Как мы знаем, Proxmox Mail Gateway защищен бесплатным антивирусом ClamAV версии 0.103.6. Как мне показалось, давольно не плохо входящая почта защищена. Но оказалось не так. Пока в один прекрасный момент, я получил Exel файл. (файл заражен, скачиваете на свой страх и риск). Открыв его в незащещенной сети, я получил зараженный комп и без конца стучащиеся по SMB в сеть процессы. Так же один процесс, межал установке антивируса, помог только Online сканер. Пересмотрев логи почтовика увидел, что вируса в файле не обнаружено. Но Online сервис утверждает, что ClamAV все же определяет вирус.

Проверим какие базы работают у нас:

clamscan --debug 2>&1 /dev/null | grep "loaded"

В результате мы увидим, что некоторые базы не подключились, так как требуют ClamAV более высокой версии

LibClamAV debug: init_tdb: Signature for Doc.Downloader.Qbot-af43432fbcb8603c-99 49169-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-b600c9ff3ec1c136- 9950239-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-adc2d23d2dc26dd0- 9950240-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-ea85857e7e81817a- 9950241-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-add2d22d2bc26dd0- 9950243-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-b3c4cc3b33c03bcc- 9950244-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Qbot-aa2a2a3fd5f4342a-99 50245-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-b3c5cc3b13c03bcc- 9950246-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Lokibot-b7709cc9c9e32730 -9950247-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Qbot-b760f03263b7c21b-99 50248-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.IcedID-8ff0f02ff0876072- 9950256-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Trojan-a3552b953bb78322- a3552b953bb78322-9950267-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Trojan-a0425f7f2000faff- a0425f7f2000faff-9950268-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.Trojan-bf70f023603538ee- bf70f023603538ee-9950269-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Trojan-b333b3b333898c4c- b333b3b333898c4c-9950284-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Zloader-f8537378cabc848c -9950315-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Abracadabra-f87353785a98 8c8e-9950319-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-bd646399c2d39496- bd646399c2d39496-9950330-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-fa81817e7e85817a- 9950340-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.Trojan-f0f887070fc68787- f0f887070fc68787-9950342-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-aa524936374996af- 9950344-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-b3b8ccc73b3840c7- 9950421-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-adc2d23d2dc26dc2- 9950422-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Trojan-aa0b8f388d8573cd- aa0b8f388d8573cd-9950439-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Qbot-b760f03262b6e23b-99 50440-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-b2cbc93e36c0c13e- 9950560-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.RedLine-9fe0e00f9e2fc00f -9950883-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-b2cbc93636c1c13e- 9950990-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-a5251d2d2d7d3722- 9950991-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-a5251d1d2d6d3726- 9951018-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-ab81c42b2bdc747c- 9951019-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-a5251d3d2d6d3722- 9951020-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-b680c97f3ec1c03e- 9951030-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-bd646319c2d29cd6- 9951195-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-ab81c42b2bd4747e- 9951196-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.IcedID-9f1f1d193a2a2a2b- 9951463-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Qbot-aa2a2a2fd5f4742a-99 51464-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.Formbook-bc97c1e0c33c3c9 3-9951465-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.SVCReady-8f5af0a5f0da707 0-9951542-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-ea85817e7e81383e- 9951566-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.IcedID-87f88705f807f878- 9951567-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Remcos-ffff7e420001049f- 9951592-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.SVCReady-81fe832081fe7c7 c-9951593-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-ea81817e7f807ab1- 9952142-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.DocuSign-dea86a54956ba3c 2-9952540-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-aa87d5786a858772- 9953435-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.SVCReady-c5c43a913b3eccc 9-9953477-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.MirrorBlast-f8f807074fc9 8734-9955046-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.IcedID-87f0ff24f8876052- 9955146-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.IcedID-8f0bf81ff0df2060- 9955147-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-b649c93692b4c9d9- 9976616-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Dropper.Detected-9977031-0 not load ed (required f-level: 151)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.Emotet-ca2435d8af069a3f- 9977227-0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.Valyria-9978334-0 not lo aded (required f-level: 151)
LibClamAV debug: init_tdb: Signature for Html.Phishing.af0f91939b636494-9978353- 0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Html.Phishing.8f8e708f7b8f7080-9978354- 0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Html.Phishing.8786709b7b8f64a4-9978355- 0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Html.Phishing.a7279d9b7b606484-9978356- 0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Html.Phishing.8f8e708f7b8f6480-9978357- 0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Doc.Downloader.afc5c039d11fd238-9978787 -0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.be3e9999e42690c3-9978797 -0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.94c25b356b5a6cac-9978798 -0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.af2fa5c5d0587870-9978799 -0 not loaded (required f-level: 150)
LibClamAV debug: init_tdb: Signature for Xls.Downloader.d795e45a60a593c6-9978800 -0 not loaded (required f-level: 150)

Ну чтож пробуем обновить до последней версии (на момент написания статьи, последняя версия ClamAV, 0.105.1):

Устанавливаем следующие пакеты:

apt-get update && apt-get install -y \
wget gcc make pkg-config python3 python3-pip python3-pytest valgrind \
check libbz2-dev libcurl4-openssl-dev libjson-c-dev libmilter-dev \
libncurses5-dev libpcre2-dev libssl-dev libxml2-dev zlib1g-dev

python3 -m pip install cmake

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

apt-get install -y cargo rustc

Cкачиваем и распаковываем новый дистрибутив. Собирать мы будем из исходников

cd /srv
wget https://prohosting.by/program/Other/ClamAV/clamav-0.105.1-3.tar.gz
tar -xzf clamav-0.105.1-3.tar.gz
cd clamav-0.105.1-3
mkdir build && cd build

Собираем:

cmake .. \
-D CMAKE_INSTALL_PREFIX=/usr \
-D CMAKE_INSTALL_LIBDIR=lib \
-D APP_CONFIG_DIRECTORY=/etc/clamav \
-D DATABASE_DIRECTORY=/var/lib/clamav \
-D ENABLE_JSON_SHARED=OFF
cmake --build

Перед установкой проверяем, все ли собралось правильно:

ctest

Если не получили никаких ошибок, пробуем устанавливать

sudo cmake --build . --target install

После успешной установки, нам следует отключить clamav-daemon c версией 0.103.6

systemctl stop clamav-daemon && systemctl disable clamav-daemon

На текущем этапе, обновление ClamAV до версии 0.105.1 выполнено, проверить версию можно командой:

clamdscan -V

Проверим все ли базы подключились:

clamscan --debug 2>&1 /dev/null | grep "loaded"

На этом Все 🙂 Всем безопасных Email-ов.