Questions[clamav](server)

The email virus filter wrapper for ClamAV, clamassassin, appends its headers to the message headers.

X-Virus-Status: No
X-Virus-Checker-Version: clamassassin 1.2.4 with clamscan / ClamAV 1.0.3/27134/Mon Dec 25 11:40:06 2023

It would be better that any MTA delivering the message only prepends to the headers, as RFC 5322, 3.6 suggests:

However, for the purposes of this specification, header fields SHOULD NOT be reordered when a message is transported or transformed. More importantly, the trace header fields and resent header fields MUST NOT be reordered, and SHOULD be kept in blocks prepended to the message. See sections 3.6.6 and 3.6.7 for more information.

For instance, spamassassin prepends its X-Spam-* headers above the existing headers. Why clamassassin does not do the same, and how to alter this behaviour? If, e.g., the .procmailrc had the following I would expect these headers to appear in the same place.

:0 fw
| clamassassin

:0 fw
| spamassassin

My server is centos 7.4, with clamav 0.101.1-1.el7.
When I run clamscan -r --infected --exclude-dir="^/sys" / through terminal, I always wait more than 6 hours to get output.
And if I close terminal, clamscan will stop.

Then I want to use clamdscan to scan in background.
My question are:
1.How to --exclude-dir="^/sys" / with clamdscan?
2.How to make clamdscan only log --infected?

Following error is showed when starting clamd;

freshclam[26882]: [LibClamAV] mpool_malloc():Attempt to allocate 8388608 bytes. Please report to http://bugs.clamav.net

I have lots of RAM memory unused on my linuxOS, but this error keeps showing on the display,I couldn't start clamd daemon because of the error. And now I can't send or receive emails.

Could you tell us the cause of this error and how to solve it?

I've been doing "extensive" research on securing a linux web server. On top of what is considered the "basics" (removing unused services, hardening ssh, iptables, etc.) is it wise to include anti-rootkits (Tripwire) and an anti-virus (ClamAV)? Are these just overkill for a web server? I know this is a very vague question, but I'm curious on others opinions.

My future environment: - ubuntu 10.04 - fail2ban - nginx 0.8.x - php 5.3.x (suhosin, apc, memcached) - mongodb 1.6.x

Possible applications: - web services - web apps with user uploads (pictures, pdfs, etc.) - typical websites (forms, etc.)

If you have any other tips, please feel free to add!

Thanks

Clamd is taking up about 5% of my memory (2GB) on my dedicated server (running linux) and I'm wondering if I can disable it without any security risks.

The server just hosts a few of my own websites. For the most part, email received and sent is done through gmail (which connects to my pop3 accounts).

The only other email use case is where one of my websites parses all emails and grabs attached images and the subject line.

Would there be any security / risks of virus infection if I disable clamd?