Hi, clamav developers. I'm a new subscriber to this list
and want to propose a one patch to clamav, hope it will be
useful to others.
I'm was not satisfied with freshclam's option '--proxy-user=user:password',
because it opens a potential security hole: any console
user can watch proxy user's password by ps(1) and other
tools when freshclam is working. So, I'm decided to
add feature for reading such info from some file
(that might be protected from unwanted eyes by permissions etc).
So, I'm added additional option '--proxy-user-from=/path/to/secret/filename'
to freshclam. When this option specified then 'proxy-user' option
ignored. freshclam tries to open file, and read first line
from it, assuming it is 'user:password' string.
Some comments:
1. Patch based on v0.65 of clamav.
2. Patch works for me fine (FreeBSD 4.8 and 4.9).
3. Patch tries to report errors when it cannot read file.
4. I'm using static buffer. Function gets() with
limiting parameter used to prevent buffer overflows, I hope this OK.
Though FreeBSD's ports build warns about such usage of 'potentially
unsafe function' like it complains about use of tmpnam in many other
places.
5. Only first string of file is read, others ignored, newlines are OK,
but spare spaces at end of string is not. I'm not decided yet to trim
spaces at start and end of string or not.
Patch attached in this messages and listed here:
---------------------------------------------------------------------------------
diff -u -r clamav-0.65.prev/docs/man/freshclam.1 clamav-0.65/docs/man/freshclam.1
--- clamav-0.65.prev/docs/man/freshclam.1 Tue Nov 11 22:23:29 2003
+++ clamav-0.65/docs/man/freshclam.1 Thu Dec 4 19:25:24 2003
@@ -52,6 +52,9 @@
\fB\-\-proxy\-user=user:password\fR
Do proxy authorization for user. Password is required.
.TP
+\fB\-\-proxy\-user\-from=/path/secret-file\fR
+Read string 'username:password' from specified file instead of more insecure previous
option. Password is required.
+.TP
\fB\-\-daemon\-notify=/path/to/clamav.conf\fR
Notify the daemon about the new database. By default it reads a hardcoded config file
but you can use an another one. Both local and TCP sockets are supported.
.TP
diff -u -r clamav-0.65.prev/freshclam/freshclam.c clamav-0.65/freshclam/freshclam.c
--- clamav-0.65.prev/freshclam/freshclam.c Tue Nov 11 22:12:35 2003
+++ clamav-0.65/freshclam/freshclam.c Thu Dec 4 18:52:43 2003
@@ -349,6 +349,7 @@
mprintf(" --log-verbose save additional
informations\n");
mprintf(" --http-proxy=hostname[:port] use proxy server hostname\n");
mprintf(" --proxy-user=username:passwd use username/password for proxy
auth\n");
+ mprintf(" --proxy-user-from=/path/secret-file get username/password for proxy
auth from file\n");
#ifdef BUILD_CLAMD
mprintf(" --daemon-notify[=/path/clamav.conf] send RELOAD command to
clamd\n");
#endif
diff -u -r clamav-0.65.prev/freshclam/manager.c clamav-0.65/freshclam/manager.c
--- clamav-0.65.prev/freshclam/manager.c Tue Nov 11 23:26:10 2003
+++ clamav-0.65/freshclam/manager.c Thu Dec 4 21:04:17 2003
@@ -34,6 +34,7 @@
#include <fcntl.h>
#include <sys/stat.h>
#include <clamav.h>
+#include <errno.h>
#include "others.h"
#include "options.h"
@@ -104,13 +105,37 @@
struct cl_cvd *current, *remote;
int hostfd, nodb = 0, ret;
char *tempname, ipaddr[16];
- const char *proxy, *user;
+ const char *proxy, *user, *proxyuserfile;
+ char buf[256];
+ FILE *fd = NULL;
if((current = cl_cvdhead(localname)) == NULL)
nodb = 1;
- if(optl(opt, "proxy-user"))
+ if (optl(opt, "proxy-user-from"))
+ {
+ user = NULL;
+ proxyuserfile = getargl(opt, "proxy-user-from");
+ if((fd = fopen(proxyuserfile, "r")) == NULL)
+ {
+ fprintf(stderr, "ERROR: Cann't open proxy username:password file %s : %s
!\n", proxyuserfile, strerror(errno));
+ return 55; /* Return 'Error reading file' status. */
+ }
+
+ if (fgets(buf, sizeof(buf), fd) == NULL)
+ {
+ if (feof(fd))
+ fprintf(stderr, "ERROR: Zero-size proxy username:password file %s
!\n", proxyuserfile);
+ else if (ferror(fd))
+ fprintf(stderr, "ERROR: Failed to read proxy username:password file
%s : %s !\n", proxyuserfile, strerror(errno));
+ fclose(fd);
+ return 55; /* Return 'Error reading file' status. */
+ }
+ else
+ user = &buf[0];
+ fclose(fd);
+ }
+ else if(optl(opt, "proxy-user"))
user = getargl(opt, "proxy-user");
else
user = NULL;
diff -u -r clamav-0.65.prev/freshclam/options.c clamav-0.65/freshclam/options.c
--- clamav-0.65.prev/freshclam/options.c Sun Oct 26 00:24:34 2003
+++ clamav-0.65/freshclam/options.c Thu Dec 4 18:47:45 2003
@@ -51,6 +51,7 @@
{"checks", 1, 0, 'c'},
{"http-proxy", 1, 0, 0},
{"proxy-user", 1, 0, 0},
+ {"proxy-user-from", 1, 0, 0},
{"daemon-notify", 2, 0, 0},
{"on-update-execute", 1, 0, 0},
{"on-error-execute", 1, 0, 0},
---------------------------------------------------------------------------------
--
Антон Бреусов,
системный администратор
DIALLA Communications
рекламное агентство - http://www.dialla.com
Тел: (044) 490-6131, факс 490-6132diff -u -r clamav-0.65.prev/docs/man/freshclam.1 clamav-0.65/docs/man/freshclam.1
--- clamav-0.65.prev/docs/man/freshclam.1 Tue Nov 11 22:23:29 2003
+++ clamav-0.65/docs/man/freshclam.1 Thu Dec 4 19:25:24 2003
@@ -52,6 +52,9 @@
\fB\-\-proxy\-user=user:password\fR
Do proxy authorization for user. Password is required.
.TP
+\fB\-\-proxy\-user\-from=/path/secret-file\fR
+Read string 'username:password' from specified file instead of more insecure previous
option. Password is required.
+.TP
\fB\-\-daemon\-notify=/path/to/clamav.conf\fR
Notify the daemon about the new database. By default it reads a hardcoded config file
but you can use an another one. Both local and TCP sockets are supported.
.TP
diff -u -r clamav-0.65.prev/freshclam/freshclam.c clamav-0.65/freshclam/freshclam.c
--- clamav-0.65.prev/freshclam/freshclam.c Tue Nov 11 22:12:35 2003
+++ clamav-0.65/freshclam/freshclam.c Thu Dec 4 18:52:43 2003
@@ -349,6 +349,7 @@
mprintf(" --log-verbose save additional
informations\n");
mprintf(" --http-proxy=hostname[:port] use proxy server hostname\n");
mprintf(" --proxy-user=username:passwd use username/password for proxy
auth\n");
+ mprintf(" --proxy-user-from=/path/secret-file get username/password for proxy
auth from file\n");
#ifdef BUILD_CLAMD
mprintf(" --daemon-notify[=/path/clamav.conf] send RELOAD command to
clamd\n");
#endif
diff -u -r clamav-0.65.prev/freshclam/manager.c clamav-0.65/freshclam/manager.c
--- clamav-0.65.prev/freshclam/manager.c Tue Nov 11 23:26:10 2003
+++ clamav-0.65/freshclam/manager.c Thu Dec 4 21:04:17 2003
@@ -34,6 +34,7 @@
#include <fcntl.h>
#include <sys/stat.h>
#include <clamav.h>
+#include <errno.h>
#include "others.h"
#include "options.h"
@@ -104,13 +105,37 @@
struct cl_cvd *current, *remote;
int hostfd, nodb = 0, ret;
char *tempname, ipaddr[16];
- const char *proxy, *user;
+ const char *proxy, *user, *proxyuserfile;
+ char buf[256];
+ FILE *fd = NULL;
if((current = cl_cvdhead(localname)) == NULL)
nodb = 1;
- if(optl(opt, "proxy-user"))
+ if (optl(opt, "proxy-user-from"))
+ {
+ user = NULL;
+ proxyuserfile = getargl(opt, "proxy-user-from");
+ if((fd = fopen(proxyuserfile, "r")) == NULL)
+ {
+ fprintf(stderr, "ERROR: Cann't open proxy username:password file %s : %s
!\n", proxyuserfile, strerror(errno));
+ return 55; /* Return 'Error reading file' status. */
+ }
+
+ if (fgets(buf, sizeof(buf), fd) == NULL)
+ {
+ if (feof(fd))
+ fprintf(stderr, "ERROR: Zero-size proxy username:password file %s
!\n", proxyuserfile);
+ else if (ferror(fd))
+ fprintf(stderr, "ERROR: Failed to read proxy username:password file
%s : %s !\n", proxyuserfile, strerror(errno));
+ fclose(fd);
+ return 55; /* Return 'Error reading file' status. */
+ }
+ else
+ user = &buf[0];
+ fclose(fd);
+ }
+ else if(optl(opt, "proxy-user"))
user = getargl(opt, "proxy-user");
else
user = NULL;
diff -u -r clamav-0.65.prev/freshclam/options.c clamav-0.65/freshclam/options.c
--- clamav-0.65.prev/freshclam/options.c Sun Oct 26 00:24:34 2003
+++ clamav-0.65/freshclam/options.c Thu Dec 4 18:47:45 2003
@@ -51,6 +51,7 @@
{"checks", 1, 0, 'c'},
{"http-proxy", 1, 0, 0},
{"proxy-user", 1, 0, 0},
+ {"proxy-user-from", 1, 0, 0},
{"daemon-notify", 2, 0, 0},
{"on-update-execute", 1, 0, 0},
{"on-error-execute", 1, 0, 0},
