ClamAV

ClamAV is the open-source antivirus engine used by mail gateways, file servers and web applications to scan files for malware. This module runs the ClamAV daemon as a scan service for the cluster: Nextcloud's Antivirus for files app, ecoDMS, Samba or any other client that speaks the clamd protocol connects to it over TCP 3310.

The ClamAV app announcement TBA

ClamAV is a community application from the tebbiworld repository. Documentation and source can be found on Github

The NS8 Mail module ships its own clamd, but bound to 127.0.0.1:11330 of the mail node only — unusable for a Nextcloud on another node. This module runs the official clamav/clamav image (Cisco Talos) wherever it is needed and is reachable from every node of the cluster through the cluster VPN.

• clamd on TCP 3310 in the host network, with freshclam keeping the signatures current
• reachable from modules on the same node, from every node via the cluster VPN, and optionally from the LAN
• scan limits (file size, scan size, stream length) and the update schedule as settings
• live status on the settings page: engine and signature database version

A single rootless container from the pinned official image.

Who can connect is decided by the node firewall, not by the module:

One instance per node (fixed port). The Mail module's clamd on 11330 does not clash.

On the NethServer 8 cluster leader:

add-module ghcr.io/tebbiworld/clamav:1.0.0 1

Configure it (all settings have defaults; this keeps the LAN closed):

api-cli run module/clamav1/configure-module --data '{
  "listen_lan": false,
  "max_file_size_mb": 100,
  "max_scan_size_mb": 400,
  "stream_max_length_mb": 100,
  "signature_checks_per_day": 12
}'

The first start unpacks the signature database; clamd answers after a minute or two, and the settings page then shows engine and signature version together with the addresses clients should use.

Install the app Antivirus for files (files_antivirus), then under Administration → Security → Antivirus for files:

Upload the EICAR test file to confirm the connection: Nextcloud refuses it with a virus warning.

The daemon speaks the plain clamd protocol on TCP 3310 — the same one Nextcloud uses — so any computer that reaches the port can use it, not only modules of the cluster.

• Switch on LAN access in the module settings. That opens 3310/tcp in the node firewall (public zone); the settings page then lists the LAN address to use. Without the switch only the node itself and the cluster VPN reach the daemon.
• The clamd protocol has no authentication and no encryption. Anyone who can reach the port may submit files for scanning and could keep the daemon busy with large uploads. Enable LAN access only in a trusted network. Until the module offers an allow-list of its own, the source addresses can be restricted on the node with a firewalld rich rule for the service clamav1 (replace the plain service opening by the rule).
• Files are scanned as a stream (INSTREAM): the client sends the file contents to the daemon. The SCAN <path> command only works for paths the daemon sees inside its container, so it is useless from other machines. The stream size is limited by Maximum stream length (default 100 MB).

• ClamAV command line (clamdscan from the ClamAV package on Linux, macOS or Windows): a client configuration with the node address is enough, no local signatures are needed:

# clamd-remote.conf
TCPAddr <node address>
TCPSocket 3310

clamdscan --stream --config-file=clamd-remote.conf --fdpass=no /path/to/file

• Software with a clamd integration: mail filters (rspamd, Amavis), proxies (Squid with c-icap), file servers (Samba vfs_virusfilter), web applications with upload scanning, backup or ticket systems — configure them with host <node address>, port 3310, mode “TCP” / “network daemon”.
• Scripts: the protocol is simple enough for a few lines of Python or PowerShell (send zINSTREAM\0, then length-prefixed chunks, a zero-length chunk ends the file; the daemon answers stream: OK or stream: <signature> FOUND). The module README contains a working Python example.

There is no HTTP layer: no web form to upload a file, no REST endpoint, no login. Users without a clamd-capable client cannot use the scanner today. A REST/web front end behind Traefik with its own credentials is a candidate for a later release; the clamd port itself would stay as it is.

The NS8 backup contains state/environment and state/clamav.env only. The signature database is not backed up on purpose; after a restore the container downloads it again.

Unofficial, community-built package, not affiliated with or endorsed by Cisco Talos or the ClamAV project. “ClamAV” and the ClamAV mascot logo are trademarks of Cisco Systems, Inc.; the logo is used unmodified from the ClamAV project only to identify the packaged software.

ClamAV is licensed GPL-2.0; the official image is pulled at runtime and not redistributed. The module's own code is licensed GPL-3.0-or-later.

• ClamAV documentation
• Official container image
• Nextcloud antivirus configuration
• Module on Github
• Bug reports

Private hobby project, shared as-is. No warranty, no guaranteed support, use at your own risk.