Перехожу с drweb на clamav0.8
не удается прикрутить clamav-milter к sendmail-8.12.11, ось freeBSD-4.10
В логах вижу:
sm-mta: Milter (clmilter): error connecting to filter: Connection refused by /var/run/clamav/clmilter.sock

Объясните, что сие значит.

• Clamav-milter,andrey, 08:02 , 29-Ноя-04
  • Clamav-milter,lavr, 11:26 , 29-Ноя-04
    • Clamav-milter,andrey, 11:14 , 30-Ноя-04
      • Clamav-milter,andrey, 04:16 , 01-Дек-04
      • Clamav-milter,lavr, 15:57 , 01-Дек-04
  • Clamav-milter,Walter, 22:31 , 14-Фев-05
    • Clamav-milter,Purple, 15:28 , 16-Фев-05

clamav08 портировал,
поставил вместе drweb и clamav в sendmaile
trusted users: drweb clamav
прописал как в мануале clamav, собрал

kern.maxfiles=8000
kern.ipc.somaxconn=32768
gcc 2.95.4

drwebd и drweb-smf работает под smmsp, все нормально.
clamd и clamav-milter работают тоже под smmsp,
сокет имеет права: srwx------     smmsp smmsp     clmilter.sock

в логах error connect to filter
что sm-mta надо еще????

>clamav08 портировал,
>поставил вместе drweb и clamav в sendmaile
>trusted users: drweb clamav
>прописал как в мануале clamav, собрал
>
>kern.maxfiles=8000
>kern.ipc.somaxconn=32768
>gcc 2.95.4
>
>drwebd и drweb-smf работает под smmsp, все нормально.
>clamd и clamav-milter работают тоже под smmsp,
>сокет имеет права: srwx------     smmsp smmsp  
>  clmilter.sock
>
>в логах error connect to filter
>что sm-mta надо еще????

вероятно правильную строку MILTER фильтра в sendmail.cf, правильно
настроенный clamav.conf и правильно запущенные clamav-milter и clamd

а информации ты выдал НУЛЬ, поэтому и совет самый общий.

Большое спасибо, что откликнулся.

Права на папки выставлены, логи clamd:

+++ Started at Mon Nov 29 11:39:39 2004
clamd daemon 0.80 (OS: freebsd4.10, ARCH: i386, CPU: i386)
Log file size limited to 1048576 bytes.
Running as user smmsp (UID 25, GID 25)
Reading databases from /var/clamav/base
Protecting against 27566 viruses.
Unix socket file /var/clamav/run/clamd
Setting connection queue length to 15
Archive: Archived file size limit set to 10485760 bytes.
Archive: Recursion level limit set to 5.
Archive: Files limit set to 1000.
Archive: Compression ratio limit set to 250.
Archive support enabled.
Archive: RAR support disabled.
Portable Executable support enabled.
Mail files support enabled.
OLE2 support enabled.
HTML support enabled.
Self checking every 1800 seconds.
Socket file removed.
Pid file removed.
Exiting (clean)
--- Stopped at Mon Nov 29 11:42:02 2004

fresh запускается и обновляет базы
сокеты создаются

sendmail.mc

INPUT_MAIL_FILTER(`clmilter', `S=/var/clamav/run/clmilter.sock, F=, T=S:4m;R:4m')
define(`confINPUT_MAIL_FILTERS', `clmilter')

--------------------------------------------------

запуск идет через /etc/rc.sendmail
когда запускал в ./rc.d/clamd.sh
sendmail ругался и я решил перенести:

echo -n ' clamd '
/usr/local/sbin/clamd
echo -n ' clmilter '
sleep 2
/usr/local/sbin/clamav-milter -ol local:/var/clamav/run/clmilter.sock
sleep 5

if [ -r /etc/defaults/rc.conf ]; then
    . /etc/defaults/rc.conf
    source_rc_confs
elif [ -r /etc/rc.conf ]; then

    . /etc/rc.conf
fi
......

-----------------------------------------------

clamav.conf

# Comment or remove the line below.
#Example

# Uncomment this option to enable logging.
# LogFile must be writable for the user running daemon.
# A full path is required.
# Default: disabled
#LogFile /var/log/clamav/clamd.log
LogFile /var/clamav/log/clamd.log

# By default the log file is locked for writing - the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run
# the daemon with --config-file option).
# This option disables log file locking.
# Default: disabled
#LogFileUnlock

# Maximal size of the log file.
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 1M
#LogFileMaxSize 2M

# Log time with each message.
# Default: disabled
#LogTime

# Also log clean files. Useful in debugging but drastically increases the
# log size.
# Default: disabled
#LogClean

# Use system logger (can work together with LogFile).
# Default: disabled
#LogSyslog

# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
# Default: LOG_LOCAL6
#LogFacility LOG_MAIL

# Enable verbose logging.
# Default: disabled
#LogVerbose

# This option allows you to save a process identifier of the listening
# daemon (main thread).
# Default: disabled
#PidFile /var/run/clamav/clamd.pid
PidFile /var/clamav/run/clamd.pid

# Optional path to the global temporary directory.
# Default: system specific (usually /tmp or /var/tmp).
TemporaryDirectory /var/clamav/tmp

# Path to the database directory.
# Default: hardcoded (depends on installation options)
#DatabaseDirectory /usr/local/share/clamav
DatabaseDirectory /var/clamav/base

# The daemon works in a local OR a network mode. Due to security reasons we
# recommend the local mode.

# Path to a local socket file the daemon will listen on.
# Default: disabled
#LocalSocket /var/run/clamav/clamd
LocalSocket /var/clamav/run/clamd

# Remove stale socket after unclean shutdown.
# Default: disabled
FixStaleSocket

# TCP port address.
# Default: disabled
#TCPSocket 3310

# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
# Default: disabled
#TCPAddr 127.0.0.1

# Maximum length the queue of pending connections may grow to.
# Default: 15
#MaxConnectionQueueLength 30

# Close the connection if this limit is exceeded.
# Default: 10M
#StreamMaxLength 20M

# Maximal number of threads running at the same time.
# Default: 10
#MaxThreads 20

# Waiting for data from a client socket will timeout after this time (seconds).
# Value of 0 disables the timeout.
# Default: 120
#ReadTimeout 300

# Waiting for a new job will timeout after this time (seconds).
# Default: 30
#IdleTimeout 60

# Maximal depth directories are scanned at.
# Default: 15
#MaxDirectoryRecursion 20

# Follow directory symlinks.
# Default: disabled
#FollowDirectorySymlinks

# Follow regular file symlinks.
# Default: disabled
#FollowFileSymlinks

# Perform internal sanity check (database integrity and freshness).
# Default: 1800 (30 min)
#SelfCheck 600

# Execute a command when virus is found. In the command string %v will
# be replaced by a virus name.
# Default: disabled
#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"

# Run as a selected user (clamd must be started by root).
# Default: disabled
#User clamav
User smmsp

# Initialize supplementary group access (clamd must be started by root).
# Default: disabled
AllowSupplementaryGroups

# Don't fork into background.
# Default: disabled
#Foreground

# Enable debug messages in libclamav.
# Default: disabled
#Debug

# Do not remove temporary files (for debug purposes).
# Default: disabled
#LeaveTemporaryFiles

# By default clamd uses scan options recommended by libclamav. This option
# disables recommended options and allows you to enable selected ones below.
# DO NOT TOUCH IT unless you know what you are doing.
# Default: disabled
#DisableDefaultScanOptions

##
## Executable files
##

# PE stands for Portable Executable - it's an executable file format used
# in all 32-bit versions of Windows operating systems. This option allows
# ClamAV to perform a deeper analysis of executable files and it's also
# required for decompression of popular executable packers such as UPX, FSG,
# and Petite.
# Default: enabled
#ScanPE

# With this option clamav will try to detect broken executables and mark
# them as Broken.Executable
# Default: disabled
#DetectBrokenExecutables

##
## Documents
##

# This option enables scanning of Microsoft Office document macros.
# Default: enabled
#ScanOLE2

##
## Mail files
##

# Enable internal e-mail scanner.
# Default: enabled
#ScanMail

# If an email contains URLs ClamAV can download and scan them.
# WARNING: This option may open your system to a DoS attack.
#       Never use it on loaded servers.
# Default: disabled
#MailFollowURLs

##
## HTML
##

# Perform HTML normalisation and decryption of MS Script Encoder code.
# Default: enabled
#ScanHTML

##
## Archives
##

# ClamAV can scan within archives and compressed files.
# Default: enabled
#ScanArchive

# Due to license issues libclamav does not support RAR 3.0 archives (only the
# old 2.0 format is supported). Because some users report stability problems
# with unrarlib it's disabled by default and you must uncomment the directive
# below to enable RAR 2.0 support.
# Default: disabled
#ScanRAR

# The options below protect your system against Denial of Service attacks
# using archive bombs.

# Files in archives larger than this limit won't be scanned.
# Value of 0 disables the limit.
# Default: 10M
#ArchiveMaxFileSize 15M

# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
# file, all files within it will also be scanned. This options specifies how
# deep the process should be continued.
# Value of 0 disables the limit.
# Default: 5
#ArchiveMaxRecursion 8

# Number of files to be scanned within an archive.
# Value of 0 disables the limit.
# Default: 1000
#ArchiveMaxFiles 1500

# If a file in an archive is compressed more than ArchiveMaxCompressionRatio
# times it will be marked as a virus (Oversized.ArchiveType, e.g. Oversized.Zip)
# Value of 0 disables the limit.
# Default: 250
#ArchiveMaxCompressionRatio 300

# Use slower but memory efficient decompression algorithm.
# only affects the bzip2 decompressor.
# Default: disabled
#ArchiveLimitMemoryUsage

# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
# Default: disabled
#ArchiveBlockEncrypted

# Mark archives as viruses if ArchiveMaxFiles, ArchiveMaxFileSize, or
# ArchiveMaxRecursion limit is reached.
# Default: disabled
#ArchiveBlockMax

##
## Clamuko settings
## WARNING: This is experimental software. It is very likely it will hang
##        up your system!!!
##

# Enable Clamuko. Dazuko (/dev/dazuko) must be configured and running.
# Default: disabled
#ClamukoScanOnAccess

# Set access mask for Clamuko.
# Default: disabled
#ClamukoScanOnOpen
#ClamukoScanOnClose
#ClamukoScanOnExec

# Set the include paths (all files in them will be scanned). You can have
# multiple ClamukoIncludePath directives but each directory must be added
# in a seperate line.
# Default: disabled
#ClamukoIncludePath /home
#ClamukoIncludePath /students

# Set the exclude paths. All subdirectories are also excluded.
# Default: disabled
#ClamukoExcludePath /home/guru

# Don't scan files larger than ClamukoMaxFileSize
# Value of 0 disables the limit.
# Default: 5M
#ClamukoMaxFileSize 10M

извини за настойчивость lavr
не мог бы ты посмотреть эти настройки и сказать свое мнение
если все корректно, я мог бы более сориентироваться в ситуации

с уважением

>Большое спасибо, что откликнулся.
>
>Права на папки выставлены, логи clamd:
>
>+++ Started at Mon Nov 29 11:39:39 2004
>clamd daemon 0.80 (OS: freebsd4.10, ARCH: i386, CPU: i386)
>Log file size limited to 1048576 bytes.
>Running as user smmsp (UID 25, GID 25)
>Reading databases from /var/clamav/base
>Protecting against 27566 viruses.
>Unix socket file /var/clamav/run/clamd
>Setting connection queue length to 15
>Archive: Archived file size limit set to 10485760 bytes.
>Archive: Recursion level limit set to 5.
>Archive: Files limit set to 1000.
>Archive: Compression ratio limit set to 250.
>Archive support enabled.
>Archive: RAR support disabled.
>Portable Executable support enabled.
>Mail files support enabled.
>OLE2 support enabled.
>HTML support enabled.
>Self checking every 1800 seconds.
>Socket file removed.
>Pid file removed.
>Exiting (clean)
>--- Stopped at Mon Nov 29 11:42:02 2004
>

почему stopped?! clamd демон все время должен висеть в памяти и работать,
sendmail через clamav-milter будет ему почту скармливать

>fresh запускается и обновляет базы
>сокеты создаются

тоже всегда должен висеть и каждые n-часов обновлять базы

>
>sendmail.mc
>
>INPUT_MAIL_FILTER(`clmilter', `S=/var/clamav/run/clmilter.sock, F=, T=S:4m;R:4m')

вообще-то by default: сокет path = /var/run/clamav/clmilter.sock
смотри ЧТО у тебя выше написано, или ты при компиляции сам задал:
/var/clamav/run/clmilter.sock ?

>define(`confINPUT_MAIL_FILTERS', `clmilter')

ну, если один - то верно, если несколько фильтров через milter:

INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamass-milter.sock,
T=C:15m;S:4m;R:4m;E:10m')
INPUT_MAIL_FILTER(`clmilter',`S=local:/var/run/clamav/clmilter.sock,
T=S:4m;R:4m')dnl
define(`confINPUT_MAIL_FILTERS', `spamassassin, clmilter')

параметры F=, T= лучше посмотреть в описании milter'а и подкрутить
под себя: FreeBSD - /usr/src/contrib/sendmail/libmilter/README

>--------------------------------------------------
>
>запуск идет через /etc/rc.sendmail
>когда запускал в ./rc.d/clamd.sh
>sendmail ругался и я решил перенести:
>
>echo -n ' clamd '
>/usr/local/sbin/clamd
>echo -n ' clmilter '
>sleep 2
>/usr/local/sbin/clamav-milter -ol local:/var/clamav/run/clmilter.sock
>sleep 5

clamav-milter -ol -p postmaster@domain.net -P ...

проверяй владельца от которого запускается clamav-milter и clamd и
ls -la /var | grep clamav
ls -la /var/clamav | grep run
ls -la /var/clamav/run/clmilter.sock

owner, group, other и chmod

>if [ -r /etc/defaults/rc.conf ]; then
> . /etc/defaults/rc.conf
> source_rc_confs
>elif [ -r /etc/rc.conf ]; then
>
> . /etc/rc.conf
>fi
>......
>
>-----------------------------------------------
>
>clamav.conf
>
># Comment or remove the line below.
>#Example
>
># Uncomment this option to enable logging.
># LogFile must be writable for the user running daemon.
># A full path is required.
># Default: disabled
>#LogFile /var/log/clamav/clamd.log
>LogFile /var/clamav/log/clamd.log

тоже что и выше владелец и права

># By default the log file is locked for writing - the
>lock protects against
># running clamd multiple times (if want to run another clamd, please
>
># copy the configuration file, change the LogFile variable, and run
># the daemon with --config-file option).
># This option disables log file locking.
># Default: disabled
>#LogFileUnlock
>
># Maximal size of the log file.
># Value of 0 disables the limit.
># You may use 'M' or 'm' for megabytes (1M = 1m
>= 1048576 bytes)
># and 'K' or 'k' for kilobytes (1K = 1k = 1024
>bytes). To specify the size
># in bytes just don't use modifiers.
># Default: 1M
>#LogFileMaxSize 2M

default=1M смотри есть ли ограничения в sendmail на MaxMessageSize
и выставляй так как тебе нужно, соответственно, вобщем по желанию

># Log time with each message.
># Default: disabled
>#LogTime
>
># Also log clean files. Useful in debugging but drastically increases the
>
># log size.
># Default: disabled
>#LogClean
>
># Use system logger (can work together with LogFile).
># Default: disabled
>#LogSyslog
>
># Specify the type of syslog messages - please refer to 'man
>syslog'
># for facility names.
># Default: LOG_LOCAL6
>#LogFacility LOG_MAIL
>
># Enable verbose logging.
># Default: disabled
>#LogVerbose
>
># This option allows you to save a process identifier of the
>listening
># daemon (main thread).
># Default: disabled
>#PidFile /var/run/clamav/clamd.pid
>PidFile /var/clamav/run/clamd.pid

владелец и права

># Optional path to the global temporary directory.
># Default: system specific (usually /tmp or /var/tmp).
>TemporaryDirectory /var/clamav/tmp

владелец и права

># Path to the database directory.
># Default: hardcoded (depends on installation options)
>#DatabaseDirectory /usr/local/share/clamav
>DatabaseDirectory /var/clamav/base

тоже и должно соответствовать freshclam

># The daemon works in a local OR a network mode. Due
>to security reasons we
># recommend the local mode.
>
># Path to a local socket file the daemon will listen on.
>
># Default: disabled
>#LocalSocket /var/run/clamav/clamd
>LocalSocket /var/clamav/run/clamd

владелец, права

># Remove stale socket after unclean shutdown.
># Default: disabled
>FixStaleSocket
>
># TCP port address.
># Default: disabled
>#TCPSocket 3310
>
># TCP address.
># By default we bind to INADDR_ANY, probably not wise.
># Enable the following to provide some degree of protection
># from the outside world.
># Default: disabled
>#TCPAddr 127.0.0.1
>
># Maximum length the queue of pending connections may grow to.
># Default: 15
>#MaxConnectionQueueLength 30
>
># Close the connection if this limit is exceeded.
># Default: 10M
>#StreamMaxLength 20M
>
># Maximal number of threads running at the same time.
># Default: 10
>#MaxThreads 20
>
># Waiting for data from a client socket will timeout after this
>time (seconds).
># Value of 0 disables the timeout.
># Default: 120
>#ReadTimeout 300
>
># Waiting for a new job will timeout after this time (seconds).
>
># Default: 30
>#IdleTimeout 60
>
># Maximal depth directories are scanned at.
># Default: 15
>#MaxDirectoryRecursion 20
>
># Follow directory symlinks.
># Default: disabled
>#FollowDirectorySymlinks
>
># Follow regular file symlinks.
># Default: disabled
>#FollowFileSymlinks
>
># Perform internal sanity check (database integrity and freshness).
># Default: 1800 (30 min)
>#SelfCheck 600
>
># Execute a command when virus is found. In the command string
>%v will
># be replaced by a virus name.
># Default: disabled
>#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"
>
># Run as a selected user (clamd must be started by root).
>
># Default: disabled
>#User clamav
>User smmsp

проверяй как сказано выше чтобы остальное соответствовало и chmod

># Initialize supplementary group access (clamd must be started by root).
># Default: disabled
>AllowSupplementaryGroups
>
># Don't fork into background.
># Default: disabled
>#Foreground
>
># Enable debug messages in libclamav.
># Default: disabled
>#Debug
>
># Do not remove temporary files (for debug purposes).
># Default: disabled
>#LeaveTemporaryFiles
>
>
># By default clamd uses scan options recommended by libclamav. This option
>
># disables recommended options and allows you to enable selected ones below.
>
># DO NOT TOUCH IT unless you know what you are doing.
>
># Default: disabled
>#DisableDefaultScanOptions
>
>##
>## Executable files
>##
>
># PE stands for Portable Executable - it's an executable file format
>used
># in all 32-bit versions of Windows operating systems. This option allows
>
># ClamAV to perform a deeper analysis of executable files and it's
>also
># required for decompression of popular executable packers such as UPX, FSG,
>
># and Petite.
># Default: enabled
>#ScanPE
>
># With this option clamav will try to detect broken executables and
>mark
># them as Broken.Executable
># Default: disabled
>#DetectBrokenExecutables
>
>
>##
>## Documents
>##
>
># This option enables scanning of Microsoft Office document macros.
># Default: enabled
>#ScanOLE2
>
>##
>## Mail files
>##
>
># Enable internal e-mail scanner.
># Default: enabled
>#ScanMail
>
># If an email contains URLs ClamAV can download and scan them.
>
># WARNING: This option may open your system to a DoS attack.
>
>#    Never use it on loaded servers.
># Default: disabled
>#MailFollowURLs
>
>
>##
>## HTML
>##
>
># Perform HTML normalisation and decryption of MS Script Encoder code.
># Default: enabled
>#ScanHTML
>
>
>##
>## Archives
>##
>
># ClamAV can scan within archives and compressed files.
># Default: enabled
>#ScanArchive
>
># Due to license issues libclamav does not support RAR 3.0 archives
>(only the
># old 2.0 format is supported). Because some users report stability problems
>
># with unrarlib it's disabled by default and you must uncomment the
>directive
># below to enable RAR 2.0 support.
># Default: disabled
>#ScanRAR
>
># The options below protect your system against Denial of Service attacks
>
># using archive bombs.
>
># Files in archives larger than this limit won't be scanned.
># Value of 0 disables the limit.
># Default: 10M
>#ArchiveMaxFileSize 15M
>
># Nested archives are scanned recursively, e.g. if a Zip archive contains
>a RAR
># file, all files within it will also be scanned. This options
>specifies how
># deep the process should be continued.
># Value of 0 disables the limit.
># Default: 5
>#ArchiveMaxRecursion 8
>
># Number of files to be scanned within an archive.
># Value of 0 disables the limit.
># Default: 1000
>#ArchiveMaxFiles 1500
>
># If a file in an archive is compressed more than ArchiveMaxCompressionRatio
>
># times it will be marked as a virus (Oversized.ArchiveType, e.g. Oversized.Zip)
>
># Value of 0 disables the limit.
># Default: 250
>#ArchiveMaxCompressionRatio 300
>
># Use slower but memory efficient decompression algorithm.
># only affects the bzip2 decompressor.
># Default: disabled
>#ArchiveLimitMemoryUsage
>
># Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
># Default: disabled
>#ArchiveBlockEncrypted
>
># Mark archives as viruses if ArchiveMaxFiles, ArchiveMaxFileSize, or
># ArchiveMaxRecursion limit is reached.
># Default: disabled
>#ArchiveBlockMax
>
>
>##
>## Clamuko settings
>## WARNING: This is experimental software. It is very likely it will
>hang
>##     up your system!!!
>##
>
># Enable Clamuko. Dazuko (/dev/dazuko) must be configured and running.
># Default: disabled
>#ClamukoScanOnAccess
>
># Set access mask for Clamuko.
># Default: disabled
>#ClamukoScanOnOpen
>#ClamukoScanOnClose
>#ClamukoScanOnExec
>
># Set the include paths (all files in them will be scanned).
>You can have
># multiple ClamukoIncludePath directives but each directory must be added
># in a seperate line.
># Default: disabled
>#ClamukoIncludePath /home
>#ClamukoIncludePath /students
>
># Set the exclude paths. All subdirectories are also excluded.
># Default: disabled
>#ClamukoExcludePath /home/guru
>
># Don't scan files larger than ClamukoMaxFileSize
># Value of 0 disables the limit.
># Default: 5M
>#ClamukoMaxFileSize 10M

положи sendmail, положи clamav-milter и clamd, затем стартуй:

clamd
clamav-milter
sendmail

ps -axuww | grep clam
ps -axuww | grep sendmail

если проблемы, включай логи и/или debug в clamav-milter и clamd

>kern.ipc.somaxconn=32768

Вот это значение уменьш. И всё станет мягким и шелковистым.

>>kern.ipc.somaxconn=32768
>
>Вот это значение уменьш. И всё станет мягким и шелковистым.
А для Red-hat есть средство? У меня такая же история. Перешел с clamav-milter 0.80j на 0.83, теперь мильтер не стартует.