I am trying to install a Upload scanner for any uploads via the web server Apache using inspectFile method in ModSecurity. The scanner script I use here is provided by the Maldet itself which in turn uses clamd engine.
The files I am trying to deploy on the server are.
content of /etc/apache2/conf.d/modsec/modsec2.user.conf is
# cat /etc/apache2/conf.d/modsec/modsec2.user.conf SecRule FILES_TMPNAMES "@inspectFile /usr/local/maldetect/modsec.sh" "id:99,deny,log,status:406,msg:'Malware found'"
and content of /usr/local/maldetect/modsec.sh is:
# cat /usr/local/maldetect/modsec.sh
#!/usr/bin/env bash
file="$1"
inspath='/usr/local/maldetect'
intcnf="$inspath/internals/internals.conf"
if [ -f "$intcnf" ]; then
source $intcnf
fi
## these values can be overridden in conf.maldet.hookscan
quarantine_hits=1
quarantine_clean=0
scan_tmpdir_paths=''
isclamd=`pidof clamd 2> /dev/null`
if [ "$isclamd" ] && [ -f "$clamdscan" ]; then
clamd_scan=1
else
clamd_scan=0
fi
hookcnf="$inspath/conf.maldet.hookscan"
if [ -f "$hookcnf" ]; then
source $hookcnf
fi
cd /tmp ; $inspath/maldet --config-option quarantine_hits=$quarantine_hits,quarantine_clean=$quarantine_clean,tmpdir=/var/tmp,scan_tmpdir_paths=$scan_tmpdir_paths,scan_clamscan=$clamd_scan --hook-scan -a "$file"
Content of /usr/local/maldetect/internals/internals.conf is:
# cat /usr/local/maldetect/internals/internals.conf
##
# Linux Malware Detect v1.5
# (C) 2002-2016, R-fx Networks
# (C) 2016, Ryan MacDonald
# This program may be freely redistributed under the terms of the GNU GPL v2
##
#
inspath=/usr/local/maldetect
intcnf="$inspath/internals/internals.conf"
libpath="$inspath/internals"
intfunc="$libpath/functions"
logdir="$inspath/logs"
confpath="$inspath"
cnffile="conf.maldet"
cnf="$confpath/$cnffile"
varlibpath="$inspath"
maldet_log="$logdir/event_log"
clamscan_log="$logdir/clamscan_log"
datestamp=`date +"%y%m%d-%H%M"`
utime=`date +"%s"`
user=`whoami`
wget_timeout="5"
wget_retries="3"
wget=`which wget 2> /dev/null`
if [ "$(echo $OSTYPE | grep -i 'freebsd')" ]; then
md5sum="/sbin/md5 -q"
else
md5sum=`which md5sum 2> /dev/null`
fi
hostid=`which hostid 2> /dev/null`
if [ "$hostid" ]; then
hostid=`$hostid | $md5sum | awk '{print$1}'`
else
hostid=`uname -a | $md5sum | awk '{print$1}'`
fi
storename_prefix="$hostid.$RANDOM"
od=`which od 2> /dev/null`
find=`which find 2> /dev/null`
perl=`which perl 2> /dev/null`
nice=`which nice 2> /dev/null`
cpulimit=`which cpulimit 2> /dev/null`
ionice=`which ionice 2> /dev/null`
wc=`which wc 2> /dev/null`
mail=`which mail 2> /dev/null`
pidof=`which pidof 2> /dev/null`
stat=`which stat 2> /dev/null`
logger=`which logger 2> /dev/null`
clamdscan=`which clamdscan 2> /dev/null`
ignore_paths="$confpath/ignore_paths"
ignore_sigs="$confpath/ignore_sigs"
ignore_inotify="$confpath/ignore_inotify"
ignore_file_ext="$confpath/ignore_file_ext"
quardir="$varlibpath/quarantine"
sessdir="$varlibpath/sess"
sigdir="$varlibpath/sigs"
cldir="$varlibpath/clean"
tmpdir="$inspath/tmp"
userbasedir="$varlibpath/pub"
hits_history="$sessdir/hits.hist"
quar_history="$sessdir/quarantine.hist"
clean_history="$sessdir/clean.hist"
suspend_history="$sessdir/suspend.hist"
monitor_scanned_history="$sessdir/monitor.scanned.hist"
sig_version_file="$sigdir/maldet.sigs.ver"
if [ -f "$sig_version_file" ]; then
sig_version=`cat $sig_version_file`
fi
sig_version_url="http://cdn.rfxn.com/downloads/maldet.sigs.ver"
sig_sigpack_url="http://cdn.rfxn.com/downloads/maldet-sigpack.tgz"
sig_clpack_url="http://cdn.rfxn.com/downloads/maldet-cleanv2.tgz"
sig_md5_file="$sigdir/md5v2.dat"
sig_hex_file="$sigdir/hex.dat"
sig_cav_hex_file="$sigdir/rfxn.ndb"
sig_cav_md5_file="$sigdir/rfxn.hdb"
sig_cust_md5_file="$sigdir/custom.md5.dat"
sig_cust_hex_file="$sigdir/custom.hex.dat"
lmd_versionsion_file="$inspath/VERSION"
lmd_version="$ver"
lmd_referer="LMD:$ver:$hostid"
lmd_hash_file="$inspath/internals/VERSION.hash"
lmd_hash_url="http://cdn.rfxn.com/downloads/maldet.current.hash"
lmd_version_url="http://www.rfxn.com/downloads/maldet.current.ver"
clamav_paths="/usr/local/cpanel/3rdparty/share/clamav/ /var/lib/clamav/ /var/clamav/ /usr/share/clamav/ /usr/local/share/clamav"
tlog="$libpath/tlog"
inotify=`which inotifywait 2> /dev/null`
inotify_log="$inspath/logs/inotify_log"
inotify_user_instances=128
inotify_trim=150000
hex_fifo_path="$varlibpath/internals/hexfifo"
hex_fifo_script="$libpath/hexfifo.pl"
hex_string_script="$libpath/hexstring.pl"
scan_user_access_minuid=40
find_opts="-regextype posix-egrep"
email_template="$libpath/scan.etpl"
email_subj="maldet alert from $(hostname)"
cron_custom_exec="$confpath/cron/custom.cron"
cron_custom_conf="$confpath/cron/conf.maldet.cron"
compatcnf="$libpath/compat.conf"
The problem is, Apache still allows malware uploads and spam emails go out from the server. I am pulling my hair here and not sure why it is not working :)
Any help would be appreciated.
