have been disabled by default, but it is activated actually.

So, I disabled it, and... clamd still refuses to start, but for a new reason!

"ERROR: TCP: bind() error: Address already in use"

What does that means? I tried to stop iptables but it didn't improved.

Post Reply