Question /usr/share/clamav/freshclam-sleep

[Neptune]

Hello,

since the last update of plesk, I have this error (
01/01/2022 03:33

received by email several times a day

/usr/share/clamav/freshclam-sleep

ERROR: downloadFile: Unexpected response (403) from https://database.clamav.net/daily-26440.cdiff

ERROR: getpatch: Can't download daily-26440.cdiff from https://database.clamav.net/daily-26440.cdiff

ERROR: downloadFile: Unexpected response (403) from https://database.clamav.net/daily.cvd

ERROR: getcvd: Can't download daily.cvd from https://database.clamav.net/daily.cvd

ERROR: Update failed for database: daily

ERROR: Database update process failed: HTTP GET failed (11)

***********************************************************************************
and I have this on the plesk server dashboard

Failure to update the ruleset ModSecurity : modsecurity_ctl failed: Atomic Updater Modified (AUM) Installer (v6.0.0)
Further Documentation is available at:

Aum - Atomicorp Wiki

wiki.atomicorp.com

Support: [email protected]
Ensuring yum is up to date: Done
Installing the Atomic GPG key: Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* tortix-common: www5.atomicorp.com
Package 1:aum-5.0-18502.el7.art.x86_64 already installed and latest version
Nothing to do

ERROR: Update failed.

can you help me please?

thank you in advance

sorry for the translation, I don't speak English

 

[IgorG]

Try to add line:

200.236.31.1 database.clamav.net

to the /etc/hosts file.

 

[Neptune]

Hello

thanks for the help

I don't have this file in /etc/hosts file.

 

[IgorG]

I don't have this file in /etc/hosts file.

You have to add this line to /etc/hosts file.

 

[Dave W]

Hi Igor,

Had the same issue and tried adding the IP to the hosts file, but it continued to fail on that IP with an SSL error.
So did some digging about, it seems the IP has changed to cloudflare;

 nslookup database.clamav.net
Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
database.clamav.net     canonical name = database.clamav.net.cdn.cloudflare.net.
Name:   database.clamav.net.cdn.cloudflare.net
Address: 104.16.218.84
Name:   database.clamav.net.cdn.cloudflare.net
Address: 104.16.219.84
Name:   database.clamav.net.cdn.cloudflare.net
Address: 2606:4700::6810:db54
Name:   database.clamav.net.cdn.cloudflare.net
Address: 2606:4700::6810:da54

Depending on what DNS servers your server is using (though should have updated by now) you may have to add

104.16.218.84 database.clamav.net

to your /etc/hosts file.
It looks like some changes at clamav are causing this.

Rgds
Dave

 

[Neptune]

Bonjour,

cela n'a rien changé avec l'ip dans etc/ fichier host, il y a un soucis général d'après mes recherches, j'ai trouvé ceci

modsecurity_ctl failed: Atomic Updater Modified (AUM) Installer (v6.0.0)
...
Package 1:aum-5.0-18024.el7.art.x86_64 already installed and latest version
Nothing to do
To complete installation run:
aum configure
and to update your rules:
aum upgrade

Cause
Temporary issue on Atomic side.

Resolution
Wait until Atomic fixes the issue or,

Personnellement je suis sous Plesk et j'ai le message ci-dessus affiché dans modsecurity avec impossibilité de changer les régles pour une autre (exemple comodo)

 

[Neptune]

Toujours cette erreur reçu par mail

/usr/share/clamav/freshclam-sleep

ERROR: downloadFile: Unexpected response (403) from https://database.clamav.net/daily-26440.cdiff
ERROR: getpatch: Can't download daily-26440.cdiff from https://database.clamav.net/daily-26440.cdiff
ERROR: downloadFile: Unexpected response (403) from https://database.clamav.net/daily.cvd
ERROR: getcvd: Can't download daily.cvd from https://database.clamav.net/daily.cvd
ERROR: Update failed for database: daily
ERROR: Database update process failed: HTTP GET failed (11)
ERROR: Update failed.

J'ai tenté une nouvelle fois de suivre l'instruction donné par le message de Plesk dans Modsecurity via Putty, mais la réponse et celle-ci

[XXXXXXXXXXXX ~]# aum -configure

Configuring Atomic Secured Linux (ASL) 5.0-14099 for nsXXXXXXXXXXXX.

[XXXXXXXXXXXX ~]# aum -upgrade

Checking versions ...

AUM version is current: le paquet asl n'est pas installé [PASS]
Updating Web Application Firewall to 202202056303: updated [PASS]

Warning: Not an array or iterable object in foreach, variable is NULL in component/c_apache.php on line 29
-------------------------------------------------------------------------------
Errors were encountered:

L CODE SOURCE MESSAGE
- ---- ----------------------------- ------------------------------------------
2 9901 ASLCommon::cmd_exec ERROR: '(1) /usr/sbin/apachectl -t 2>&1 >/dev/null -- [Thu Feb 10 14:23:24.645619 2022] [so:warn] [pid 21494:tid 140699067873408] AH01574: module unique_id_module is already loaded, skipping||[Thu Feb 10 14:23:24.693067 2022] [so:warn] [pid 21494:tid 140699067873408] AH01574: module security2_module is already loaded, skipping||AH00526: Syntax error on line 35 of /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf:||ModSecurity: Found another rule with the same id'
2 601 c_modsec::apply_rules There is a problem with the apache config: 1
2 601 c_modsec::apply_rules There is a problem with the apache config: Rolling back to the previous update
2 48 c_modsec::apply_rules Reverting all changes
2 48 ASLRBC::rollback_file Could not retrieve versions for /etc/asl/system.properties
3 600 c_modsec::apply_rules Errors occurred with Apache
XXXXXXXXXXXX

[XXXXXXXXXXXX ~]#

Là, j'avoue être perdu, car je ne suis pas non plus très expérimenté sur cela
Si vous avez une aide à m'apporter, ce serait avec grand plaisir !
Merci

 

[IgorG]

2 9901 ASLCommon::cmd_exec ERROR: '(1) /usr/sbin/apachectl -t 2>&1 >/dev/null -- [Thu Feb 10 14:23:24.645619 2022] [so:warn] [pid 21494:tid 140699067873408] AH01574: module unique_id_module is already loaded, skipping||[Thu Feb 10 14:23:24.693067 2022] [so:warn] [pid 21494:tid 140699067873408] AH01574: module security2_module is already loaded, skipping||AH00526: Syntax error on line 35 of /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf:||ModSecurity: Found another rule with the same id'
2 601 c_modsec::apply_rules There is a problem with the apache config: 1
2 601 c_modsec::apply_rules There is a problem with the apache config: Rolling back to the previous update
2 48 c_modsec::apply_rules Reverting all changes
2 48 ASLRBC::rollback_file Could not retrieve versions for /etc/asl/system.properties
3 600 c_modsec::apply_rules Errors occurred with Apache

https://support.plesk.com/hc/en-us/articles/115002350045-Running-aum-u-fails-with-the-error-and-breaks-Apache-in-Plesk