Kaspersky8 10.1 problems

[Paulv]

hi.

I found some problems/bugs in plesk 10.1.

1. we can't edit the config files anymore because kaspersky is embedded in plesk.
2. Plesk can start the service but can't see if it's started so he thinks that it's down all the time.
3. Kaspersky don't update because the plesk deamon(who does the updates) can't see if the service is running.
5. Kaspersky don't scan because plesk don't send him any commands because plesk thinks he is offline.

here are a few commands to do it manual by the shell.

(if you didn't have kasperskay a kaspersky key before plesk 10.1 kaspersky don't see a key do you can't update/start him)
start kaspersky:

/etc/init.d/kavehost start

stop kaspersky:

/etc/init.d/kavehost stop

check if kaspersky is running:

/etc/init.d/kavehost status

update kaspersky: (jou can also make a daily cronjob for him.)

/opt/kav/sdk8l3/bin/kav8update

-tomorrow i go try to fix plesk self (find the file that mabe makes this bugs)
--------------------------
my server info: plesk10.1 > ubuntu 10.10

 

[Knarf]

Hi Paulv,

Thank you for your message, as I also have problems with the bugs in Plesk causing Kaspersky to fail.
Nobody at this forum seems to have a solution and the parallels people don't respond either.

My server is Ubuntu 10.04 x86_64 + Plesk v10.1.1
Until today I didn't find anybody who has Kaspersky working wih Plesk v10.1.1.

Your commands give the following results on my server:

# /etc/init.d/kavehost stop
Stopping kavehost: -en 033[60G
[ OK ]

# /etc/init.d/kavehost start
Starting kavehost: -en 033[60G
[ OK ]

# /etc/init.d/kavehost status
kavehost is already running.

# /opt/kav/sdk8l3/bin/kav8update

Loading engine...
Current product version: 8.0.1.25
Initializing engine...
Using xml-file: /opt/kav/sdk8l3/bin/settings.xml.

LICENSE INFO:
Key file: kav.key
Expiration date: 23/01/2012
[: 8: x10: unexpected operator
#

As you can see, there is a scripting error at the end of kav8update.
Unfortunately Kaspersky still does not work.
The embedded Kaspersky screen is not visible in my Plesk and the mail is not scanned.
I hope you can help.
Thank you.

 

[Paulv]

Hey knarf.

there is no embadded screen for it. you can only see him by (running services). About the key, did you run the update as a sudo command? or a user"root"(strato server). than you get this error becouse that is a security in kaspersky. you may not run it as super user.

 

[Knarf]

there is no embadded screen for it. you can only see him by (running services).

Hi Paulv,

Look here:

There is no more Kaspersky module, it's embeded to panel.

Furthermore, it must be possible to adjust the settings of Kaspersky somewhere in Plesk, I assume?

About the key, did you run the update as a sudo command? or a user"root"(strato server). than you get this error becouse that is a security in kaspersky. you may not run it as super user.

I ran it as user "root" (Strato server indeed), but also tried it with sudo: same result.

 

[Paulv]

Already few fixes (need more for plesk - working on it)

okey. I find some little bugs in the the kaspersky self start/stop/status script and update script.

in the attached fixes.zip you see 2 files kav8update and kavehost

replace /etc/init.d/kavehost with kavehost
replace /opt/kav/sdk8l3/bin/kav8update with kav8update

easy way to do this for a ubuntu that allows sftp (strato server)
take ftp client(filezilla) make connection to your server ip. set this connection as a ssh connection.
(for strato servers that use ubuntu 10.x you can login with user root and your ssh password) maby other servers to but i tested this one. now you can just replace the files with ftp client. After this, the commands will work also as root/su.

the files will fix only your kaspersky bugs (not the plesk software. - parallels likes ajax/javascript so it's hard to find wich file is used for this function.) it's already late now. need to work tomorrow after i go work on the plesk modifications

Still ToDo: need to get that plesk script thats working with and also debug that one.

 

[Knarf]

Hi Paulv,

Thank you for the fixes!
No more errors with the above scripts running as "root".
But still the e-mail is not checked: in the e-mail header no X-flags are present about the virusscanner.
I have a valid Kaspersky key, kav8update works and kavehost is running.

Do you have an idea why the e-mail still is not scanned?
(The e-mail account has the option in- and outgoing virusscan checked in Plesk).

 

[Paulv]

Yes i know why he is not scanning. The kaspersky we use is not a full(stand alone) mail scanner. that means he need a software(like plesk) to scan the mail. Plesk is the e-mail handler that use kaspersky to scan it. because ple plesk bugs he can't. i fixed only the kaspersky(start/stop/update) bugs. Because plesk use the kaspersky embedded is it hard to find out how plesk use it. I'm working on it but it can take a few days. have find 1 plesk script today what plesk use to contact init.d kavscript start/stop. i can't tell it yet becouse need to reverse engeneer the plesk ajax/jquerry/java scripts first. I think i get some results next weekend. (i don't have hole days to work on it. have also a job. i do this as hobby). i find /opt/psa/admin/sbin/kavmng - he is 1 connector between plesk en kaspersky. i go look at him but it's alos possible that other scripts that use this file are bugged. so it's a little hard to find out. i'm not the devoleper of the plesk/kaspersky software so i need to all what they did over and over untill i know how thay work.

 

[Knarf]

Hi Paulv, wow thank you for the information! This information gives me a good understanding of how things work behind the scenes.

It should not be necessary that you do the work that Parallels should have done in the first place (maybe they can hire you ). I was hoping that parallels gave more information about the knowledge of the bugs and the timeframe in which we can expect a solution. It is very disappointing that the users must edit the files themselves and come with their own solution to solve the bugs that are present in Plesk.
Well, I am glad that a possible solution may be in sight and that my recently spent money for the Kaspersky license is not trashed.

 

[Paulv]

Hi.

As i told you. it will take a dew days to get this done but i can tell you that i fixed the scripts. There are still a few little bugs in it but kaspersky will work and will block the e-mail. (tested with eicar.com virus). you can also set it on/off in te service management of plesk. Replace the all the file with tho in your server. I only tested them on ubuntu 10.04 (strato server). Even if you already added my other files, replace them also.

1. Replace /opt/kav/sdk8l3/etc/kav-handler.cfg with kav-handler.cfg This is a config file you can edit it. i setted all on in here
2. Replace /opt/kav/sdk8l3/bin/kav8update with kav8update. This one fix 1 error that you get when updating.
3. Replave /opt/psa/admin/sbin/kavmng with kavmng. This fix some bugs so plesk can see the services and can use the commands now.
4. Replace /etc/init.d/kavehost with kavehost. i changed some command outputs so plesk plesk can reed his ouput and don't need. to use his own (bugged) check stats script anymore.
5. restart your hole server now.
6. Set all setting in plesk correct again. even if you already did. when you save it he will settup your kav-handler with your e-mails.
7. now restart your kaspersky service. Do it with the stop and start buttons. you need to do this other he will not make a cron.job for the updates. (when you click on the start button. It can take 20/30 sec before you see change to running.) Don't use the restart button yet. Didn't check/test or fixed him yet.

Plesk will not make a kaspersky notification in every mail. (only the infected e-mail). Remember. Not all bugs are fixed yet.
I hope it will help you all. Or even better, that parallels make a embedded update for the kav bugs.

 

[Knarf]

Hi Paulv,

Thank you for the very quick support! Parallels should be thankful for for such a devoted user.
I probably will try your fixes tomorrow night, as I have 60 domains running.

By the way, today I got an email from my server's Parallels Panel KAV about a detected trojan, so it seems the virusscanner was already working (despite the missing X-flag -but now understand not every mail has this flag- and probably also because of your 2 previous fixes).
Also tested it again with the EICAR testvirus, and indeed it is working now.

Should I still do your update then, or better keep it this way and wait for a definitive fix by Parallels?

 

[Paulv]

yes it's better to use my new files. the daily auto update is fixed to in my new scripts. And you don't need to login in ssh anymore to view your kaspersky. you kan now see it in plesk. And maby parallels will come with a fix but maby it will take a few weeks. we don't know. so better use them. and also when plesk bring a update. they replace my file than so it will back to normal when they fixed his one.

 

[RayvanS]

Ola PaulV, is there a root ftp to strato? I'm having the same problem, no module to see but it should be as protection in the paralelels version they offer.

I can't upload the files unfortunately, can you help?

Regards Ray

 

[RayvanS]

even the 11.5 update did not resolve it, and can't get ftp root acces to strato server, not even temporary, so cant use the paalv tips to see its working, any ideas anaone? ;-(

extra info...ftp through ssh seems to work now, they said it could not, yes it can, but not through following their standard console instructions ;-)
Unfortunately...the paulv suggestion is even not working for me ;-(

update gives me an error;
/opt/kav/sdk8l3/bin/kav8update

Loading engine...
Current product version: 8.0.1.25
Initializing engine...
Using xml-file: /opt/kav/sdk8l3/bin/settings.xml.
Can't initialize engine. Error code: 0x8004025c

/etc/init.d/kavehost start
Starting kavehost:
-en
[FAILED]