linux-malware-detect icon indicating copy to clipboard operation
linux-malware-detect copied to clipboard

scan_ignore_user with non-existent user causes no files to be scanned

Open Gazoo opened this issue 5 years ago • 0 comments

If you have a non-existant user specified in the scan_ignore_user setting then no files will be scanned when trying to run a scan.

example in /usr/local/maldetect/conf.maldet

scan_ignore_user="test"

When a scan is run I can see it get passed in:

Apr 17 05:29:35 el7p17 maldet(45355): {scan} launching scan of /var/www/vhosts/example.com/ to background, see /usr/local/maldetect/logs/event_log for progress
Apr 17 05:30:36 el7p17 maldet(45355): {scan} signatures loaded: 15519 (12707 MD5 | 2035 HEX | 777 YARA | 0 USER)
Apr 17 05:30:36 el7p17 maldet(45355): {scan} building file list for /var/www/vhosts/example.com/, this might take awhile...
Apr 17 05:30:36 el7p17 maldet(45355): {scan} setting nice scheduler priorities for all operations: cpunice 19 , ionice 6
Apr 17 05:30:36 el7p17 maldet(45355): {scan} executed eval /usr/bin/nice -n 19 /usr/bin/ionice -c2 -n 6 /usr/bin/find "/var/www/vhosts/example.com/" /tmp /var/tmp /dev/shm -maxdepth 15 -regextype posix-egrep -type f  -size +24c -size -6947618c  -not -perm 000   -not -uid 0 -not -gid 0 -not -user test 
Apr 17 05:30:36 el7p17 maldet(45355): {scan} scan returned empty file list; check that path exists and contains files in scope of configuration.

You can see that scan returned empty file list; check that path exists and contains files in scope of configuration even though there are files in that directory.

Gazoo avatar Apr 17 '19 11:04 Gazoo