Re: [Proftpd-devel] New module: mod_clamav

[Joseph B. <jo...@th...>]

Hello,

I'd be happy to research and possibly code this module.  I'd like some 
information for the design of this module, though.

It seems as if your looking for a general purpose filtering module; 
however, I am curious to know what you have in mind to filter.  Are you 
looking for filename based matching or are you looking for pattern 
matching within a given file?

The reason I ask is that a general module to call out to an executable 
file to determine is a file passes or fails a test, wouldn't work well 
in the real world.  This is why the clamav scanner is included directly 
as a programmed module.  The reason behind this is fairly simple.  If I 
were uploading small files, say my web site, I wouldn't want: a. a bunch 
of executables being launched on each file, and b. the delay in all of 
this processing overhead.

Now, if you're asking for a general file naming pattern matcher and/or a 
filter by the contents of a file, then sure, it would be a good idea... 
For example: I might not want .DLLs or .MP3s uploaded - and to possibly 
thwart the users attempts at renaming an MP3, I'd like to search within 
the file to find the ID3 tag inside of it.

Can you please expand on your thoughts?

Thanks!
Joseph Benden
http://www.uglyboxindustries.com/


Mihai Rusu wrote:

> On Tue, 19 Apr 2005, Joseph Benden wrote:
>
>> Hello.  I've posted a new module to my site, mod_clamav.  It enables 
>> the FTP server to scan newly uploaded files for viruses, before 
>> allowing the file upload to complete.  This has proven itself very 
>> handy for my admin situation, and I thought that I'd share, in case 
>> someone else can benefit from it too.
>
>
> I think there should be a more general module to ProFTPD. Something 
> that can have different ways of deciding if a file is accepted or not, 
> with external hooks. And for that module there should be clamav 
> support, etc. This way one can switch easily from one antivirus to 
> another or even implement it's own way of filtering files.
>
>> Thanks,
>> Joseph Benden
>
>