ClamAV called by SA

katip · Post by **katip** » 2017-04-24 22:09

Has someone tried (and succeeded) to to install that plugin and call ClamAV from within SA?
from Jam SW FAQ:

Q: Is it possible to use ClamAV with SpamAssassin for Windows?
A: ClamAV and the SpamAssassin ClamAV plugin are not included in SpamAssassin for Windows and the official Apache SpamAssassin. If you want to make use of ClamAV in SpamAssassin for Windows, you need to have an operational ClamAV and the SpamAssassin ClamAV plugin, which you can find on the Apache SpamAssassin website.

mattg · Post by **mattg** » 2017-04-24 23:23

yep

(On my Ubuntu system)
Then I score for attachments that get caught by the Sane Security Definitions

SorenR · Post by **SorenR** » 2017-04-25 01:51

mattg wrote:yep

(On my Ubuntu system)
Then I score for attachments that get caught by the Sane Security Definitions

Just tried it out... Works for Windows (JAM version 3.4.0) also...

It is a bit confusing that the Plugin and the CLAMAV Client code share the same name but they go into different directories.

I have SA installed in C:\SpamAssassin

The CLAMAV CLIENT:
File::Scan::ClamAV goes into C:\SpamAssassin\lib\file\scan\clamav.pm

The CLAMAV Plugin:
SpamAssasin Plugin ClamAV (.cf AND .pm) I have installed in C:\SpamAssassin\etc\spamassassin with the local.cf file.

Remember to edit ClamAV.cf and change

Code: Select all

# our $CLAMD_SOCK = 3310;               # for TCP-based usage
our $CLAMD_SOCK = "/var/run/clamd.basic/clamd.sock";   # change me

to

Code: Select all

our $CLAMD_SOCK = 3310;               # for TCP-based usage
# our $CLAMD_SOCK = "/var/run/clamd.basic/clamd.sock";   # change me

ClamAV Plugin here --> https://wiki.apache.org/spamassassin/ClamAVPlugin

File::Scan::ClamAV here --> http://cpansearch.perl.org/src/CFABER/F ... /ClamAV.pm

katip · Post by **katip** » 2017-04-25 06:58

SorenR wrote: File::Scan::ClamAV here --> http://cpansearch.perl.org/src/CFABER/F ... /ClamAV.pm

that's it! thank you!

last night i simply followed the link on SA Wiki and lost more than 1 hour with the recent release on CPAN site ( http://search.cpan.org/src/CFABER/File- ... /ClamAV.pm ) which is obviously incompatible (SA can't find the module when starting up).

SorenR · Post by **SorenR** » 2017-04-25 13:09

katip wrote: http://search.cpan.org/src/CFABER/File- ... /ClamAV.pm ) which is obviously incompatible (SA can't find the module when starting up).

Nope, works fine here...

It needs to be placed in the @INC dirtree (the include directory tree; the "lib" directory where I placed the other version.)

BTW... There is a new header attached to all this...

oMessage.HeaderValue("X-Spam-Virus") can be either "No" or "Yes" and the score is added to the general "X-Spam-Status" score.

katip · Post by **katip** » 2017-04-25 14:23

SorenR wrote:
katip wrote: http://search.cpan.org/src/CFABER/File- ... /ClamAV.pm ) which is obviously incompatible (SA can't find the module when starting up).
Nope, works fine here...

huh, that's really weird. right now i replaced pm with v1.8 and it worked here too

yesterday SA was throwing error with it on startup. anyway, good to have most recent module...

yes, X-Spam-Virus is handy for filtering purposes. default score 10 looks reasonable too, didn't touch it for now.
thanks again.

SorenR · Post by **SorenR** » 2017-04-25 14:58

Do you have "DBD::mysql" working ??

I'm having some serious issues with a statistics module (rulestats.pm) and all the solutions I find are either for Apple, Linux or Netware...

It seems I have problems finding/making the proper mysql.dll ...

https://labs.mwrinfosecurity.com/tools/ ... cs-plugin/

katip · Post by **katip** » 2017-04-25 16:11

SorenR wrote:Do you have "DBD::mysql" working ??

no, haven't got into SA /w SQL thing yet.
in fact i switched to SA last weekend (frankly spoken, after discovering that user_prefs entries are effective immediately upon saving

).
got to learn a lot first

SorenR · Post by **SorenR** » 2017-04-26 18:07

Got it working

As I am using SA 3.4.0 the most difficult thing was to find ActivePerl-5.8.9.827-MSWin32-x86-291969.msi ...

After that it's only a matter of ppm installing stuff and copying files to the proper structure under the SA install directory.

tunis · Post by **tunis** » 2017-04-27 14:14

I also get it to work.
But I have installed SpamAssassin x64 3.4.1.x and this is based on Strawberry Perl 5.22.
So I downloaded the Strawberry Perl 5.22.x x64 zip and copy

/perl/vendor/lib/auto/DBD/mysql to SA/runtime/lib/auto/DBD/mysql
/perl/vendor/lib/DBD/mysql to SA/runtime/lib/DBD/mysql
/perl/vendor/lib/DBD/mysql.pm to SA/runtime/lib/DBD/mysql.pm
/c/bin/libmysql__.dll to SA/libmysql__.dll

SA = install path for SpamAssassin

SorenR · Post by **SorenR** » 2017-04-27 14:58

tunis wrote:I also get it to work.
But I have installed SpamAssassin x64 3.4.1.x and this is based on Strawberry Perl 5.22.
So I downloaded the Strawberry Perl 5.22.x x64 zip and copy

/perl/vendor/lib/auto/DBD/mysql to SA/runtime/lib/auto/DBD/mysql

/perl/vendor/lib/DBD/mysql to SA/runtime/lib/DBD/mysql

/perl/vendor/lib/DBD/mysql.pm to SA/runtime/lib/DBD/mysql.pm

/c/bin/libmysql__.dll to SA/libmysql__.dll
SA = install path for SpamAssassin

Yeah, Strawberry got it all from day 1 ab factory... With ActivePerl you have to bloody ppm/mingw/gcc all the friggin crap first ... No, I'm not the least negative

katip · Post by **katip** » 2017-04-27 18:20

SorenR wrote:Got it working

ehm, newbie in the class here

i already got those files from ex-antispam setup (which was also running on strawberry 22) and copied to proper SA locations as suggested by tunis.
now, where to go? first thing is creating a DB & tables i suppose? how to bind all this to spamd? etc...
thanks for any advise. (if you think we go slowly OT here, i can open a new thread "SA /w mySQL" for instance)

SorenR · Post by **SorenR** » 2017-04-27 23:27

1: create tables according to info in rulestats.pm (yes, open file and read!)

Code: Select all

CREATE TABLE 'global_statistics' (                            
  'day' date NOT NULL default '0000-00-00',                   
  'spam_count' int(10) unsigned NOT NULL default '0',         
  'ham_count' int(10) unsigned NOT NULL default '0',          
  'score_total' int(11) NOT NULL default '0',                 
  'max_score' int(11) NOT NULL default '0',                   
  'min_score' int(11) NOT NULL default '0',                   
  PRIMARY KEY  ('day'),                                       
  KEY 'i_avg_day' ('score_total','day'),                      
  KEY 'i_d_s_h' ('day','spam_count','ham_count'),             
  KEY 'i_d_h_s' ('day','ham_count','spam_count'),             
  KEY 'i_s_h_d' ('spam_count','ham_count','day'),             
  KEY 'i_h_s_d' ('ham_count','spam_count','day'),             
  KEY 'i_maxscore' ('max_score'),                             
  KEY 'i_minscore' ('min_score')                              
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

Code: Select all

CREATE TABLE 'rule_statistics' (
  'day' date NOT NULL default '0000-00-00',
  'rulename' varchar(255) NOT NULL,
  'spam_count' int(10) unsigned NOT NULL default '0',
  'ham_count' int(10) unsigned NOT NULL default '0',
  'score_total' int(11) NOT NULL default '0',
  'max_score' int(11) NOT NULL default '0',
  'min_score' int(11) NOT NULL default '0',
  PRIMARY KEY  ('day','rulename'),
  KEY 'i_rulename_day' ('rulename','day'),
  KEY 'i_rulename_s_h' ('rulename','spam_count','ham_count'),
  KEY 'i_rulename_h_s' ('rulename','ham_count','spam_count'),
  KEY 'i_rulename_avg' ('rulename','score_total'),
  KEY 'i_avg' ('score_total'),
  KEY 'i_s_h' ('spam_count','ham_count'),
  KEY 'i_h_s' ('ham_count','spam_count'),
  KEY 'i_maxscore' ('max_score'),
  KEY 'i_minscore' ('min_score'),
  KEY 'i_rulename_max_avg' ('rulename','max_score','score_total'),
  KEY 'i_rulename_min_avg' ('rulename','min_score','score_total')
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

2: create rulestats.cf to put in \spamassassin\etc\spamassassin

Code: Select all

loadplugin Mail::SpamAssassin::Plugin::Rulestats

use_rulestats                 1
user_rulestats_dsn            DBI:mysql:spamd:localhost:3306
user_rulestats_sql_username   dbuser
user_rulestats_sql_password   dbpass

DBI:<vendor>:<database>:<server>:<port>

3: drop rulestats.pm into \spamassassin\lib\Mail\Spamassassin\Plugin

https://labs.mwrinfosecurity.com/assets ... .0.tar.bz2

4: run spamassassin --lint -D

VERY long output so configure your DOS box with a large history

mattg · Post by **mattg** » 2017-04-28 00:45

I must say, recollecting this was much easier on Ubuntu...

SorenR · Post by **SorenR** » 2017-04-28 00:53

mattg wrote:I must say, recollecting this was much easier on Ubuntu...

Nah...

mattg · Post by **mattg** » 2017-04-28 01:09

https://wiki.apache.org/spamassassin/ClamAVPlugin

First of all, you need to install ClamAV and ensure that scanning a mail with clamscan works.

Second, you need to install the File::Scan::ClamAV perl module.

Finally, save the two files above into the /etc/mail/spamassassin/ directory. You can adjust the default score of 10 in clamav.cf if you like. You should edit the clamav.pm file and change the setting for '$CLAMD_SOCK' to match where your ClamAV installation has put its named pipe.

Restart the spamd daemon if you're using that, and you should be all set.

jimimaseye · Post by **jimimaseye** » 2017-04-28 09:13

SorenR wrote:
katip wrote: http://search.cpan.org/src/CFABER/File- ... /ClamAV.pm ) which is obviously incompatible (SA can't find the module when starting up).
Nope, works fine here...

It needs to be placed in the @INC dirtree (the include directory tree; the "lib" directory where I placed the other

The link from SA page shows version 2.0 dated 2010 and is considerably shorter than the v1.6 dated 2004 on that cpan site.

SorenR · Post by **SorenR** » 2017-04-28 13:30

jimimaseye wrote:
SorenR wrote:
katip wrote: http://search.cpan.org/src/CFABER/File- ... /ClamAV.pm ) which is obviously incompatible (SA can't find the module when starting up).
Nope, works fine here...

It needs to be placed in the @INC dirtree (the include directory tree; the "lib" directory where I placed the other
The link from SA page shows version 2.0 dated 2010 and is considerably shorter than the v1.6 dated 2004 on that cpan site.

Good catch ... Also the ClamAV.cf do not match version 1.6/1.8 of ClamAV.pm ...

And ... ClamAV.pm version 2.0 gives me an error ...

Code: Select all

Fri Apr 28 13:25:21 2017 [508] warn: rules: failed to run CLAMAV test, skipping:
Fri Apr 28 13:25:21 2017 [508] warn:  (Undefined subroutine &File: [...]:Scan::ClamAV called at lib/Mail/SpamAssassin/Plugin/ClamAV.pm line 29.
Fri Apr 28 13:25:21 2017 [508] warn: )

Why, oh WHY, can't things just be SIMPLE

SorenR · Post by **SorenR** » 2017-04-28 15:12

Bloody he**....

I got into my head that they were two versions of the same code... They ARE NOT

The code in version 2.0 ammend the code in version 1.8 ... What a weird way to alter a module

Version 1.8 of ClamAV.pm goes into .\lib\File\Scan with NO .cf file
Version 2.0 of ClamAV.pm goes into .\etc\spamassassin along with the ClamAV.cf file

Removing or omitting the version 1.8 ClamAV.pm code will result in an error.

Code: Select all

Fri Apr 28 14:59:52 2017 [2664] error: Can't locate File/Scan/ClamAV.pm in @INC (@INC contains: lib C:\SpamAssassin) at C:\SpamAssassin\etc\spamassassin\clamav.pm line 14.
Fri Apr 28 14:59:52 2017 [2664] error: Can't locate File/Scan/ClamAV.pm in @INC (@INC contains: lib C:\SpamAssassin) at C:\SpamAssassin\etc\spamassassin\clamav.pm line 14.
Fri Apr 28 14:59:52 2017 [2664] warn: plugin: failed to parse plugin C:\SpamAssassin\etc\spamassassin\clamav.pm: Can't locate File/Scan/ClamAV.pm in @INC (@INC contains: lib C:\SpamAssassin) at C:\SpamAssassin\etc\spamassassin\clamav.pm line 14.
Fri Apr 28 14:59:52 2017 [2664] warn: BEGIN failed--compilation aborted at C: [...]\SpamAssassin\etc\spamassassin\clamav.pm line 14.
Fri Apr 28 14:59:52 2017 [2664] warn: Compilation failed in require at /<C: [...]\SpamAssassin\sawin.dll>Mail/SpamAssassin/PluginHandler.pm line 109.
Fri Apr 28 14:59:55 2017 [2664] warn: rules: failed to run CLAMAV test, skipping:
Fri Apr 28 14:59:55 2017 [2664] warn:  (Can't locate object method "check_clamav" via package "Mail: [...]:SpamAssassin::PerMsgStatus" at (eval 2178) line 331.
Fri Apr 28 14:59:55 2017 [2664] warn: )

jimimaseye · Post by **jimimaseye** » 2017-04-28 16:39

SorenR wrote:Bloody he**....

I got into my head that they were two versions of the same code... They ARE NOT The code in version 2.0 ammend the code in version 1.8 ... What a weird way to alter a module

Version 1.8 of ClamAV.pm goes into .\lib\File\Scan with NO .cf file
Version 2.0 of ClamAV.pm goes into .\etc\spamassassin along with the ClamAV.cf file

Would that explain why the length of the code is different berween v1.8 and v2.0?

Im confused: are you saying that simply using the .cf and .pm (and following the instructions) as found at https://wiki.apache.org/spamassassin/ClamAVPlugin isnt sufficient?

SorenR · Post by **SorenR** » 2017-04-28 16:44

jimimaseye wrote:
SorenR wrote:Bloody he**....

I got into my head that they were two versions of the same code... They ARE NOT The code in version 2.0 ammend the code in version 1.8 ... What a weird way to alter a module

Version 1.8 of ClamAV.pm goes into .\lib\File\Scan with NO .cf file
Version 2.0 of ClamAV.pm goes into .\etc\spamassassin along with the ClamAV.cf file
Would that explain why the length of the code is different berween v1.8 and v2.0?

Im confused: are you saying that simply using the .cf and .pm (and following the instructions) as found at https://wiki.apache.org/spamassassin/ClamAVPlugin isnt sufficient?

Instructions ARE sufficient - You just need to read ALL of them

Note this line: "Second, you need to install the File::Scan::ClamAV perl module."
That's version 1.8 or 1.95 as I have found to be the latest ...

Using identical names for the two plugins is what is causing the confusion.

katip · Post by **katip** » 2017-04-28 18:34

just for the record:
with attached set, SA 3.4.1 & ClamAV 0.99.2 work fine here (i renamed files as location hints).

SorenR · Post by **SorenR** » 2017-04-28 20:11

He he... Checked by HMS and SA

X-Spam-Report reformattet for clarity.

Code: Select all

Return-Path: securitycheck@emailsecuritycheck.net
Delivered-To: postmaster@acme.inc
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on datacenter.acme.inc
X-Spam-Flag: YES
X-Spam-Level: ****
X-Spam-Status: Yes, score=4.4 required=3.0 tests=BAYES_50,CLAMAV,INVALID_MSGID, RCVD_IN_DNSWL_NONE,SPF_HELO_PASS autolearn=disabled version=3.4.0
X-Spam-Virus: Yes (Eicar-Test-Signature)
X-Spam-Report: 

* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no 
*      trust 
*      [149.202.232.193 listed in list.dnswl.org] 
* -0.0 SPF_HELO_PASS SPF: HELO matches SPF record 
*  0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% 
*      [score: 0.5100] 
*  3.0 CLAMAV Clam AntiVirus detected a virus 
*      [Eicar-Test-Signature] 
*  0.6 INVALID_MSGID Message-Id is not valid, according to RFC 2822

Received: from backup-mx.post.tele.dk (backup-mx2.post.tele.dk [80.160.77.115]) by mx.acme.inc ; Fri, 28 Apr 2017 20:01:47 +0200
Received: from emailsecuritycheck.net (outbound.emailsecuritycheck.net [149.202.232.193]) by backup-mx.post.tele.dk (Postfix) with ESMTP id 0F63074C017 for <postmaster@acme.inc>; Fri, 28 Apr 2017 20:01:46 +0200 (CEST)
Received: from localhost by byteplant.com with smtp (Exim 4.80) (envelope-from <securitycheck@emailsecuritycheck.net>) id 1d4ACq-0008AU-Um for postmaster@acme.inc; Fri, 28 Apr 2017 20:01:24 +0200
Subject: * VIRUS * : Test mail 2/7 (ID=MvBKnJLlwC4zZSX4GJa7Bw==)
Date: Fri, 28 Apr 2017 20:01:24 +0200
Message-ID: emailsecuritycheck.net.2.MvBKnJLlwC4zZSX4GJa7Bw==
From: securitycheck@emailsecuritycheck.net
To: postmaster@acme.inc
MIME-Version: 1.0
X-hMailServer-Spam: YES
X-hMailServer-Reason-2: Tagged as Spam by SpamAssassin - (Score: 4)
X-hMailServer-Reason-Score: 4
X-Envelope-To: postmaster@acme.inc
X-Envelope-OriginalTo: postmaster@acme.inc
X-Envelope-From: securitycheck@emailsecuritycheck.net

katip · Post by **katip** » 2017-04-28 21:40

SorenR wrote:4: run spamassassin --lint -D

VERY long output so configure your DOS box with a large history

phew! was a difficult birth (how Germans say), but done!
stats are there. thanks..

SorenR · Post by **SorenR** » 2017-04-28 22:30

Es gibt kein Problem - es gibt nur Lösungen

ClamAV called by SA

ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA

Re: ClamAV called by SA