[clamav-users] Request for guidelines to connect freshclam to Squid proxy

2021-04-29 Thread Zvi Kave via clamav-users
Hello Joel, We would like to get a manual that describes how to configure freshclam and proxy to refresh the signature files through the proxy (squid) and not directly. Explanation: Our servers are behind a firewall.

Re: [clamav-users] Request for guidelines to connect freshclam to Squid proxy

2021-04-29 Thread Matus UHLAR - fantomas
On 29.04.21 11:05, Zvi Kave via clamav-users wrote: We would like to get a manual that describes how to configure freshclam and proxy to refresh the signature files through the proxy (squid) and not directly. use freshclam options: HTTPProxyServer STR, HTTPProxyPort NUMBER Expl

Re: [clamav-users] Request for guidelines to connect freshclam to Squid proxy

2021-04-29 Thread Eero Volotinen
Please check out documentation. There are proxy settings inside of freshclam configuration file. Eero On Thu 29. Apr 2021 at 11.08, Zvi Kave via clamav-users < clamav-users@lists.clamav.net> wrote: > Hello Joel, > > We would like to get a manual that describes how to configure freshclam > and pr

Re: [clamav-users] Request for guidelines to connect freshclam to Squid proxy

2021-04-29 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 29 Apr 2021, Zvi Kave via clamav-users wrote: We would like to get a manual that describes how to configure freshclam and proxy to refresh the signature files through the proxy (squid) and not directly. At the shell prompt: man freshaclam.conf or in a browser: https://www

Re: [clamav-users] Request for guidelines to connect freshclam to Squid proxy

2021-04-29 Thread Eero Volotinen
> > > We wish to open only one IP in the firewall. > > Can you explain why it matters to you how many different IPs are used > to provide the service? Do you use IPv4 and IPv6 addresses? Have you > also asked Google if they will only send mail to you from a single IP? > > https://www.razlee.com/

Re: [clamav-users] Request for guidelines to connect freshclam to Squid proxy

2021-04-29 Thread Zvi Kave via clamav-users
Hi, The SysAdmin that responsible for Firewall maintenance,  allows to open only one IP in the firewall for freshclam use. I shall check squid definitions again. Thank you, Zvi

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Robert Kudyba
How would you make this work for docs.google.com as well? the following regex corresponds to https://drive.google.com next if /^MBL_\d+:0:\*:68747470733a2f2f64726976652e676f6f676c652e636f6d$/; On Thu, Apr 29, 2021, 12:25 AM Olivier wrote: > Robert, > > In the configuration file user.conf for C

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Olivier via clamav-users
Robert Kudyba writes: > [1:text/plain Show] > > > [2:text/html Hide Save:noname (3kB)] > > How would you make this work for docs.google.com as well? > > the following regex corresponds to https://drive.google.com > next if /^MBL_\d+:0:\*:68747470733a2f2f64726976652e676f6f676c652e636f6d$/; If I r

Re: [clamav-users] Request for guidelines to connect freshclam to Squid proxy

2021-04-29 Thread Eero Volotinen
Well. Then you need to install proxy outside of your network and open port to that address. Eero On Thu, Apr 29, 2021 at 2:59 PM Zvi Kave via clamav-users < clamav-users@lists.clamav.net> wrote: > Hi, > > The SysAdmin that responsible for Firewall maintenance, allows to open > only one IP in

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Robert Kudyba
> > > How would you make this work for docs.google.com as well? > > > > the following regex corresponds to > https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com&d=DwIBAg&c=aqMfXOEvEJQh2iQMCb7Wy8l0sPnURkcqADc2guUW8IM&r=X0jL9y0sL4r4iU_qVtR3lLNo4tOL1ry_m7-psV3GejY&m=rEXlMfZlmblv9Z7-T

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 29 Apr 2021, Olivier via clamav-users wrote: Robert Kudyba writes: How would you make this work for docs.google.com as well? the following regex corresponds to https://drive.google.com next if /^MBL_\d+:0:\*:68747470733a2f2f64726976652e676f6f676c652e636f6d$/; If I remembe

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Robert Kudyba
> > On Thu, 29 Apr 2021, Olivier via clamav-users wrote: > > Robert Kudyba writes: > > > >> How would you make this work for docs.google.com as well? > >> > >> the following regex corresponds to > https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com&d=DwICAg&c=aqMfXOEvEJQh2iQMCb7W

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Olivier via clamav-users
Robert Kudyba writes: > >> next if /^MBL_\d+:0:\*:68747470733a2f2f64726976652e676f6f676c652e636f6d$/; > next if /^MBL_\d+:0:\*:68747470733a2f2f646f63732e676f6f676c652e636f6d$/; > > You could do better with a regex, see the excellent Perl documentation. > > So what's the syntax to use || (or)

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Robert Kudyba
> > > >> next if > /^MBL_\d+:0:\*:68747470733a2f2f64726976652e676f6f676c652e636f6d$/; > > next if /^MBL_\d+:0:\*:68747470733a2f2f646f63732e676f6f676c652e636f6d$/; > > > > You could do better with a regex, see the excellent Perl documentation. > > > > So what's the syntax to use || (or) with this

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 29 Apr 2021, Robert Kudyba wrote: ... no error(s) when I just ran it manually. There are lots of things in the script which look likely to cause issues, so I'd have expected something: 1. Is your Perl interpreter in /usr/local/bin/? It's often in usr/bin/. 2. The environm

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Robert Kudyba
> > 1. Is your Perl interpreter in /usr/local/bin/? It's often in usr/bin/. > Thanks I saw that after the fact, indeed /usr/bin in Fedora 2. The environment is likely to be different when the script runs via > freshclam from when it runs at the command line, and it's usually bad > form in script

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Michael Orlitzky via clamav-users
On Thu, 2021-04-29 at 16:22 +0100, G.W. Haywood via clamav-users wrote: > > 3. What is uid 110 on your system? On my clamd server it's 'sshd'. > This means that if I were to run it as root as it is, the script would > change ownership of the modified files to the wrong user (which would > break f

Re: [clamav-users] false positive on MBL_85256034.UNOFFICIAL with Google Drive links

2021-04-29 Thread Olivier via clamav-users
"G.W. Haywood via clamav-users" writes: > Hi there, > > On Thu, 29 Apr 2021, Robert Kudyba wrote: > >> ... no error(s) when I just ran it manually. > > There are lots of things in the script which look likely to cause > issues, so I'd have expected something: > > 1. Is your Perl interpreter in /u