Re: [Clamav-devel] ClamWin 0.1c released on SourceForge
On Wed, 31 Mar 2004 21:12:36 +0200 Tomasz Papszun <[EMAIL PROTECTED]> wrote: On Sat, 27 Mar 2004 at 19:05:12 +1100, Alex Cherney wrote: [...] 4. You need to be an administrator on NT/2000/XP in order to install it Which is often out of discussion in corporate environment. Pity :-( . Well, in order to install windows explorer context menu shell extension you need to write to HKEY_CLASSES_ROOT registry key, it won't work otherwise. If you leave explorer menu integration out during setup then you can install as ordinary user. Current setup though it will complain about HKEY_LOCAL_MACHINE because it writes installation path there, I will change it in future so it will be possible to install without admin privileges when Explorer integration is not selected. (write permissions to HKEY_LOCAL_MACHINE are necessary). However you may run it in an ordinary user account from python sources. Tomasz Kojm wrote: Kurde, tego listu (od Cherneya) tez nie dostalem. I will repost last message for those who didn't get it... I am working on new release with more settings (as Tomasz Kojm suggested) and MS Outlook integration. --- Hi, I have decided to rename WinClamAV to ClamWin, which in my opinion is shorter and easier to pronounce. Also the project has been moved to http://clamwin.sourceforge.net (Please update name and links on www.clamav.net contrib and binary pages) Now to the software. I have made several updates to the program (release 0.1c): 1. Main scanner window applicaton runs on Linux too. All you need is Python 2.2 and lates wxPython rpm (http://www.wxpython.org/download.php#binaries). Then download the source code, or get it from CVS and run python ClamWin.py. Please let me know how it goes as I only tested it on RH9. 2. Scanner will display the contents of log file (created with --log option) at the end of scan, so errors/infected files are displayed. 3. \tmp directory woes have been solved by adding HKEY_LOCAL_MACHINE\SOFTWARE\Cygnus Solutions\Cygwin\mounts v2\/tmp registry key 4. You need to be an administrator on NT/2000/XP in order to install it (write permissions to HKEY_LOCAL_MACHINE are necessary). However you may run it in an ordinary user account from python sources. Regards, Alex --- --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] clamav-milter (logging, notify to postmaster, reject message)
On Thursday 01 April 2004 03:39, Antony Stone wrote: > All your suggestions assume that ClamAV is running in combination with > sendmail Yes. I write in subject: "clamav-milter". It's all only for it. > This is not a safe assumption. People use ClamAV with all sorts of different > MTAs - probably sendmail, exim, postfix and qmail are the most common, but > there may well be more. "milter" is a sendmail's filter interface. All it can't use "clamav-milter", it's use clamd directly or via over interfaces. Once again: the subject point to sendmail only. I'm not interest about problems with other MTA now. ;-) -- regards, Sergey [EMAIL PROTECTED] --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] clamav-milter (logging, notify to postmaster, reject message)
On 2004-03-31, Antony Stone wrote: >On Wednesday 31 March 2004 10:33 pm, Sergey wrote: > >> I think produce to discussion some patch. > >All your suggestions assume that ClamAV is running in combination with >sendmail (and, perhaps, combined in a very particular way). A quick look into his patch shows that the only part of clamav which gets modified is clamav-milter, so all these assumptions are right ;) s. -- (0> Jakub Jankowski [url]: s.atn.pl "Nawet w Krainie Czarow //\ [EMAIL PROTECTED] [rlu]: 174516 latwiej jest spotkac V_/_ [EMAIL PROTECTED] [ekg]: 921514 Babe Jage niz Alicje" Fingerprint: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] clamav-milter (logging, notify to postmaster, reject message)
Antony Stone wrote: On Wednesday 31 March 2004 10:33 pm, Sergey wrote: Hello. I think produce to discussion some patch. All your suggestions assume that ClamAV is running in combination with sendmail (and, perhaps, combined in a very particular way). which is generaly a valid assumption for clamav-milter on a semi related note, is there a "clamdstreamscan" available? --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] clamav-milter (logging, notify to postmaster, reject message)
On Wednesday 31 March 2004 10:33 pm, Sergey wrote: > Hello. > > I think produce to discussion some patch. All your suggestions assume that ClamAV is running in combination with sendmail (and, perhaps, combined in a very particular way). This is not a safe assumption. People use ClamAV with all sorts of different MTAs - probably sendmail, exim, postfix and qmail are the most common, but there may well be more. Also, people use many different ways to interface the MTA with ClamAV - some use a milter, some use procmail, some use MailScanner, some use other methods... So, although your ideas may be good ones, they must be able to be implemented in a very wide variety of settings (to give you an example, when ClamAV is used under MailScanner, it gets called as a simple anti-virus file scanner - ClamAV itself has (a) no idea it's being used in an email environment, and (b) no way of interacting with the MTA receiving the email (to give a filure response) because by the time ClamAV sees the file, the email has been completely received and locally stored). Regards, Antony. -- Programming is a Dark Art, and it will always be. The programmer is fighting against the two most destructive forces in the universe: entropy and human stupidity. They're not things you can always overcome with a "methodology" or on a schedule. - Damian Conway, Perl God Please reply to the list; please don't CC me. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] ClamWin 0.1c released on SourceForge
On Wed, 31 Mar 2004 at 22:45:51 +0200, Diego d'Ambra wrote: > > > > On Sat, 27 Mar 2004 at 19:05:12 +1100, Alex Cherney wrote: > > [...] > > > 4. You need to be an administrator on NT/2000/XP in order to install > it > > > > Which is often out of discussion in corporate environment. > > Pity :-( . > > It's easy to create and distribute the installation as a MSI package. An > administrator can then publish this package through an AD Group Policy But I just was talking about a situation where an administrator is _not_ going to bother himself with any "strange", unofficial etc. software. And not only because of laziness but also due to the corporate policy. > (works on Win2k/XP with Win2K/2003 domain) and this doesn't require the > user be an administrator. > > If you run WinNT domain and/or workstations you'll need to create a > script that runs the installation with "run as" rights. > > Installation of AV software with these methods is normal :-) Yes, of a software approved by the corporate policy. And I'm talking about a user who wants to install Clamav on his own. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
[Clamav-devel] clamav-milter (logging, notify to postmaster, reject message)
Hello. I think produce to discussion some patch. It's contain *1*. modified reply message for sendmail: 2004-04-01 02:10:24 sendmail[11026]: i2VLANKk011026: to=, delay=00:00:01, pri=3 0539, stat=Exploit.HTML.Bagle.Gen-3-eml virus detected by ClamAV - http://www.clamav.net Initial code from Bryan Swanson, rewrited by Andrey J. Melnikoff reason: It message may be to see in DSN: === - The following addresses had permanent fatal errors - (reason: 550 5.7.1 Worm.BugBear.B virus detected by ClamAV - http://www.clamav.net) - Transcript of session follows - ... while talking to xx: >>> DATA <<< 550 5.7.1 Worm.BugBear.B virus detected by ClamAV - http://www.clamav.net 554 5.0.0 Service unavailable = *2*. two modifications for E-Mail notification a) rfc-compatible received from local server: Received: from qwerty (qqq.eee.com [xx.xx.xx.xx]) by srv7.kraft-s.ru (clamav-milter 0.70c) with id i2VKJ6Tb015441; Thu, 01 Apr 2004 01:19:10 +0500 (SAMST) Received: From: [EMAIL PROTECTED] To: <[EMAIL PROTECTED]> Date: Wed, 31 Mar 2004 15:15:51 -0500 Subject: Delivery Failure: Re: Extended Mail X-Mailer: SurfControl E-mail Filter b) X-Infected-Received-From in header : X-Infected-Received-From: qqq.eee.com [xx.xx.xx.xx] first is a standart form of important data, second is very usable for sorting (for example by Sieve) *3*. improved (I think :-) ) logging with sendmail's Message Id in each line. It's usable for greping all data about message in maillog. The patch written for last CVS snapshot where compilation of clamav-milter is possible. Patch: http://hippo.ru/~asy/clamav/clamav-log-and-notify.patch snapshot (just in case): http://hippo.ru/~asy/clamav/clamav-20040328.tar.gz -- Regards, Sergey PS: sorry for my english :-( --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
[Clamav-devel] Patch for milter to build
The following patch makes clamav-milter build for me on a RH 9 box: --- clamav-0.70pre2/clamav-milter/Makefile.am 2004-03-31 10:32:40.0 -0800 +++ clamav-0.70pre.new/clamav-milter/Makefile.am2004-03-31 12:35:06.0 -0800 @@ -24,6 +24,8 @@ clamav_milter_SOURCES = \ $(top_srcdir)/shared/cfgparser.c \ $(top_srcdir)/shared/cfgparser.h \ +$(top_srcdir)/shared/memory.c \ +$(top_srcdir)/shared/memory.h \ $(top_srcdir)/shared/getopt.c \ $(top_srcdir)/shared/getopt.h \ clamav-milter.c --- clamav-0.70pre2/clamav-milter/clamav-milter.c.orig 2004-03-31 10:32:41.0 -0800 +++ clamav-0.70pre.new/clamav-milter/clamav-milter.c2004-03-31 12:29:15.0 -0800 @@ -493,7 +493,7 @@ #endif #include "defaults.h" -#include "cfgfile.h" +#include "cfgparser.h" #include "../target.h" #include "str.h" #include "../libclamav/others.h" You'll have to run automake in the base directory of the source (which will regenerate the amavis-milter/Makefile.in, among others) and then ./configure should build the Makefile. It builds for me, YMMV. Blue skies... Todd --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] ClamWin 0.1c released on SourceForge
On Wed, 31 Mar 2004 21:12:36 +0200 Tomasz Papszun <[EMAIL PROTECTED]> wrote: > On Sat, 27 Mar 2004 at 19:05:12 +1100, Alex Cherney wrote: > [...] > > 4. You need to be an administrator on NT/2000/XP in order to install > > it > > Which is often out of discussion in corporate environment. > Pity :-( . > > > (write permissions to HKEY_LOCAL_MACHINE are necessary). However you > > may run it in an ordinary user account from python sources. Kurde, tego listu (od Cherneya) tez nie dostalem. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Wed Mar 31 22:42:56 CEST 2004 pgp0.pgp Description: PGP signature
Re: [Clamav-devel] clamav-milter StreamMaxLength option
On Wednesday 31 Mar 2004 9:30 pm, Joe Maimon wrote: > I saw the below patch in cvs. I just want to point out that I dont think > will work. Thanks for this. I will keep it until 0.70 is out, I am working on that at the moment. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
RE: [Clamav-devel] ClamWin 0.1c released on SourceForge
> -Original Message- > From: [EMAIL PROTECTED] [mailto:clamav-devel- > [EMAIL PROTECTED] On Behalf Of Tomasz Papszun > Sent: 31. marts 2004 21:13 > To: [EMAIL PROTECTED] > Subject: Re: [Clamav-devel] ClamWin 0.1c released on SourceForge > > On Sat, 27 Mar 2004 at 19:05:12 +1100, Alex Cherney wrote: > [...] > > 4. You need to be an administrator on NT/2000/XP in order to install it > > Which is often out of discussion in corporate environment. > Pity :-( . > It's easy to create and distribute the installation as a MSI package. An administrator can then publish this package through an AD Group Policy (works on Win2k/XP with Win2K/2003 domain) and this doesn't require the user be an administrator. If you run WinNT domain and/or workstations you'll need to create a script that runs the installation with "run as" rights. Installation of AV software with these methods is normal :-) Best regards, Diego d'Ambra smime.p7s Description: S/MIME cryptographic signature
[Clamav-devel] clamav-milter StreamMaxLength option
I saw the below patch in cvs. I just want to point out that I dont think
will work.
A) len will typically be a "chunk" of size MILTER_CHUNK_SIZE (65535)
B) sendmail libmilter calls the xxfi_body callback once for each chunk
of body
C) clamfi_send should only be called if len > 0 and from then on we
should just continue, returning SMFIS_CONTINUE
D) however, we do not want to return until after the code which stores
the body for the signature addition. The whole body needs to be sent
back to sendmail for that to work. So we need to store it all.
E)its logVerbose, not legVerboze
F) we need to check that we only do the syslog statement once per body,
not once per body chunk.
Attached is a patch that does the above for me.
I have also attached a patch which demonstrates how clamd can actualy
accept up to the StreamMaxLength option and scan it, instead of aborting.
Thanks for your consideration and (hopefully) feedback.
Joe
cvs diff -u -D yesterday clamav-milter/clamav-milter.c
Index: clamav-milter/clamav-milter.c
===
RCS file: /cvsroot/clamav/clamav-devel/clamav-milter/clamav-milter.c,v
retrieving revision 1.65
diff -u -r1.65 clamav-milter.c
--- clamav-milter/clamav-milter.c 27 Mar 2004 21:44:21 - 1.65
+++ clamav-milter/clamav-milter.c 31 Mar 2004 19:59:27 -
@@ -1785,12 +1785,24 @@
clamfi_body(SMFICTX *ctx, u_char *bodyp, size_t len)
{
struct privdata *privdata = (struct privdata *)smfi_getpriv(ctx);
+ size_t maxzise = 0;
+ struct cfgstruct *cpt = NULL;
if(logVerbose)
syslog(LOG_DEBUG, "clamfi_envbody: %u bytes", len);
#ifdef CL_DEBUG
cli_dbgmsg("clamfi_envbody: %u bytes\n", len);
#endif
+ if((cpt = cfgopt(copt, "StreamMaxLength")))
+ {
+ if(cpt->numarg < len)
+ {
+ if(logVerboze)
+ syslog(LOG_INFO, "clamfi_envbody: %u is
more than StreamMaxLength option of %u",len, cpt->numarg);
+ len = cpt->numarg;
+ }
+ }
+
if(clamfi_send(privdata, len, (char *)bodyp) < 0) {
clamfi_cleanup(ctx);
--- clamav-0.70-rc/clamav-milter/clamav-milter.cMon Mar 15 15:03:13 2004
+++ clamav-0.70-rc-jm/clamav-milter/clamav-milter.c Tue Mar 30 18:29:39 2004
@@ -566,6 +566,7 @@
char*filename; /* Where to store the message in quarantine */
u_char *body; /* body of the message if Sflag is set */
size_t bodyLen;/* number of bytes in body */
+ size_t nWritten; /* number of bytes we have written */
header_list_t headers; /* Message headers */
};
@@ -1914,17 +1915,14 @@
clamfi_body(SMFICTX *ctx, u_char *bodyp, size_t len)
{
struct privdata *privdata = (struct privdata *)smfi_getpriv(ctx);
+ struct cfgstruct *cpt = NULL;
+ size_t sendlen = 0;
if(logVerbose)
syslog(LOG_DEBUG, "clamfi_envbody: %u bytes", len);
#ifdef CL_DEBUG
printf("clamfi_envbody: %u bytes\n", len);
#endif
-
- if(clamfi_send(privdata, len, (char *)bodyp) < 0) {
- clamfi_cleanup(ctx);
- return cl_error;
- }
if(Sflag) {
if(privdata->body) {
assert(privdata->bodyLen > 0);
@@ -1938,6 +1936,41 @@
privdata->bodyLen = len;
}
}
+
+ if((!quarantine_dir)
+ && (cpt = cfgopt(copt, "StreamMaxLength"))
+ && cpt->numarg < (len + privdata->nWritten)
+ ){
+ sendlen = (cpt->numarg - privdata->nWritten);
+ if(use_syslog && privdata->nWritten != cpt->numarg){
+ char buf[1024];
+ strncpy(buf,privdata->from,sizeof(buf));
+ syslog(LOG_INFO,"Stream from %s size exceeded max of %u ,
already wrote %u, will write %u more instead of len %u",
+ buf,
+ cpt->numarg,
+ privdata->nWritten,
+ sendlen,
+ len);
+ }
+ }
+ else {
+ sendlen = len;
+ }
+
+ if(!sendlen)
+ return SMFIS_CONTINUE;
+
+
+ if(sendlen && (clamfi_send(privdata, sendlen, (char *)bodyp) < 0)) {
+ clamfi_cleanup(ctx);
+ return cl_error;
+ }else
+ {
+ if(sendlen)
+ privdata->nWritten += sendlen;
+ }
+
+
return SMFIS_CONTINUE;
}
@@ -2389,6 +2422,7 @@
printf("clamfi_send: len=%u bufsiz=%u\n", len, sizeof(output));
#endif
+ errno = 0;
while(len > 0) {
const int nbytes = (quarantine_dir) ?
write(p
Re: [Clamav-devel] ClamWin 0.1c released on SourceForge
On Sat, 27 Mar 2004 at 19:05:12 +1100, Alex Cherney wrote: [...] > 4. You need to be an administrator on NT/2000/XP in order to install it Which is often out of discussion in corporate environment. Pity :-( . > (write permissions to HKEY_LOCAL_MACHINE are necessary). However you may > run it in an ordinary user account from python sources. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
Re: [Clamav-devel] request: integrate LogFile stderr patch
On Tue, 30 Mar 2004 16:00:50 -0800 James Couzens <[EMAIL PROTECTED]> wrote: > There is a patch available to clamav that affords the functionality of > logging to stderr, I would love to see this become a permanent part of > the ClamAV package. Is this possible? Due to many requests it will be incorporated yet before 0.70. > The patch can be found here. The reason? It means I can use multilog > logging, which then enables me to easily generate graphs using RRDTool > all with the same program (which parses multilog generated logfiles). -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Wed Mar 31 09:38:02 CEST 2004 pgp0.pgp Description: PGP signature
Re: [Clamav-devel] request: integrate LogFile stderr patch
On Wednesday 31 Mar 2004 1:00 am, James Couzens wrote: > There is a patch available to clamav that affords the functionality of > logging to stderr, I would love to see this become a permanent part of > the ClamAV package. Is this possible? Why can't you set the LogFile in clamav.conf to be /dev/stderr? > Cheers, > > James -Nigel --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-devel
