EPrints Technical Mailing List Archive

See the EPrints wiki for instructions on how to join this mailing list and related information.

Message: #05353

< Previous (by date) | Next (by date) > | < Previous (in thread) | Next (in thread) > | Messages - Most Recent First | Threads - Most Recent First

[EP-tech] Antwort: Re: Virus Scan during Upload

Many thanks Brian,

after solving some initial problems we got it working.

- clamd daemon must be installed and running
- port must be the same as the LocalSocket defined in /etc/clamd.conf
- the clam user running the clamd daemon must be in the same group as the apache user.

We tested with a text file containing the EICAR signature (http://www.eicar.org/download/eicar.com.txt )- works fine.
ClamAV does not recognize the EICAR signature enclosed in a pdf file using a Trojan horse file dropper (http://blog.didierstevens.com/2015/08/28/test-file-pdf-with-embedded-doc-dropping-eicar/ ), while the Antivirus scanner on my Mac did.

Best regards,

Martin

--
Dr. Martin Brändle
Zentrale Informatik
Universität Zürich
Stampfenbachstr. 73
CH-8006 Zürich

mail: martin.braendle@id.uzh.ch
phone: +41 44 63 56705
fax: +41 44 63 54505
http://www.zi.uzh.ch

Inactive hide details for "Brian D. Gregg" ---25/01/2016 16:57:16---Martin, This is what we us in our IR (running EPrints 3.2.8"Brian D. Gregg" ---25/01/2016 16:57:16---Martin, This is what we us in our IR (running EPrints 3.2.8).  It could probably be written a bit be

Von: "Brian D. Gregg" <bdgregg@pitt.edu>
An: "eprints-tech@ecs.soton.ac.uk" <eprints-tech@ecs.soton.ac.uk>
Datum: 25/01/2016 16:57
Betreff: [EP-tech] Re: Virus Scan during Upload
Gesendet von: eprints-tech-bounces@ecs.soton.ac.uk




Martin,
 
This is what we us in our IR (running EPrints 3.2.8).  It could probably be written a bit better (obviously – feel free to tweak as anyone sees fit), but works as is for us currently.  You will need ClamAV installed (including the associated PERL modules).
 
This part goes into the cfg/cfg.d/document_validate.pl file under the “CHECKS IN HERE” comment but before the “return ( @problems );”
 
        # Virus scan the uploaded files.
        my %files = $document->files;
        my $path = $document->local_path;
        while ( my ($filename, $size) = each(%files)) {
                # for each file uploaded
                use File::Scan::ClamAV;
                my $av = new File::Scan::ClamAV(find_all => 1, port=> '/tmp/clamd');
                my $filetoscan = "$path/$filename";
                my %caught = $av->scan("$filetoscan");
                while (my ($k,$v) = each %caught ) {
                        # Viruses Found
                        push @problems,
                                $session->html_phrase( "validate:virus_found",
                                        filename => $session->make_text($filename),
                                        virus => $session->make_text($v) );
                }
        }
        # End Virus scan.
 
And the HTML Phrase can go into the file cfg/lang/en/validate.xml
 
<epp:phrase id="validate:virus_found">The file that has been uploaded contains a virus.  The file in question is: <epc:pin name="filename"/>.  It contains the virus: <epc:pin name="virus"/>. Please remove the file and upload a virus free version.</epp:phrase>
 
Hope this helps or at least points you in a direction as to what you might need.
 
Thanks,
Brian Gregg.
 
Brian D. Gregg
Solutions Architect | Manager Systems Development
University of Pittsburgh | University Library System
Address: 7500 Thomas Blvd.  Room 129 Pittsburgh, PA 15208
Tel: (412) 648-3264 | Email: bdgregg@pitt.edu | Fax: (412) 648-3585
https://orcid.org/0000-0001-6541-4544
 
 
 
From: eprints-tech-bounces@ecs.soton.ac.uk [mailto:eprints-tech-bounces@ecs.soton.ac.uk] On Behalf Of martin.braendle@id.uzh.ch
Sent: Monday, January 25, 2016 10:19 AM
To: eprints-tech@ecs.soton.ac.uk
Subject: [EP-tech] Virus Scan during Upload
 

Hi,

in the course of a Swiss Digital Lifecycle Management Project, we are evaluating EPrints and our repo according to the POWRR scheme (gap analysis) to find tools for digital preservation.

One criterion is virus scan of a document before it is uploaded. I have found this old thread: http://www.eprints.org/tech.php/thread-16755.html

Has anyone followed up on this, implemented a hook and is willing to share code?

Thank you for all your advice and help.

Martin

--
Dr. Martin Brändle
Zentrale Informatik
Universität Zürich
Stampfenbachstr. 73
CH-8006 Zürich*** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech
*** Archive: http://www.eprints.org/tech.php/
*** EPrints community wiki: http://wiki.eprints.org/
*** EPrints developers Forum: http://forum.eprints.org/