Installing and Configuring ICAP on ClamAV - Revision history

Ebasso at 19:48, 1 October 2024

2024-10-01T19:48:03Z

← Older revision		Revision as of 19:48, 1 October 2024
Line 10:		Line 10:



			You can checkout files from this GitHub https://github.com/ebasso/ibm-secure-proxy-icap-clamav-demo

	= Procedure =		= Procedure =

Ebasso at 19:26, 1 October 2024

2024-10-01T19:26:39Z

← Older revision		Revision as of 19:26, 1 October 2024
Line 1:		Line 1:
			The integration of c-icap with ClamAV is commonly used to provide antivirus scanning for web traffic, email, or other content passing through proxy servers (like Squid) or gateway services. This setup helps intercept and scan potentially harmful content before it reaches end users or systems.

			Overview of c-icap and ClamAV Integration

			* '''c-icap'''
			: It's a high-performance, open-source server that implements the ICAP (Internet Content Adaptation Protocol). ICAP is commonly used by proxy servers (such as Squid) to offload tasks like content modification or virus scanning to specialized servers.

			* '''ClamAV'''
			: ClamAV is an open-source antivirus engine designed to detect malware and viruses. It's widely used for scanning files on mail gateways, web proxies, and other points where potentially harmful files might pass.



	= Procedure =		= Procedure =

Ebasso at 18:41, 1 October 2024

2024-10-01T18:41:48Z

← Older revision		Revision as of 18:41, 1 October 2024
Line 9:		Line 9:
	2) run dnf		2) run dnf

	<nowiki>dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm -y</nowiki>		<nowiki>dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm</nowiki>

	3) Install Clamav packages		3) Install Clamav packages
Line 17:		Line 17:
	4) Install C-ICAP packages		4) Install C-ICAP packages

	dnf install c-icap c-icap-libs c-icap-modules -y		dnf -y install c-icap c-icap-libs c-icap-modules

	== Clamav Server ==		== Clamav Server ==
Line 48:		Line 48:

	<nowiki>		<nowiki>
	~~LogSyslog~~ yes		LogFile /var/log/clamd.scan.log
			LogFileMaxSize 10M
			LogTime yes
			LogClean yes
			LogVerbose yes
			LogRotate yes
	TCPSocket 3310		TCPSocket 3310
			PidFile /run/clamd.scan/clamd.pid
	LocalSocket /run/clamd.scan/clamd.sock		LocalSocket /run/clamd.scan/clamd.sock
	User clamscan		User clamscan
Line 123:		Line 129:
	Service antivirus_module virus_scan.so		Service antivirus_module virus_scan.so
	ServiceAlias srv_clamav virus_scan		ServiceAlias srv_clamav virus_scan
	ServiceAlias avscan virus_scan?allow204=on&sizelimit=off&mode=simple		ServiceAlias avscan virus_scan?allow204=on&sizelimit=off&mode=simple
	virus_scan.ScanFileTypes TEXT DATA EXECUTABLE ARCHIVE GIF JPEG MSOFFICE		virus_scan.ScanFileTypes TEXT DATA EXECUTABLE ARCHIVE GIF JPEG MSOFFICE
	virus_scan.SendPercentData 5		virus_scan.SendPercentData 5
	virus_scan.StartSendPercentDataAfter 2M		virus_scan.StartSendPercentDataAfter 2M
	virus_scan.MaxObjectSize 5M		virus_scan.MaxObjectSize 5M
	virus_scan.DefaultEngine ~~clamav~~		virus_scan.DefaultEngine clamd
	Include clamd_mod.conf		Include clamd_mod.conf
	</nowiki>		</nowiki>
Line 139:		Line 145:
	<nowiki>		<nowiki>
	Module common clamd_mod.so		Module common clamd_mod.so
	clamd_mod.ClamdSocket /run/~~clamav~~/clamd.sock		clamd_mod.ClamdSocket /run/clamd.scan/clamd.sock
	</nowiki>		</nowiki>

Ebasso: /* Can not connect to clamd server */

2024-10-01T15:24:44Z

Can not connect to clamd server

← Older revision		Revision as of 15:24, 1 October 2024
Line 209:		Line 209:
	== Know Problems ==		== Know Problems ==

	=== ~~Can not~~ connect to clamd server ===		=== C-ICAP: Cannot connect to clamd server ===

	In /var/log/c-icap/server.log, I had the following error:		In /var/log/c-icap/server.log, I had the following error:

Ebasso: /* Can not connect to clamd server */

2024-10-01T15:24:15Z

Can not connect to clamd server

← Older revision		Revision as of 15:24, 1 October 2024
Line 213:		Line 213:
	In /var/log/c-icap/server.log, I had the following error:		In /var/log/c-icap/server.log, I had the following error:

	<small><nowiki>		<small><nowiki>Tue Oct 1 08:10:44 2024, main proc, clamd_connect: Can not connect to clamd server on /run/clamd.scan/clamd.sock!
	Tue Oct 1 08:10:44 2024, main proc, clamd_connect: Can not connect to clamd server on /run/clamd.scan/clamd.sock!
	Tue Oct 1 08:10:44 2024, main proc, clamd_init: Error while sending command to clamd server		Tue Oct 1 08:10:44 2024, main proc, clamd_init: Error while sending command to clamd server
	Tue Oct 1 08:10:44 2024, main proc, Registry 'virus_scan::engines' does not exist!		Tue Oct 1 08:10:44 2024, main proc, Registry 'virus_scan::engines' does not exist!</nowiki></small>
	</nowiki></small>

	To fix, change permissions of clamd.scan directory:		To fix, change permissions of clamd.scan directory:

Ebasso: /* Can not connect to clamd server */

2024-10-01T15:24:04Z

Can not connect to clamd server

← Older revision		Revision as of 15:24, 1 October 2024
Line 213:		Line 213:
	In /var/log/c-icap/server.log, I had the following error:		In /var/log/c-icap/server.log, I had the following error:

	Tue Oct 1 08:10:44 2024, main proc, clamd_connect: Can not connect to clamd server on /run/clamd.scan/clamd.sock!		<small><nowiki>
	Tue Oct 1 08:10:44 2024, main proc, clamd_init: Error while sending command to clamd server		Tue Oct 1 08:10:44 2024, main proc, clamd_connect: Can not connect to clamd server on /run/clamd.scan/clamd.sock!
	Tue Oct 1 08:10:44 2024, main proc, Registry 'virus_scan::engines' does not exist!		Tue Oct 1 08:10:44 2024, main proc, clamd_init: Error while sending command to clamd server
			Tue Oct 1 08:10:44 2024, main proc, Registry 'virus_scan::engines' does not exist!
			</nowiki></small>

	To fix, change permissions of clamd.scan directory:		To fix, change permissions of clamd.scan directory:

Ebasso: /* Verify Configuration */

2024-10-01T15:23:29Z

Verify Configuration

← Older revision		Revision as of 15:23, 1 October 2024
Line 205:		Line 205:

	tail -f /var/log/c-icap/access.log		tail -f /var/log/c-icap/access.log


			== Know Problems ==

			=== Can not connect to clamd server ===

			In /var/log/c-icap/server.log, I had the following error:

			Tue Oct 1 08:10:44 2024, main proc, clamd_connect: Can not connect to clamd server on /run/clamd.scan/clamd.sock!
			Tue Oct 1 08:10:44 2024, main proc, clamd_init: Error while sending command to clamd server
			Tue Oct 1 08:10:44 2024, main proc, Registry 'virus_scan::engines' does not exist!

			To fix, change permissions of clamd.scan directory:

			chmod g+rx,o+rx /run/clamd.scan

	== Ver também ==		== Ver também ==

Ebasso: /* Verify Configuration */

2024-09-30T21:25:46Z

Verify Configuration

← Older revision		Revision as of 21:25, 30 September 2024
Line 176:		Line 176:
	Sample result:		Sample result:

	<nowiki>c-icap-client		<small><nowiki>c-icap-client
	ICAP server:localhost, ip:127.0.0.1, port:1344		ICAP server:localhost, ip:127.0.0.1, port:1344

Line 197:		Line 197:
	X-Include: X-Authenticated-User, X-Authenticated-Groups		X-Include: X-Authenticated-User, X-Authenticated-Groups
	Encapsulated: null-body=0		Encapsulated: null-body=0
	</nowiki>		</nowiki></small>

Ebasso: /* Verify Configuration */

2024-09-30T21:25:34Z

Verify Configuration

← Older revision		Revision as of 21:25, 30 September 2024
Line 168:		Line 168:
	== Verify Configuration ==		== Verify Configuration ==

			1) Testing your instalation

			To test your c-icap server you can use the c-icap-client utility which included in c-icap package.

			c-icap-client

			Sample result:

			<nowiki>c-icap-client
			ICAP server:localhost, ip:127.0.0.1, port:1344

			OPTIONS:
			Allow 204: Yes
			Allow 206: No
			Preview: 1024
			Keep alive: Yes

			ICAP HEADERS:
			ICAP/1.0 200 OK
			Methods: RESPMOD, REQMOD
			Service: C-ICAP/0.6.2 server - Echo demo service
			ISTag: "CI0001-XXXXXXXXX"
			Transfer-Preview: *
			Options-TTL: 3600
			Date: Mon, 30 Sep 2024 19:49:43 GMT
			Preview: 1024
			Allow: 204
			X-Include: X-Authenticated-User, X-Authenticated-Groups
			Encapsulated: null-body=0
			</nowiki>

Ebasso: /* Configure clamav */

2024-09-30T17:04:57Z

Configure clamav

← Older revision		Revision as of 17:04, 30 September 2024
Line 50:		Line 50:
	LogSyslog yes		LogSyslog yes
	TCPSocket 3310		TCPSocket 3310
			LocalSocket /run/clamd.scan/clamd.sock
	User clamscan		User clamscan
	</nowiki>		</nowiki>