ClaimAV blocks nextcloud access

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 30.0
  • Operating system and version (e.g., Ubuntu 24.04):
    • Docker
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • nginx proxy manager 2.12.2
  • PHP version (e.g, 8.3):
    • 8.3
  • Is this the first time you’ve seen this error? (Yes / No):
    • Yes
  • When did this problem seem to first start?
    • after installing clamav container
  • Installation method (e.g. AIO, NCP, Bare Metal/Archive, etc.)
    • AIO

Summary of the issue you are facing:

Cannot access anymore to Nextcloud login or dashboard.

Steps to replicate it (hint: details matter!):

  1. Installing ClamAV container in Docker
  2. Setting Antivirus file scanner in Nextcloud ( Executable mode)
  3. After click “save” I lost access to nextcoud.

Log entries

\Sabre\File",“type”:“->”,“args”:[“*** sensitive parameters replaced “]},{“file”:”/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",“line”:1098,“function”:“createFile”,“class”:“OCA\DAV\Connector\Sabre\Directory”,“type”:“->”,“args”:[" sensitive parameters replaced “]},{“file”:”/var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php",“line”:504,“function”:“createFile”,“class”:“Sabre\DAV\Server”,“type”:“->”,“args”:[" sensitive parameters replaced ***”]},{“file”:“/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php”,“line”:89,“function”:“httpPut”,“class”:“Sabre\DAV\CorePlugin”,“type”:“->”,“args”:[{“class”:“Sabre\HTTP\Request”},{“class”:“Sabre\HTTP\Response”}]},{“file”:“/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php”,“line”:472,“function”:“emit”,“class”:“Sabre\DAV\Server”,“type”:“->”,“args”:[“method:PUT”,[{“class”:“Sabre\HTTP\Request”},{“class”:“Sabre\HTTP\Response”}]]},{“file”:“/var/www/html/apps/dav/lib/Connector/Sabre/Server.php”,“line”:43,“function”:“invokeMethod”,“class”:“Sabre\DAV\Server”,“type”:“->”,“args”:[{“class”:“Sabre\HTTP\Request”},{“class”:“Sabre\HTTP\Response”}]},{“file”:“/var/www/html/apps/dav/lib/Server.php”,“line”:370,“function”:“start”,“class”:“OCA\DAV\Connector\Sabre\Server”,“type”:“->”,“args”:},{“file”:“/var/www/html/apps/dav/appinfo/v2/remote.php”,“line”:19,“function”:“exec”,“class”:“OCA\DAV\Server”,“type”:“->”,“args”:},{“file”:“/var/www/html/remote.php”,“line”:146,“args”:[“/var/www/html/apps/dav/appinfo/v2/remote.php”],“function”:“require_once”}],“File”:“/var/www/html/custom_apps/files_antivirus/lib/Scanner/LocalClam.php”,“Line”:38,“message”:“The antivirus executable could not be found at /usr/bin/clamscan”,“exception”:{},“CustomMessage”:“The antivirus executable could not be found at /usr/bin/clamscan”}}

Apps

  • activity: 3.0.0
  • admin_audit: 1.20.0
  • announcementcenter: 7.0.1
  • app_api: 4.0.0
  • bruteforcesettings: 3.0.0
  • calendar: 5.0.6
  • circles: 30.0.0
  • cloud_federation_api: 1.13.0
  • comments: 1.20.1
  • contacts: 6.1.1
  • contactsinteraction: 1.11.0
  • dashboard: 7.10.0
  • dav: 1.31.1
  • deck: 1.14.2
  • encryption: 2.18.0
  • federatedfilesharing: 1.20.0
  • federation: 1.20.0
  • files: 2.2.0
  • files_downloadlimit: 3.0.0
  • files_pdfviewer: 3.0.0
  • files_reminders: 1.3.0
  • files_sharing: 1.22.0
  • files_trashbin: 1.20.1
  • files_versions: 1.23.0
  • firstrunwizard: 3.0.0
  • logreader: 3.0.0
  • lookup_server_connector: 1.18.0
  • mail: 4.0.9
  • nextcloud-aio: 0.7.0
  • nextcloud_announcements: 2.0.0
  • notes: 4.11.0
  • notifications: 3.0.0
  • notify_push: 0.7.0
  • oauth2: 1.18.1
  • onlyoffice: 9.5.0
  • password_policy: 2.0.0
  • photos: 3.0.2
  • privacy: 2.0.0
  • provisioning_api: 1.20.0
  • recommendations: 3.0.0
  • related_resources: 1.5.0
  • serverinfo: 2.0.0
  • settings: 1.13.0
  • sharebymail: 1.20.0
  • socialsharing_facebook: 3.2.0
  • support: 2.0.0
  • survey_client: 2.0.0
  • suspicious_login: 8.0.0
  • systemtags: 1.20.0
  • tasks: 0.16.1
  • text: 4.1.0
  • theming: 2.5.0
  • twofactor_backupcodes: 1.19.0
  • twofactor_nextcloud_notification: 4.0.0
  • twofactor_totp: 12.0.0-dev
  • user_status: 1.10.0
  • viewer: 3.0.0
  • weather_status: 1.10.0
  • webhook_listeners: 1.1.0-dev
  • workflowengine: 2.12.0
    Disabled:
  • files_external: 1.22.0
  • user_ldap: 1.21.0

I tried to disable self scanning, remove clamav container, restart docker.
From portainer logs everything seems fine.

Thanks for the help.

I am pretty sure this will not work. If ClamAV is running in a container, you need to connect to it using daemon mode, the executable mode expects to directly access the executable. That’s also what the message says:

The antivirus executable could not be found at /usr/bin/clamscan

1 Like

Thank you for your anwser.
After making numerous attempts I came to the solution.
The Claimav scan had triggered the DDOS protection of my TNAS, blocking access to the domain. :expressionless:
Now, i’m looking for a different way to prevent phenomenon.
Maybe the cause was the incorrect way I set up the antivirus.

Hi, why are you not enabling the clamav container via the AIO interface? That should usually work…

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.