Tag Info

Hot answers tagged

11

First, if there's a rootkit, you're probably fighting a neverending fight. Take the server offline and reinstall and restore backups that are pre-infection. That's the "best" method of fixing. Second, were you up to date on patches and such before the infection or did you patch after? Third, what custom code is running on the server outside Plesk? How do ...


7

The easiest way would be to us an EICAR test file. Create a text file and add in the following code: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* More information here


6

Just send an email with the eicar test file attached. This file has a signature which any virus scanner should know and detect. As for the monitoring of the clamd process itself, there are many possibilities. I personally prefer using monit for it.


6

For a public facing server, I would say installing something like tripwire is not overkill. ClamAV is a different matter. I would consider setting that up that if your visitors will be sharing files by uploading to, and downloading from, your website. PDFs can contain exploits. On public facing servers, I have SSH not allow password authentication, only ...


6

Directory permissions on /var/spool/exim4/scan should be 750, and owned by the exim user and its primary group (on my FreeBSD systems, these are mailnull and mail, respectively). If your clamav user has Debian-exim as a supplementary group - that is, if Debian-exim is not its primary group, then you need "AllowSupplementaryGroups yes" in your clamd.conf ...


4

You can limit disk usage of the temporary files when running clamscan, by using the --max-space flag like this clamscan --max-space=50m --tempdir=/tmp/ --infected --recursive /home/


4

A few comments and things you can check: I don't see anything obviously wrong in the log you posted. What makes you think the last line in the log is an issue? Near 100% RAM utilization is actually a good thing in general. What you don't want to happen, though, is begin to use swap space which will kill your server's performance pretty quickly and may be ...


4

Why not setup some sort of virtual machine and use snapshots to reset their machines regularly? This way any viri/trojans that get past the AV can be wiped out easily. There is also more specialised software to do this aimed more at libraries/internet cafes if you want to take the idea further.


4

The clamd server doesn't appear to be running. Try starting it.


4

Since you want to disable virus checking entirely, the easiest way to do so is find the @bypass_virus_checks_maps line in the Amavis configuration files (amavis.conf or conf.d/50-user) and change it to this; bypass_virus_checks_maps => [1];


3

In clamd.conf AllowSupplementaryGroups is default false try this: AllowSupplementaryGroups true


3

It turns out that there's a LOT to this. First, someone NOT familiar with this exact problem pointed out that maybe I didn't have enough of the software installed. What I had installed is listed in the question above. However, I did a yum list clamav-* and found there were packages available I did not have installed, including a milter, among other things. ...


3

The clamd socket file /var/run/clamd.scan/clamd.sock has somehow gotten mislabeled. It has the type var_run_t, but it should be antivirus_var_run_t in current SELinux policy. Anything matching /var/run/clamd.* should be labeled antivirus_var_run_t. This could be because the socket was created while an older version of the policy was installed, or a program ...


3

try starting the server and then immediately log in and run top then press M (being actually a capital M to sort by memory usage) and watch your resources. You should see your swap at 0 bytes used and your memory free either fully used as linux can use sometimes or little under but mainly watch the top of the light of processes consuming memory. You should ...


3

download the EICAR test file and scan it. it was made exactly for this purpose


3

There is no generic approach - it's all hands-on. You typically would need to have configured extensive logging, preferably not only from the system you are inspecting but also from an independent IDS, which you are periodically archiving. Also, a good bunch of experience with computer security and forensics is required, otherwise you don't stand a chance. ...


3

Based on your real goal (I am building a web app where my user will be able to upload epubs files and I want to make sure they are no executable files.) ClamAV is probably overkill for your needs. You can use the file utility (or various APIs that hook the same database of magic data) to determine what kind of file the user is trying to upload, and reject ...


3

The defaut /etc/clamd.comnf (or equivalent on your distribution) should be fine. On CentOs, the antivirus (clamav), the update (clamav-db alais freshclam), and the deamon (clamd) are different packages. /etc/freshclam.conf use the default 12 update checks a day. Then, you need to figure out what you actually want to do with your AV: system-wide scan, ...


3

To use clamav in Debian squeeze you need to start by installing the exim4-daemon-heavy package instead of the default exim4-daemon-light version, the heavy daemon was compiled with more functionality including the ability to link into clamav. Just do an apt-get install exim4-daemon-heavy, it won't change much, and pretty safe to run. After you have that ...


3

In addition to SpamAssassin use amavisd-new and MailZu. This way you get easily manageable per-user SpamAssassin settings and a personal quarantine for each user which they can browse & manage over the web interface.


3

You may want to check on the version of your ClamAV. Recently they stopped providing updated db files to version 0.94, so when your freshclam (the part that updates the definitions db) goes to download the update, instead of the expected result, if receives the error message, which may not play well with your freshclam and it tries to re-download the updates ...


3

Nope, you didn't go far enough. 1)You need a web application firewall like mod_security and make sure its configured to block attacks, not just log them. 2)Lock down php with phpsecinfo. 3)Lock down your web application's MySQL account, make sure your application doesn't have FILE privileges, its by far the most dangerous one in MySQL. 4)Firewall ...


2

"Welcome aboard! On board of our new airliner you can enjoy restaurant, cinema, gym, sauna and swimming pool. Now fasten your seat belts, our captain is going to try to get all this shit airborne." mod_security is a pain for both you and server. It's resources hungry and its rules need serious maintaining and it's going to be a neverending task. And no, it ...


2

I had the same problem on Centos 6.2 running exim4 with clamAV, solved it by adding clam user to the mail group. # usermod -a -G mail clam


2

You can probably safely install AIDE on a web server - adding and removing customers doesn't change too many configuration files, and you could probably filter out the normal chatter pretty easily. But something that a lot of web server security guides don't mention is that you should turn noexec on on your /tmp partition in /etc/fstab. If you're offering ...


2

if you installed clamav from the repository, using yum, then the scripts should have been installed and configured, when you installed the package. you can do something like ln -s /etc/init.d/clamd /etc/rc3.d/S90clamd, or, like you said, using chkconfig but again, if you installed from a package, all this should have been done for you.


2

You might want to have a look at MailCleaner commercial or Open Source.


2

My view is that 5% is trivial. If your web server actually needs all 2GB of RAM and you really can't spare that 5% you should be looking elsewhere for improvements and not jumping on clamd. ClamAV will detect some non-virus malware, which is not included in the claim that there are no Linux viruses (yet). Another consideration is email, regardless of the ...


2

All of the other answers for some reason seem to assume that clamd actually scans your system automatically. In reality, clamd does not scan your system on its own. All it does is wait for another process to ask it to scan the system, and thus doesn't do much more then speed up the "clamscan" procedure (since it doesn't have to reload virus definitions on ...


2

NOTE: You should immediately consult a Linux system security professional regarding your question as your system may be compromised. This looks like your system is likely compromised in some way. The folder described is presenting itself as a Linux "dot file". "Dot files" are usually used to store configuration data for programs, however, as you see in ...



Only top voted, non community-wiki answers of a minimum length are eligible