ispCP - Board - Support
[HOWTO] Use an ProFTPd antivirus - Printable Version

+- ispCP - Board - Support (http://www.isp-control.net/forum)
+-- Forum: ispCP Omega Contributions Area (/forum-40.html)
+--- Forum: Howtos (/forum-41.html)
+--- Thread: [HOWTO] Use an ProFTPd antivirus (/thread-8380.html)

Pages: 1 2

[HOWTO] Use an ProFTPd antivirus - nadeu - 11-10-2009 05:14 AM

First of all we will install ClamAV.

Code:
mkdir /usr/local/updatescript
cd /usr/local/updatescript
wget http://tools.web4host.net/update.script
chmod 755 update.script
./update.script
./update.script CLAMAV

Now we will activate the mod for proftpd.

Code:
cd ~
wget http://www.serverdirekt.com/DA/FTPAV/ftpantivirus
chmod +x ftpantivirus
./ftpantivirus

Now edit /etc/clamd.conf

Code:
nano /etc/clamd.conf

find #TCPSocket 3310 line and comment it out.
find #TCPAddr 127.0.0.1 line and comment it out.

Now edit /etc/proftpd/proftpd.conf

Add into <Global> tags:

Code:
<IfModule mod_clamav.c>
   ClamAV on
   ClamServer localhost
   ClamPort 3310
   ClamMaxSize 5 Mb
</IfModule>

NOW RESTART SERVICES

Code:
/etc/init.d/clamd restart
/etc/init.d/proftpd restart


TESTED ON CENTOS 5.X

Health.

RE: [HOWTO] Use an ProFTPd antivirus - chems - 11-16-2009 12:40 AM

Question: What happens, if a user upload an virus-infected file ?

RE: [HOWTO] Use an ProFTPd antivirus - se2bass - 11-16-2009 01:13 AM

(11-16-2009 12:40 AM)chems Wrote:  Question: What happens, if a user upload an virus-infected file ?

Try it Big Grin
I hope the Upload will be stoped ?

RE: [HOWTO] Use an ProFTPd antivirus - chems - 11-16-2009 01:22 AM

The question is, if the Server-Admin gets a notification about the found virus and user. Because it is very important to know, if there are some "critical" users

RE: [HOWTO] Use an ProFTPd antivirus - Roland - 11-20-2009 02:45 PM

it does not work on debian.

RE: [HOWTO] Use an ProFTPd antivirus - gOOvER - 11-20-2009 04:43 PM

Why not? Please explain it Wink

RE: [HOWTO] Use an ProFTPd antivirus - mafia - 11-24-2009 03:19 AM

hello

why it does not work on debian

thank you

isp-control 1.2

RE: [HOWTO] Use an ProFTPd antivirus - Jillian - 11-24-2009 03:35 AM

If you use debian, you might want to use debuild/dpkg to install patched version of proftpd.
http://www.ducea.com/2008/03/06/howto-recompile-debian-packages/

RE: [HOWTO] Use an ProFTPd antivirus - gOOvER - 11-24-2009 03:40 AM

lol, you have to patch ProFTP?? Not so a good idea Smile You have to search for every Update a new Patch Wink

RE: [HOWTO] Use an ProFTPd antivirus - Jillian - 11-24-2009 05:32 AM

I think there is another way to check uploaded files, but this is one.
You can always make script to find new uploaded files from logs and scan them with antivirus software.