topic AV for samba server in Operating System - Linux

AV for samba server

Maaz — Tue, 09 Sep 2008 07:18:13 GMT

from www.clamav.net

Clam AntiVirus ... designed especially for e-mail scanning

as I have a fileserver(samba), does clamav can also work(scan/kill viruses) on locally stored files/folder ? I mean is it just for mail gateways or its a general purpose AV ?

Re: AV for samba server

Ivan Krastev — Tue, 09 Sep 2008 07:54:15 GMT

See this page - http://www.openantivirus.org/projects.php

regards,
ivan

Re: AV for samba server

Heironimus — Tue, 09 Sep 2008 15:42:50 GMT

clamav can be a general-purpose scanner, but there is usually not much value in having a virus scanner on a UNIX system. I suppose you could use it to scan Samba shares.

Re: AV for samba server

Court Campbell — Tue, 09 Sep 2008 18:07:13 GMT

you can run clamav locally.

Re: AV for samba server

Maaz — Wed, 10 Sep 2008 06:50:39 GMT

Nice help ;)

I did the following:

# rpm -q samba-vscan
samba-vscan-0.3.6b-42.71

# rpm -q clamav
clamav-0.94-0.1
# rcclamd status
Checking for Clam AntiVirus daemon running

# cp /usr/share/doc/packages/samba-vscan/vscan-clamav.conf /etc/samba

append following in /etc/samba/smb.conf
# cat /etc/samba/smb.conf
[test]
path = /test
vfs object = vscan-oav
vscan-oav: config-file = /etc/samba/vscan-clamav.conf
writeable = yes
browseable = yes

is it enough/OK ? how can I know if the configuration is working ?

issue:
whenever I access /test directory from client machines, I got the following messages in /var/log/messages on samba server

Sep 10 12:55:11 nano smbd_vscan-oav[11527]: samba-vscan (vscan-oav 0.3.6c beta4) connected (Samba 3.0), (c) by Rainer Link, OpenAntiVirus.org
Sep 10 12:55:11 nano smbd_vscan-oav[11527]: INFO: connect to service test by user root

when I try to create a file from client machine(suse) using touch or vi, on samba server I got the following error in /var/log/messages

Sep 10 12:51:41 nano smbd_vscan-oav[11438]: ERROR: can not connect to ScannerDaemon (IP: '127.0.0.1', port: '8127')!

and when I try to read a file from client machine(suse), I got the permission denied error on client, while on samba server, I got the following in /var/log/messages

Sep 10 12:56:43 nano smbd_vscan-oav[11534]: ERROR: can not connect to ScannerDaemon (IP: '127.0.0.1', port: '8127')!
Sep 10 12:56:43 nano smbd_vscan-oav[11534]: ERROR: can not communicate to daemon - access denied

help

Re: AV for samba server

Maxim Revutskiy — Fri, 12 Sep 2008 07:30:25 GMT

Could you provide your /etc/samba/vscan-clamav.conf anf clamd.conf?

By the way, AFAIK oav module did not supported by latest samba releases. (And last update for oav at sourceforge Aug 24 2005)..

Try to look at dazuko kernel module. It allow on access scanning for most of antiviruses, and its rely on system, not only on samba. So will able to scan ftp, nfs, etc shares, not only smb. I successfully used it with Nod32, but ClamAV also support it (clamuko).

Best regards.

Re: AV for samba server

Gokul Chandola — Sat, 13 Sep 2008 02:51:48 GMT

Hi,
This is a General Purpos Antivirus also, and as you know this is designed especially for e-mail scanning.

Regards,
Gokul Chandola

Re: AV for samba server

Maaz — Sat, 13 Sep 2008 03:34:30 GMT

Hi thanks Maxim Revutskiy for support.
>Could you provide your /etc/samba/vscan-clamav.conf anf clamd.conf?

>Try to look at dazuko kernel module..but ClamAV also support it (clamuko).
thanks for nice suggestion, I'll check dazuko and clamuko

Regards