[clamav-users] Remote On Access Scanning

[G.W. Haywood]

Hi there,

On Thu, 2 Jan 2020, Tom Ossman via clamav-users wrote:

> ... a central server where clamd is running and a remote client
> where I have clamd.conf pointed to the central server, I can run
> clamdscan on the remote client, it scans and finds the test file I
> have created on it.  I am now trying to perform an On Access Scan on
> the remote client, from what I have read about clamonacc it requires
> clamd to be running alongside it.  I was hoping that because I can
> get clamdscan to run on the remote client the same would be true for
> clamonacc, but this is not working for me.  Running the command
> `sudo clamonacc` results in a command on found error

It's possible, if unlikely, that the clamonacc binary simply isn't on
the search path.  More likely, I guess, clamonacc hasn't been installed.

> I'm assuming clamonacc is included with clamd

If it came from a distro package, it depends on who packaged it.

>, but clamd is not installed on the client instance as per the
> documentation I found on setting up network mode (something about
> clamd fussing about being pointed at a remote server).

I don't know the documentation to which you refer.  I use remote clamd
instances and I don't think of them as being especially fussy.

> So at the moment I'm curious if what I am trying to do is possible
> and if so if I am missing a step in the setup process?

I believe what you want to do is possible, see for example

https://blog.clamav.net/2019/09/understanding-and-transitioning-to.html

but it might not have been forseen by the people who packaged ClamAV
for your distribution, or perhaps it was forseen but discounted as a
low priority.  If you build from the sources I think you'll get what
you need (although I haven't yet seen a 'man' page for clamonacc).

-- 

73,
Ged.