Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to enable Google Safe Browsing anti phishing/malware filtering on my mail server using ClamAV. I enabled it in freshclam.conf, and I got a fresh new safebrowsing.cld file in my datadir. But when I run a scan, through clamscan or clamdscan, it doesn't detect bad links. I tested with http://*malware.testing * .google.test ** /testing/malware/ which is a sample malware URL provided by Google and that made my Firefox scream to death, and I tested with some other bad URLs too.

Is the SafeBrowsing support still available and working in current ClamAV engine ? Do I have to enable something special in my conf file ?

Thanks for any help !

Here are some debug info about my test case :

main.cld is up to date (version: 53, sigs: 846214, f-level: 53, builder: sven)
daily.cld is up to date (version: 12620, sigs: 35178, f-level: 58, builder: ccordes)
safebrowsing.cld is up to date (version: 27036, sigs: 544427, f-level: 58, builder: google)
bytecode.cld is up to date (version: 123, sigs: 29, f-level: 58, builder: edwin)

root@b /var/lib/clamav # ls -al
total 94920
drwxr-xr-x  2 clamav clamav     4096 2011-02-03 10:34 .
drwxr-xr-x 39 root   root       4096 2010-11-30 01:22 ..
-rw-r--r--  1 clamav clamav   437248 2011-01-23 15:25 bytecode.cld
-rw-r--r--  1 clamav clamav  2311680 2011-02-03 07:25 daily.cld
-rw-r--r--  1 clamav clamav 65422336 2010-11-14 18:40 main.cld
-rw-------  1 clamav clamav      988 2011-02-03 10:34 mirrors.dat
-rw-r--r--  1 clamav clamav 28894720 2011-02-03 09:59 safebrowsing.cld

root@b /var/lib/clamav # clamscan /tmp/malware-test.eml
/tmp/malware-test.eml: OK

----------- SCAN SUMMARY -----------
Known viruses: 1424589
Engine version: 0.96.5
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 2.739 sec (0 m 2 s)

#Automatically Generated by clamav-base postinst
#To reconfigure clamd run #dpkg-reconfigure clamav-base
#Please read /usr/share/doc/clamav-base/README.Debian.gz for details
LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup clamav
LocalSocketMode 666
# TemporaryDirectory is not set to its default /tmp here to make overriding
# the default with environment variables TMPDIR/TMP/TEMP possible
User clamav
AllowSupplementaryGroups true
ScanMail true
ScanArchive true
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
LogSyslog false
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav
SelfCheck 3600
Foreground false
Debug false
ScanPE true
ScanOLE2 true
ScanHTML true
DetectBrokenExecutables false
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
PhishingSignatures true
PhishingScanURLs true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
DetectPUA false
ScanPartialMessages false
HeuristicScanPrecedence false
StructuredDataDetection false
CommandReadTimeout 5
SendBufTimeout 200
MaxQueue 100
ExtendedDetectionInfo true
OLE2BlockMacros false
StreamMaxLength 10M
LogFile /var/log/clamav/clamav.log
LogTime true
LogFileUnlock false
LogFileMaxSize 0
Bytecode true
BytecodeSecurity TrustSigned
BytecodeTimeout 60000
OfficialDatabaseOnly false
CrossFilesystems true
share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

I contacted ClamAV team, it was a bug in their code.

See https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2514

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.