AV for samba server

[Maaz]

from www.clamav.net

Clam AntiVirus ... designed especially for e-mail scanning

as I have a fileserver(samba), does clamav can also work(scan/kill viruses) on locally stored files/folder ? I mean is it just for mail gateways or its a general purpose AV ?

[Ivan Krastev]

See this page - http://www.openantivirus.org/projects.php

regards,
ivan

[Heironimus]

clamav can be a general-purpose scanner, but there is usually not much value in having a virus scanner on a UNIX system. I suppose you could use it to scan Samba shares.

[Court Campbell]

you can run clamav locally.

[Maaz]

Nice help ;)

I did the following:

# rpm -q samba-vscan
samba-vscan-0.3.6b-42.71

# rpm -q clamav
clamav-0.94-0.1
# rcclamd status
Checking for Clam AntiVirus daemon running

# cp /usr/share/doc/packages/samba-vscan/vscan-clamav.conf /etc/samba

append following in /etc/samba/smb.conf
# cat /etc/samba/smb.conf
[test]
path = /test
vfs object = vscan-oav
vscan-oav: config-file = /etc/samba/vscan-clamav.conf
writeable = yes
browseable = yes

is it enough/OK ? how can I know if the configuration is working ?

issue:
whenever I access /test directory from client machines, I got the following messages in /var/log/messages on samba server

Sep 10 12:55:11 nano smbd_vscan-oav[11527]: samba-vscan (vscan-oav 0.3.6c beta4) connected (Samba 3.0), (c) by Rainer Link, OpenAntiVirus.org
Sep 10 12:55:11 nano smbd_vscan-oav[11527]: INFO: connect to service test by user root

when I try to create a file from client machine(suse) using touch or vi, on samba server I got the following error in /var/log/messages

Sep 10 12:51:41 nano smbd_vscan-oav[11438]: ERROR: can not connect to ScannerDaemon (IP: '127.0.0.1', port: '8127')!

and when I try to read a file from client machine(suse), I got the permission denied error on client, while on samba server, I got the following in /var/log/messages

Sep 10 12:56:43 nano smbd_vscan-oav[11534]: ERROR: can not connect to ScannerDaemon (IP: '127.0.0.1', port: '8127')!
Sep 10 12:56:43 nano smbd_vscan-oav[11534]: ERROR: can not communicate to daemon - access denied

help

[Maxim Revutskiy]

Could you provide your /etc/samba/vscan-clamav.conf anf clamd.conf?

By the way, AFAIK oav module did not supported by latest samba releases. (And last update for oav at sourceforge Aug 24 2005)..

Try to look at dazuko kernel module. It allow on access scanning for most of antiviruses, and its rely on system, not only on samba. So will able to scan ftp, nfs, etc shares, not only smb. I successfully used it with Nod32, but ClamAV also support it (clamuko).

Best regards.

[Gokul Chandola]

Hi,
This is a General Purpos Antivirus also, and as you know this is designed especially for e-mail scanning.

Regards,
Gokul Chandola

[Maaz]

Hi thanks Maxim Revutskiy for support.
>Could you provide your /etc/samba/vscan-clamav.conf anf clamd.conf?

>Try to look at dazuko kernel module..but ClamAV also support it (clamuko).
thanks for nice suggestion, I'll check dazuko and clamuko

Regards