Domino 12.0.2 EAP CD 1 – ClamAV & ICAP
A word of warning. The described features of Domino 12.0.2 EAP are subject to change in later code drops.
The described configuration of ClamAV & ICAP is NOT intended to be used in production. I take no responsibility for any damage or data loss caused by using the configuration on test or production systems.
A new feature “Virus scanning for message attachments” has been added to Domino 12.0.2 EAP. You can set up HCL Domino to work with any virus scanning server that supports the ICAP protocol to scan attachments in mail messages for viruses. In addition to Domino 12.0.2 , you need a third-party ICAP protocol server to do the virus scanning. Domino has been tested with the products Trend Micro Web Security and McAfee Web Gateway. TLS is required in Domino 12.0.2 GA to connect to the server, but it is disabled by now.
Prerequisites
The installation uses CentOS 8 Stream. The minimum installation was chosen for the software selection. All required packages are installed later via dnf.
For my tests, I have set SELinux to permissive as described here: https://linuxize.com/post/how-to-disable-selinux-on-centos-8/
We need to download and configure some files during the setup. This can be down using VI or any other text editor. I prefer NANO.
dnf -y install nano wget
Next, we install an additional repository
dnf -y install epel-release
Install ClamAV, freshclam and clamd
and install ClamAV and related services.
dnf --enablerepo=epel -y install clamav clamd clamav-update
Run
freshclam
to initialize or update the virus signature databases.
For a scheduled update, we will run freshclam as service. create a new file ( nano will create an empty file, if it does not exists.)
nano /usr/lib/systemd/system/freshclam.service
and add the following content to it
[Unit] Description = ClamAV Scanner After = network.target [Service] Type = forking ExecStart = /usr/bin/freshclam -d -c 1 Restart = on-failure PrivateTmp =true [Install] WantedBy=multi-user.target
Save and close the file. Then start the freshclam service and enable it to start on server startup. freshclam will update the signatures once a day.
systemctl start freshclam systemctl enable freshclam Created symlink /etc/systemd/system/multi-user.target.wants/freshclam.service → /usr/lib/systemd/system/freshclam.service.
Check the freshclam status.
systemctl status freshclam
● freshclam.service - ClamAV Scanner
Loaded: loaded (/usr/lib/systemd/system/freshclam.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2022-05-31 07:07:48 CEST; 16s ago
Main PID: 1809 (freshclam)
Tasks: 1 (limit: 11344)
Memory: 2.2M
CGroup: /system.slice/freshclam.service
└─1809 /usr/bin/freshclam -d -c 1
May 31 07:07:48 localhost.localdomain systemd[1]: Starting ClamAV Scanner...
May 31 07:07:48 localhost.localdomain systemd[1]: Started ClamAV Scanner.
To configure Clamd edit the /etc/clamd.d/scan.conf
nano /etc/clamd.d/scan.conf
and enable / change the existing values
LogFile /var/log/clamd.scan PidFile /run/clamd.scan/clamd.pid TemporaryDirectory /var/tmp LocalSocket /run/clamd.scan/clamd.sock LocalSocketGroup root TCPSocket 3310 User root
then initialize the logfile with
touch /var/log/clamd.scan
Create a new file
nano /etc/tmpfiles.d/clamd.scan.conf
and add the following content
d /run/clamd.scan 0770 root root -
Next, start, enable and get the status of clamd.service
systemctl start clamd@scan
systemctl enable clamd@scan
systemctl status clamd@scan
[root@localhost ~]# systemctl status clamd@scan
● clamd@scan.service - clamd scanner (scan) daemon
Loaded: loaded (/usr/lib/systemd/system/clamd@.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2022-05-31 06:41:23 CEST; 4s ago
Docs: man:clamd(8)
man:clamd.conf(5)
https://www.clamav.net/documents/
Process: 1727 ExecStart=/usr/sbin/clamd -c /etc/clamd.d/scan.conf (code=exited, status=0/SUCCESS)
Main PID: 1728 (clamd)
Tasks: 2 (limit: 11344)
Memory: 1.3G
CGroup: /system.slice/system-clamd.slice/clamd@scan.service
└─1728 /usr/sbin/clamd -c /etc/clamd.d/scan.conf
Install c-icap
dnf -y install gcc make
curl -L -O http://downloads.sourceforge.net/project/c-icap/c-icap/0.5.x/c_icap-0.5.10.tar.gz tar zxvf c_icap-0.5.10.tar.gz cd c_icap-0.5.10
We need to modify the source code to work with Domino 12.0.2 EAP1. this is subject to become obsolete in a future Domino code drop.
Find all occurrencies of “HTTP/1.0” in the source code. The mailscan task in Domino 12.0.2 expects “HTTP/1.1”.
grep -r -e “HTTP/1.0” *
You will get 3 matches in 2 source files.
info.c: ci_http_response_add_header(req, "HTTP/1.0 200 OK"); utils/c-icap-client.c: ci_headers_add(headers, "HTTP/1.0 200 OK"); utils/c-icap-client.c: snprintf(lbuf,1024, "%s %s HTTP/1.0", method, url);
Replace HTTP/1.0 with HTTP/1.1
sed -i 's/HTTP\/1.0/HTTP\/1.1/g' info.c sed -i 's/HTTP\/1.0/HTTP\/1.1/g' utils/c-icap-client.c
Run the following commands to build and install the binaries
./configure make make install cd cp /usr/local/etc/c-icap.conf /etc
Create a new file
nano /etc/tmpfiles.d/c-icap.conf
and add the following content
d /var/run/c-icap 0755 root root -
Create the c-icap service. Create a new file
nano /usr/lib/systemd/system/c-icap.service
and add the following content
[Unit] Description=c-icap service After=network.target [Service] Type=forking PIDFile=/var/run/c-icap/c-icap.pid ExecStart=/usr/local/bin/c-icap -f /etc/c-icap.conf KillMode=process [Install] WantedBy=multi-user.target
Now you can start, enable and check the status of the c-icap service
systemctl start c-icap
systemctl enable c-icap
systemctl status c-icap
● c-icap.service - c-icap service
Loaded: loaded (/usr/lib/systemd/system/c-icap.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2022-05-31 07:25:30 CEST; 15s ago
Main PID: 7757 (c-icap)
Tasks: 37 (limit: 11344)
Memory: 2.3M
CGroup: /system.slice/c-icap.service
├─7757 /usr/local/bin/c-icap -f /etc/c-icap.conf
├─7758 /usr/local/bin/c-icap -f /etc/c-icap.conf
├─7759 /usr/local/bin/c-icap -f /etc/c-icap.conf
└─7760 /usr/local/bin/c-icap -f /etc/c-icap.conf
May 31 07:25:30 localhost.localdomain systemd[1]: Starting c-icap service...
May 31 07:25:30 localhost.localdomain systemd[1]: Started c-icap service.
Install squidclamav
curl -L -O http://downloads.sourceforge.net/project/squidclamav/squidclamav/7.1/squidclamav-7.1.tar.gz tar zxvf squidclamav-7.1.tar.gz cd squidclamav-7.1
As with c-icap, we need to modify the source code to work with Domino 12.0.2 EAP1.
grep -r -e "HTTP/1.0" * src/squidclamav.c: ci_http_response_add_header(req, "HTTP/1.0 403 Forbidden"); src/squidclamav.c: ci_http_response_add_header(req, "HTTP/1.0 307 Temporary Redirect"); sed -i 's/HTTP\/1.0/HTTP\/1.1/g' src/squidclamav.c
Build and deploy the binaries
./configure --with-c-icap make make install cd
Edit c-icap configuration
nano /etc/c-icap.conf
and add the squidclamav service after the existing echo service
Service squidclamav squidclamav.so
Create a symlink for the squidclamav configuration file
ln -s /usr/local/etc/squidclamav.conf /etc/squidclamav.conf
Edit /etc/squidclamav.conf and apply the changes
nano /etc/squidclamav.conf ## comment redirect (we don't need it here) #redirect http://proxy.domain.dom/cgi-bin/clwarn.cgi ## change clamd_local /var/run/clamav/clamd.ctl to clamd_local /run/clamd.scan/clamd.sock
Restart c-icap
systemctl restart c-icap
Finally, we need to open port 1344 in the firewall
firewall-cmd --zone=public --add-port=1344/tcp --permanent firewall-cmd --reload
Congratulations! You now have a ICAP server that uses ClamAV to scan your attachments for viruses.
You can now use the ICAP server in your mailscan configuration in Domino 12.0.2. You’ll find information on how to configure mailscan in Domino 12.0.2 here
And last but not least, here is an example of a scanlog for the EICAR virus
I will update this post / write additional information during the Beta phase of Domino 12.0.2.