How To Integrate ClamAV Into PureFTPd For Virus Scanning On Debian Squeeze

Want to support HowtoForge? Become a subscriber!
 
Submitted by falko (Contact Author) (Forums) on Mon, 2012-04-30 20:11. :: Debian | FTP | Security

How To Integrate ClamAV Into PureFTPd For Virus Scanning On Debian Squeeze

Version 1.0
Author: Falko Timme <ft [at] falkotimme [dot] com>
Follow me on Twitter
Last edited 04/23/2012

This tutorial explains how you can integrate ClamAV into PureFTPd for virus scanning on a Debian Squeeze system. In the end, whenever a file gets uploaded through PureFTPd, ClamAV will check the file and delete it if it is malware.

I do not issue any guarantee that this will work for you!

 

1 Preliminary Note

You should have a working PureFTPd setup on your Debian Squeeze server, e.g. as shown in this tutorial: Virtual Hosting With PureFTPd And MySQL (Incl. Quota And Bandwidth Management) On Debian Squeeze .

 

2 Installing ClamAV

ClamAV can be installed as follows:

apt-get install clamav clamav-daemon

 

3 Configuring PureFTPd

First we create the file /etc/pure-ftpd/conf/CallUploadScript which simply contains the string yes:

echo "yes" > /etc/pure-ftpd/conf/CallUploadScript

Next we create the file /etc/pure-ftpd/clamav_check.sh (which will call /usr/bin/clamdscan whenever a file is uploaded through PureFTPd)...

vi /etc/pure-ftpd/clamav_check.sh

#!/bin/sh
/usr/bin/clamdscan --remove --quiet --no-summary "$1"

... and make it executable:

chmod 755 /etc/pure-ftpd/clamav_check.sh

Now we edit /etc/default/pure-ftpd-common...

vi /etc/default/pure-ftpd-common

... and change the UPLOADSCRIPT line as follows:

[...]
# UPLOADSCRIPT: if this is set and the daemon is run in standalone mode,
# pure-uploadscript will also be run to spawn the program given below
# for handling uploads. see /usr/share/doc/pure-ftpd/README.gz or
# pure-uploadscript(8)

# example: UPLOADSCRIPT=/usr/local/sbin/uploadhandler.pl
UPLOADSCRIPT=/etc/pure-ftpd/clamav_check.sh
[...]

Finally we restart PureFTPd:

/etc/init.d/pure-ftpd-mysql restart

That's it! Now whenever someone tries to upload malware to your server through PureFTPd, the "bad" file(s) will be silently deleted.

 

4 Links


Please do not use the comment function to ask for help! If you need help, please use our forum.
Comments will be published after administrator approval.
Submitted by Anonymous (not registered) on Tue, 2012-08-28 15:38.

hello, please help

on server with ispconfig 3 not working, not scan the files, receive next mesage, think not have the corect privileges

lstat() failed: Permission denied. ERROR

Thank You

Submitted by Samuele Tognini (not registered) on Wed, 2013-01-23 21:49.
Use the --fdpass option for clamdscan.