Hello Dianne & Bill, Thank you both for your replies..
@Dianne: I have already tested your recommendation, i.e. run mimedefang with the -G option and have the clamav user as member of the defang group. In particular, the startup parameters of both services are: /usr/bin/mimedefang -P /run/mimedefang.pid -o /var/spool/MIMEDefang/mimedefang.lock -m /var/spool/MIMEDefang/mimedefang-multiplexor.sock -y -R -1 -U defang -r -s -t -G -q -p inet:14865 /usr/bin/mimedefang-multiplexor -p /run/mimedefang-multiplexor.pid -o /var/spool/MIMEDefang/mimedefang-multiplexor.lock -m 2 -x 10 -y 0 -U defang -b 600 -r 200 -l -t /var/log/mimedefang/stats -Z -G -s /var/spool/MIMEDefang/mimedefang-multiplexor.sock .. and I get the issues with the Work files creation as initially mentioned, even though clamav user is a member of the defang group. Unfortunately, I cannot run clamav under defang due to admin restricions/policies. @Bill, as per the 0766 setting, I changed it as a troubleshooting method. The directory does not have 0766 permissions under normal operation. You are right in your statements and thank you for describing them in detail. I had checked the manual pages and found Dianne's recommendation, however as it was not working on our system I started searching even deeper. Anything else I can check regarding this error, should it provide more insight towards solving the issue? Thank you, Socrates -----Original Message----- From: MIMEDefang [mailto:[email protected]] On Behalf Of Bill Cole Sent: Wednesday, November 22, 2017 8:52 PM To: [email protected] Subject: Re: [Mimedefang] Error with mimedefang + clamd On 22 Nov 2017, at 10:11 (-0500), Info @ brainwash wrote: > /var/spool/MIMEDefang/ directory has rights 0766 and belongs to user > defang:defang (it is been reset to these values every time the > mimedefang service restarts or the server reboots). Dianne has already given the proper solution but this begs for a general warning... Setting the world-writable bit on any file or on a directory without also setting the sticky bit is a risky action. You should NEVER leave a file or directory world-writable. Also on directories, it is generally not useful to set read bits without also setting the execute (i.e. search, for directories) bits. > From what I found when Googling this error, the issue is that > MIMEDefang cannot create the work directory thus Clam cannot find the > file to scan. It's usually best to read the man pages that are written by the author of a program before searching for random answers on the web who may not understand their problem, may not be getting an error message for the same reason you are, and may be using a version (or platform variant) that is unlike yours. This looks to me like a wrong answer but it really does not matter because the fix is simple and clearly documented in the mimedefang man page. > I tried to make the directory 0777 and even change the users using > chown, to no effect. Reiterating the above: don't set the world-writable bit anywhere except on shared directories with the sticky bit set (e.g. /tmp and /var/tmp use mode 1777) and (sometimes) sockets and devices. It's not a safe solution to any problem and usually isn't even helpful as a troubleshooting tool. MIMEDefang by design creates and destroys many files and directories for short lives, so for safety it needs to manage permissions itself very carefully and tightly. It cannot rely on sysadmins creating safe working ownership and permission constructs because it is a known fact that many sysadmins never actually read documentation. It is conceivable that MD could have been written to be entirely ignorant of security issues and rely on sysadmins to use whatever mix of standard ownership & permissions, BSD setgid semantics, and ACLs is available and necessary to allow everything MD does to work safely. I believe that if that were the case, MD would have a reputation of being hard to make work and grossly insecure. It's better this way. -- Bill Cole [email protected] or [email protected] (AKA @grumpybozo and many *@billmail.scconsult.com addresses) Currently Seeking Steady Work: https://linkedin.com/in/billcole _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list [email protected] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list [email protected] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
