ich habe einen transparenten SMTP-Proxy (clamsmtpd) im Zusammenspiel mit ClamAV laufen, der bis zu einem Upgrade korrekt funktioniert hat.
Code: Alles auswählen
# cat /var/log/aptitude | grep -i clam
[AKTUALISIERUNG] clamav 0.94.dfsg-1 -> 0.94.dfsg.2-1
[AKTUALISIERUNG] clamav-base 0.94.dfsg-1 -> 0.94.dfsg.2-1
[AKTUALISIERUNG] clamav-daemon 0.94.dfsg-1 -> 0.94.dfsg.2-1
[AKTUALISIERUNG] clamav-freshclam 0.94.dfsg-1 -> 0.94.dfsg.2-1
[AKTUALISIERUNG] clamav-testfiles 0.94.dfsg-1 -> 0.94.dfsg.2-1
[AKTUALISIERUNG] clamsmtp 1.8-5.3 -> 1.8-6
[AKTUALISIERUNG] libclamav5 0.94.dfsg-1 -> 0.94.dfsg.2-1
Code: Alles auswählen
Feb 12 10:54:35 flatliner clamsmtpd: 1005C6: accepted connection from: 10.xxx
Feb 12 10:54:37 flatliner clamsmtpd: 1005C6: from=xxx@gmx.de, to=xxx@gmx.de, to=xxx@web.de, to=xxx@web.de, to=xxx@xxx.de, to=xxxr@web.de, to=xxx@gmx.de, to=xxx@web.de, status=CLEAN
Feb 12 10:54:56 flatliner clamsmtpd: 1005C7: accepted connection from: 10.151.253.156
Feb 12 10:54:57 flatliner clamsmtpd: 1005C7: from=xxx@gmx.de, to=xxx@mytum.de, status=CLEAN
Feb 12 14:03:08 flatliner clamsmtpd: 100000: accepted connection from: 10.151.254.229
Feb 12 14:05:36 flatliner clamsmtpd: 100001: accepted connection from: 10.151.254.229
Feb 12 14:06:08 flatliner clamsmtpd: 100000: SERVER: couldn't connect to: 10.151.248.1:10025: Operation now in progress
Feb 12 14:08:11 flatliner clamsmtpd: 100002: accepted connection from: 10.151.254.229
Feb 12 14:08:36 flatliner clamsmtpd: 100001: SERVER: couldn't connect to: 10.151.248.1:10025: Operation now in progress
Feb 12 14:11:11 flatliner clamsmtpd: 100002: SERVER: couldn't connect to: 10.151.248.1:10025: Operation now in progress
Feb 12 14:44:09 flatliner clamsmtpd: 100003: accepted connection from: 10.151.255.248
Feb 12 14:45:03 flatliner clamsmtpd: 100004: accepted connection from: 10.151.255.248
Code: Alles auswählen
Thu Feb 12 01:04:02 2009 -> SelfCheck: Database status OK.
Thu Feb 12 10:54:36 2009 -> SelfCheck: Database modification detected. Forcing reload.
Thu Feb 12 10:54:36 2009 -> Reading databases from /var/lib/clamav
Thu Feb 12 10:54:38 2009 -> Database correctly reloaded (513166 signatures)
Thu Feb 12 12:10:07 2009 -> Socket file removed.
Thu Feb 12 12:10:07 2009 -> Pid file removed.
Thu Feb 12 12:10:07 2009 -> --- Stopped at Thu Feb 12 12:10:07 2009
Thu Feb 12 13:02:54 2009 -> +++ Started at Thu Feb 12 13:02:54 2009
Thu Feb 12 13:02:54 2009 -> clamd daemon 0.94.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Thu Feb 12 13:02:54 2009 -> Log file size limit disabled.
Thu Feb 12 13:02:54 2009 -> Reading databases from /var/lib/clamav
Thu Feb 12 13:02:54 2009 -> Not loading PUA signatures.
Thu Feb 12 13:02:57 2009 -> Loaded 513262 signatures.
Thu Feb 12 13:02:57 2009 -> LOCAL: Unix socket file /var/run/clamav/clamd.ctl
Thu Feb 12 13:02:57 2009 -> LOCAL: Setting connection queue length to 15
Auffällig in den Clamd-Logs ist dass er normalerweise recht regelmäßig Checks durchführt:
Code: Alles auswählen
Sun Feb 8 20:14:21 2009 -> SelfCheck: Database status OK.
Sun Feb 8 22:09:38 2009 -> SelfCheck: Database status OK.
Mon Feb 9 00:41:48 2009 -> SelfCheck: Database status OK.
Code: Alles auswählen
Sun Feb 15 23:36:03 2009 -> +++ Started at Sun Feb 15 23:36:03 2009
Sun Feb 15 23:36:03 2009 -> clamd daemon 0.94.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Sun Feb 15 23:36:03 2009 -> Log file size limit disabled.
Sun Feb 15 23:36:03 2009 -> Reading databases from /var/lib/clamav
Sun Feb 15 23:36:03 2009 -> Not loading PUA signatures.
Sun Feb 15 23:36:04 2009 -> Loaded 513328 signatures.
Sun Feb 15 23:36:04 2009 -> LOCAL: Unix socket file /var/run/clamav/clamd.ctl
Sun Feb 15 23:36:04 2009 -> LOCAL: Setting connection queue length to 15
Sun Feb 15 23:36:04 2009 -> Limits: Global size limit set to 104857600 bytes.
Sun Feb 15 23:36:04 2009 -> Limits: File size limit set to 26214400 bytes.
Sun Feb 15 23:36:04 2009 -> Limits: Recursion level limit set to 16.
Sun Feb 15 23:36:04 2009 -> Limits: Files limit set to 10000.
Sun Feb 15 23:36:04 2009 -> Archive support enabled.
Sun Feb 15 23:36:04 2009 -> Algorithmic detection enabled.
Sun Feb 15 23:36:04 2009 -> Portable Executable support enabled.
Sun Feb 15 23:36:04 2009 -> ELF support enabled.
Sun Feb 15 23:36:04 2009 -> Mail files support enabled.
Sun Feb 15 23:36:04 2009 -> OLE2 support enabled.
Sun Feb 15 23:36:04 2009 -> PDF support enabled.
Sun Feb 15 23:36:04 2009 -> HTML support enabled.
Sun Feb 15 23:36:04 2009 -> Self checking every 3600 seconds.
Es gibt einen Bug in der von mir verwendeten clamav-daemon-Paket, aber ich bin mir sehr unschlüssig ob das unser Problem ist. Was bedeutet bei Bugs eigentlich "Forwarded" in Abgrenzung zu "Outstanding"?
Hat jemand einen Vorschlag was ich machen könnte? Einen Bugreport? Oder versuchen ältere Paket-Versionen wieder zu holen (Gibt's dazu irgendwo 'ne Anleitung)?
Stephan