Re: [samba-vscan, clamav, thunderbird...]

Rainer Link <[email protected]> Wed, 19 Oct 2005 11:18:55 +0200
Newsgroups gmane.comp.security.virus.openantivirus.general
Message-ID <[email protected]>
On Wed, Oct 19, 2005 at 11:08:54AM +0200, Marco Gaiarin wrote:
> I've just sent this to rainer, but i've received no answer.

Sorry, just too busy ATM. Still to many unanswered emails ...

> After some digging around, removing all possible cause of trouble and
> misconfiguration, i've simply added to /etc/samba/vscan-clamav.conf:
> 
> 	max file size = 10485760
> 
> and all return to work as expected. The mailbox was 24MB.
> 
> 
> Dissecting the problem on samba-it mailinglist, again with simo sorce,
> gave me some hypotesis: for some reason, possibly the fact that clamav
> recognize the file as MBox and try to decode all attachment, decompress
> it, ..., clamav take too many time in processing the file and the samba
> process timeouts/die.
> 
> 
> My question is simple. I consider using max file size = 10485760 as a
> workaround, not a solution... there's some better around?
> Can i force some timeout in vscan, or in clamav, so that the samba
> process does not timeout?

Well, unfortunately file/libmagic can not detect Mbox files, otherwise
it would have been possible to exclude them via the exclude filetype
setting in the samba-vscan configuration file. 

Can you please check the "ScanMail" setting in clamav.conf?


cheers, Rainer



-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl