Domino on Linux/Unix, Troubleshooting, Best Practices, Tips and more ...


Daniel Nashed


Domino Antivius powered by ClamAV

Daniel Nashed  31 May 2020 21:03:04

This project was only on hold for 12 years. -- LOL. When I wrote SpamGeek, I always wanted a matching anti-virus.
But I never found a good and free integration for Linux. Two weeks ago I discovered that "clamd" the service behind ClamAV offers a nice TCP/IP interface.
It doesn't provide channel encryption but should be OK when invoked on (port 3310) like the Tika server used by Notes/Domino 10 and higher to index attachments.

See the ClamAV website for details:

First implementation & ClamAV

Clamd is native available on Linux and also for Windows so I wrote a native integration on TCP/IP level.

For now it is a servers for W32/W64/Linux64 which can scan databases. If all works well, I will integrate it with my SpamGeek application.

Beside scanning attachments it can send the full MIME stream to clamd. I am still experimenting with the different clamd scan options like heuristics.
The task by default skips larger attachments to scan whole databases. The limit can be increased.

And you can also use a remote clamd server specifying an IP address via notes.ini or command-line for testing.
The task prints the virus name along with a Notes:// link. And also generates a SHA1 used for a link to VirusTotal lookups.
You can move potentially infected mails from inbox to a virus Notes folder.

I am planning to give this away for free for smaller environments with up to 20 user. And I am not sure yet if I want to make this available for larger environments.
This has been build for my own needs first. But I am sure this would be a great fit for many small customer or business partner environments.

Beta available on request

Installing the servertask is pretty simple and by default it just scans and reports.

The more complex part is the clamd configuration. And there isn't a systemd service for clamd. I might write one.

But for testing the servertask would be already available by mail.

Here is the current syntax and a scan example from my info mail account.

What do you think? Would this be helpful?

-- Daniel


-f   Move infected from Inbox to Virus Folder

-m   Also scan MIME (sent complete EML to Clamd)

-e   Try to scan encrypted documents (will only work for owner of mail-file)

-v   Verbose

-s Remote Server to scan

-a   Maximum scan size per attachment  a=KB, A=MB (Default 1 MB)

-b   Maximum scan size for MIME stream b=KB, B=MB (Default 1 MB)

nnshdomav.exe mail/nashcom5.nsf -c

31.05.2020 22:41:29   nshdomav: Domino Antivius 0.5.1 using Clamd: []

31.05.2020 22:41:29   nshdomav: ClamAV 0.102.3/25828/Sat May 30 14:36:41 2020

31.05.2020 22:41:29   nshdomav: [mail/nashcom5.nsf] Scanning 335 documents

31.05.2020 22:41:30   nshdomav: [] -> [Win.Trojan.Agent-35842] (79 ms)  [
notes:///mail/nashcom5.nsf/0/8AC7E8B7F5F9A4A7C12576850069BACA] []
31.05.2020 22:41:31   nshdomav: [] -> [Win.Trojan.Generic-42] (187 ms)  [
notes:///mail/nashcom5.nsf/0/15BAA48400CFC7DCC125772B00796FA5] []
31.05.2020 22:41:32   nshdomav: [] -> [Win.Trojan.Bublik-23] (546 ms)  [
notes:///mail/nashcom5.nsf/0/EB27A50C0325766EC12579EA003C1839] []
31.05.2020 22:41:32   nshdomav: [] -> [Win.Trojan.Bublik-23] (454 ms)  [
notes:///mail/nashcom5.nsf/0/9633B7A3A0D41D58C12579EA003BE637] []
31.05.2020 22:41:33   nshdomav: [] -> [Win.Trojan.Bublik-23] (468 ms)  [
notes:///mail/nashcom5.nsf/0/9A4A7171E3EA8529C12579EA003AE57B] []
31.05.2020 22:41:33   nshdomav: [] -> [Win.Trojan.Agent-1138832] (422 ms)  [
notes:///mail/nashcom5.nsf/0/6C54495460287EC022228391C9073494] []
31.05.2020 22:41:35   nshdomav: [VERSANDDETAILS 12-05-2020┬Ě] -> [Win.Trojan.Fareit-7784794-0] (453 ms)  [
notes:///mail/nashcom5.nsf/0/0F4CC616428497B7BCFA697A41FAB71E] []
31.05.2020 22:41:35

31.05.2020 22:41:35   nshdomav: Virus Attachments  :          7

31.05.2020 22:41:35   nshdomav: Virus Att Warn     :          0

31.05.2020 22:41:35   nshdomav: Virus MimeStream   :          0

31.05.2020 22:41:35   nshdomav: Databases          :          1

31.05.2020 22:41:35   nshdomav: DatabaseOpenErrors :          0

31.05.2020 22:41:35   nshdomav: Attachment Erorrs  :          0

31.05.2020 22:41:35   nshdomav: Attachments        :        623

31.05.2020 22:41:35   nshdomav: Skipped Large      :         10

31.05.2020 22:41:35   nshdomav: Docs with Attm     :        335

31.05.2020 22:41:35   nshdomav: Docs No Attm       :          0

31.05.2020 22:41:35   nshdomav: Docs encrypted     :          0

31.05.2020 22:41:35   nshdomav: Socket resets      :          0

31.05.2020 22:41:35   nshdomav: Runtim   (sec)     :          5

31.05.2020 22:41:35   nshdomav: ScanTime (sec)     :          4

31.05.2020 22:41:35   nshdomav: Total Size Attm    :    73.5 MB

31.05.2020 22:41:35   nshdomav: Total size scanned :    45.2 MB

31.05.2020 22:41:35   nshdomav: Total size skipped :    28.3 MB

31.05.2020 22:41:35   nshdomav: Shutdown


1Ales Lichtenberg  01.06.2020 6:47:02  Domino Antivius powered by CalmAV

Great job Daniel! I think it will be a very interesting solution for small businesses.

2Robert Read  02.06.2020 2:22:34  Domino Antivius powered by CalmAV

Great effort, as they say necessity is the mother of invention!

We have just over 40 users and could be interested as I am working on migrating to Centos from Windows for our Domino Domain while upgrading to V11 and thus will not be able to utilize Eset for Domino anymore as it is a Windows only product.

3Thomas  04.06.2020 6:58:18  Domino Antivius powered by CalmAV

Great job, Daniel,

this sounds really perfect. I'm really looking forward to see the final solution.

4Alex  11.06.2020 10:27:58  Domino Antivius powered by CalmAV

Hi all,

you can use also in front of Domino on Linux the efa (on VMWare)

5Daniel Nashed  11.06.2020 18:13:37  Domino Antivius powered by CalmAV

Hi Alex!

Thanks for the tip! And since this looks like a free offering, posting it here is OK for me.

What type of anti virus do you use in your project?

I am working on a gateway solution as one component and I am also having a free anti spam solution called SpamGeek which is a native Domino application.

The Domino ClamAV integration also allows to scan existing Notes databases. This cannot be done with a gateway solution. But both can be combined :-

-- Daniel

6Gonzalo Nicolas Bravo  20.07.2020 15:53:40  Domino Antivius powered by CalmAV

Great Daniel, I would be interested in trying the final version.

Thank you



    • [HCL Domino]
    • [Domino on Linux]
    • [Nash!Com]
    • [Daniel Nashed]