[clamav-users] Using clamd across containers

[Paul Kosinski]

I couldn't find anything in some quick Google searches about this, and I
don't remember seeing anything relevant on this list, so I will ask:

Currently I avoid clamscan startup delay on ad-hoc scans by using a
small Perl script to expand the name(s) of the file(s) or directory(s)
to be scanned and then use clamdscan to pass file descriptor(s) to a
running (on its own userid) clamd. Could this be made to work if clamd
were running in a different Linux container?
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[G.W. Haywood]

Hi there,

... Could this be made to work if clamd were running in a different
Linux container?

Yes.

man clamd.conf

Look for 'TCPSocket'.

[G.W. Haywood]

Hi there,

I finally got Postfix, Amavisd, Spamassassin and Clamd working together

:)

[...snip...] I surmise from this that while I had clamd running
without error, it was apparently starting up with defaults and not
using my config file.

I didn't see a question in all that, but I wonder if you're trying to
use a volatile filesystem (/tmp to hold sockets) before the OS startup
scripts have created it.

I assume you're restarting daemons after changing their configuration
files, many won't reread them without being restarted or e.g. sigHUPed.

[Paul Kosinski]

Yes, thanks, but I'm already using TCPSocket for this purpose -- without
Containers.

My question is whether a file descriptor passed via a socket is valid
in a different container than where it was created. I can easily see the
kernel rejecting it as a security violation, maybe unless some option
is set for the Container(s), or on the FD itself. Even clamd(scan) might
have a problem, I suppose, if the FD mechanism wasn't designed with
Containers in mind.


On Sat, 23 Jul 2016 18:20:15 +0100 (BST)

Post by G.W. Haywood
Hi there,

... Could this be made to work if clamd were running in a different
Linux container?

Yes.
man clamd.conf
Look for 'TCPSocket'.

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Scott Horton]

Post by G.W. Haywood

[...snip...] I surmise from this that while I had clamd running
without error, it was apparently starting up with defaults and not
using my config file.

I didn't see a question in all that,

Apologies I wasn't clearer. I meant the question to be: How can I fix this
error??:

Jul 21 22:23:08 tn4 clamd: ERROR: Please define server type (local and/or
TCP).
Jul 21 22:23:08 tn4 systemd: ***@amavisd.service: main process exited,
code=exited, status=1/FAILURE Jul 21 22:23:08 tn4 systemd: Unit

Post by G.W. Haywood
I assume you're restarting daemons after changing their configuration
files, many won't reread them without being restarted or e.g. sigHUPed.

Yes, even rebooting in desperation sometimes.

Post by G.W. Haywood
I wonder if you're trying to
use a volatile filesystem (/tmp to hold sockets) before the OS startup
scripts have created it.

The sockets settings I have are in these files /etc/clamd.d/amavisd.conf
/etc/clamd.conf (link to below) /etc/clamd.d/scan.conf All have:
LocalSocket /var/run/clamd.amavisd/clamd.sock

/etc/amavisd/amavisd.conf
Has:
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamd.amavisd/clamd.sock"],

/var/run is linked from /run on this box. I don't know if that's volatile
or not.


Thanks, Scott





_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Reindl Harald]

Post by Scott Horton

Post by G.W. Haywood

[...snip...] I surmise from this that while I had clamd running
without error, it was apparently starting up with defaults and not
using my config file.

I didn't see a question in all that,

Apologies I wasn't clearer. I meant the question to be: How can I fix this
Jul 21 22:23:08 tn4 clamd: ERROR: Please define server type (local and/or
TCP).
code=exited, status=1/FAILURE Jul 21 22:23:08 tn4 systemd: Unit

enter the message in google points here:
https://bbs.archlinux.org/viewtopic.php?id=94452

[Scott Horton]

Post by Reindl Harald
https://bbs.archlinux.org/viewtopic.php?id=94452

So it does. Says to uncomment Localsocket. Per the original post pasted
below, it was done. Did not fix.

Post by Reindl Harald
...My conf file does have the LocalSocket line uncommented and a file
# Default: disabled (must be specified by a user)
LocalSocket /var/run/clamd.amavisd/clamd.sock
I also have PID defined.

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Reindl Harald]

Post by Scott Horton

Post by Reindl Harald
https://bbs.archlinux.org/viewtopic.php?id=94452

So it does. Says to uncomment Localsocket. Per the original post pasted
below, it was done. Did not fix.

Post by Reindl Harald
...My conf file does have the LocalSocket line uncommented and a file
# Default: disabled (must be specified by a user)
LocalSocket /var/run/clamd.amavisd/clamd.sock
I also have PID defined

and you are sure that *this* config file is really used?

[***@mail-gw:~]$ ps aux | grep clamd
root 4307 0.0 0.0 118508 2168 pts/2 S<+ 00:59 0:00
/usr/bin/grep --color clamd
clamscan 31784 0.2 12.1 951392 493452 ? SNsl Jul17 26:10
/usr/sbin/clamd -c /etc/clamd.d/scan-sa.conf
clamscan 31786 0.2 11.2 897040 454476 ? SNsl Jul17 24:13
/usr/sbin/clamd -c /etc/clamd.d/scan.conf

[Reindl Harald]

ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf --foreground=yes
Not sure what the %i resolves to. I think I saw that was amavisd somewhere.
Maybe the user that starts it?

https://fedoramagazine.org/systemd-template-unit-files/

<service_name>@<argument>.service

The argument is a bit of text (string) passed to systemd to use in the
unit file. The argument can be used to customize the way systemd deals
with that specific instance of the unit. Multiple instances of the same
unit can exist.

Two identifiers are used in the unit file for passing the instance argument.

%i passes the argument, specially formatted (escaped)
%I passes the argument verbatim without escaping

[Scott Horton]

Post by Reindl Harald
and you are sure that *this* config file is really used?

I'm not terribly sure of anything <smile>. But I appreciate anyone helping
me see the trees for the forest.

This is what it says:
[***@tn2 ~]# ps ax|grep clamd
695 ? Ssl 0:09 /usr/sbin/clamd -c /etc/clamd.d/amavisd.conf
--foreground=yes
1909 pts/0 R+ 0:00 grep --color=auto clamd

From /etc/clamd.d/amavisd.conf, pasted below:
....
# Path to a local socket file the daemon will listen on.
LocalSocket /var/run/clamd.amavisd/clamd.sock ...



_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Reindl Harald]

Post by Scott Horton

Post by Reindl Harald
and you are sure that *this* config file is really used?

I'm not terribly sure of anything <smile>. But I appreciate anyone helping
me see the trees for the forest.
695 ? Ssl 0:09 /usr/sbin/clamd -c /etc/clamd.d/amavisd.conf
--foreground=yes
1909 pts/0 R+ 0:00 grep --color=auto clamd
....
# Path to a local socket file the daemon will listen on.
LocalSocket /var/run/clamd.amavisd/clamd.sock ...

previously in the thread you said "My configuration file is located at
/etc/clamd.d/scan.conf"

if you have "Unit ***@amavisd.service entered failed" then "ps aux "
would not show a running clamd - so hwat is this process and who started
it? what says "systemctl list-units | grep clam"
_________________________________

BTW: you touched "/usr/lib/systemd/system/***@.service" while as user
you have no business below /usr/lib/systemd as packages are not supposed
to touch anything living below /etc/systemd/system which is suppose for
overrides / replacements

[Scott Horton]

Post by Reindl Harald
previously in the thread you said "My configuration file is located at
/etc/clamd.d/scan.conf"
would not show a running clamd - so hwat is this process and who started

it?

Post by Reindl Harald
what says "systemctl list-units | grep clam"

I didn't mean to. I had changed the settings in both files to be sure
though. I think clamd service has always been running, it just appeared it
was not picking up on the config file.

[***@tn2 shorton]# systemctl list-units | grep clam
***@amavisd.service
loaded active running clamd scanner (amavisd) daemon
system-clamd.slice
loaded active active system-clamd.slice

I don't know where clamd.slice comes from (who started it). Maybe that's
the problem?





_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml