ClaimAV blocks nextcloud access

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 30.0
  • Operating system and version (e.g., Ubuntu 24.04):
    • Docker
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • nginx proxy manager 2.12.2
  • PHP version (e.g, 8.3):
    • 8.3
  • Is this the first time you’ve seen this error? (Yes / No):
    • Yes
  • When did this problem seem to first start?
    • after installing clamav container
  • Installation method (e.g. AIO, NCP, Bare Metal/Archive, etc.)
    • AIO

Summary of the issue you are facing:

Cannot access anymore to Nextcloud login or dashboard.

Steps to replicate it (hint: details matter!):

  1. Installing ClamAV container in Docker
  2. Setting Antivirus file scanner in Nextcloud ( Executable mode)
  3. After click “save” I lost access to nextcoud.

Log entries

\Sabre\File",“type”:“->”,“args”:[“*** sensitive parameters replaced “]},{“file”:”/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",“line”:1098,“function”:“createFile”,“class”:“OCA\DAV\Connector\Sabre\Directory”,“type”:“->”,“args”:[" sensitive parameters replaced “]},{“file”:”/var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php",“line”:504,“function”:“createFile”,“class”:“Sabre\DAV\Server”,“type”:“->”,“args”:[" sensitive parameters replaced ***”]},{“file”:“/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php”,“line”:89,“function”:“httpPut”,“class”:“Sabre\DAV\CorePlugin”,“type”:“->”,“args”:[{“class”:“Sabre\HTTP\Request”},{“class”:“Sabre\HTTP\Response”}]},{“file”:“/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php”,“line”:472,“function”:“emit”,“class”:“Sabre\DAV\Server”,“type”:“->”,“args”:[“method:PUT”,[{“class”:“Sabre\HTTP\Request”},{“class”:“Sabre\HTTP\Response”}]]},{“file”:“/var/www/html/apps/dav/lib/Connector/Sabre/Server.php”,“line”:43,“function”:“invokeMethod”,“class”:“Sabre\DAV\Server”,“type”:“->”,“args”:[{“class”:“Sabre\HTTP\Request”},{“class”:“Sabre\HTTP\Response”}]},{“file”:“/var/www/html/apps/dav/lib/Server.php”,“line”:370,“function”:“start”,“class”:“OCA\DAV\Connector\Sabre\Server”,“type”:“->”,“args”:},{“file”:“/var/www/html/apps/dav/appinfo/v2/remote.php”,“line”:19,“function”:“exec”,“class”:“OCA\DAV\Server”,“type”:“->”,“args”:},{“file”:“/var/www/html/remote.php”,“line”:146,“args”:[“/var/www/html/apps/dav/appinfo/v2/remote.php”],“function”:“require_once”}],“File”:“/var/www/html/custom_apps/files_antivirus/lib/Scanner/LocalClam.php”,“Line”:38,“message”:“The antivirus executable could not be found at /usr/bin/clamscan”,“exception”:{},“CustomMessage”:“The antivirus executable could not be found at /usr/bin/clamscan”}}

Apps

  • activity: 3.0.0
  • admin_audit: 1.20.0
  • announcementcenter: 7.0.1
  • app_api: 4.0.0
  • bruteforcesettings: 3.0.0
  • calendar: 5.0.6
  • circles: 30.0.0
  • cloud_federation_api: 1.13.0
  • comments: 1.20.1
  • contacts: 6.1.1
  • contactsinteraction: 1.11.0
  • dashboard: 7.10.0
  • dav: 1.31.1
  • deck: 1.14.2
  • encryption: 2.18.0
  • federatedfilesharing: 1.20.0
  • federation: 1.20.0
  • files: 2.2.0
  • files_downloadlimit: 3.0.0
  • files_pdfviewer: 3.0.0
  • files_reminders: 1.3.0
  • files_sharing: 1.22.0
  • files_trashbin: 1.20.1
  • files_versions: 1.23.0
  • firstrunwizard: 3.0.0
  • logreader: 3.0.0
  • lookup_server_connector: 1.18.0
  • mail: 4.0.9
  • nextcloud-aio: 0.7.0
  • nextcloud_announcements: 2.0.0
  • notes: 4.11.0
  • notifications: 3.0.0
  • notify_push: 0.7.0
  • oauth2: 1.18.1
  • onlyoffice: 9.5.0
  • password_policy: 2.0.0
  • photos: 3.0.2
  • privacy: 2.0.0
  • provisioning_api: 1.20.0
  • recommendations: 3.0.0
  • related_resources: 1.5.0
  • serverinfo: 2.0.0
  • settings: 1.13.0
  • sharebymail: 1.20.0
  • socialsharing_facebook: 3.2.0
  • support: 2.0.0
  • survey_client: 2.0.0
  • suspicious_login: 8.0.0
  • systemtags: 1.20.0
  • tasks: 0.16.1
  • text: 4.1.0
  • theming: 2.5.0
  • twofactor_backupcodes: 1.19.0
  • twofactor_nextcloud_notification: 4.0.0
  • twofactor_totp: 12.0.0-dev
  • user_status: 1.10.0
  • viewer: 3.0.0
  • weather_status: 1.10.0
  • webhook_listeners: 1.1.0-dev
  • workflowengine: 2.12.0
    Disabled:
  • files_external: 1.22.0
  • user_ldap: 1.21.0

I tried to disable self scanning, remove clamav container, restart docker.
From portainer logs everything seems fine.

Thanks for the help.

I am pretty sure this will not work. If ClamAV is running in a container, you need to connect to it using daemon mode, the executable mode expects to directly access the executable. That’s also what the message says:

The antivirus executable could not be found at /usr/bin/clamscan

1 Like

Thank you for your anwser.
After making numerous attempts I came to the solution.
The Claimav scan had triggered the DDOS protection of my TNAS, blocking access to the domain. :expressionless:
Now, i’m looking for a different way to prevent phenomenon.
Maybe the cause was the incorrect way I set up the antivirus.

Hi, why are you not enabling the clamav container via the AIO interface? That should usually work…