Nethserver-clamscan think tank

[medworthy (Mark Edworthy)]

@stephdl

@stephdl

In the same manner, if you see non English sentences, please shout…I’m French

To quote Antoine de Saint-Exupéry
“Language is the source of misunderstandings.”

[stephdl (Stéphane de Labrusse)]

we will need probably some tabs :’(

Since there is so much parameters, and a lot I don’t know what it deserves, I created a hidden db to write specific commands.

[m.traeumner (Michael Träumner)]

@stephdl

/usr/bin/clamscan --recursive --infected --stdout --log /var/log/clamav/clamscan.log --exclude=/proc --exclude=/sys --exclude=/usr/share/doc --exclude=/var/spool/clamav/quarantine --official-db-only=yes /

Hi,
I can execute the command after building a clamscan logfile manually. I thought it should have to be there by activating clamav at the settings of the contentfilter, isn’t it right?
I don’t have a quarantine directory either.

Can I install a web-ui like yours in post 5. I tried with

yum --enablerepo=nethforge-testing install nethserver-clamscan
but ther was nothing to install.

[stephdl (Stéphane de Labrusse)]

not yet ready, thank for your interest.

[m.traeumner (Michael Träumner)]

Thanks for your answer.
I’ve some ideas for functions for the webui:

• A “scan now” function with a chance to choose which directory or file you want to scan
• Checkboxes for the categories of PUA
• Start the signature update manually
• A function to restore from quarantine

[alefattorini (Alessio Fattorini)]

Just wondering if we need to turn the basic scan concept, why define exclusions and not inclusions?
Where are situated suspicious files? In my opinion just in maildirs, shared folders and nextcloud data dirs.
Why not point the scan only on them? It would be more efficient and effective anyway.
What do you think?

[medworthy (Mark Edworthy)]

@alefattorini

In my opinion just in maildirs, shared folders and nextcloud data dirs.Why not point the scan only on them? It would be more efficient and effective anyway.

@alefattorini, I agree (I did suggest this in an earlier posting – re: the comment I posted 3 days ago within this thread).

@medworthy

(it might be a good idea to restrict the virus checks to the ibay, email spool / attachments, /var/www and any other user specific directories).

[alefattorini (Alessio Fattorini)]

Sorry I missed it, glad to see you suggested the same

[m.traeumner (Michael Träumner)]

@alefattorini

why define exclusions and not inclusions

Sometimes scanners are marking files as a virus, which aren’t a virus, so you have to exclude them for next scans.

[stephdl (Stéphane de Labrusse)]

@alefattorini

In my opinion just in maildirs, shared folders and nextcloud data dirs.Why not point the scan only on them? It would be more efficient and effective anyway.What do you think?

We cannot expect what is the place of a malware, by definition, it won’t ask your permission for coming, so the scanning of the whole drive makes sense for me. I did some exclusions, and I regret them

You forget also the data of wordpress in /usr/share/wordpress…that’s said, it is really hard to think all places, the easier is to scan the whole drive.

@alefattorini

why define exclusions and not inclusions?

in fact the exclusion work by a regex, useful and weak (I forgot to add something on this, WIP), and like @m.traeumner said, we need to whitelist tagged files by clamav.

[stephdl (Stéphane de Labrusse)]

@m.traeumner

A “scan now” function with a chance to choose which directory or file you want to scan

good idea

@m.traeumner

Checkboxes for the categories of PUA

I thought on it, mainly that now I want to create a panel with Tabs

@m.traeumner

Start the signature update manually

why not launch freshclam manually

@m.traeumner

A function to restore from quarantine

ok here it is a hight and interesting challenge because clamav writes to its log the moved files to quarantine, there is no database to interrogate

after the cron job we need to parse the log and create a (e-smith ?) database to restore the file in the good place…

This is for the backend, for the front end it is another game and I really (yet) don’t know how to do it, either by a table in Nethgui, or by JS in a panel…it needs some searches

To @all thank a lot for sharing your ideas.

[medworthy (Mark Edworthy)]

@stephdl

We cannot expect what is the place of a malware, by definition, it won’t ask your permission for coming, so the scanning of the whole drive makes sense for me. I did some exclusions, and I regret them

You forget also the data of wordpress in /usr/share/wordpress…that’s said, it is really hard to think all places, the easier is to scan the whole drive.

Ok, considering that some web based apps do install various files in /etc, /var/lib and /usr/share (and other applications such as ejabber do use the /opt directory), I can understand the importance of virus checking the whole partition(s).

[medworthy (Mark Edworthy)]

@stephdl,

I have been reinstalling Webmin on one of my servers and this has given me the opportunity to play with their ClamAV module.

I thought that whilst using this module, I might as well upload some screenshots so that you can compare your module with theirs.

(Screenshot01 – Main Screen)

(Screenshot02 – System Backup / Restore)

(Screenshot03 – Quarantine)

(Screenshot04 – Database Updates)

(Screenshot05 – Directories Check)

(Screenshots06 - 11 – General Settings)

(Screenshot12 – Remote Control)

(Screenshots13 & 14 – Log Viewer)

(Screenshots15 & 16 – Virus Database – [More] href links to www.viruslist.com)

(Screenshot17 – Signatures Extraction / File Analyst)

I hope that the above images gives you some ideas!

The above module is hosted at

wbmclamav - The Webmin ClamAV Antivirus manager

and
http://labs.libre-entreprise.org/projects/wbmclamav/

[m.traeumner (Michael Träumner)]

@stephdl

why not launch freshclam manually

Thats good

@stephdl

for the front end it is another game and I really (yet) don’t know how to do it, either by a table in Nethgui, or by JS in a panel

I’m thinking about a table with checkboxes and a recovery button. It could be the easiest way,

[alefattorini (Alessio Fattorini)]

All those webmin’s checkboxes make me dizzy

[stephdl (Stéphane de Labrusse)]

What’s worry me is the time to code the same features…even if the development is not so active now, it started in 2004

[flatspin (Ralf Jeckel)]

@stephdl I really like you GUI. Great work as always! And it’s an essential modul for NS.
Will you also integrate the ScanOnAccess feature?

[stephdl (Stéphane de Labrusse)]

Wait the next UI, you will love it

[flatspin (Ralf Jeckel)]

Can’t await it!

[m.traeumner (Michael Träumner)]

Yes we wait, but it is difficult…
thanks for your great job.