Changes for page ClamAV

From version 23.1
edited by fse
on 25.05.2022, 11:55
Change comment: Neues Bild de_plugin.png hochladen
To version 24.1
edited by fse
on 25.05.2022, 15:56
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -1,19 +1,34 @@
1 1  {{info}}
2 2  {{version major="7" minor="0" patch="13" showInfo="true"}}
3 -This plugin can only be used with {{formcycle/}} version 7.0.13 or higher.
3 +This plugin can only be used with {{formcycle/}} Version 7.0.13 or higher.
4 4  {{/version}}
5 5  {{/info}}
6 6  
7 -[[**Plugin download**>>https://customer.formcycle.eu/index.php/apps/files/?dir=/FORMCYCLE%20-%20Plugins%20Customer/fc-plugin-malware-scanner/ClamAV&fileid=40404]] (Requires login)
7 +[[**Plugin-Download**>>https://customer.formcycle.eu/index.php/apps/files/?dir=/FORMCYCLE%20-%20Plugins%20Customer/fc-plugin-malware-scanner/ClamAV&fileid=40404]] (requires login)
8 8  
9 9  {{content/}}
10 10  
11 -Uploaded files can be checked for viruses via the plug-in. For this purpose, this plugin is required as an activated system plugin and a running ClamAV-daemon service that can be accessed via TCP.
11 +With the free //ClamAV// plugin for {{formcycle/}} it is possible to scan uploaded files for viruses. For this purpose, this plugin establishes a connection to a //ClamAV// daemon service via TCP.
12 12  
13 -After this plugin has been installed, it must be configured. The configuration consists of specifying which {{smallcaps}}host:port{{/smallcaps}} combination is to be used. Furthermore, the transfer can be done with a {{smallcaps}}InputStream{{/smallcaps}} or working straight on the path.
13 +== Functionality ==
14 14  
15 -== Configuration ==
15 +; Immediate virus scan
16 +: Each file is scanned immediately after upload.
16 16  
18 +The used //ClamAV//-daemon service can neither be configured nor started by this plugin.
19 +
20 +== Installation ==
21 +
22 +The installation of the plugin has to be carried out via the interface of plugins provided for this purpose. Only the corresponding //jar// file has to be installed.
23 +
24 +{{info}}
25 + The //ClamAV// plug-in scans files in backend and fronted. To be always available to all users it is advisable to install the plugin as a system plugin. This also avoids possible problems with double-used ports and enables a central configuration.
26 +{{/info}}
27 +
28 +== Plugin configuration ==
29 +
30 +After saving, a ping test is automatically performed. If this fails, a message will be displayed. In this case all uploads in the backend or in the form will be marked as faulty - the plugin should be deactivated first and a working connection should be established.
31 +
17 17  {{figure image="en_error.png" width="400"}}
18 18   If no connection can be established to the specified host, this message is displayed.
19 19  {{/figure}}
... ... @@ -21,39 +21,122 @@
21 21  The following configuration parameters exist:
22 22  
23 23  ; host (Required)
24 -: Host name or IP address of the server running ClamAV-daemon. The standard port is {{smallcaps}}127.0.0.1{{/smallcaps}}, since ClamAV-daemon should be running on the same server as {{formcycle/}}.
39 +: Default value: //127.0.0.1//. Specifies the //IP// address of the //ClamAV//-daemon service to be used. The default value is //127.0.0.1// and thus uses a local //ClamAV//-daemon service.
25 25  ; port (Required)
26 -: The default port of ClamAV-daemon is {{smallcaps}}3310{{/smallcaps}}. If the port is different, it must be specified here.
41 +: Default value: //3310//. Specifies the port of the //ClamAV//-daemon service to use. The default value should only be changed if this port is not available.
27 27  ; file-source
28 -: By default, the element to be checked is transferred via Java's {{smallcaps}}InputStream{{/smallcaps}}. If the value {{smallcaps}}path{{/smallcaps}} is entered here, the path is used directly - whereby the ClamAV-daemon service must have root rights.
43 +: If the value //stream// is entered here (default value), the data of the file to be checked will be transferred directly to the //ClamAV//-daemon service. If the value //path// is entered here, scanning is done directly on the path - whereby the //ClamAV//-daemon service must have root rights for this.
29 29  
30 -After saving, a ping test is automatically executed. If this fails, a corresponding message is displayed. In this case, all uploads in the backend or in the form are marked as faulty - the plugin should first be deactivated and a functioning connection established.
45 +{{info}}
46 +//ClamAV// is intended to run on Linux-based servers. Therefore, we cannot guarantee any other support.
47 +{{/info}}
31 31  
32 -== ClamAV settings ==
33 33  
34 -The following section discusses important configuration steps of ClamAV-Daemon. Our recommended scenario is to install {{formcycle/}} and the ClamAV-Daemon service on the same server.
50 +== Configuration //ClamAV// ==
35 35  
36 -Since the actual virus scanning takes place separately from {{formcycle/}}, take care to keep the virus signature database up-to-date via {{smallcaps}}freshclam{{/smallcaps}}.
52 +The following section discusses installation and configuration of //ClamAV//. Our recommended scenario is to install {{formcycle/}} and the //ClamAV//-daemon service on the same server.
37 37  
38 -This plugin transmits the elements to be examined via TCP, which is deactivated by default in ClamAV-daemon. To enable it, the configuration file: {{smallcaps}}/etc/clamav/clamd.conf{{/smallcaps}} has to be edited.
54 +=== Installation ===
39 39  
40 -The following parameters have to be added to the file:
56 +To install //ClamAV// on a server, the following commands should be entered on the server.
41 41  
42 -; TCPAddr (Required)
43 -: Shall be added and specified with the value {{smallcaps}}127.0.0.1{{/smallcaps}}.
44 -; TCPSocket (Required)
45 -: Shall be added and specified with the value {{smallcaps}}3310{{/smallcaps}} or different, if the port is occupied.
46 -; User
47 -: By default this is {{smallcaps}}clamav{{/smallcaps}} and has to be changed to {{smallcaps}}root{{/smallcaps}} to give root rights to the ClamAV-daemon service.
58 +//ClamAV// is the program that can scan files for viruses and is required for the use of //ClamAV//-daemon.
48 48  
49 -{{figure image="en_tcp_test.png"}}
50 - With the help of {{smallcaps}}netstat{{/smallcaps}} the TCP socket of the ClamAV-daemon service can be examined.
51 -{{/figure}}
60 +; Update the package list:
61 +; {{code language="shell"}} sudo apt-get update {{/code}}
52 52  
53 -In order for this plugin to address the ClamAV-daemon service, the service has to be listening in the right place - in this case at {{smallcaps}}127.0.0.1:3310{{/smallcaps}}. This can be checked by the following command in the terminal:
63 +; Install //ClamAV// and //ClamAV//-daemon:
64 +; {{code language="shell"}} sudo apt-get install clamav clamav-daemon -y {{/code}}
54 54  
55 -{{code language="shell"}}
56 -sudo netstat -anp | grep -E "(clam)"
57 -{{/code}}
66 +=== Update the virus signature database ===
58 58  
68 +//freshclam// is automatically installed with //ClamAV// and is used to update the virus signature database.
59 59  
70 +; Terminate the automatic //freshclam// process:
71 +; {{code language="shell"}} sudo systemctl stop clamav-freshclam {{/code}}
72 +
73 +; Manually update virus signature database:
74 +; {{code language="shell"}} sudo freshclam {{/code}}
75 +
76 +=== Configuration //ClamAV//-daemon ===
77 +
78 +//ClamAV//-daemon is the process running in the background on the server, which is addressed for the virus scan. This is done via TCP and must be configured accordingly.
79 +
80 +For this purpose, the configuration file under: // /etc/clamav/clamd.conf // should be adapted.
81 +
82 +Open the configuration file:
83 +; {{code language="shell"}} sudo nano /etc/clamav/clamd.conf {{/code}}
84 +
85 +Use the arrow keys to navigate to the end of the file.
86 +
87 +; Add //TCPAddr 127.0.0.1 //
88 +; Add //TCPSocket 3310 //
89 +
90 +{{lightbox image="en_clamd.conf.png"/}}
91 +
92 +; Specify root rights for //ClamAV//-daemon
93 +: To do this, the row //User clamav// has to be changed to //User root// in this file.
94 +
95 +Now you can save and exit with //Ctrl + X//. Confirm with //Y// and the Enter key.
96 +
97 +=== Starting the //ClamAV//-daemon Service ===
98 +
99 +Now the service can be started.
100 +
101 +: Start the //ClamAV//-daemon Service:
102 +; {{code language="shell"}} sudo systemctl start clamav-daemon.service {{/code}}
103 +
104 +=== Checking the availability of the service ===
105 +
106 +In order for this plugin to be able to address the //ClamAV//-daemon service, the service must be listening in the right place - in this case at //127.0.0.1:3310//. This can be checked in the server's terminal.
107 +
108 +Using //netstat// the TCP socket of the //ClamAV//-daemon service can be examined.
109 +; {{code language="shell"}} sudo netstat -anp | grep -E "(clam)" {{/code}}
110 +
111 +{{lightbox image="en_tcp_test.png"/}}
112 +
113 +If no line starting with //tcp// is seen or a different //host:port// combination is seen as //127.0.0.1:3310//, the configuration has to be checked again.
114 +
115 +== Example configuration ==
116 +
117 +An example configuration with the above default values:
118 +
119 +{{lightbox image="en_plugin.png"/}}
120 +
121 +== Usage ==
122 +
123 +As soon as a virus signature has been detected, the following message is displayed:
124 +
125 +{{lightbox image="en_virus_found.png"/}}
126 +
127 +=== Test file ===
128 +
129 +A common method for checking virus scanners is the //eicar.com// file.
130 +At any point this test file can be uploaded and after successful configuration the message shown above should be seen.
131 +
132 +; [[**Wikipedia**>>https://de.wikipedia.org/wiki/EICAR-Testdatei]]
133 +; [[**Download**>>https://www.eicar.org/download-anti-malware-testfile/]]
134 +
135 +=== Logging ===
136 +
137 +//ClamAV// creates logs which can be found under // /var/log/clamav/clamav.log //.
138 +
139 +For example, after uploading the //eicar.com// test file, the following entry can be seen in //clamav.log //:
140 +; {{code language="shell"}} Wed May 25 10:10:21 2022 -> instream(127.0.0.1@32984): Win.Test.EICAR_HDB-1(44d88612fea8a8f36de82e1278abb02f:68) FOUND {{/code}}
141 +
142 +{{formcycle/}} logs can be found for this at // /formcycle-data/formcycle7/logs //.
143 +
144 +After uploading the //eicar.com// test file, for example, the following entry can be seen in //formcycle-errors-log //:
145 +; {{code language="shell"}} [WARN] [25-05-22 10:10:21,192] [ajp-nio-127.0.0.1-8009-exec-43] (MalwareScanner.java:211) - Scanner <fc.plugin.malware.scanner.clamAV. ClamAntiVirusFileScanner@7b2a4953> detected malware signature for file </home/fc/tomcat9/tmp/xima-temp/formcycle7/xfc-malware-scan/stream-scan12705251110052849842/data2383296604287452271>: {stream=[Win.Test.EICAR_HDB-1]} {{code}}
146 +; {{code language="shell"}} [ERROR] [25-05-22 10:10:21,207] [ajp-nio-127.0.0.1-8009-exec-43] (VirusScannerService.java:71) - Detected a virus {{/code}}
147 +
148 +== Version history ==
149 +
150 +**Version 1.0.1**
151 +
152 +* Optimisations for installation on server clusters
153 +
154 +**Version 1.0.0
155 +
156 +* Initial release
157 +