[Dazuko-help] Dazuko doesn't fire in cron job?

[Kevin Keane]

Hi,

I've got an odd problem: I set up Clamuko to monitor some shared 
directories on my server. Then I created a script to verify that Clamuko 
works.

This script works fine when invoked from the command line (as root). 
When running the exact same identical script from a cron job (also as 
root), it fails.

The script simply writes the eicar.com test virus to a protected 
location, and then tries to delete it again. Dazuko/ClamAV should of 
course prevent that from happening.

From the command line, I can create the eicar.com virus file (not sure 
why, but I can live with that), but get an "Access denied" error when 
trying to delete it - which is as expected.

From a cron job, creating the virus works, but deleting the file also 
succeeds.

Any suggestions what I may be doing wrong?

Thanks!


This is on Opensuse 10.3 x64, dazuko 2.3.3 (the Opensuse package, I 
didn't recompile it).

Here is the relevant part of the script (I changed the echo statement 
that generates the eicar test virus to avoid tripping antivirus software)

Thanks!


function makeEicarVirus()
{
   # Note that echo must have the -n and use single quotes, or bash would
   # interpret the string and add a newline
   echo -n 'xxxxxx' >$1
}

function checkAntivirus()
{
   # We check clamav by trying to write the Eicar test virus to
   # a protected location. That should fail
   makeEicarVirus /home/eicar.com >/dev/null 2>/dev/null
   rm /home/eicar.com >/dev/null 2>/dev/null
   if [ $? -eq 0 ]
   then
       echo "EICAR test virus could be accessed on a protected location"
       return 2
   else
       echo "Your antivirus protected you"
       return 0
   fi
}



--
Kevin Keane
Owner
The NetTech
Find the Uncommon: Expert Solutions for a Network You Never Have to Think About

Office: 866-642-7116
http://www.4nettech.com

This e-mail and attachments, if any, may contain confidential and/or 
proprietary information. Please be advised that the unauthorized use or 
disclosure of the information is strictly prohibited. The information herein is 
intended only for use by the intended recipient(s) named above. If you have 
received this transmission in error, please notify the sender immediately and 
permanently delete the e-mail and any copies, printouts or attachments thereof.