Antivirus

The antivirus service is responsible for scanning files for viruses.

• Configuration
  • Antivirus Scanner Type
  • Maximum Scan Size
  • Infected File Handling
  • Scanner Inaccessibility
• Operation Modes
  • Postprocessing
• Example Yaml Config

The antivirus service currently supports ICAP and ClamAV as antivirus scanners. The ANTIVIRUS_SCANNER_TYPE environment variable is used to select the scanner. The detailed configuration for each scanner heavily depends on the scanner type selected. See the environment variables for more details.

• For icap, only scanners using the X-Infection-Found header are currently supported.
• For clamav only local sockets can currently be configured.

Several factors can make it necessary to limit the maximum filesize the antivirus service will use for scanning. Use the ANTIVIRUS_MAX_SCAN_SIZE environment variable to scan only a given amount of bytes. Obviously, it is recommended to scan the whole file, but several factors like scanner type and version, bandwidth, performance issues, etc. might make a limit necessary.

The antivirus service allows three different ways of handling infected files. Those can be set via the ANTIVIRUS_INFECTED_FILE_HANDLING environment variable:

• delete: (default): Infected files will be deleted immediately, further postprocessing is cancelled.
• abort: (advanced option): Infected files will be kept, further postprocessing is cancelled. Files can be manually retrieved and inspected by an admin. To identify the file for further investigation, the antivirus service logs the abort/infected state including the file ID. The file is located in the storage/users/uploads folder of the ocis data directory and persists until it is manually deleted by the admin via the Manage Unfinished Uploads command.
• continue: (obviously not recommended): Infected files will be marked via metadata as infected but postprocessing continues normally. Note: Infected Files are moved to their final destination and therefore not prevented from download which includes the risk of spreading viruses.

In all cases, a log entry is added declaring the infection and handling method and a notification via the userlog service sent.

In case a scanner is not accessible by the antivirus service like a network outage, service outage or hardware outage, the antivirus service uses the abort case for further processing, independent of the actual setting made. In any case, an error is logged noting the inaccessibility of the scanner used.

The antivirus service can scan files during postprocessing. on demand scanning is currently not available and might be added in a future release.

The antivirus service will scan files during postprocessing. It listens for a postprocessing step called virusscan. This step can be added in the environment variable POSTPROCESSING_STEPS. Read the documentation of the postprocessing service for more details.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# Autogenerated
# Filename: antivirus-config-example.yaml

file: ""
log:
  level: ""
  pretty: false
  color: false
  file: ""
debug:
  addr: 127.0.0.1:9277
  token: ""
  pprof: false
  zpages: false
tracing:
  enabled: false
  type: ""
  endpoint: ""
  collector: ""
infected-file-handling: delete
events:
  endpoint: 127.0.0.1:9233
  cluster: ocis-cluster
  tls_insecure: false
  tls_root_ca_certificate: ""
  enable_tls: false
  username: ""
  password: ""
scanner:
  type: clamav
  clamav:
    socket: /run/clamav/clamd.ctl
  icap:
    timeout: 0
    scan_timeout: 5m0s
    url: icap://127.0.0.1:1344
    service: avscan
max-scan-size: ""