Scan a file over the Internet by its url using ClamAV

Question

Sometimes I have a need to scan the files over the Internet given their urls. I didn't find any information about this capacity at the documentation of ClamAV. Does it allow to do that? How do I get the result of scanning?

Solution 1

To scan a file you have to download it. You can only scan it on the server if it is your server and you have remote access to it. So if you want to download it from the terminal and run a scan as soon as it is downloaded, you should use a command like:

wget -O /tmp/filetoscan http://LINK_TO_THE_FILE && clamscan /tmp/filetoscan

or if you don't need the file after download, you can pipe it to clamscan:

 wget -qO- http://LINK_TO_THE_FILE | clamscan -

The above will still download the file, the only difference is that it won't store it on your storage. (So your bandwith will be still used during the process, and if you decide that the file is clean, you have to redownload it if you need it on your pc.)

If you don't want to download it, then you have to use a cloud service which downloads and scans it for you, e.g virustotal does it and it scans the file with ClamAV also. Virustotal also has a public API which you can use to initiate scans from your terminal or from any program you write.

If it is your server with clamAV installed on it and you have ssh access to it, then you just ssh to the server and scan the file just like you would scan it on your client. You can use somwthing like:

ssh YOUR_USER@`echo "example.com/file1" | awk -F "/" '{print $1}'` "clamscan /var/www`echo "example.com/file1" | awk -F ".com" '{print $2}'`"

Of course this depends on your server root (/var/www) and whether there are other settings on the server which should be taken into an account when reconstructing the filepath from the URL, but because you know how your server is set up you can do it.

Solution 2

You can use curl to do this:

curl http://example.com/file | clamscan -

By default, curl will not save the file to your drive space.

Comments

[jobin]

What do you mean when you say you need to scan the files?

[Incerteza]

@Jobin, what could I mean by that when I'm taking the antivirus?

[jobin]

Oh my bad, didn't know ClamAV was an anti-virus software.

[Incerteza]

If it is your server with clamAV installed on it and you have ssh access to it, then you just ssh to the server and scan the file just like you would scan it on your client. - yes, but how is that related to being able to scan a file given its url?

[falconer]

@Alex Is it your server? If not, the first part of my answer is relevant to you. If it is yours, then why would you like to scan it based on an URL? But even in the latter case, you can break up that URL (e.g with sed or awk) to the domain name and to the path to the resource and reconstruct the file path from the latter. (Because you know your server setup, it is doable.) Then you use the domain name in the ssh for the server name, and the filepath for the filename, and this means you used the URL for scanning. Good, isn't it?

[Incerteza]

Yes, it is mine. Why I need it is not relevant. Sorry, I didn't get it. Let's say there is a huge file at example.com/file1 which is too much effort to download. How do I scan it for viruses?

[falconer]

@Alex Update...