Peekaboo "run_av error" about peekabooav HOT 6 CLOSED

Hi Michael,
no worries. Issues help others too who run into problems.

Please check whether amavis has filesystem permissions to access the socket file.

Since you don't use Ubuntu I can't really help. Please check if you've followed/replicated the steps performed by the installer and report back.

E.g.: line 230 + 231
gpasswd -a amavis peekaboo
gpasswd -a peekaboo amavis

from peekabooav.

Amavis should have permissions to access the *.sock-file.
I'm going to try this at home. After that, maybe I'm able to compare the two installations.

from peekabooav.

Hi Felix,
Would it help if I could send you my log?

As far as I can see, the attachment cannot be uploaded to cuckoo.

from peekabooav.

If you could attach the mail log and peekaboo log most of the relevant information should be in there.

For debugging purpose I suggest the following:
Become amavis user sudo su -s /bin/bash amavis and try to connect to the socket using socat STDIN UNIX-CONNECT:/var/run/peekaboo/peekaboo.sock. You should then see the greeting message Hallo das ist Peekaboo. At this point you could already give a local path to files that will then be scanned recursively if readable by the peekaboo user.

Make sure /etc/amavis/conf.d/15-av_scanners contains the correct entry to use Peekaboo and find the socket.

In addition to that you could submit a file to cuckoo manually. Become the peekaboo user and run cuckoo submit /path/to/file. This should give you the job id which you can follow at the cuckoo web ui.

Let me know how far you got.

from peekabooav.

Hi Felix,

Yesterday, I was able to start peekaboo in the right way with the service.
It was absolutely my fault.
I wasn't sure, if the patch of amavisd was going to ruin the whole configuration. But I tried and could restart amavisd successfully.
After that I only had trouble, that amavis didn't upload the attachment.

Also this problem was very easy to solve. I didn't know I need to change the path in the amavisd.conf to the same path, like in the peekaboo.conf.

Only a few minutes later, incoming mails did go trough cuckoo.
So it's working now!!! :D

But there's still stuff i couldn't figure out. For example, where I can add files, to send to cuckoo, or where I can change the peekaboo signatures.

from peekabooav.

Rule definitions can be found in peekaboo/ruleset/rules.py and can be used in peekaboo/rules/processor.py.

Remeber to run setup.py install and restart peekaboo to apply changes.

Have fun
Felix

from peekabooav.