HTTP Anti-Virus Proxy

Official HAVP Support Forum
Registration disabled, I'm tired of spambots. E-mail havp@hege.li if you have questions.
HAVP project is pretty much frozen/abandoned at this time anyway.


All times are UTC + 2 hours [ DST ]




Post new topic Reply to topic  [ 8 posts ] 
Author Message
PostPosted: 28 Nov 2009 16:16 
Offline

Joined: 27 Nov 2009 00:28
Posts: 6
Hello.

I'm trying to get my feet wet with havp so, I'm trying to test it using clamav. When I try to start havp I get the following error:

/usr/local/sbin/havp: error while loading shared libraries: libclamav.so.6:

I noticed that the library is in /usr/local/lib and have this in the havp.config

ENABLECLAMLIB true
CLAMDBDIR /usr/local/lib

Any suggestions?

Thanks in advanced for your help.


Top
 Profile  
 
PostPosted: 28 Nov 2009 18:30 
Offline

Joined: 27 Nov 2009 00:28
Posts: 6
Found the solution:


run ldconfig

and it works now.

How can I test havp / clamav / squid ?????


Top
 Profile  
 
PostPosted: 28 Nov 2009 21:27 
Offline

Joined: 23 Apr 2008 09:36
Posts: 101
Hi landysaccount!

Try to download a testvirus on http://www.eicar.org/anti_virus_test_file.htm and you should see an HAVP access denied page!

Regards


Top
 Profile  
 
PostPosted: 29 Nov 2009 01:01 
Offline

Joined: 27 Nov 2009 00:28
Posts: 6
I tried it and I do NOT get access denied page. I can even download the file without problems... I guess my conf is not correct.

I have hapv, clamav, and squid as transparent proxy running on my machine.

clamd.conf
TCPAddr 192.168.1.1
LogFile /tmp/clamd.log
LogSyslog yes
User clamav
Debug yes
ScanHTML yes

havp.config
USER havp
GROUP havp
DAEMON true
SERVERNUMBER 20
MAXSERVERS 100
ACCESSLOG /var/log/havp/access.log
ERRORLOG /var/log/havp/havp.log
USESYSLOG true
SYSLOGNAME havp
SYSLOGFACILITY daemon
SYSLOGLEVEL info
SYSLOGVIRUSLEVEL warning
LOGLEVEL 1
SCANTEMPFILE /var/tmp/havp/havp-XXXXXX
TEMPDIR /var/tmp
DBRELOAD 60
TRANSPARENT true

PARENTPROXY 192.168.1.1
PARENTPORT 3128
PORT 8001
BIND_ADDRESS 127.0.0.1

and squid.conf
cache_peer 127.0.0.1 parent 8001 0 no-query no-digest no-netdb-exchange default

http_port 192.168.1.1:3128 transparent

# Access-lists (ACLs) will permit or deny hosts to access the proxy
acl lan-access src 192.168.1.0/24
acl localhost src 127.0.0.1
acl CONNECT method CONNECT
http_access allow localhost
http_access allow lan-access



etc.....


Top
 Profile  
 
PostPosted: 29 Nov 2009 02:13 
Offline

Joined: 23 Apr 2008 09:36
Posts: 101
Short answer: are there any error logs of havp? You also should make squid exceptions for https requests, because havp can't scan ssl connections!

What squid version are you using? Following is an example sandwich configuration for squid
Code:
http_port 192.168.1.1:3128 transparent

# Needed if using sandwich configuration
http_port 127.0.0.1:3129

# Define acl for HAVP port (the port HAVP connects to SQUID2)
acl FROM_HAVP myport 3129

# Don't log duplicate requests coming from HAVP
log_access deny FROM_HAVP

# HAVP on localhost port 8001
cache_peer 127.0.0.1 parent 8001 0 name=havp proxy-only no-query no-digest no-netdb-exchange default

# Needed if we want to go directly to SQUID2 without HAVP
cache_peer 127.0.0.1 parent 3129 0 name=squid2 proxy-only no-query no-digest no-netdb-exchange

# This makes sure ALL requests are sent to parent peers when needed
prefer_direct off
nonhierarchical_direct off

# HTTPS traffic scanning not needed
# (squid2 skipped too, since it can't be cached)
acl HTTPS proto HTTPS
acl SSL proto SSL
always_direct allow SSL

# Always force use of HAVP or Squid2 parent
never_direct allow !FROM_HAVP

# It's easier to create whitelists her than in HAVP
# Also, if there is a bug in HAVP, whitelisting there might not work (please uncomment and modify)
#acl NOSCAN dstdomain .some_domain.com

cache_peer_access havp deny FROM_HAVP
cache_peer_access havp deny SSL
cache_peer_access havp deny NOSCAN
cache_peer_access havp allow all
cache_peer_access squid2 deny FROM_HAVP
cache_peer_access squid2 allow all

This example should work too, if deleting all squid2 entries.


Top
 Profile  
 
PostPosted: 29 Nov 2009 06:57 
Offline

Joined: 27 Nov 2009 00:28
Posts: 6
Thanks for replying.

I'm using squid version 3.1.

I tried your acl configurations but, it looks like squid is not reponding, it just hangs and never serves the page to the client. I've checked /var/log/havp/access.log and don't see anyting here eventhough I have havp log ok. Now, after a while I see something in access.log.

If I stop havp then the page loads right away and everything seems normal.

Do I need to redirect port 80 to 8001?

I'm a little confused and don't understand much how havp, clamav, squid work together. Is there a tutorial on how to get them to work so, I can understand better?


Top
 Profile  
 
PostPosted: 04 Dec 2009 03:37 
Offline

Joined: 27 Nov 2009 00:28
Posts: 6
Hello.

Sorry to bother everyone with this but, I'm still having problems trying to get this resolved.


Top
 Profile  
 
PostPosted: 10 Dec 2009 13:45 
Offline

Joined: 02 Feb 2008 22:24
Posts: 28
Hi landysaccount,

Quote:
CLAMDBDIR /usr/local/lib


first I see the problem here. CLAMDBDIR is the directory with the clamav databases, not the directory with the libraries.
Maybe this is the culprit.

Regards Severus


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC + 2 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group