bbs/deb-mbse
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added documentation for stream scanning

Browse Source
This commit is contained in:
Michiel Broek 2008-02-17 21:51:43 +00:00
parent b2ad8fce19
commit 3e89ed19fb
2 changed files with 45 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -3,6 +3,11 @@ $Id$
v0.95.1 07-Jan-2008 v0.95.1 07-Jan-2008
upgrade:
Start mbsetup and exit. If you have a clamd running on some
server (or bbs machine), you can switch to use stream
scanning. See the manual for details.
mbselib.h: mbselib.h:
Added file virscan function. Added file virscan function.
Added stream scanning for ClamAV, scanning is 10 times faster Added stream scanning for ClamAV, scanning is 10 times faster

44
html/setup/virscan.html
View File

@ -14,7 +14,7 @@
</HEAD> </HEAD>
<BODY> <BODY>
<BLOCKQUOTE> <BLOCKQUOTE>
<div align='right'><h5>Last update 03-May-2004</h5></div> <div align='right'><h5>Last update 17-Feb-2008</h5></div>
<div align='center'><H1>MBSE BBS Setup - virus scanners</H1></div> <div align='center'><H1>MBSE BBS Setup - virus scanners</H1></div>
Once upon a time there was no DOS and no computer virusses. But since DOS was Once upon a time there was no DOS and no computer virusses. But since DOS was
@ -47,8 +47,7 @@ Can also be installed in sendmail or Postfix to scan incoming
and outgoing email. This may be a good idea if you run a email gateway. and outgoing email. This may be a good idea if you run a email gateway.
This version can be registered for personal use. This version can be registered for personal use.
<LI><strong>F-PROT</strong> available from <A <LI><strong>F-PROT</strong> available from <A
HREF="http://www.frisk.is">http://www.frisk.is</A>. For now the BETA releases are free HREF="http://www.frisk.is">http://www.frisk.is</A>. There is a free version for personal use.
for personal use.
<LI><strong>Clam AntiVirus</strong> is a GNU licensed virus scanner for Unix. It <LI><strong>Clam AntiVirus</strong> is a GNU licensed virus scanner for Unix. It
is available from <A HREF="http://www.clamav.net">www.clamav.net</A>. It has one is available from <A HREF="http://www.clamav.net">www.clamav.net</A>. It has one
slight disadvantage over other scanners (or just the opposite), when it tests a slight disadvantage over other scanners (or just the opposite), when it tests a
@ -60,7 +59,44 @@ As soon as you have made one scanner available in the setup and you receive file
in tic areas where the scan flag is set, then these files will be checked. in tic areas where the scan flag is set, then these files will be checked.
As soon as one of the scanners detects a virus the received file will not be imported. As soon as one of the scanners detects a virus the received file will not be imported.
Uploads from users will be checked with the installed virus scanners as well. Uploads from users will be checked with the installed virus scanners as well.
<p> <p>&nbsp;<p>
<H3>Stream scanners</H3>
<P>
A new feature is stream scanning. In this setup you need a virus scanner loaded as a daemon and it
must listen to a TCP/IP port to receive commands and data to scan. Currently this is only implemented
for ClamAV, but F-Prot may follow. First you need a machine where <b>clamd</b> is running, this
can be a remote machine but of course also the bbs machine itself. ClamAV needs to be configured
so that it listens to a TCP/IP port, and depending on other things on the local socket too.
Recent versions of ClamAV can do both together. Change your <code>/etc/clamav/clamd.conf</code> to
contain the following lines:
<pre>
# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
LocalSocket /var/run/clamav/clamd
# Remove stale socket after unclean shutdown.
# Default: no
#FixStaleSocket yes
# TCP port address.
# Default: no
TCPSocket 3310
# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
# Default: no
#TCPAddr 127.0.0.1
</pre>
I left the comment for the TCPaddr, but it's up to you to protect the clamd server. After you
restart <b>clamd</b> test the connection with <code>telnet host.where.clamd.runs 3310</code>,
type VERSION followed by a return and you should see the ClamAV version. If that works, you can enable
the ClamAV stream scanner in mbsetup and disable the old commandline scanner.<BR>
So why would you use this. It's about 10 times faster then the commandline scanner.
<P>
<A HREF="./"><IMG SRC="../images/larrow.png" ALT="Back" Border="0">Back to index</A>&nbsp; <A HREF="./"><IMG SRC="../images/larrow.png" ALT="Back" Border="0">Back to index</A>&nbsp;
<A HREF="../"><IMG SRC="../images/b_arrow.png" ALT="Home" Border="0">Back to main index</A> <A HREF="../"><IMG SRC="../images/b_arrow.png" ALT="Home" Border="0">Back to main index</A>