Replace DrWeb with ClamAV

[ProWebS]

hello,

anyone knows how can I replace DrWeb antivirus with ClamAV for Plesk 9.5 (CentOS) ?

 

[atomicturtle]

Sure, you will need either qmail-scanner (for qmail) or clapf (for postfix). You can install it & clamav with:

1) Add the atomic repo
wget -q -O - http://www.atomicorp.com/installers/atomic |sh

2) Install clamd
yum install clamd
service clamd start

3) Install qmail-scanner / clapf
yum install qmail-scanner

or

yum install clapf

 

[ProWebS]

atomicturtle thank you for your answer,
dont I have to remove drweb first?
or is this optional ? should I just install clam as you said and leave drweb be ?

 

[atomicturtle]

yeah you can remove it with:

yum remove *drweb*

 

[ProWebS]

hmm

I try to connect to the SMTP to send a test email for first time and I get the error:

Jun 19 12:10:46 office X-Qmail-Scanner-2.08st: [subdomain.domain.tld127693864679024843] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2

any ideas?

 

[ProWebS]

Ok I did run /etc/cron.daily/freshclam

I got the following errors
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

after I changed the perms of /var/log/clamav/freshclam.log and rerun /etc/cron.daily/freshclam
everything works fine.

I did send a fake virus and it blocked it.
Jun 19 12:34:41 office qmail-scanner[25051]: CLAMDSCAN:Eicar-Test-Signature:RC:0(192.168.2.3): 0.897428 1567 ******@*******.tld ******@*****.tld test_attack <4C1C8F42.6070609@*****.tld> theone.com

thanx for the help.

 

[hardlink]

Hey,

Just followed these simple instructions for a fresh install of Centos 5.5 (no OS updates), but after removing DrWeb and updating Plesk to Plesk 10.3.1 with CBM 10.3.0.

Almost idiot proof! (Me being an idiot)

Might add though, I did run freshclam before trying any mail testing.
The clamscan (clamd) process stopped working the first time I tried it, but I just restarted clamd and so far so good after some testing.
Also, as for running freshclam as above, my yum installed freshclam in cron.hourly instead of daily.

Here's what I did...

Install Clamav for Qmail on Centos 5.5...

1) Add the atomic repo
wget -q -O - http://www.atomicorp.com/installers/atomic |sh

2) Install clamd
yum install clamd
service clamd start

3) change permission on freshclam log file
chmod 777 /var/log/clamav/freshclam.log

4) Update defs
/etc/cron.hourly/freshclam

5) Install qmail-scanner
yum install qmail-scanner

Defaultly, I can't send an email with a virus, it rejects it without notification. Will be looking into changing that.

Thanks very much!

 

[hardlink]

Just found this as I noticed two sets of spam headers on testing things...

https://support.amhosting.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=68

 

[joinindia]

Hello,

I need to Replace Dr. Web with ClamAV on Posfix, Spam, Domain Key on Plesk 11.5x & Centos 6.4 64bit.

Please Suggest Steps how to implement this on Server.

Thanks!

 

[IgorG]

Hello,

I need to Replace Dr. Web with ClamAV on Posfix, Spam, Domain Key on Plesk 11.5x & Centos 6.4 64bit.

Please Suggest Steps how to implement this on Server.

Thanks!

Just remove DrWeb and install ClamAV from atomic repo.

 

[joinindia]

Hello Igorg,

Thanks for your reply.
Please confirm the below steps and suggest changes if required;

1) Add the atomic repo

wget -q -O - http://www.atomicorp.com/installers/atomic |sh

2) Install clamd

yum install clamd

service clamd start

3) Install clapf

yum install clapf

Any thing else is to be done?

Thanks!

 

[atomicturtle]

Yeah thats it

 

[joinindia]

Hello,

When I try to run

> yum install clapf
Loaded plugins: priorities
577 packages excluded due to repository priority protections
Setting up Install Process
No package clapf available.
Error: Nothing to do


How to FIX this Issue ?

 

[atomicturtle]

Did you add the repo?

 

[joinindia]

Yes After Adding repo only I installed clamd
But now when i run;

[root@ns1 ~]# yum install clapf
atomic | 1.9 kB 00:00
base | 3.7 kB 00:00
epel/metalink | 17 kB 00:00
epel | 4.2 kB 00:00
epel/primary_db | 5.8 MB 00:00
extras | 3.4 kB 00:00
rpmforge | 1.9 kB 00:00
updates | 3.4 kB 00:00
updates/primary_db | 1.4 MB 00:00
Setting up Install Process
No package clapf available.
Error: Nothing to do

Please Help.

Regards!

 

[IgorG]

Yes, I confirm.
I have tested it and found that after adding atomic repo clapf can't be found for installation.

 

[abdi]

I can get it installed but then requires a higher version of MySQL client (MySQL 5.5*)

#/etc/init.d/clapf start
Starting Clapf AntiVirus/AntiSpam Daemon: clapf: error while loading shared libraries: libmysqlclient.so.18: cannot open shared object file: No such file or directory

 

[IgorG]

I can get it installed but then requires a higher version of MySQL client (MySQL 5.5*)

#/etc/init.d/clapf start
Starting Clapf AntiVirus/AntiSpam Daemon: clapf: error while loading shared libraries: libmysqlclient.so.18: cannot open shared object file: No such file or directory

Install MySQL 5.5 from atomic repo too.

 

[abdi]

Sure, I just did that and now clapf starts fine, though in mail logs there is this error:

Jan 23 10:43:54 ns1 clapf[8039]: Cannot connect to mysql server

Though, MySQL is up and running and all the rest of the services are functioning just fine!

 

[abdi]

I got it resolved by creating the respective DB for clapf and populating it's tables and then linking the db to the /etc/clapf.conf. All should be fine now and mail headers now produce

X-Clapf-spamicity: 52e0eb846ce7561a30604cadff3b5a
X-Clapf-spamicity: 0.5000

Which should be ok ..