quarantine directory not working dor vscan-sophos

Thomas Hänig <[email protected]> Tue, 7 Dec 2004 10:49:25 +0100
Newsgroups gmane.comp.security.virus.openantivirus.general
Message-ID <[email protected]>
Hi all,
I have a little problem telling vscan-sophos where to move found viruses to.

What is installed:
SuSE 9.1 (up to date patch release)
Kernel 2.6.5-7.111.5-default
samba-winbind-3.0.4-1.32
samba-3.0.4-1.34.3
samba-client-3.0.4-1.32
samba-vscan-0.3.4-83.35
+sophie-3.04rc2
+Sophos Sweep 3.88

# snippet from /etc/samba/smb.conf

[vscan]
   comment = virus-protected /tmp directory
   path = /tmp
   vfs object = vscan-sophos
   vscan-sophos: config-file = /etc/samba/vscan-sophos.conf
   writeable = yes
   browseable = yes
   guest ok = yes

-----

# snippet from /etc/samba/vscan-sophos.conf:

; where to put infected files - you really want to change this!
; it has to be on the same physical device as the share!
quarantine directory  = /virus/ 
# /virus (w/o trailing "/") does not work either

; prefix for files in quarantine
quarantine prefix = vxx-

-----

# snippet from /var/log/messages

Dec  7 10:41:43 thomas smbd_vscan-sophos[4428]: samba-vscan (vscan-sophos 0.3.4) registered (Samba 3.0), (c) by Rainer Link, OpenAntiVirus.org
Dec  7 10:41:43 thomas smbd_vscan-sophos[4428]: samba-vscan (vscan-sophos 0.3.4) connected (Samba 3.0), (c) by Rainer Link, OpenAntiVirus.org
Dec  7 10:41:43 thomas smbd_vscan-sophos[4428]: INFO: connect to service vscan by user MYDOMAIN+thomas
Dec  7 10:41:43 thomas smbd_vscan-sophos[4428]: ALERT - Scan result: '/tmp/eicar.com' infected with virus 'EICAR-AV-Test', client: '192.168.216.5'
Dec  7 10:41:43 thomas smbd_vscan-sophos[4428]: ERROR: quarantining file '/tmp/eicar.com' to '/var/tmp/vxx-BUVnfh' failed, reason: Operation not permitted

-----
so smbd does not recognize my setting for "quarantine directory"
What am I missing?

Any help appreciated
Thomas



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/