Steps to install clamav on my 1&1/FC6/PSA8.6/SA3.25?

[WiKDMoNKY]

I have had users complaining of viruses in emails and wanted to install clamav. But I wasnt sure about the difference between clamav/clamd/clamav-server.

I have about 70 domains a a few hundred email accounts and was concerned about screwing up the server by running "yum install clamav".

Is it as easy as typing "yum install clamav" then running freshclam? Do I need to do anything else? Will a default install be enough to keep out MOST of the viruses?

If anyone has a link to (or a simple yes or no if I can screw everything up) a step by step, I would greatly appreciate it!

Thanks in advance!!!

P.S. I did search and could not find exactly what I needed...

 

[atomicturtle]

Step 1) Add the atomic repo
wget -q -O - http://www.atomicorp.com/installers/atomic |sh

Step 2) install clamd (this is the daemon, its faster)
yum install clamd

 

[WiKDMoNKY]

Thats it?

It installs everything and starts working without any extra configuration? Will it automatically update itself on a daily basis? Is there anyting that can go wrong? Do I need to install qmail-scanner?

That seems too easy. My experiences with Linux (over the years) has been that everything is a pain in the butt to install and setup. I just dont want to hose my server and spend a day restoring from a backup.

Why clamd over clamav or clamav-server? What is the difference?

Sorry for so many questions, I just have a lot riding on this server...

Thanks in advance!!!

 

[atomicturtle]

It will automatically update its signatures several times a day. To use it with plesk you will need to use either qmail-scanner, or atomic-scanner from ASL.

 

[WiKDMoNKY]

If I do not install qmail-scanner, does that mean I will have no GUI front end in Plesk to manage clamav? That is not a major concern of mine, but it would be a nice feature.

Thanks in advance!!!

 

[breun]

qmail-scanner does not provide a Plesk GUI (atomic-scanner will though), it's just the wrapper that connects qmail and your spam and virus filtering software. You can install and start clamd, but clamd wouldn't have anything to do without qmail-scanner feeding it emails.

 

[WiKDMoNKY]

To install qmail-scanner, do I just type yum install qmail-scanner?

Does it install and configure itself? Or do I need to do something to make it work?

Sorry to be a pest, but my clients go nuts if the mail server is down for more than a few minutes.

Thanks in advance!!!

 

[atomicturtle]

Yeah if you've got the atomic repo set up, yum install qmail-scanner will get you what you want.

 

[WiKDMoNKY]

And once it installs, there is nothing I need to configure? It will just work?

I think I will give it a shot tonight...

Thanks in advance!!!

 

[atomicturtle]

yup thats it. There are cron jobs that automatically update clam. Otherwise just stay on top of your rpm updates and thats it

 

[postman]

I am interested in this myself to get clam working and also to customise spamassassin a bit - I'd like spam reports and possibly DCC, Razor.

I am considering installing qmail-scanner as suggested and already have the ART repositories configured but before I try installing qmail-scanner I am wondering how qmail currently interfaces with SA. I'm sure I just don't understand my machine well enough but yum list qmail-scanner shows the one in the ART repository so I am beginning to think that my qmail is not using psa-spamassassin despite the Plesk interface having the SA options. Tell me I am wrong, please?

Thanks,
postman

 

[atomicturtle]

yes, it will use spamassassin, as well as other AV scanners. qmail-scanner however does not interface with psa-spamassassin (this is the native plesk gui), for that you would need atomic-scanner.

 

[Kanagaraj]

After installing and update clamed on our Centos 5 server,we got following error in logwatch file. how can we solve this.

Thanks
Raj

--------------------- clam-update Begin ------------------------


The ClamAV update process was started 1 time(s)

Last ClamAV update process started at Tue Sep 9 04:13:52 2008

Last Status:
main.cld is up to date (version: 48, sigs: 399264, f-level: 35, builder: sven)
Trying host db.us.clamav.net (199.184.215.2)...
Downloading daily-8185.cdiff [100%]
Downloading daily-8186.cdiff [100%]
Downloading daily-8187.cdiff [100%]
Downloading daily-8188.cdiff [100%]
Downloading daily-8189.cdiff [100%]
Downloading daily-8190.cdiff [100%]
Downloading daily-8191.cdiff [100%]
Downloading daily-8192.cdiff [100%]
Downloading daily-8193.cdiff [100%]
Downloading daily-8194.cdiff [100%]
Downloading daily-8195.cdiff [100%]
daily.cld updated (version: 8195, sigs: 17354, f-level: 35, builder: arnaud)
Database updated (416618 signatures) from db.us.clamav.net (IP: 199.184.215.2)
WARNING: Clamd was NOT notified: Can't connect to clamd through /tmp/clamd.socket

The following ERRORS and/or WARNINGS were detected when
running the ClamAV update process. If these ERRORS and/or
WARNINGS do not show up in the "Last Status" section above,
then their underlying cause has probably been corrected.

WARNINGS:
Clamd was NOT notified: Can't connect to clamd through /tmp/clamd.socket: 1 Time(s)

---------------------- clam-update End -------------------------

 

[WiKDMoNKY]

I ran yum install clamd, let it install, then ran yum install qmail-scanner, let it install. (Both were from ART repo)

Email stopped working (POP/SMTP).

Ran freshclam, got the exact same error as the previous poster.

I immediately ran yum remove qmail-scanner, let it uninstall, then ran yum remove clamd, let it uninstall.

Email worked again.

I knew it couldnt be that easy...

 

[breun]

Looks like you didn't start the ClamAV daemon: clamd. Try 'service clamd start' and run 'qmail-scanner-reconfigure' after you started all the spam and virus filtering daemons you want to use with qmail-scanner.

Also don't forget to check if clamd is set to start at boot time.

 

[Kanagaraj]

afterstart clamd and qmail-scanner-configur we got following error message on our log

X-Qmail-Scanner-2.02st: [123.domain.com122104343379111716] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2

and also we got following error

Can't connect to clamd through /tmp/clamd.socket: 1 Time(s)

Thanks

 

[breun]

These problems are all discussed on ART's forum: http://www.atomicrocketturtle.com/forum/

You probably need to run these commands:

# chown -R qscand:qscand /var/clamav
# service clamd start
# service spamassassin start
# qmail-scanner-reconfigure

Check if you can run 'freshclam' without any errors. If not, check if you have 'DatabaseOwner qscand' in /etc/freshclam.conf, /var/log/clamav is 775 and if /var/log/clamav/* is owned by qscand:qscand.

 

[nickpick]

Vps?

Can this be done on a Virtuozzo VPS as well?

I will anwer my own question here: Yes, works like a charm.

 

[nickpick]

yum update

I'm having a specific question for atomicturtle.

So I installed the clamd according to this thread. And all is OK.
Now I run "yum update" and I see it is telling me there is an update for e.g. mysql:

mysql x86_64 5.0.58-1.el5.art atomic 3.0 M
mysql-bench x86_64 5.0.58-1.el5.art atomic 514 k
mysql-devel x86_64 5.0.58-1.el5.art atomic 2.9 M
mysql-server x86_64 5.0.58-1.el5.art atomic 11 M

It is taking it from the ART repo.

However, when I disable the atomic.repo, then there is NO mysql update from centos repo.
Why is that?

 

[atomicturtle]

What updates do you see from centos? It could be that those are dependencies relating to the updates from the atomic side.