On 01/27/2008 08:54 PM, Carlos E. R. wrote:
The Sunday 2008-01-27 at 08:43 +0800, Joe Morris wrote:
> On 01/27/2008 04:03 AM, Carlos E. R. wrote:
>>
>> I'll give clamav a try, but I have to find a way to disable
"antivir": I
>> do not want both running. I'll check the config.
> Check the clamd entry in amavisd.conf. All you would need to do is
comment out the entry for antivir for it not to be used.
I had to do way more.
First, comment out the section for antivir in amavis:
### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira
Antivirus
#Cer
# ['Avira AntiVir', ['antivir','vexira'],
# '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/,
# qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) |
# (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/ ],
# # NOTE: if you only have a demo version, remove -z and add 214,
as in:
# # '--allfiles -noboot -nombr -rs -s {}', [0,214], qr/ALERT:|VIRUS:/,
This was all I was talking about, to NOT use antivir.
After installing clamav and started its daemon, amavis only detected
clamav as secondary scanner and as program, not daemon. I had to
un-comment clamd section:
# ### http://www.clamav.net/
# Cer
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
# # NOTE: run clamd under the same user as amavisd, or run it under
its own
# # uid such as clamav, add user clamav to the amavis group, and
then add
# # AllowSupplementaryGroups to clamd.conf;
# # NOTE: match socket name (LocalSocket) in clamav.conf to the socket
name in
# # this entry; when running chrooted one may prefer socket
"$MYHOME/clamd".
This was mentioned in the thread.
But amavis failed to use it, because the socket was wrong. I had to
edit "/etc/clamd.conf":
Better to edit amavisd.conf above to the correct path and name of the
clamd socket, i.e. /var/lib/clamsv/clamd-socket
--
Joe Morris
Registered Linux user 231871 running openSUSE 10.3 x86_64
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
