Customer can't upload anymore. clamd error

[Matthias]

Mmm....

I get following error-message from the errorlog.

[Wed Apr 22 13:23:59 2009] [error] [client 80.254.174.230] ModSecurity: [file "/etc/httpd/modsecurity.d/05_asl_scanner.conf"] [line "42"] [id "351000"] [rev "1"] [msg "Malicious File upload attempt"] [severity "CRITICAL"] Access denied with code 403 (phase 2). File "/tmp/20090422-132246-@562zH8AAAEAADGyDCkAAAAB-file-D00LJP" rejected by the approver script "/usr/bin/modsec-clamscan.pl": 0 Unable to parse clamscan output [ERROR: Can't connect to clamd: No such file or directory] [hostname "www.swissinput.com"] [uri "/contenido/main.php"] [unique_id "@562zH8AAAEAADGyDCkAAAAB"]

Any ideas? The customer are no more able to upload files.

[Highland]

Keep in mind that after triggering a modsec error, ossec will lock you out for 15 mins or so.

What it looks like your problem is

Code: Select all

Unable to parse clamscan output [ERROR: Can't connect to clamd: No such file or directory]

Make sure clamd is up and running

Code: Select all

service clamd status

I'd start there and see what's going on. There's also support@atomicorp.com if you get stuck.

[Matthias]

The clamd-service are running. He also can be restarted.