-4

We are using CentOS with parallel plesk server for our web application. User can upload their files to server. For security reason I need a anti-virus software scanning on all uploaded files. So please suggest me good solution for me.

3
  • What kind of protocol your clients are using to upload files ? ftp http ?
    – B14D3
    Aug 28, 2012 at 9:44
  • The user will upload files from browser itself. They are not using the FTP Aug 28, 2012 at 9:46
  • Shopping questions are off topic. It's in the faq
    – MDMarra
    Aug 28, 2012 at 9:55

3 Answers 3

1

You can install Fabric, then put the following into a .py file:

from fabric.api import *

@hosts('1.2.3.4')
def clamav():
    run('sudo yum -y install clamav.x86_64 clamav-db.x86_64 clamd.x86_64')
    run('sudo /usr/bin/freshclam')
    run('sudo /sbin/chkconfig clamd on')
    run('sudo /etc/init.d/clamd restart')
    run('wget ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.4a.tar.bz2')
    run('tar jxvf proftpd-1.3.4a.tar.bz2')
    run('[ -d /usr/local/proftpd ] || sudo mkdir /usr/local/proftpd')
    run('wget https://secure.thrallingpenguin.com/redmine/attachments/download/1/mod_clamav-0.11rc.tar.gz')
    run('tar zxvf mod_clamav-0.11rc.tar.gz')
    run('cp mod_clamav-0.11rc/mod_clamav.* proftpd-1.3.4a/contrib/')
    run('cd proftpd-1.3.4a && patch -p1 < ../mod_clamav-0.11rc/proftpd.patch')
    run('cd proftpd-1.3.4a && ./configure --prefix=/usr/local/proftpd --with-modules=mod_ldap:mod_clamav && make && sudo make install')
    run('sudo /sbin/chkconfig --add proftpd')
    run('sudo /sbin/chkconfig proftpd on')
    run('sudo chmod +x /etc/init.d/proftpd')
    run('sudo /etc/init.d/proftpd restart')

and install it by running:

$ fab -f /path/to/the/.py/file clamav

UPDATE

Okay, but the user will upload files from browser itself. They are not using the FTP

Then run clamscan as a daily cron job, something like this:

0 2 * * * clamscan -i -r /var/www/html --move=/home/quanta/viruses --log=/var/log/clamav/scan.log

2
  • Okay, but the user will upload files from browser itself. They are not using the FTP Aug 28, 2012 at 9:47
  • updated my answer.
    – quanta
    Aug 28, 2012 at 9:53
0

If you are using ftp and the ftp deamon is pure-ftpd then configuring clamav to scan every uploaded file is very very simple and clamav is very good and free anti-virus software.

Here is tutprial http://www.howtoforge.com/how-to-integrate-clamav-into-pureftpd-for-virus-scanning-on-ubuntu-12.04 on how to integrate clamav into pure-ftpd in Ubuntu but it should be very similar in Centos.

If you dont use pure-ftpd then also you can use clamav for example as cronjob to checking files once a day.

EDIT:

If they are using browser then you can check mod_clamav(it is an Apache 2 filter which scans the content delivered by the proxy module (mod_proxy) for viruses using the Clamav virus scanning engine).

If you are using other www server than u can check is there a way to integrate clamav with it.

Other solution that is simple but a litle bit expensive(you need additional server). I was doing something like that when I was securing servers for one of university in Poland (servers where some training grounds for students ). I put Untangle server in front of those servers. Untanlge is very easy to use firewall software with very nice web interface.

You can configure Untangle as transparent bridge and then configure proper modules to check for viruses, (clamav or Kaspersky module but Kaspersky is not free). Check untangle.com its very nice software.

1
  • Thanks, But the user will upload files from browser itself. They are not using the FTP. Aug 28, 2012 at 9:46
0

Check it out http://www.parallels.com/products/antivirus/. This antivirus is recommended by plesk and it is really nice.

Not the answer you're looking for? Browse other questions tagged .