In-memory scanning of files, ideally using ClamAV

java antivirus
Martin picture Martin · Jul 24, 2012 · Viewed 14.3k times · Source

We are implementing an enterprise application with a heavy focus on security, which includes the uploading of files. These files need to be virus scanned, but also need to be encrypted.

The current process is that the files are uploaded and then streamed - through an encrypter - to a temporary storage area on disk. The virus-scanner is then called and the files are decrypted on the fly, streamed through to ClamAV via a socket - and then the virus-status returned from the socket.

The problem is that ClamAV seems to write to a temporary area on disk before scanning, which means unencrypted, potentially-sensitive data on the file-system.

Does anyone know how to fix this? Possibly by configuring ClamAV to scan in-memory only (my Google search yielded no results), or maybe some alternative suggestions?

Answer

Rafael Ferreira picture Rafael Ferreira · Jul 25, 2012

I'm assuming here that you are using clamd since you are talking to it via a socket not clamscan the cli tool.

In that case you can configure it via the TemporaryDirectory directive in your clamd.conf to point to an encrypted filesystem for temp storage using something like dm-crypt (https://help.ubuntu.com/community/EncryptedFilesystemHowto) - I hope this helps.

Reference from man 5 clamd.conf:

   TemporaryDirectory STRING
          Optional path to the global temporary directory.
          Default: system specific (usually /tmp or /var/tmp).

Related questions

How do you virus scan a file being uploaded to your java webapp as it streams?

Basically, I want to virus scan files as they are uploaded (before writing them to disk) to a web app. In particular, I'd like to integrate with "McAfee VirusScan Enterprise" (latest version). From a design and maintenance perspective, would it …

Read More
Java Being Blocked By Antivirus Software (Specifically AVG)

I have a program that I've been working on that downloads files. Everything works perfectly, unless a user is using AVG. Oddly enough, it seems that in order to fix the issue AVG's "Email Protection" must be disabled; adding either …

Read More
How do I convert a String to an int in Java?

How can I convert a String to an int in Java? My String contains only numbers, and I want to return the number it represents. For example, given the string "1234" the result should be the number 1234.

Read More