Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I installed ClamAV (clamav-daemon and clamav-freshclam) in order to set up a policy of regularly scanning my LTSP thin client setup for Windows viruses.

Currently, we have a variety of users, each with their own group. All files in their home directory are owned by each user, and to each user's group. How can I have clamdscan read all of their files, whether 0700 or not, while not running clamdscan as root? (which is just asking for problems)

share|improve this question
    
There's a launchpad ticket open with your problem. bugs.launchpad.net/ubuntu/+source/clamav/+bug/450250 –  Joseph Kern Oct 13 '09 at 14:01
add comment

1 Answer

up vote 1 down vote accepted

Maybe, you should install a job to each user's crontab, so all files are scanned collectively by a user's instance of clamdscan?

share|improve this answer
    
We'd also have to disable a user's ability to edit their crontab, since a malicious user could just disable the scan. –  lfaraone Oct 14 '09 at 16:18
    
Hm. So run a task as root (so crontast is not removable) and su to each user's account just before launching clamdscan :) –  kolypto Oct 15 '09 at 0:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.