clamav and mailscanner

[Zivago Lee]

On 28/02/07, Zivago Lee <z at ziff.net> wrote:
> On Wed, 2007-02-28 at 10:01 +0100, Glenn Steen wrote:
> > On 28/02/07, Zivago Lee <z at ziff.net> wrote:
> > > I've been noticing an issue with clamav and mailscanner.  I can run
> > > clamscan just fine separately, however, in mailscanner, I get this
error
> > > in debug mode:
> > >
> > > Feb 26 13:18:38 www MailScanner[2871]: Commencing scanning by clamav...
> > > Feb 26 13:18:38 www MailScanner[2871]: ERROR: Unable to open file or
> > > directory
> > > Feb 26 13:18:38 www MailScanner[2871]: Completed scanning by clamav
> > > Any ideas on what directories I need it to give permissions on?
> >
> > /Var/spool/MailScanner/incoming perhaps?
>
> Here are my current perms:
>
> drwx------   4 postfix postfix  4096 Feb 28 07:49 incoming
>
> I don't think I changed anything recently besides updating clamav to
> 0.90.  Are these the correct perms for this directory?  I'm assuming
> that the postfix user is running clamscan so it shouldn't have any
> issues, correct?
>
Try it as that user:
su - postfix -s /bin/bash
clamscan ....
and perhaps try the wrapper too.
Should show a more eloquent error, if any.
When you call the wrapper, you should use the options as specified in
SweepViruses.pm ...
Something like
/usr/lib/MailScanner/clamav-wrapper /usr/local -r --disable-summary
--stdout .
.... somewhere appropriate.

Cheers
-- 
-- Glenn

> Check /usr/local/share/clamav/daily.inc. We've found several servers
> having problems after upgrading clamav to 0.90 and using clamavmodule.
> Seems like the new daily.inc directory has been created with the wrong
> permissions - it was 700 but I think needs to be 755 so that the
> mailscanner user can read it.
>
> --
> Regards,
> Sarah Trayser

Thanks Glenn and Sarah.  Using Glenn's suggestion I got this:

-sh-3.00$ clamscan
LibClamAV Error: cli_loaddbdir(): Can't open directory /var/clamav/daily.inc
ERROR: Unable to open file or directory

So it looks like Sarah is correct.  I did notice that I tried changing the
/var/clamav/daily.inc directory to 755 before to get the clamavmodule to
work but for some reason, it would change back to 700 after a day so I
went back to using the normal clamav as it would still process mail.  I'll
try it again but it looks that you guys found the culprit.

Thanks!
Zivago

--
Zivago Lee
z at ziff.net