Clamdscan on Debian Sarge

Hi,

i have configured my server (Debian 3.1) with clamdscan because my load average was > 95 % !!!

I used this post http://www.howtoforge.com/forums/showthread.php?t=12864&highlight=clamd

Version of ISPconfig : 2.2.12

Version of Clamd 0.84

Code:

/etc/init.d/postfix stop
/etc/init.d/ispconfig_server stop

apt-get install clamav-base clamav-daemon clamav-freshclam libclamav1

I changed the CLAMSCAN line in /home/admispconfig/ispconfig/tools/clamav/bin/clamassassin

Code:

CLAMSCAN=/usr/bin/clamdscan

In /etc/clamav/clamd.conf i didn't find "ScanMail true" but "ScanMail"

In /etc/clamav/freshclam.conf and /home/admispconfig/ispconfig/tools/clamav/etc/freshclam.conf I changed the NotifyClamd line :

Code:

NotifyClamd /etc/clamav/clamd.conf

When i test with an eicar virus, the virus is not stoped !

This is my mail header

Code:

X-Virus-Status: No
X-Virus-Checker-Version: clamassassin 1.2.3 with clamdscan / ClamAV 0.84/3411/Tue Jun 12 16:55:03 2007

Could you help me please ?

thanks a lot !

 

I don't understand because when i read my clamav.log i find this lines :

Code:

Wed Jun 13 16:34:56 2007 -> stream: Email.Phishing.RB-792 FOUND
Wed Jun 13 16:34:56 2007 -> stream: Email.Phishing.RB-792 FOUND
Wed Jun 13 16:34:56 2007 -> stream: Email.Phishing.RB-792 FOUND
Wed Jun 13 16:34:56 2007 -> stream: Email.Phishing.RB-792 FOUND
Wed Jun 13 16:34:56 2007 -> stream: Email.Phishing.RB-792 FOUND

This means that my clamdscan is working ?! But when i send an eicar virus i receive the mail with the virus !

Could you help me ?

thanks for your ideas

 

I answer to myself ) it seems that the version of clamassassin is not compatible with clamav < 0.90.

Do you think i can use a debian sarge backport version of clamav-daemon ? (backport.org) is it a risk ?

thanks for your answers

 

Thanks Till !

it works perfectly with volatile version of clamav-daemon
The load average of my server is ok now !

Thanks for your great work !

 

Hi!

I have this setup running on debian 3.1 + volatile, but I have now debian's and ispconfig's freshclam running. I suppose that the good one is Debian's one, because debian's clamd is in use

I think it's nonsense downloading databases twice (and a bandwith waste for clamav's project)
Is it possible to use ispconfig's freshclam for updating debian's clamd database or should I disable ispconfig freshclam?
How can I disable it?

I can see debian's and ispconfig's clamav databases are in different format:

Code:

# ls -la /home/admispconfig/ispconfig/tools/clamav/share/clamav/daily.inc/
total 1778
drwxr-xr-x  2 admispconfig admispconfig     376 2007-06-20 10:12 .
drwxr-xr-x  4 admispconfig admispconfig     136 2007-06-20 19:33 ..
-rwxr-xr-x  1 admispconfig admispconfig   17992 2007-06-19 20:30 COPYING
-rwxr-xr-x  1 admispconfig admispconfig      58 2007-06-19 20:30 daily.cfg
-rwxr-xr-x  1 admispconfig admispconfig   23562 2007-06-19 20:30 daily.db
-rwxr-xr-x  1 admispconfig admispconfig    3050 2007-06-19 20:30 daily.fp
-rwxr-xr-x  1 admispconfig admispconfig    3407 2007-06-20 06:06 daily.hdb
-rw-r--r--  1 admispconfig admispconfig     457 2007-06-20 10:12 daily.info
-rwxr-xr-x  1 admispconfig admispconfig 1195216 2007-06-20 10:12 daily.mdb
-rwxr-xr-x  1 admispconfig admispconfig  544940 2007-06-20 10:12 daily.ndb
-rwxr-xr-x  1 admispconfig admispconfig    2248 2007-06-19 20:30 daily.pdb
-rwxr-xr-x  1 admispconfig admispconfig     762 2007-06-19 20:30 daily.wdb
-rwxr-xr-x  1 admispconfig admispconfig    2786 2007-06-19 20:30 daily.zmd

Code:

# ls -la /var/lib/clamav/
total 9922
drwxr-xr-x   2 clamav clamav     136 2007-06-20 20:08 .
drwxr-xr-x  37 root   root       944 2007-04-29 14:12 ..
-rw-r--r--   1 clamav clamav  786774 2007-06-20 19:08 daily.cvd
-rw-r--r--   1 root   root   9351789 2007-06-20 18:48 main.cvd
-rw-------   1 clamav clamav     208 2007-06-20 20:08 mirrors.dat

 

Hi Guys,

I need to do this for ubuntu. When i run "apt-get install clamav-base clamav-daemon clamav-freshclam libclamav1" it gives me an error.

Any help

 

I think you need to change libclamav1 to libclamav2

aka:

apt-get install clamav-base clamav-daemon clamav-freshclam libclamav2

 

need help

i have had a etch server (perfect) running for about a year. ispconfig working great, until a month ago. then server quit responding. found that clamav was maxing out resources, so i changed it to clamd and that fixed that part but now i am losing good emails. any advice would help. p.s. i figured it was time to upgrade so i built two perfect ubuntu servers with ispconfig 2.2.35 and put them in and in about a 1/2 hour they were doing the same thing. really stumped here. can you help

Thanks Ernie