clamav

[oconshaw]

Using modoboa 1.8.2

I don't think clamav is working quite right. When I check the maillog I see nothing about infected messages even though I have sent test EICAR test files to my email account. The files reach my email account without being flagged at all.
I can see that clamav is running, but it doesn't seem to be working:
amavis 883 1 0 07:34 ? 00:00:23 /usr/sbin/clamd -c /etc/clamd.d/amavisd.conf --foreground=yes

In /etc/amavisd/amavisd.conf I can see that clamav seems to be called correctly by amavis; at least I think this is where avamis calls clamav:
['ClamAV-clamd',
&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamd.amavisd/clamd.sock"],
qr/\bOK$/m, qr/\bFOUND$/m,
qr/^.?: (?!Infected Archive)(.) FOUND$/m ],

How do I troubleshoot this?

[tonioo]

@oconshaw How did you install modoboa?

[tonioo]

@oconshaw ping

[oconshaw]

I installed it per your instructions using the installer.

[tonioo]

@oconshaw Can you check the /etc/amavis/conf.d/15-content_filter_mode file please?

[oconshaw]

This is on CENTOS7. Not sure if that matters in this case. There is no amavis directory at that location. Doing a find on the server, there is no file called ‘15-content_filter_mode’ There is a folder called amavisd. And in there is an amavisd.conf file. Is that what you want? From: Antoine Nguyen [mailto:notifications@github.com] Sent: Friday, November 10, 2017 9:31 AM To: modoboa/modoboa-amavis <modoboa-amavis@noreply.github.com> Cc: oconshaw <oconshaw@gmail.com>; Mention <mention@noreply.github.com> Subject: Re: [modoboa/modoboa-amavis] clamav (#65) @oconshaw <https://github.com/oconshaw> Can you check the /etc/amavis/conf.d/15-content_filter_mode file please? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#65 (comment)> , or mute the thread <https://github.com/notifications/unsubscribe-auth/AYMBgUqWGPy6VC7SjscuHYUvL4kOlGSqks5s1GwfgaJpZM4P3Zni> . <https://github.com/notifications/beacon/AYMBgdlaLHsdyK5G5Fj3OMVXROiHe1lkks5s1GwfgaJpZM4P3Zni.gif>

[tonioo]

My bad, the configuration file is /etc/amavisd.conf. At the begining of this file, you should see something like @bypass_virus_checks_maps = (1);. Is it commented or not?

[oconshaw]

It is commented. From: Antoine Nguyen [mailto:notifications@github.com] Sent: Friday, November 10, 2017 9:52 AM To: modoboa/modoboa-amavis <modoboa-amavis@noreply.github.com> Cc: oconshaw <oconshaw@gmail.com>; Mention <mention@noreply.github.com> Subject: Re: [modoboa/modoboa-amavis] clamav (#65) My bad, the configuration file is /etc/amavisd.conf. At the begining of this file, you should see something like @bypass_virus_checks_maps = (1);. Is it commented or not? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#65 (comment)> , or mute the thread <https://github.com/notifications/unsubscribe-auth/AYMBgdRmpPoW9WReKaWqN-jW8HOXZGy3ks5s1HENgaJpZM4P3Zni> . <https://github.com/notifications/beacon/AYMBgceYJkzhkW8k7WAXz-PYgzmanwcEks5s1HENgaJpZM4P3Zni.gif>

[tonioo]

So clamd should be used... Can you check amavis startup logs to see if it finds clamav?