Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ClamAV possible?

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    24 Posts 6 Posters 5.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kejianshi
      last edited by

      My suggestion is:

      1.  Install squid 2, the stable one.  2.7.9 pkg v.4.3.4 (not squid 3)

      2.  reboot pfsense, then configure squid, the reboot again.

      3. install dansguardian (I think clamav is part of that package)

      You have to go into dansguardian and click the check box to enable clamav scanning.
      You should probably do the first clamav signature update at the command line of pfsense.

      4.  Configure dansguardian.

      5.  Configure the pfsense firewall so that selected machines on the LAN get HTTP through dansguardian.

      If there is some new bug that would break this I wouldn't be aware of it.  when my kids got older I deactivated net-nanny.

      1 Reply Last reply Reply Quote 0
      • M
        MrGlasspoole
        last edited by

        I really tried already allot and everything i found here but nothing works.
        I also tried this: http://egoncalves.com.br/pfsense/pfsense-squid3-dev-clamav-i386/
        But I'm on x64 and there I can't find a clwarn.cgi

        Also in Dansguardian ClamAV does not start.

        1 Reply Last reply Reply Quote 0
        • K
          kejianshi
          last edited by

          Hmmm.  That doesn't look like the stable release of squid to me…

          1 Reply Last reply Reply Quote 0
          • C
            Cino
            last edited by

            I must be lucky then.. I have it working using squid3-dev 3.3.10 pkg 2.2.6 on i386… Of course I can't remember if I had to do some work around...

            Come to think of it, I think I may had to change folder permissions /var/log/c-icap and /var/log/clamav to be clamav:wheel and make sure clwarn.cgi is browser accessible

            Just did a test to make sure its still working:

            SquidClamAv 6.10: Virus detected!

            The requested URL http://www.eicar.org/download/eicar.com.txt contains a virus
            Virus name: Eicar-Test-Signature

            This file cannot be downloaded.

            Origin: 192.168.0.101 / -

            Powered by SquidClamAv 6.10.

            1 Reply Last reply Reply Quote 0
            • M
              MrGlasspoole
              last edited by

              @Cino:

              I must be lucky then.. I have it working using squid3-dev 3.3.10 pkg 2.2.6 on i386…

              As i wrote I'm on x64 and the folder creation and permission stuff is shown in the link and something i tried.

              But i can't execute freshclam cause there is no clwarn.cgi on my system.
              And as the forum searchs show - I'm not the only one with this problems.

              1 Reply Last reply Reply Quote 0
              • K
                kejianshi
                last edited by

                Cino - Cool.  Then its possible with squid3 as well.

                At the time that I tried it I had issues with that and no particular need for squid 3 over 2.

                But its good to know its possible.

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by

                  You took a look at this already?

                  http://egoncalves.com.br/pfsense/pfsense-squid3-dev-clamav-i386/

                  1 Reply Last reply Reply Quote 0
                  • M
                    MrGlasspoole
                    last edited by

                    @Thats the link i was talking about and i posted above ;D

                    1 Reply Last reply Reply Quote 0
                    • K
                      kejianshi
                      last edited by

                      Hmmmm…

                      Sorry.  I guess I'm not helping.
                      My next move might be to wipe the box and start fresh following that guide on a fresh install.

                      That will be a controversial suggestion.

                      1 Reply Last reply Reply Quote 0
                      • C
                        Cino
                        last edited by

                        freshclam only updates the virus definitions. From what I can tell, the package wasn't setup to enable this for some reason but I was able to get it run.

                        edit /usr/pbi/squid-i386/etc/freshclam.conf to your liking. then run this from the cmdline

                        
/usr/pbi/squid-i386/bin/freshclam -d /usr/pbi/squid-i386/etc/freshclam.conf

                        Auto start on reboots, create file /usr/local/etc/rc.d/freshclam.sh with 755

                        
#!/bin/sh
# This file was automatically generated
# by the pfSense service handler.

rc_start() {
	/usr/pbi/squid-i386/bin/freshclam -d /usr/pbi/squid-i386/etc/freshclam.conf
}

rc_stop() {
	killall freshclam
}

case $1 in
	start)
		rc_start
		;;
	stop)
		rc_stop
		;;
	restart)
		rc_stop
		rc_start
		;;
esac

                        I copied /usr/pbi/squid-i386/libexec/squidclamav/clwarn.cgi to /usr/local/www/clwarn.cgi

                        adjust squid-i386 to squid-amd64 if your running amd64

                        1 Reply Last reply Reply Quote 0
                        • C
                          Cino
                          last edited by

                          i haven't tried it on amd64… It could be that the binaries are compiled run if you founded http://egoncalves.com.br/pfsense/pfsense-squid3-dev-clamav-i386/ cause that how-to looks basically what I did to get it to run..

                          1 Reply Last reply Reply Quote 0
                          • M
                            MrGlasspoole
                            last edited by

                            @Cino, ok i will give it another try.

                            I'm on 2.2 Beta cause i run in Hyper-V and it looks like there is not really a stable and working Squid:
                            https://forum.pfsense.org/index.php?topic=82232.msg450075#msg450075

                            Found it cause i wanted to try Squid3 and you can't install it.

                            1 Reply Last reply Reply Quote 0
                            • C
                              Cino
                              last edited by

                              I was able to get squid3-dev running on 2.2 using the work around in the first post in that thread. https://forum.pfsense.org/index.php?topic=82232.msg449847#msg449847

                              I didn't try all the feature in squid tho, just got it to run and used it over the weekend. I'd like to move to 2.2 but not ready (no time) tweak all the packages i use

                              1 Reply Last reply Reply Quote 0
                              • M
                                MrGlasspoole
                                last edited by

                                No luck >:(
                                I did:

                                killall squid
cd /usr/pbi/squid-amd64/
cp -r ./local/* /usr/local/
rm -rf ./local
ln -s /usr/local ./local
sync
squid
/usr/pbi/squid-amd64/bin/freshclam -d /usr/pbi/squid-amd64/etc/freshclam.conf
cp -p /usr/pbi/squid-amd64/libexec/squidclamav/clwarn.cgi /usr/local/www/
pw useradd clamav -G wheel
pw usermod clamav -G wheel
mkdir /var/log/clamav
chmod 777 /var/log/clamav
mkdir /var/db/clamav
chmod 777 /var/db/clamav
mkdir /var/run/clamav
chmod 777 /var/run/clamav
chmod 775 /usr/local/www/clwarn.cgi
freshclam

                                The log is full of:

                                Squid_Alarm[42503]: Squid has exited. Reconfiguring filter.
Squid_Alarm[42836]: Attempting restart...
squid[47315]: Squid Parent: will start 1 kids
squid[47315]: Squid Parent: (squid-1) process 48073 started
squid[47315]: Squid Parent: (squid-1) process 48073 exited with status 1
squid[47315]: Squid Parent: (squid-1) process 49046 started
Squid_Alarm[48826]: Reconfiguring filter...
squid[47315]: Squid Parent: (squid-1) process 49046 exited with status 1
Squid_Alarm[50721]: Squid has resumed. Reconfiguring filter.
check_reload_status: Reloading filter
squid[47315]: Squid Parent: (squid-1) process 58000 started
squid[47315]: Squid Parent: (squid-1) process 58000 exited with status 1
squid[47315]: Squid Parent: (squid-1) process 58304 started
squid[47315]: Squid Parent: (squid-1) process 58304 exited with status 1
squid[47315]: Squid Parent: (squid-1) process 58620 started
squid[47315]: Squid Parent: (squid-1) process 58620 exited with status 1
squid[47315]: Squid Parent: (squid-1) process 58620 will not be restarted due to repeated, frequent failures

                                What is the right way to disable squid without uninstalling?
                                Stoping the service does not allow me to surf the web.
                                Sure i can write here cause the side is ssl - but i can't browse plain http
                                as long squid is installed.

                                EDIT:
                                Stupid me - disable transparent and i can surf

                                1 Reply Last reply Reply Quote 0
                                • M
                                  MrGlasspoole
                                  last edited by

                                  Nobody some idea? :(

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.