<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Martin,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Glad to hear it works. Although it doesn’t scan on upload as you indicated you were looking for, but scan on deposit into the archive was the next best thing
we could think of.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">J</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">-Brian.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> eprints-tech-bounces@ecs.soton.ac.uk [mailto:eprints-tech-bounces@ecs.soton.ac.uk]
<b>On Behalf Of </b>martin.braendle@id.uzh.ch<br>
<b>Sent:</b> Wednesday, January 27, 2016 6:51 AM<br>
<b>To:</b> eprints-tech@ecs.soton.ac.uk<br>
<b>Subject:</b> [EP-tech] Antwort: Re: Virus Scan during Upload<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Many thanks Brian,</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">after solving some initial problems we got it working.</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">- clamd daemon must be installed and running</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">- port must be the same as the LocalSocket defined in /etc/clamd.conf</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">- the clam user running the clamd daemon must be in the same group as the apache user.</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">We tested with a text file containing the EICAR signature (</span><a href="http://www.eicar.org/download/eicar.com.txt"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">http://www.eicar.org/download/eicar.com.txt</span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif"> )-
works fine.</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">ClamAV does not recognize the EICAR signature enclosed in a pdf file using a Trojan horse file dropper (</span><a href="http://blog.didierstevens.com/2015/08/28/test-file-pdf-with-embedded-doc-dropping-eicar/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">http://blog.didierstevens.com/2015/08/28/test-file-pdf-with-embedded-doc-dropping-eicar/</span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif"> ),
while the Antivirus scanner on my Mac did.</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Best regards,</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Martin</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">--</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Dr. Martin Brändle</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Zentrale Informatik</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Universität Zürich</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Stampfenbachstr. 73</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">CH-8006 Zürich</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">mail: <a href="mailto:martin.braendle@id.uzh.ch">
martin.braendle@id.uzh.ch</a></span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">phone: +41 44 63 56705</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">fax: +41 44 63 54505</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif"><a href="http://www.zi.uzh.ch">http://www.zi.uzh.ch</a></span><br>
<br>
<img border="0" width="16" height="16" id="_x0000_i1025" src="cid:image001.gif@01D158FA.AE05F7B0" alt="Inactive hide details for "Brian D. Gregg" ---25/01/2016 16:57:16---Martin, This is what we us in our IR (running EPrints 3.2.8"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#424282">"Brian
D. Gregg" ---25/01/2016 16:57:16---Martin, This is what we us in our IR (running EPrints 3.2.8). It could probably be written a bit be</span><br>
<br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Von: </span>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif">"Brian D. Gregg" <<a href="mailto:bdgregg@pitt.edu">bdgregg@pitt.edu</a>></span><br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">An: </span>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif">"<a href="mailto:eprints-tech@ecs.soton.ac.uk">eprints-tech@ecs.soton.ac.uk</a>" <<a href="mailto:eprints-tech@ecs.soton.ac.uk">eprints-tech@ecs.soton.ac.uk</a>></span><br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Datum:
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif">25/01/2016 16:57</span><br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Betreff:
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif">[EP-tech] Re: Virus Scan during Upload</span><br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Gesendet von:
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif"><a href="mailto:eprints-tech-bounces@ecs.soton.ac.uk">eprints-tech-bounces@ecs.soton.ac.uk</a></span><o:p></o:p></p>
<div class="MsoNormal">
<hr size="2" width="100%" noshade="" style="color:#8091A5" align="left">
</div>
<p class="MsoNormal"><br>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Martin,</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">This is what we us in our IR (running EPrints 3.2.8). It could probably be written a bit better (obviously – feel free to tweak as anyone sees fit), but works as is for us currently.
You will need ClamAV installed (including the associated PERL modules).</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">This part goes into the cfg/cfg.d/document_validate.pl file under the “CHECKS IN HERE” comment but before the “return ( @problems );”</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> # Virus scan the uploaded files.</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> my %files = $document->files;</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> my $path = $document->local_path;</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> while ( my ($filename, $size) = each(%files)) {</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> # for each file uploaded</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> use
<a href="File:///\\:Scan::ClamAV">File::Scan::ClamAV</a>;</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> my $av = new
<a href="File:///\\:Scan::ClamAV(find_all">File::Scan::ClamAV(find_all</a> => 1, port=> '/tmp/clamd');</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> my $filetoscan = "$path/$filename";</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> my %caught = $av->scan("$filetoscan");</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> while (my ($k,$v) = each %caught ) {</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> # Viruses Found</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> push @problems,</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> $session->html_phrase( "validate:virus_found",</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> filename => $session->make_text($filename),</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> virus => $session->make_text($v) );</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> }</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> }</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> # End Virus scan.</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">And the HTML Phrase can go into the file cfg/lang/en/validate.xml
</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><epp:phrase id="validate:virus_found">The file that has been uploaded contains a virus. The file in question is: <epc:pin name="filename"/>. It contains the virus: <epc:pin name="virus"/>.
Please remove the file and upload a virus free version.</epp:phrase></span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hope this helps or at least points you in a direction as to what you might need.</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thanks,</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Brian Gregg.</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<b><span style="font-size:18.0pt;font-family:"Calibri",sans-serif;color:#323E4F">Brian D. Gregg</span></b><br>
<i><span style="font-size:13.5pt;font-family:"Calibri",sans-serif;color:#323E4F">Solutions Architect
</span></i><span style="font-size:13.5pt;font-family:"Calibri",sans-serif;color:#323E4F">|<i> Manager Systems Development</i></span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#323E4F">University of Pittsburgh | University Library System</span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#323E4F">Address:
</span><a href="https://maps.google.com/maps?q=7500+Thomas+Blvd,+Pittsburgh,+PA&hl=en&sll=41.117935,-77.604698&sspn=7.662465,13.73291&oq=7500+Tho&t=h&hnear=7500+Thomas+Blvd,+Pittsburgh,+Pennsylvania+15208&z=17" target="_blank"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#0563C1">7500
Thomas Blvd. Room 129 Pittsburgh, PA 15208</span></a><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#17365D">Tel: (412) 648-3264 | Email:
</span><a href="mailto:bdgregg@pitt.edu"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#0563C1">bdgregg@pitt.edu</span></a><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#17365D"> | Fax: (412) 648-3585</span><br>
<a href="https://orcid.org/0000-0001-6541-4544"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#0563C1">https://orcid.org/0000-0001-6541-4544</span></a><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><br>
<b><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:10.0pt;font-family:"Calibri",sans-serif"> <a href="mailto:eprints-tech-bounces@ecs.soton.ac.uk">eprints-tech-bounces@ecs.soton.ac.uk</a> [<a href="mailto:eprints-tech-bounces@ecs.soton.ac.uk">mailto:eprints-tech-bounces@ecs.soton.ac.uk</a>]
<b>On Behalf Of </b><a href="mailto:martin.braendle@id.uzh.ch">martin.braendle@id.uzh.ch</a><b><br>
Sent:</b> Monday, January 25, 2016 10:19 AM<b><br>
To:</b> <a href="mailto:eprints-tech@ecs.soton.ac.uk">eprints-tech@ecs.soton.ac.uk</a><b><br>
Subject:</b> [EP-tech] Virus Scan during Upload</span><br>
<o:p></o:p></p>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Hi,</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif"><br>
in the course of a Swiss Digital Lifecycle Management Project, we are evaluating EPrints and our repo according to the POWRR scheme (gap analysis) to find tools for digital preservation.</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif"><br>
One criterion is virus scan of a document before it is uploaded. I have found this old thread:
</span><a href="http://www.eprints.org/tech.php/thread-16755.html"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">http://www.eprints.org/tech.php/thread-16755.html</span></a><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif"><br>
Has anyone followed up on this, implemented a hook and is willing to share code?</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif"><br>
Thank you for all your advice and help.</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif"><br>
Martin</span><br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif"><br>
--<br>
Dr. Martin Brändle<br>
Zentrale Informatik<br>
Universität Zürich<br>
Stampfenbachstr. 73<br>
CH-8006 Zürich</span><tt><span style="font-size:10.0pt">*** Options: <a href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech">
http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech</a></span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>*** Archive: <a href="http://www.eprints.org/tech.php/">http://www.eprints.org/tech.php/</a></tt><br>
<tt>*** EPrints community wiki: <a href="http://wiki.eprints.org/">http://wiki.eprints.org/</a></tt><br>
<tt>*** EPrints developers Forum: <a href="http://forum.eprints.org/">http://forum.eprints.org/</a></tt></span><o:p></o:p></p>
</div>
</body>
</html>