sophos av path exclusion not working

0

I repeatedly get the Unable to write to talpa socket error because sophos free on ubuntu is trying to access a sshfs mount. I don't know what else I need to do to get sophos to not try to scan this mount (or anything under it).

root@myhost:~# /opt/sophos-av/bin/savconfig get ExcludeFilePaths
/home/myuser/mynetmount
root@myhost:~# /opt/sophos-av/bin/savconfig get ExcludeFilesystems
/home/myuser/mynetmount

And the periodic email root gets that has me trying to disable network scans:

An error classified as '0x3c: Unable to write to talpa socket' was detected in the file '/home/myuser/mynetmount/........' when attempting to open it at Fri Sep 28 01:14:00 2018 PDT -1500 (2018-09-28 08:14:00 UTC).  Access to the file was not allowed.

Ubuntu 16.04.5, SophosAV free-linux 9.15.0 VE3.72.1 (9.15.0.0.61)

(BTW: network-shares tag solely because I believe the SAV problem is incorrectly access network shares, not that I want to scan or set up network shares. Tangentially, the sshfs share is mounted with drwxr-xr-x and root can access most files in there. The remote site is not totally under my control, so there are files that the remote user cannot read.)

r2evans

Posted 2018-09-28T18:11:12.877

Reputation: 324

Answers

1

You need to exclude /home/myuser/mynetmount/ to exclude a directory stem.

/home/myuser/mynetmount just excludes a file explicitly named "/home/myuser/mynetmount"

Douglas Leeder

Posted 2018-09-28T18:11:12.877

Reputation: 1 375

The trailing slash is all? Huh ... giving it a try, thank you. – r2evans – 2018-09-29T15:01:47.783

Dang it, *so* frustrated by a missed opportunity to normalize/detect paths. *sigh* – r2evans – 2018-09-30T22:38:25.890