Using remote exploration ICAP service from Eset File Security for linux v8, I can handle virus detection for PMG using this code with some adjustment:Hello all,
I just wanted to provide another example code to integrate F-Secure Atlant via Icap. as this utilizes the icap protocol it should be easy to adapt to any other icap-compatible anti-virus-solution.
For better understanding: "atlant" is the product name of the F-Secure Icap Service. You may want to adapt this matching to your product.
Prereqesites:
Change pmg.cfg:
- Installed c-icap-client on pmg (apt install c-icap)
- Up and running icap service (either on localhost or elsewhere)
- /etc/hosts entry having the name "atlant" pointing to your atlant-server (just in case of this example. If you run another icap system just adapt the script)
In the admin-section add:
Code:pmg.admin.custom_check = 1
Build /usr/local/bin/pmg-custom-check :
I adapted the following code from the official proxmox example I found in the documentatioin. So you may also want to look there.
As usual this code comes without any warranty. it is not the most sophisticated piece of software and also has NOT been heavily tested. Read it. Understand it. Use it on your own risk. Improve it and post your improvements here
It is a bit hacky as c-icap-client is not meant to do this job and is posting it's headers to stderr. (thats why 2 ist redirected to 1 in order to capture those headers containing infection-information)
Again: USE AT OWN RISK AND GOOD LUCK
Bash:#!/bin/sh if [ "$#" -ne 2 ]; then echo "usage: $0 APIVERSION QUEUEFILENAME" 1>&2 exit 1 fi apiver="$1" shift if [ "$apiver" != "v1" ]; then echo "wrong APIVERSION: $apiver" 1>&2 exit 2 fi queue_file="$1" echo "v1" ATLANT="atlant" result="$(c-icap-client -i "$ATLANT" -v -f "$queue_file" 2>&1 | grep -F 'X-FSecure-Infection-Name')" infected=$? if [ "$infected" = "1" ]; then echo OK else echo "VIRUS: $(echo $result | awk '{ print $2 }' )" fi
put the executable flag (chmod +x) and test test:
Code:# /usr/local/bin/pmg-custom-check v1 testfile v1 VIRUS: "Malware.Eicar-Test-Signature"
Code:# /usr/local/bin/pmg-custom-check v1 /etc/hosts v1 OK
Have fun.
Regards
Matthias
#!/bin/sh
if [ "$#" -ne 2 ]; then
echo "usage: $0 APIVERSION QUEUEFILENAME" 1>&2
exit 1
fi
apiver="$1"
shift
if [ "$apiver" != "v1" ]; then
echo "wrong APIVERSION: $apiver" 1>&2
exit 2
fi
queue_file="$1"
echo "v1"
SERVER="127.0.0.1"
result="$(c-icap-client -i "$SERVER" -v -f "$queue_file" 2>&1 | grep -F 'X-Infection-Found')"
infected=$?
if [ "$infected" = "1" ]; then
echo OK
else
echo "VIRUS: $(echo $result | awk -F= '{ print $4 }' )"
fiUPD
you need to install avast from an external source (as described in the PMG wiki: https://pmg.proxmox.com/wiki/index.php/Install_Avast)
