How to integrate ClamAV into Pure-FTPd for virus scanning

One problem in website administration is a webmaster’s computer becoming infected with a virus or Trojan without their knowledge. When files are uploaded to the server, the malware may have modified scripts or HTML files to include unwanted code. Fixing the webmaster’s computer alone may not be enough. This article shows how to configure an FTP server to scan uploaded files for viruses, adding another layer of protection to the server. The installation method in this article has been modified to write logs for later review. You can see which files a user uploaded and whether they were infected. Files detected as infected are moved to /var/spool/FtpQuarantine rather than deleted. *This article does not cover installing pure-ftpd. Instructions for installing it are available at (being written…). The only software required is pure-ftpd and clamav (Free anti-virus). Follow the steps below. :)

1. Install clamav with this command (see install clamav for Centos 5).

   [root@ezylinux ~]## yum install -y clamav

2. Edit /etc/pure-ftpd/pure-ftpd.conf and set CallUploadScript to yes (or uncomment it) so that it can run the virus-scanning script we will create. See the example below.

   CallUploadScript yes

3. Create clamav_check.sh in /etc/pure-ftpd with this command.

   [root@ezylinux ~]# vi /etc/pure-ftpd/clamav_check.sh

   Add the following code.

   
   #!/bin/sh
   /etc/pure-ftpd/clamav_check.py "$1" $UPLOAD_VUSER

4. Create clamav_check.py in /etc/pure-ftpd with this command.

   [root@ezylinux ~]# vi /etc/pure-ftpd/clamav_check.py

   Add the following code.

   
   #!/usr/bin/python
   
   import sys
   import os
   import time
   
   HOSTNAME = 'Ezylinux.com'
   SENDMAIL = "/usr/sbin/sendmail"
   QUARANTINE ="/var/spool/FtpQuarantine"
   LogFile = '/var/log/ftpscan'
   
   arg = sys.argv
   cmdline = "/usr/bin/clamscan --move="+QUARANTINE+" --no-summary " + arg[1]
   results = os.popen(cmdline).readlines()
   file = open(LogFile, 'a')
   for result in results:
           result = '['+time.asctime( time.localtime(time.time()) )+']'+ "[user: "+ arg[2]+ "] " + result
           file.write(result)
   file.close()

5. Run pure-uploadscript as shown below so that pure-ftpd runs clamav_check.sh after each upload finishes.

   [root@ezylinux ~]# /usr/sbin/pure-uploadscript -B -r /etc/pure-ftpd/clamav_check.sh

6. Edit /etc/rc.local and add: /usr/sbin/pure-uploadscript -B -r /etc/pure-ftpd/clamav_check.sh

7. Restart the pure-ftpd service with this command.

   [root@ezylinux ~]# service pure-ftpd restart

8. Add the following cron job for freshclam (signature updates).

   0 0-23/12 * * * /usr/bin/freshclam