Moodle in English: The path supplied to Clam is invalid

The path supplied to Clam is invalid

by Saeed Amiri - Friday, October 31, 2014, 4:17 PM

I have installed the latest version of Moodle on a Centos 6.5 server through DirectAdmin panel. I have also installed Clamav on my server to check the emails but I would like to use it in Moodle to check the uploaded files to the server. Unfortunately, though, Moodle does not consider the the following paths as valid:

/usr/local/bin/clamscan

/usr/local/bin/clamdscan

/usr/share/clamav

It just returns, for instance,

Moodle is configured to run clam on file upload, but the path supplied to Clam

AV, /usr/local/bin/clamdscan, is invalid.

Any ideas would be highly appreciated.

Regards

Re: The path supplied to Clam is invalid

by Dan Poltawski - Saturday, November 1, 2014, 1:32 AM

Do you know what the correct path is?

It sounds possible that your web host does not allow php (moodle) to access these files, because for example open_basedir is set. You could check if that is set in Admin > Server > PHP Info

Average of ratings:Useful (1)

Re: The path supplied to Clam is invalid

by Saeed Amiri - Saturday, November 1, 2014, 5:06 PM

Hello Dan

Thanks for responding. Like I mentioned before, I have tried various paths, but none seem to work. Since I have installed Moodle on a subdomain, I disabled open_basedir for the subdomain in php configuration part of DirectAdmin panel, but this does not help either.

Any other ideas?

Thanks in advance.

Regards

Average of ratings: -

Re: The path supplied to Clam is invalid

by Guillermo Madero - Saturday, November 1, 2014, 11:01 PM

Hello Saeed,

As mentioned already by Dan, the first thing would be to know where is ClamAv actually installed.

Average of ratings: -

Re: The path supplied to Clam is invalid

by Ken Task - Saturday, November 1, 2014, 11:15 PM

Assuming you have command line access (ssh), one could discover where clamav was installed using the following command:

which clamscan

shows which (if more than one installed) will execute from the command line should a command line user attempt to use it.

whereis clamscan

will show the path to clamscan if it's registered with the system.

Typical path for a standalone (not a shared system) clamscan is:

/usr/local/bin/clamscan

If it's not there, how was clamav installed? And if your system is remotely hosted and shared, does provider have forums/FAQ's, etc. for customers? Not all remotely hosted/shared systems are configured the same.

'spirit of sharing', Ken

Average of ratings:Useful (2)

Re: The path supplied to Clam is invalid

by Saeed Amiri - Monday, November 3, 2014, 1:07 AM

@ Ken. Hello. Thanks for responding.

Well, it's a standalone VPS. As the server was originally configured with DirectAdmin, I used this tutorial to install CLam.

Issuing both which clamscan or whereis clamscan returns the following path:

/usr/local/bin/clamscan

So I'm kind of sure that this must be the right path. However, Moodle does not seem to get access to it.

Any other ideas?

Regards

Average of ratings: -

Re: The path supplied to Clam is invalid

by Ken Task - Monday, November 3, 2014, 5:39 AM

Could be you need to add the user for clam to apache group. Clam is set in a very restrictive mode with it's own user/group.

Also check your operating system's temp directory setting ... include the temp directory for PHP. Uploading a file in Moodle will go to that temp directory first. That's where the scanning should take place, I would think ... before it's moved into the Moodle file system.

Check apache error logs as well as secure logs.

'spirit of sharing', Ken

Average of ratings:Useful (1)

Re: The path supplied to Clam is invalid

by Dave Perry - Monday, November 3, 2014, 6:10 PM

+1 for Linux user/groups on the server being a blocker for things (that or SELinux). It's the one thing that I don't really understand so quite happy to run Windows on web servers.

Average of ratings: -

Re: The path supplied to Clam is invalid

by Ken Task - Monday, November 3, 2014, 9:07 PM

Given the current climate of the net, think it good that some linux distros + remote providers attempt to protect customers from themselves. Yes, makes it harder to get up and running, but that's a matter of learning the system - which any server operator should do.

The 'easy button' is oft a two way street ... easy for op to get it up and running could also mean easy for hacker to compromise - right out of the shrink wrap. But, that's an opinion, of course! ;)

'spirit of thinkering', Ken

Average of ratings: -

Re: The path supplied to Clam is invalid

by Saeed Amiri - Friday, November 7, 2014, 7:06 PM

Well, It can't be SElinux for me as it's off. (I have CSF installed instead on my server).

Average of ratings: -

Re: The path supplied to Clam is invalid

by Ken Task - Friday, November 7, 2014, 10:01 PM

Well, here's another idea ... as root user ...

cp /usr/local/bin/clamscan /usr/bin/clamscan

or (might be best) ... create a symlink in /usr/bin/ for clamscan which points to the one executable.

cd /usr/bin/

ln -fs /usr/local/bin/clamscan clamscan

ls -l clamscan

should show:

lrwxrwxrwx 1 root root date/time clamscan -> /usr/local/bin/clamscan

In the Moodle config, use the path suggested (am looking at a 2.6 version of Moodle) and it shows /usr/bin/clamscan

Have done the above with a 2.6 and it appears to work.

Symlink would be best, I think, if clamscan is ever updated your symlink would then still point to the newer version of clamscan.

'spirit of sharing', Ken

Average of ratings: -

Re: The path supplied to Clam is invalid

by Saeed Amiri - Saturday, November 8, 2014, 3:31 AM

Hello Ken. I really have to thank you very much. The workaround seems to have solved my problem. I followed your walkthrough by making a symlink in /usr/bin/. I only changed clamscan to clamdscan because I have read that the latter is somehow quicker in starting the scan. However, when I entered /usr/bin/clamdscan, I got the following error in Moodle (I have enabled Moodle's debugging mode):

Warning: file_exists(): open_basedir restriction in effect. File(/usr/bin/clamdscan) is not within the allowed path(s): (/home/admin/:/tmp:/var/tmp:/usr/local/lib/php/) in /home/admin/domains/mydomain.com/public_html/moodle/lib/adminlib.php on line 2469

So I had to disable open_basedir in Directadmin (I had earlier tried this with "/usr/local/bin/clamscan" but it didn't work. . And now clam seems to scan the uploaded files, because I do not receive any error emails.

My only question now is why I had to disable 'open_basedir' for it to work and does disabling this feature pose any security threats to my server?

Thanks again

Saeed

Average of ratings: -

Re: The path supplied to Clam is invalid

by Ken Task - Saturday, November 8, 2014, 5:11 AM

http://phpsec.org/projects/phpsecinfo/tests/open_basedir.html

Found by Googling!!! ;)

Ken

Average of ratings: -

Re: The path supplied to Clam is invalid

by Just H - Sunday, November 2, 2014, 2:41 PM

Have a look on your server to see if it is located at /usr/local/cpanel/3rdparty/bin/clamscan.

Not sure it will be given you use DirectAdmin but it appears that's where it ends up nowadays if using cPanel according to the cPanel Docs.

Edit: Doh! feel slightly stupid posting that now looking at the path but perhaps there's an equivalent 3rdparty directory when using DirectAdmin?

Average of ratings: -

Re: The path supplied to Clam is invalid

by Saeed Amiri - Monday, November 3, 2014, 1:09 AM

Hello. Thanks for replying. The right path in DA seems to be

/usr/local/bin/clamscan

However, Moodle still does not conisder that as valid.

Average of ratings: -

Security and privacy

The path supplied to Clam is invalid