Tweak freshclam ReceiveTimeout value for slow internet connections

Bug #1865511 reported by TuxVinyards
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
clamav (Ubuntu)
Triaged
Low
Unassigned

Bug Description

Except from Package description (Eoan):

"For scanning to work, a virus database is needed. There are two options
for getting it:

 - clamav-freshclam: updates the database from Internet. This is
   recommended with Internet access.

 - clamav-data: for users without Internet access. The package is
   not updated once installed. The clamav-getfiles package allows
   creating custom packages from an Internet-connected computer."

This is causing a lot of problems:

1. clamav-data is not available.

2. clamav-freshclam package is not sufficient. Service fails to update. Manual attempts cause download but data fails to install.

Cure: install clamav-daemon package.

See:

https://askubuntu.com/questions/589318/freshclam-error-clamd-conf-file-not-found#632911

And: https://askubuntu.com/questions/909273/clamav-error-var-log-clamav-freshclam-log-is-locked-by-another-process#909276

CVE References

Revision history for this message
Andreas Hasenack (ahasenack) wrote :
Download full text (3.5 KiB)

apt install clamav on eoan brings in:
clamav clamav-base clamav-freshclam libclamav9 libltdl7 libtfm1

The freshclam daemon tries to download the databases right away:
Tue Mar 3 20:01:42 2020 -> freshclam daemon 0.102.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Tue Mar 3 20:01:42 2020 -> ClamAV update process started at Tue Mar 3 20:01:42 2020
Tue Mar 3 20:01:42 2020 -> daily database available for download (remote version: 25740)
Tue Mar 3 20:02:12 2020 -> WARNING: Download failed (28) Tue Mar 3 20:02:12 2020 -> WARNING: Message: Timeout was reached
Tue Mar 3 20:02:12 2020 -> WARNING: getcvd: Can't download daily.cvd from https://database.clamav.net/daily.cvd
Tue Mar 3 20:02:12 2020 -> Trying again in 5 secs...

While that is happening, clamscan won't work:
root@e1:~# clamcsc^C
root@e1:~# clamscan
LibClamAV Error: cli_loaddbdir(): No supported database files found in /var/lib/clamav
ERROR: Can't open file or directory

Which is expected.

It will keep trying. In my case, now it managed to download daily:
Tue Mar 3 20:03:11 2020 -> Testing database: '/var/lib/clamav/tmp.3f047/clamav-323978c4ffb272b6b680262710a2e099.tmp-daily.cvd' ...
Tue Mar 3 20:03:16 2020 -> Database test passed.
Tue Mar 3 20:03:16 2020 -> daily.cvd updated (version: 25740, sigs: 2204413, f-level: 63, builder: raynman)

And it's trying main again. That's a big file, over 100Mb in size. I believe that's why I'm getting timeouts, as I can't receive such a big file in 30s, which is the default ReceiveTimeout in /etc/clamav/freshclam.conf:

ReceiveTimeout 30

Once I updated that to 300s, and restarted the freshclam daemon, it fetched the main database just fine:

Tue Mar 3 20:08:15 2020 -> main database available for download (remote version: 59)
Tue Mar 3 20:10:09 2020 -> Testing database: '/var/lib/clamav/tmp.393b2/clamav-bcd674e3559e38c5a502dfe72b8bf48c.tmp-main.cvd' ...
Tue Mar 3 20:10:13 2020 -> Database test passed.
Tue Mar 3 20:10:13 2020 -> main.cvd updated (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
Tue Mar 3 20:10:13 2020 -> bytecode database available for download (remote version: 331)
Tue Mar 3 20:10:15 2020 -> Testing database: '/var/lib/clamav/tmp.393b2/clamav-99166262d870f9b5d36574c18189bea1.tmp-bytecode.cvd' ...
Tue Mar 3 20:10:15 2020 -> Database test passed.
Tue Mar 3 20:10:15 2020 -> bytecode.cvd updated (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
Tue Mar 3 20:10:15 2020 -> ERROR: NotifyClamd: Can't find or parse configuration file /etc/clamav/clamd.conf

The last error about NotifyClamd is also expected, since I didn't install the clamd daemon.

clamscan now works:
root@e1:~# clamscan
/root/.viminfo: OK
/root/.profile: OK
/root/.lesshst: OK
/root/.bashrc: OK

----------- SCAN SUMMARY -----------
Known viruses: 6759121
Engine version: 0.102.2
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 12.184 sec (0 m 12 s)

Regarding this bug then:
1) clamav-data should no longer be mentioned in d/control indeed, as this package doesn't exist anymore.
2) clamav-freshclam could be made a bit better by increasing the ReceiveTimeout, but by how much I'm...

Read more...

summary: - Clamav package should contain clamav-daemon
+ Tweak freshclam ReceiveTimeout value for slow internet connections
Changed in clamav (Ubuntu):
status: New → Triaged
importance: Undecided → Low
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Actually, looks like this was fixed already. The 30s ReceiveTimeout default value was being set in eoan's clamav-freshclam.postinst:

  [ -z "$ReceiveTimeout" ] && ReceiveTimeout=30

This was later changed to 0 in the package version 0.102.2+dfsg-1:
clamav (0.102.2+dfsg-1) unstable; urgency=medium

  * Import 0.102.2
    - CVE-2020-3123 (DoS may occur in the optional DLP feature)
      (Closes: 950944).
  * Update symbol file.
  * Set ReceiveTimeout to 0 which is upstream default.

Which is in Ubuntu Focal. Therefore, this bug is fixed in that upcoming release.

Revision history for this message
Bryce Harrington (bryce) wrote :

Would this be worth an SRU for eoan? Or is there one already planned? Looks like eoan-security has:

    0.102.2+dfsg-0ubuntu0.19.10.1

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.