SAMBA -:- Working With ClamAV

KristyX · Last edited by KristyX on Thu Sep 02, 2004 6:30 am; edited 3 times in total

Hi!

I'm trying to get my Samba running together with ClamAV but without the printers
as described in the Gentoo Docs.

I did emerge my SAMBA with the USE options defined in the docs and
emerged clamav. But after adding the VFS part in smb.conf that deals
with the clamav integration, testparm spits out the following:

KristyX · Posted: Wed May 19, 2004 3:57 pm Post subject:

By the way, my vscan config is:

/etc/samba/vscan-clamav.conf

jcosters · Posted: Thu May 20, 2004 10:34 am Post subject:

for samba 2.2.x use:

jcosters · Posted: Thu May 20, 2004 10:37 am Post subject:

also, you need to explicitly edit /etc/conf.d/clamd to enable the scanner to startup when running /etc/init.d/clamd start
you can also set some other parameters there like the log file locations.

also, you need to edit /etc/clamav.conf, remove the bogus example line and set the socket file to /var/run/clamd
you might want to configure this file some more.

also, you need a /etc/samba/vscan-clamav.conf file which you can find (a sample) in the samba-vscan docs.
here you can tweak the behaviour of the scanner when used by samba.

then your setup should work

KristyX · Posted: Sat May 22, 2004 1:23 am Post subject:

Thank you so much for replying! I almost gave up hope of ever getting
Samba working with Clam

The line worked! Samba starts without a hitch now

The thing is, using the sample virus-infected file from eicar.org, I copied it
into my shared folder through the network browser and it pasted without any
trouble

No error message, no access denied or anything.

Any ideas?

Thanks,
~Kristy

--------------------
/var/log/clamd.log

jcosters · Posted: Sat May 22, 2004 10:59 am Post subject:

You need an extra line in smb.conf (see below). Now your scanner is running, but it isn't called by samba.

My /var/log/clamav/clamd.log:

KristyX · Posted: Sat May 22, 2004 12:40 pm Post subject:

Thank you *so* much Ice-O-Lator.. I don't get a warning message but the
eicar.com file doesn't get copied either

~Kristy
_________________
Knowledge is a process of piling up facts; wisdom lies in their simplification. [Martin Fischer]

jcosters · Posted: Sat May 22, 2004 5:32 pm Post subject:

no problem kristyX

I had to figure the lot out analysing samba's and clamd's logs, it took me some days to get it all to work. I think the official documentation should be updated.

Anyway, when you add

thekk · n00b Joined: 28 Jan 2004 Posts: 11

KristyX · Posted: Thu Sep 02, 2004 6:12 am Post subject:

Okay, for some reason the users on my network aren't able to access my computer and list the shares.

This happened awhile back but I didn't have time to investigate.. basically, one day everything was fine and the next, it was not.

I'm not sure what could be the problem.. has anyone got any ideas why it can't find the vfs module??

Thanks,
Kristy

/var/log/samba3/log.christie

jcosters · Posted: Thu Sep 02, 2004 9:46 am Post subject:

jcosters · Posted: Thu Sep 02, 2004 9:50 am Post subject:

KristyX · Posted: Thu Sep 02, 2004 11:53 am Post subject:

Okay, that's really weird.

My smb.conf file states:

/etc/samba/smb.conf

jcosters · Posted: Thu Sep 02, 2004 2:12 pm Post subject:

KristyX · Posted: Fri Sep 03, 2004 1:22 am Post subject:

I tried it but now the error has just changed to "nobody" instead of guest.

There is a guest & a nobody account in /etc/passwd.. I'm going to see if Google can give me any clues :)

jcosters · Posted: Fri Sep 03, 2004 7:30 am Post subject:

https://forums.gentoo.org/viewtopic.php?t=203824&highlight=samba+nobody+guest

KristyX · Posted: Fri Sep 03, 2004 10:05 am Post subject:

Hey Ice-O-Lator.. the problem is definately not the guest/passwords thing because, as soon as I comment the lines:

Everything works just fine (even though the logs still show the guest error) and Win98 machines are able to access the files in my shared folder with no problems.

Going to re-emerge ClamAV.

~Kristy

KristyX · Posted: Fri Sep 03, 2004 10:58 am Post subject:

Hey Ice-O-Lator.. can you do a search and tell me where vscan-clamav.so is supposed to be located? I can't find it and I've already tried re-emerging ClamAV.

Thanks :)
Kristy
_________________
Knowledge is a process of piling up facts; wisdom lies in their simplification. [Martin Fischer]

jcosters · Posted: Sun Sep 05, 2004 4:28 pm Post subject:

vscan-clamav is part of samba-vscan i think (use flag: oav builds interfaces for some scanners when you emerge samba), so re-emerging clamd won't help.

KristyX · Posted: Mon Sep 06, 2004 1:54 am Post subject:

You're right.. I just checked my USE flags and Samba was upgraded without oav in the flags

I've placed oav in my make.conf and will be re-emerging Samba tonite.

Sorry for all the trouble :oops:

~Kristy
_________________
Knowledge is a process of piling up facts; wisdom lies in their simplification. [Martin Fischer]

KristyX · Posted: Mon Sep 06, 2004 8:30 am Post subject:

Yes, the culprit was me heh.

Samba has re-emerged and everything is working just fine with ClamAV :)

Thanks for bearing with me.. (I know, I know)

~Kristy
_________________
Knowledge is a process of piling up facts; wisdom lies in their simplification. [Martin Fischer]

jcosters · Posted: Mon Sep 06, 2004 9:12 am Post subject:

no problem :wink:

Another thing: I noticed samba shares preforming slooooow when I make samba scan them for viruses.
My server system is nothing more than an old Compaq Deskpro with a P2 400Mhz and 512MB RAM. Also, 120 GB disk space.
At first I thought it was just samba behaving badly, but after snooping around I noticed it was the clamd scanner scanning every file on read. So when I opened that share from a windows box with explorer, every file was read AND scanned. This caused very bad performance in explorer, like 5 minutes to get a (large: hundreds of files in a directory) directory listing.
Turning off the "on read" scanning fixed this, now files only are scanned on write.

cheers!

KristyX · Posted: Mon Sep 06, 2004 10:03 am Post subject:

Thanks for the tip. I think I'll do the same :)
_________________
Knowledge is a process of piling up facts; wisdom lies in their simplification. [Martin Fischer]

thekk · n00b Joined: 28 Jan 2004 Posts: 11

I've done the same, and directory listings are indeed much faster. Just a note to other users: do not do this if users can copy files to the shares in another way than through samba.

And the line to change (in /etc/samba/vscan-clamav.conf) is:

jcosters · Posted: Tue Sep 07, 2004 2:16 pm Post subject: