quarantine directory not working dor vscan-sophos
Thomas Hänig <[email protected]> Tue, 7 Dec 2004 10:49:25 +0100
| Newsgroups | gmane.comp.security.virus.openantivirus.general |
|---|---|
| Message-ID | <[email protected]> |
Hi all, I have a little problem telling vscan-sophos where to move found viruses to. What is installed: SuSE 9.1 (up to date patch release) Kernel 2.6.5-7.111.5-default samba-winbind-3.0.4-1.32 samba-3.0.4-1.34.3 samba-client-3.0.4-1.32 samba-vscan-0.3.4-83.35 +sophie-3.04rc2 +Sophos Sweep 3.88 # snippet from /etc/samba/smb.conf [vscan] comment = virus-protected /tmp directory path = /tmp vfs object = vscan-sophos vscan-sophos: config-file = /etc/samba/vscan-sophos.conf writeable = yes browseable = yes guest ok = yes ----- # snippet from /etc/samba/vscan-sophos.conf: ; where to put infected files - you really want to change this! ; it has to be on the same physical device as the share! quarantine directory = /virus/ # /virus (w/o trailing "/") does not work either ; prefix for files in quarantine quarantine prefix = vxx- ----- # snippet from /var/log/messages Dec 7 10:41:43 thomas smbd_vscan-sophos[4428]: samba-vscan (vscan-sophos 0.3.4) registered (Samba 3.0), (c) by Rainer Link, OpenAntiVirus.org Dec 7 10:41:43 thomas smbd_vscan-sophos[4428]: samba-vscan (vscan-sophos 0.3.4) connected (Samba 3.0), (c) by Rainer Link, OpenAntiVirus.org Dec 7 10:41:43 thomas smbd_vscan-sophos[4428]: INFO: connect to service vscan by user MYDOMAIN+thomas Dec 7 10:41:43 thomas smbd_vscan-sophos[4428]: ALERT - Scan result: '/tmp/eicar.com' infected with virus 'EICAR-AV-Test', client: '192.168.216.5' Dec 7 10:41:43 thomas smbd_vscan-sophos[4428]: ERROR: quarantining file '/tmp/eicar.com' to '/var/tmp/vxx-BUVnfh' failed, reason: Operation not permitted ----- so smbd does not recognize my setting for "quarantine directory" What am I missing? Any help appreciated Thomas ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/