CGatePro: Плюгин McAfee

От: Vladimir Zarozhevsky <CGatePro_at_mx_ru>
Дата: Wed 09 Jul 2003 - 21:43:33 MSD

Добрый день.

Имеем FreeBSD 4.2 CGP 4.0.6
Settings->General->Helpers наблюдаем картину "external helper is not running"
убираем галочку напротив Use Filter нажимаем Update и долго-долго ждем. Надоедает ждать, кликаем на Schedule и после снова на Helpers Ставим галочку напротив Use Filter нажимаем Update и мгновенно видим "external helper is not running"

22:18:08.42 2 TLS(9455) resumed for HTTPA-30105, refCount=10
22:18:08.64 2 EXTFILTER(McAfee) closing program input
22:18:13.00 2 TLS(9455) resumed for HTTPA-30106, refCount=11
22:18:13.13 2 TLS(9455) session closed by HTTPA-30106, refCount=10
22:18:14.60 2 TLS(9455) resumed for HTTPA-30107, refCount=11
22:18:14.77 2 TLS(9455) session closed by HTTPA-30107, refCount=10
22:18:23.01 1 EXTFILTER(McAfee) task has not stopped on stdin close, trying

to kill

22:18:29.50 2 TLS(9455) resumed for HTTPA-30108, refCount=11
22:18:29.67 2 SYSTEM User vladimir has updated the Helper settings
22:18:29.68 2 TLS(9455) session closed by HTTPA-30108, refCount=10

/var/CommuniGate/SystemLogs > ps axwww | grep CG
343 ?? Ss 1978:48.43 /usr/local/sbin/CommuniGate/CGServer --Base
/var/CommuniGate --Daemon

65525 ?? I 0:00.01 sh -c /usr/bin/perl5
/usr/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients Queue/1370485.msg
"{message} is infected with Exploit-MIME.gen.exe\\e" "Viruses: 1\\eTrojans: 0\\eJokes: 0\\eTests: 0\\e"
65526 ?? I 0:00.01 /usr/bin/perl5
/usr/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients Queue/1370485.msg
{message} is infected with Exploit-MIME.gen.exe\\e Viruses: 1\\eTrojans: 0\\eJokes: 0\\eTests: 0\\e
17443 p1 R+ 0:00.00 sh -c ps axwww | grep CG

пристрелил 65525 и 65526

/var/CommuniGate/SystemLogs > ps axww | grep CG
343 ?? Ss 1978:51.64 /usr/local/sbin/CommuniGate/CGServer --Base
/var/CommuniGate --Daemon

17529  ??  I      0:00.47 /usr/local/sbin/CommuniGate/CGPMcAfee/CGPMcAfee
17530  ??  S      0:00.80 /usr/local/sbin/CommuniGate/CGPMcAfee/CGPMcAfee
17560  p1  S+     0:00.00 sh -c ps axww | grep CG
17562  p1  R+     0:00.00 grep CG

Ооо 2 CGPMcAfee - круть

Из лога CGP (в 21:53 я начал тыкать мышой, с 18 до 21 он молчало ;( ) ...

18:12:10.12 1 EXTFILTER(McAfee) request 132547 timed-out
18:12:10.12 2 EXTFILTER(McAfee) killing the external program
18:12:10.12 1 EXTFILTER(McAfee) failed on [1370493], will retry. Error

Code=external helper timed out
21:53:51.01 2 EXTFILTER(McAfee) closing program input 21:54:05.17 1 EXTFILTER(McAfee) task has not stopped on stdin close, trying to kill
22:20:23.90 1 EXTFILTER(McAfee) stderr: Unrecognized character \177 at
/usr/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients line 1.\nUnrecognized
character \177 at /usr/local/sbin/CommuniGate/CGPMcA

22:20:23.90 2 EXTFILTER(McAfee) task output closed
22:20:23.91 2 EXTFILTER(McAfee) receiver finished
22:20:23.91 2 EXTFILTER(McAfee) program

/usr/local/sbin/CommuniGate/CGPMcAfee/CGPMcAfee released
22:20:23.91 2 EXTFILTER(McAfee) program
/usr/local/sbin/CommuniGate/CGPMcAfee/CGPMcAfee set
22:20:23.91 2 EXTFILTER(McAfee) program
/usr/local/sbin/CommuniGate/CGPMcAfee/CGPMcAfee released
22:20:23.91 2 EXTFILTER(McAfee) program
/usr/local/sbin/CommuniGate/CGPMcAfee/CGPMcAfee set
22:20:23.91 2 EXTFILTER(McAfee) receiver started 22:20:23.92 2 EXTFILTER(McAfee)
'/usr/local/sbin/CommuniGate/CGPMcAfee/CGPMcAfee' launched 22:20:23.92 2 EXTFILTER(McAfee) receiver started 22:20:23.94 2 EXTFILTER(McAfee)
'/usr/local/sbin/CommuniGate/CGPMcAfee/CGPMcAfee' launched 22:20:24.14 4 EXTFILTER(McAfee) out: 132548 INTF 2\n 22:20:24.20 4 EXTFILTER(McAfee) inp: * CGPMcAfee plugin version 3.0 FreeBSD-Intel build 6-Jun-2003 started
22:20:24.20 4 EXTFILTER(McAfee) out: 132549 INTF 2\n 22:20:24.20 4 EXTFILTER(McAfee) inp: * CGPMcAfee plugin version 3.0 FreeBSD-Intel build 6-Jun-2003 started
22:20:24.64 4 EXTFILTER(McAfee) out: 132550 INTF 2\n 22:20:25.57 4 EXTFILTER(McAfee) inp: * McAfee Antivirus Engine 4.1.60 with .DAT 4275 (75695 viruses) started
22:20:25.57 4 EXTFILTER(McAfee) inp: 132548 INTF 3 PROD=MCAF 22:20:25.57 2 EXTFILTER(McAfee) interfaceLevel = 3

Надеюсь проблема следовала из этого:

/var/CommuniGate/SystemLogs > grep perl5 2003-07-09.log |more
09:33:22.58 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280
10:45:06.48 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280
11:06:44.04 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280
12:25:58.93 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280
12:53:17.40 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280
15:21:31.07 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280
16:07:49.49 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280
17:28:01.70 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280
17:32:05.67 4 EXTFILTER(McAfee) inp: * Error while launching /usr/bin/perl5
/usr
/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients ^1 "^2" "^3", code=65280

Оказывается CGPMcAfee/notifyRecipients это бинарный фаил и в конфиге он запускается так:
POSTPROCESS=/usr/bin/perl5
/usr/local/sbin/CommuniGate/CGPMcAfee/notifyRecipients
когда CGPMcAfee создает конфиг фаил при первом запуске не найдя его.

Эххх...упало.

---
OOO IST
Vladimir Zarozhevsky
Phone: +7-3412-490397, 511173
Web: http://www.izhnet.ru

Получено Wed Jul 09 17:43:41 2003

Этот архив был сгенерирован hypermail 2.1.8 : Fri 24 Apr 2015 - 16:12:39 MSK