Tweak freshclam ReceiveTimeout value for slow internet connections

[TuxVinyards]

Except from Package description (Eoan):

"For scanning to work, a virus database is needed. There are two options
for getting it:

 - clamav-freshclam: updates the database from Internet. This is
   recommended with Internet access.

 - clamav-data: for users without Internet access. The package is
   not updated once installed. The clamav-getfiles package allows
   creating custom packages from an Internet-connected computer."

This is causing a lot of problems:

1. clamav-data is not available.

2. clamav-freshclam package is not sufficient. Service fails to update. Manual attempts cause download but data fails to install.

Cure: install clamav-daemon package.

See:

https://askubuntu.com/questions/589318/freshclam-error-clamd-conf-file-not-found#632911

And: https://askubuntu.com/questions/909273/clamav-error-var-log-clamav-freshclam-log-is-locked-by-another-process#909276

[Andreas Hasenack (ahasenack)]

apt install clamav on eoan brings in:
clamav clamav-base clamav-freshclam libclamav9 libltdl7 libtfm1

The freshclam daemon tries to download the databases right away:
Tue Mar 3 20:01:42 2020 -> freshclam daemon 0.102.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Tue Mar 3 20:01:42 2020 -> ClamAV update process started at Tue Mar 3 20:01:42 2020
Tue Mar 3 20:01:42 2020 -> daily database available for download (remote version: 25740)
Tue Mar 3 20:02:12 2020 -> WARNING: Download failed (28) Tue Mar 3 20:02:12 2020 -> WARNING: Message: Timeout was reached
Tue Mar 3 20:02:12 2020 -> WARNING: getcvd: Can't download daily.cvd from https://database.clamav.net/daily.cvd
Tue Mar 3 20:02:12 2020 -> Trying again in 5 secs...

While that is happening, clamscan won't work:
root@e1:~# clamcsc^C
root@e1:~# clamscan
LibClamAV Error: cli_loaddbdir(): No supported database files found in /var/lib/clamav
ERROR: Can't open file or directory

Which is expected.

It will keep trying. In my case, now it managed to download daily:
Tue Mar 3 20:03:11 2020 -> Testing database: '/var/lib/clamav/tmp.3f047/clamav-323978c4ffb272b6b680262710a2e099.tmp-daily.cvd' ...
Tue Mar 3 20:03:16 2020 -> Database test passed.
Tue Mar 3 20:03:16 2020 -> daily.cvd updated (version: 25740, sigs: 2204413, f-level: 63, builder: raynman)

And it's trying main again. That's a big file, over 100Mb in size. I believe that's why I'm getting timeouts, as I can't receive such a big file in 30s, which is the default ReceiveTimeout in /etc/clamav/freshclam.conf:

ReceiveTimeout 30

Once I updated that to 300s, and restarted the freshclam daemon, it fetched the main database just fine:

Tue Mar 3 20:08:15 2020 -> main database available for download (remote version: 59)
Tue Mar 3 20:10:09 2020 -> Testing database: '/var/lib/clamav/tmp.393b2/clamav-bcd674e3559e38c5a502dfe72b8bf48c.tmp-main.cvd' ...
Tue Mar 3 20:10:13 2020 -> Database test passed.
Tue Mar 3 20:10:13 2020 -> main.cvd updated (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
Tue Mar 3 20:10:13 2020 -> bytecode database available for download (remote version: 331)
Tue Mar 3 20:10:15 2020 -> Testing database: '/var/lib/clamav/tmp.393b2/clamav-99166262d870f9b5d36574c18189bea1.tmp-bytecode.cvd' ...
Tue Mar 3 20:10:15 2020 -> Database test passed.
Tue Mar 3 20:10:15 2020 -> bytecode.cvd updated (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
Tue Mar 3 20:10:15 2020 -> ERROR: NotifyClamd: Can't find or parse configuration file /etc/clamav/clamd.conf

The last error about NotifyClamd is also expected, since I didn't install the clamd daemon.

clamscan now works:
root@e1:~# clamscan
/root/.viminfo: OK
/root/.profile: OK
/root/.lesshst: OK
/root/.bashrc: OK

----------- SCAN SUMMARY -----------
Known viruses: 6759121
Engine version: 0.102.2
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 12.184 sec (0 m 12 s)

Regarding this bug then:
1) clamav-data should no longer be mentioned in d/control indeed, as this package doesn't exist anymore.
2) clamav-freshclam could be made a bit better by increasing the ReceiveTimeout, but by how much I'm...

[Andreas Hasenack (ahasenack)]

Actually, looks like this was fixed already. The 30s ReceiveTimeout default value was being set in eoan's clamav-freshclam.postinst:

  [ -z "$ReceiveTimeout" ] && ReceiveTimeout=30

This was later changed to 0 in the package version 0.102.2+dfsg-1:
clamav (0.102.2+dfsg-1) unstable; urgency=medium

  * Import 0.102.2
    - CVE-2020-3123 (DoS may occur in the optional DLP feature)
      (Closes: 950944).
  * Update symbol file.
  * Set ReceiveTimeout to 0 which is upstream default.

Which is in Ubuntu Focal. Therefore, this bug is fixed in that upcoming release.

[Bryce Harrington (bryce)]

Would this be worth an SRU for eoan? Or is there one already planned? Looks like eoan-security has:

    0.102.2+dfsg-0ubuntu0.19.10.1