2

I may be misunderstanding how to utilize clamd. I've got a situation where I have a media server that isn't quite powerfull enough to scan files as well as host the other services it is running (raspberry pi). While I was looking through clamd.conf and man pages, it looks like there is an option to have clamd listen on a specified IP address and socket. Is there a way to stream files from a remote file server to another machine running clamd to be scanned?

I've also come accross this "remote clamd scanning" though it even points out in the code

You must be using a local socket to scan local files

(it also is designed to scan a single file at a time, rather than a directory which would be nice)

A similar question has been asked here though as sandroid was pointing out

Clamd sits and listens for instructions on what files need to be scanned, that is the communication it receives via TCP. We need to know how it accesses the mail files to be scanned...

So, is remote file scanning not supported by clamd? If not, what would be the best approach to scan remote files? I could rsync over the files temporarly and scan them or configure raspbian as a file server and mount it to the machine I am hosting the clamd service. If there are better recomendations, it would be much appreciated.

2 Answers 2

2

I agree with jezzaaaa on the above answer, you can indeed configure the client/server accordingly with your needs. For example:

If you want a clamaV to be the server that will be doing the scanning and catch the infected files, here is the configuration for Ubuntu 20.04...

SERVER SIDE

# Install the 'daemon and freshclam'
sudo apt install -y clamav-daemon clamav-freshclam

Make it available for receiving the requests listen on port 3310 adding the option 'TCPSocket 3310' on '/etc/clamav/clamd.conf' file.

Done, the server is now listening and waiting for requests.

CLIENT SIDE

# Install the 'clamdscan', this will install other things, you can remove them
sudo apt install -y clamdscan

# Remove the extra from the client machine
sudo apt remove -y clamav-daemon clamav-freshclam

Add the option TCPAddr and TCPSocket (TCPAddr 1.2.3.4 TCPSocket 3310) and remove (LocalSocket) from the client on /etc/clamav/clamd.conf file.

Tests on client

~$ clamdscan -v ~/infected-file.txt
~$ clamdscan -v ~/document-file.pdf

If the server and the client machines can communicate over port 3310, the outputs should be recorded on the server machines where you have the clamav-daemon running.

1

ClamAV supports using clamdscan with the "--stream" option. You can provide the file to the clamdscan client, and it will send the file across the network to the clamd instance to do the scanning.

Configure clamd to listen for remote connections over TCP, by specifying TCPSocket and TCPAddr. The TCPAddr tells clamd what IP address to listen on.

Then on your Pi, configure the same settings for TCPSocket and TCPAddr. When clamdscan is run, it will connect to the server running clamd, and send the file as a stream. (On your Pi, you only need to specify TCPSocket and TCPAddr; all the other options from clamd.conf can be left out.)

2
  • Thank you for your answer, though could you expand it a bit more as an example? Say I have a server running clamd and the server has a local IP of 192.168.0.7, would I configure that server running clamd to listen on the same IP?
    – BobserLuck
    Jun 30, 2020 at 4:27
  • Yes. If clamd doesn't find TCPAddr in it clamd.conf, it will not listen on TCP, only on a local socket. This is the default behaviour. So on the server running clamd, you add TCPAddr and TCPsocket to clamd.conf. Restart clamd. Then, you can either copy clamd.conf to the client, in which case clamdscan will only get TCPAddr and TCPsocket from the file, or create a new clamd.conf with only those two parameters in it.
    – jezzaaaa
    Jul 1, 2020 at 5:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .