clamdscan error and cannot use FTP :(

9 posts / 0 new
Last post
#1 Sun, 08/04/2013 - 18:08
decay

clamdscan error and cannot use FTP :(

So, I logged into my virtualmin (on a centos 6 vps) the other day and did all the package updates that were on the main page of the virtualmin (i pretty much clicked the button, and virtualmin did all the work)... After the updates, virtualmin shows in big bright yellow on the main screen 2 notifications.

First one was about a php exploit asking if its ok to disable some mod_abc thing, because apparently with that explot a user is able to copy file to another user (or something like that? i cant remember what abc actually was). From memory, i dont use it on any of my php based sites, so told virtualmin to go ahead and turn it off.

2nd was about some sym link thing, again an exploit of some sort, and i told virtualmin to go ahead and do what it suggested as well (i think it looked through htaccess files, but it wasent enabled on any of my sites, so it said 0 htaccess files were changed).

So anyway, after doing this, i noticed few issues. Yes i have turned it off and on again few times (the vps i mean).

  1. on the virtialmin dashboard, it has a cross next to "ClamAV Virus Scanning Server" on the UP column. When i click the play button to start it, it does nothing (it refreshes the page but the cross is still there). Dashboard also says "Virtualmin's configuration has not been checked since it was last updated. Click the button below to verify it now", and when i click refresh and recheck configurations it gives me the following error:
The status of your system is being checked to ensure that all enabled features are available, that the mail server is properly configured, and that quotas are active ..
Your system has 512 MB of memory, which is at or above the Virtualmin recommended minimum of 256 MB.
BIND DNS server is installed, and the system is configured to use it.

Mail server Postfix is installed and configured.

Your Postfix version does not support per-domain outgoing IP addresses.

Apache is installed.

The following PHP versions are available : 5.3.3 (/usr/bin/php-cgi)

Webalizer is installed.

Apache is configured to host SSL websites.

MySQL is installed and running.

PostgreSQL is installed and running.

ProFTPd is installed.

Logrotate is installed.

SpamAssassin and Procmail are installed and configured for use.

You have selected to use clamdscan for virus scanning, but the clamd server it talks to is not running

.. your system is not ready for use by Virtualmin.

Let me know if you guys need any more info. Im a bit of a linux noob, so you might have to give me detailed instructions to follow :)

  1. Secondly, after the updates, i realised that i cannot login to any of the ftp's for any of the sites hosted under the vps through virtualmin. I tried about 3 login details/sites, and i even created a new one to test. None of them worked. Here is the error i get:
Status: Resolving address of <Correct domain name here>
Status: Connecting to <Correct IP ADDERSS HERE>...
Status: Connection established, waiting for welcome message...
Response: 220 FTP Server ready.
Command: USER <Correct Username here>
Response: 331 Password required for <Correct Username here>
Command: PASS *********
Response: 530 Login incorrect.
Error: Critical error
Error: Could not connect to server

Any thoughts?

Sun, 08/04/2013 - 18:12
decay

PS. The websites seem to resolves just fine... Just the ftp issue as far as im aware? PSS. also just before doing the updates, i installed owncloud (http://owncloud.org/) on one of the domains. This is as simple as copying a php file to the web directory of that domain and running it on a browser... it uses sqlite. So im not sure if that caused any issues either (but ftp clearly worked when i uploaded that php file, and i did the server update about 5 minutes after that, and about 10 minutes after that the ftp didnt work). Own cloud is also currently working...

Sun, 08/04/2013 - 20:34
andreychek

Howdy,

The ClamAV issue may just mean you need to start ClamAV, it may not be doing so automatically for some reason.

You can normally do that by running this command from the command line:

/etc/init.d/clamd restart

Regarding your FTP issue -- did you by chance enable a third party software repository?

We've seen a lot of occurrences of third party software packages causing FTP to break like that.

You can determine that by running this command:

rpm -qa | grep proftp

Mon, 08/05/2013 - 07:20
decay

Tried "/etc/init.d/clamd restart"

[root@server1 ~]# /etc/init.d/clamd restart
Stopping Clam AntiVirus Daemon:                            [FAILED]
Starting Clam AntiVirus Daemon: ERROR: Can't open /var/log/clamav/clamd.log in append mode (check permissions!).
ERROR: Can't initialize the internal logger
                                                           [FAILED]

Any idea?

As far as third part software repo, i dont think so. I used a standard virtual min build, followed some setup tutorials etc. And besides the standard build, the only things i have installed were git/svn, again this was going as far as ticking the boxes on the virtual min control panel lol.. Oh, i did once try write a script to copy some files as a SVN hook (automatically copy files over on commit), but never managed to trigger it properly. And only other thing was owncloud, this is just a php script, so i dont see any link.

All other installations were standard virtualmin updates/suggestions that popup on the control panel main page.

No idea what "rpm -qa | grep proftp" does, but here is the output:

[root@server1 ~]# rpm -qa | grep proftp
proftpd-1.3.4a-1.el6.rf.x86_64
[root@server1 ~]#

Any ideas? Thoughts or suggestions?

Mon, 08/05/2013 - 07:23
decay

Also, this might be helpful too (no idea if these permissions are correct or what would change it, and i dont fully understand it either, but you might notice something):

[root@server1 ~]# cd /var/log/clamav/
[root@server1 clamav]# ls -l
total 264
-rw-r----- 1 clam clam  4725 Aug  4 15:08 clamd.log
-rw-r----- 1 clam clam 58670 Jul 15 00:41 clamd.log-20130715
-rw-r----- 1 clam clam 44225 Jul 21 00:41 clamd.log-20130721
-rw-r----- 1 clam clam 59378 Jul 29 00:41 clamd.log-20130729
-rw-r----- 1 clam clam 45816 Aug  4 00:41 clamd.log-20130804
-rw-r----- 1 clam clam   781 Aug  5 00:46 freshclam.log
-rw-r----- 1 clam clam  6302 Jul 15 00:41 freshclam.log-20130715
-rw-r----- 1 clam clam  5102 Jul 21 00:41 freshclam.log-20130721
-rw-r----- 1 clam clam  6523 Jul 29 00:41 freshclam.log-20130729
-rw-r----- 1 clam clam  4936 Aug  4 00:41 freshclam.log-20130804
[root@server1 clamav]#
Mon, 08/05/2013 - 09:10
andreychek

Howdy,

The "rpm" command you ran displays the package name of the ProFTPd package you have installed... it does appear that a third party package repository was enabled... it's called "RPMForge".

That is likely the cause of the FTP problem you're seeing. To fix it, you would need to remove that third party package, and install the ProFTPd version provided by Virtualmin.

This command will help us determine if the issue you're seeing with ClamAV is due to a similar problem:

rpm -qa | grep clam

What output does that provide?

-Eric

Mon, 08/05/2013 - 16:11
decay

Hey Eric

[root@server1 ~]# rpm -qa | grep clam
clamd-0.97.7-1.el6.rf.x86_64
clamav-0.97.7-1.el6.rf.x86_64
clamav-db-0.97.7-1.el6.rf.x86_64
[root@server1 ~]#

Oh right, i lied. I forgot, during the original installation, i followed some tutorials, and ednded up getting some error. I think couldnt update some package or something? And when i googled around, the solution was to add some other repo. Cant fully remember exactly what guide i followed though :(

Anyway, tried to remove it (Managing Repositories section: http://kbfaq.blogspot.co.nz/2011/08/installing-rpmforge-repository.html), i set the enable = 0, and the last command gives me this:

[root@server1 ~]# cd /etc/yum.repos.d/
[root@server1 yum.repos.d]# ls
CentOS-Base.repo       CentOS-Media.repo  mirrors-rpmforge         mirrors-rpmforge-testing  virtualmin-bleed.repo.disabled  vz.repo
CentOS-Debuginfo.repo  CentOS-Vault.repo  mirrors-rpmforge-extras  rpmforge.repo             virtualmin.repo

[root@server1 yum.repos.d]# rpm -e rpmforge
error: package rpmforge is not installed

[root@server1 yum.repos.d]# yum remove rpmforge.repo
Loaded plugins: fastestmirror
Setting up Remove Process
No Match for argument: rpmforge.repo
Loading mirror speeds from cached hostfile
* base: mirror.steadfast.net
* extras: mirror.steadfast.net
* updates: ftpmirror.your.org
No Packages marked for removal

PS. the ls on the repo directory has virtualmin files in red.

Any instructions on removing the rpmforge and installing correct ProFTPd version?

Mon, 08/05/2013 - 20:24
andreychek

Howdy,

Yeah, having the RPMForge repository enabled can definitely cause the problems you're seeing.

It looks like you did disable the RPMForge repository, which is good.

The ClamAV and ProFTPd packages you have are from the RPMForge repository... in order to get them working, you'll need to remove those versions, and install the versions available in the Virtualmin software repository.

-Eric

Mon, 08/05/2013 - 21:22
decay

Thanks Eric, Is there a straight forward command to uninstall/install these according to the virtual min required versions?

Also, i remembered adding .disabled to the virtualmin bleed repo name, because it was giving errors, thus the reason for adding that other repo. I think i was trying to update... Anyway, so i just removed the .disabled and added .disabled to the rpmforge.repo

[root@server1 yum.repos.d]# mv virtualmin-bleed.repo.disabled virtualmin-bleed.repo
[root@server1 yum.repos.d]# mv rpmforge.repo rpmforge.repo.disabled
[root@server1 yum.repos.d]# ls
CentOS-Base.repo       mirrors-rpmforge          virtualmin-bleed.repo
CentOS-Debuginfo.repo  mirrors-rpmforge-extras   virtualmin.repo
CentOS-Media.repo      mirrors-rpmforge-testing  vz.repo
CentOS-Vault.repo      rpmforge.repo.disabled

And now i tried doing (yum install, unsure if i need to uninstall, if so, how):

[root@server1 ~]# yum install proftpd
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirror.steadfast.net
* extras: mirror.steadfast.net
* updates: centos.corenetworks.net
http://software.virtualmin.com/bleed/rhel/6/x86_64/repodata/repomd.xml: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 404"
Trying other mirror.
Error: Cannot retrieve repository metadata (repomd.xml) for repository: virtualmin-bleed. Please verify its path and try again

Any ideas? :(

Topic locked