HTTP Anti-Virus Proxy

Official HAVP Support Forum
Registration disabled, I'm tired of spambots. E-mail havp@hege.li if you have questions.
HAVP project is pretty much frozen/abandoned at this time anyway.
It is currently 22 Jun 2014 09:52

All times are UTC + 2 hours [ DST ]




Post new topic Reply to topic  [ 6 posts ] 
Author Message
PostPosted: 08 Mar 2006 14:18 
Hello :-)

First let me report, that Squid, HAVP and ClamAV seem to work fine.

There is only a problem with ClamAV. In the config file clamd.conf there are some lines saying:

# Execute a command when virus is found. In the command string %v will
# be replaced by a virus name.
# Default: disabled
#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"

So I configured:

VirusEvent echo "%v" | /bin/mail -s "VIRUS ALERT Proxy1: %v" user@domain.de

Unfortunately this does not work at all. Pointing my browser to the eicar test files HAVP reports the virus, it is logged to havp.log. But a mail is never sent out. No logging to /var/log/messages, /var/log/mail, /var/log/clamd etc.

When I call the command like this (because ClamAV is running as user vscan) everthing works fine.

sudo -u vscan echo "%v" | /bin/mail -s "VIRUS ALERT Proxy1: %v" user@domain.de

I also tried some changes in clamd.conf already to check wether this file is the one ClamAV really uses. But ClamAV is just doing nothing at all. Same result as if I comment this line out.

Any ideas ?

Thanks & Regards,
Alexander


Top
  
 
 Post subject:
PostPosted: 08 Mar 2006 14:33 
Offline
HAVP Developer

Joined: 27 Feb 2006 18:12
Posts: 687
Location: Finland
Hi, I think there is a small misunderstanding here..

HAVP does not use clamd, so clamd.conf has no effect. :)

Cheers,
Henrik


Top
 Profile  
 
 Post subject: clamscan
PostPosted: 08 Mar 2006 15:39 
Hi Henrik :-)

Sorry for this 'silly' question. Embarassing....but it explains why it does not work at all like this :oops:

Does it use clamscan which does not use clamd.conf ? If so, how can I get a mail in case clamscan finds something ?

As far as I understand the issue so far, clamscan is called by HAVP.

Perhaps that's another 'silly' question but unfortunately I have not found a solution in the documentation nor via Google... 8)

Regards,
Alexander


Top
  
 
 Post subject:
PostPosted: 08 Mar 2006 16:30 
Offline
HAVP Developer

Joined: 27 Feb 2006 18:12
Posts: 687
Location: Finland
HAVP uses ClamAV library. So it is kind of "clamd/clamscan" in itself, loads patterns and scans the files..

Clamd and clamscan are also "stand-alone" programs that use the library. :)

Cheers,
Henrik


Top
 Profile  
 
 Post subject: Mail
PostPosted: 08 Mar 2006 16:58 
Hi Henrik,

thanks for your explination.

Do you know a way in HAVP to get an email if a virus was found ? Or just use something like logsurfer or swatch ?

Regards,
Alexander


Top
  
 
 Post subject:
PostPosted: 08 Mar 2006 17:43 
Offline
HAVP Developer

Joined: 27 Feb 2006 18:12
Posts: 687
Location: Finland
I guess you just need a simple script.. robm here is already doing the same thing.

Cheers,
Henrik


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC + 2 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group