Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed ClamAV (clamav-daemon and clamav-freshclam) in order to set up a policy of regularly scanning my LTSP thin client setup for Windows viruses.

Currently, we have a variety of users, each with their own group. All files in their home directory are owned by each user, and to each user's group. How can I have clamdscan read all of their files, whether 0700 or not, while not running clamdscan as root? (which is just asking for problems)

share|improve this question
There's a launchpad ticket open with your problem. – Joseph Kern Oct 13 '09 at 14:01
up vote 1 down vote accepted

Maybe, you should install a job to each user's crontab, so all files are scanned collectively by a user's instance of clamdscan?

share|improve this answer
We'd also have to disable a user's ability to edit their crontab, since a malicious user could just disable the scan. – lfaraone Oct 14 '09 at 16:18
Hm. So run a task as root (so crontast is not removable) and su to each user's account just before launching clamdscan :) – kolypto Oct 15 '09 at 0:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.