[Open] TS-669 p Antivirus Failed to update virus definitions. Please try again later or update the definitions manually.

[DazOG]

I installed sherpa, upgraded ClamAV from the CLI (sherpa upgrade ClamAV) and it completed without error. I even restarted it (sherpa restart ClamAV). I am still unable to update any definitions from within the QNAP GUI, it just gives the same error message as it has done for the past ~15 days.

Any ideas what I've done wrong here?

Yes, you must "install" the ClamAV QPKG. You're not literally "upgrading" it as it hasn't been installed yet. The one built into QTS is not a QPKG.

Use this instead:

Code: Select all

sherpa install clamav

Then, logout your QTS UI session (if it was open in your web-browser), and login again.

Ok that makes more sense.. thanks

[McBride]

Boy oh boy! Glad I finally found this thread after poking around on a TS-469 Pro. This is not bashing someone, but it’s not the first issue I had with a QNAP. Plus, their customer service is quite arrogant.
Red flag number three to be precise. The hokey pokey with hard drives that have been on and off the compatibility list was one. The failure with iDrive was was the second and now we got this. My client paid about 1,500 EUR for the NAS and the hard drives and is not amused.
Now, they are telling me that I was the one recommending QNAP to them. Guess for future recommendations for my clients I’ll look into how other brands handle themselves.


Austria est imperare orbi universo

[FSC830]

Stay calm! A TS459-Pro is EOL! TS469-Pro was introduced in 2012, so now it is a 9 year old device, show me any other vendor who will continue service for EOL devices?
When did your customer bought the TS 469? I am sure, not in the last months! If so, he bought an already as EOL marked device, this is not to blame QNAP!
I have not only one of these EOL devices, but there are solutions available. Instead of claiming QNAP propose one of these solutions to your customer, a raspberryPi will do the job, if you dont like the sherpa solution.
But as already stated: antivirus at NAS is a nice gimmick and only the last line. Protecting the LAN needs to start much earlier than on NAS!

Regards

tu felix Austria nube!

[McBride]

I'm as cool as a cucumber. Maybe you did not read the whole post?

First we added hard drives that had been on the compatibility list (Seagate I think to remember). Then there was an issue with them and I had to learn, that they had been removed from the compatibility list, so there was no support. Therefore, we changed them all. Then later, with an update of the firmware the iDrive backup broke. The problem was, that the NAS was no longer able to process the volume and number of files (about 1.2 TB and 250k files) in a manner that would allow then to be handled properly. The app was and is a QNAP package from and still in the store. QNAP support fiddled around on the NAS remotely several times, to no avail. And now, this.

Sure, I am aware that the TS-468 Pro is EOL. Can't say that I would remember when it was bought. Oh funny enough, it's still advertised on their website https://www.qnap.com/en/product/ts-469%20pro Anywho, from a "Pro" model I expect "Pro Support". The point is not, that there are no solutions available. The point is, that EOL was Dec 2020. Back then it was already clear that the ClamAV version would have needed an update. So why not removing it from the default package and offer a QPKG in the store that can be updated?

Not saying that the device doesn't have a certain age. What I am saying is, that its not a good practice to bake something so sensitive to updates as an antivirus into the main firmware. And what I am saying is, that the client decides where he want's his protection. Perimeter security is a thing, but so is zero trust. And last but not least, we do not have any such customers but them anymore. For our current clients those small NASs are way too small and not an option anyway. But it doesn't shine a bright light on QNAP.

[syncthing]

due to https://www.qnap.com/en/product/eol.php#

the 469pro doesn't get updates since 2018-03 and no security updates since 2020-12
TS-469 Pro Limited 2018-03 (QTS 4.3.4) 2020-12

[Superdoop]

Hi all,

I have a TS-459 Pro II (firmware 4.2.6) which is EOL and had the same problem. I got it working manually (which is a start) but not able to fix its automation.

I did the following:

Downloaded the following files directly from the website (type-in the URL for each of the following into your browser and it'll download)
http://database.clamav.net/main.cvd
http://database.clamav.net/daily.cvd
http://database.clamav.net/bytecode.cvd

Manually Import each of files in the ORDER listed above using the GUI (Control Panel-->Applications-->AntiVirus) , the update should work successfully.
Commence with an AV job on a folder share and it should work.

Login via SSH:

find / -name *.cvd --[location of the files that were manually uploaded]
-->
/share/MD0_DATA/.antivirus/usr/share/clamav/main.cvd
/share/MD0_DATA/.antivirus/usr/share/clamav/daily.cvd
/share/MD0_DATA/.antivirus/usr/share/clamav/bytecode.cvd

freshclam -u admin
--> reports
ClamAV update process started at Mon Mar 22 19:38:00 2021
main.cvd is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
daily.cvd is up to date (version: 26117, sigs: 3964846, f-level: 63, builder: raynman)
bytecode.cvd is up to date (version: 333, sigs: 92, f-level: 63, builder: awillia2)

clamscan --version

--> reports ClamAV 0.99.3/26117/Mon Mar 22 11:04:41 2021

-------------------------

If anyone has got the automation bit to work, please let me know...for now the manual bit works for me.

[Toxic17]

Hi all,

I have a TS-459 Pro II (firmware 4.2.6) which is EOL and had the same problem. I got it working manually (which is a start) but not able to fix its automation.

just write a bash script to use curl or wget to download the files to the correct folder and over write the existing ones. then use crontab to run the bash script on a daily basis.

[McBride]

Hi all,

I have a TS-459 Pro II (firmware 4.2.6) which is EOL and had the same problem. I got it working manually (which is a start) but not able to fix its automation.

just write a bash script to use curl or wget to download the files to the correct folder and over write the existing ones. then use crontab to run the bash script on a daily basis.

ClamAV‘s CloudFlare protection doesn’t let you download the files with wget or curl.


Austria est imperare orbi universo

[Superdoop]

Thank you for responding.

wget http://database.clamav.net/main.cvd fails but you can download files from the site other than *.cvd files.

I don't know about curl, you have a working example? Ideally,if I can add the new bash script into the exist automated job, that would work.

I saw a post here to fool ClamAV‘s CloudFlare protection by using wget command to give the imression its using safari/chrome...not sure its that's still workable.

Ty

[Superdoop]

There is reference on how to do this https://linuxreviews.org/Wget:_download ... _with_ease

Tried it and got a difference response

[~] # wget -U "Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Mobile/15E148 Safari/604.1" http://database.clamav.net/main.cvd
--2021-03-22 21:47:13-- http://database.clamav.net/main.cvd
Resolving database.clamav.net (database.clamav.net)... 104.16.218.84, 104.16.219.84, 2606:4700::6810:da54, ...
Connecting to database.clamav.net (database.clamav.net)|104.16.218.84|:80... connected.
HTTP request sent, awaiting response... 503 Service Temporarily Unavailable
2021-03-22 21:47:13 ERROR 503: Service Temporarily Unavailable.

with the normal method of using wget that used to work:

[~] # wget http://database.clamav.net/main.cvd
--2021-03-22 21:50:47-- http://database.clamav.net/main.cvd
Resolving database.clamav.net (database.clamav.net)... 104.16.219.84, 104.16.218.84, 2606:4700::6810:da54, ...
Connecting to database.clamav.net (database.clamav.net)|104.16.219.84|:80... connected.
HTTP request sent, awaiting response... 403 Forbidden
2021-03-22 21:50:47 ERROR 403: Forbidden.

[FSC830]

@Superdoop: did you read all posts?
In post#26 alternatives are shown for an automated update.

Regards

[Superdoop]

The solution provided is a workaround.

If the instructions were clearer then I would take it further. Not a dummies-guide but enough to instill confidence that it works.

I had some-what of a nightmare with Townky media (app withdrawn) and thankfully Plex is working as its replacement, a much better product in my opinion. I want to keep customization to a minimum where possible, already customized it with netware_ng etc and don't want to make it any worse that it is.

thanks your response, much appreciated.

SD

[FSC830]

If the instructions were clearer

Here we go... (if you have already any Linux running, no matter if VM or physical)

Download and install cvdupdate,
Add two lines to crontab (only an example, modify your preferred time and paths for database download/web server root directory):

Code: Select all

0 23 * * * python3 -m cvdupdate update
15 23 * * * cp -r  ~/.cvdupdate/database/* /var/www/html

Edit /etc/init.d/antivirus.sh and add following line (search for "DatabaseMirror" in script to get the location):

Code: Select all

/bin/echo "DatabaseMirror myhost.mydomain.my" >> $FRESHCLAM_CONFIG

Add a line in NAS /etc/config/freshclam.conf (again an example, modify your hostname and domain as needed)
You must use a FQDN, it will not work using the IP!
Make sure, that FQDN can be resolved from NAS, myhost.mydomain.my is the host you installed the cvdupdate package and add the cronjobs.

Code: Select all

DatabaseMirror myhost.mydomain.my

You are done.

Regards

[Superdoop]

Thank you so much Fc...Just installation effort today...

Used the local python install approach given the EOL app limitations
App requires Python3.6, so started with that:

[/] # find / -name python3
/share/MD0_DATA/.qpkg/.installation/Optware-ng-master/sources/python3
/share/MD0_DATA/.qpkg/Python3/src/bin/python3
/share/MD0_DATA/.qpkg/Python3/python3
[/] # /share/MD0_DATA/.qpkg/Python3/src/bin/python3 --version
Python 3.5.0

Tried the offical qnap version - No good, so used the Optware-ng installed location instead (install it via the appstore if not done already)

/opt/bin] # opkg install python3

[/opt/bin] # python3 --version
Python 3.9.2

[/opt/bin] # opkg install python3-pip
Installing python3-pip (20.2.3-1) to root...
Downloading http://bin.entware.net/x64-k3.2/python3 ... 64-3.2.ipk
Installing python3-pkg-resources (49.2.1-1) to root...
Downloading http://bin.entware.net/x64-k3.2/python3 ... 64-3.2.ipk
Installing python3-setuptools (49.2.1-1) to root...
Downloading http://bin.entware.net/x64-k3.2/python3 ... 64-3.2.ipk
Installing python-pip-conf (0.1-1) to root...
Downloading http://bin.entware.net/x64-k3.2/python- ... 64-3.2.ipk
Configuring python-pip-conf.
Configuring python3-pkg-resources.
Configuring python3-setuptools.
Configuring python3-pip.

Local install approach

[/opt/bin] # python3 -m pip install --user /share/MD0_DATA/./Download/cvdupdate-0.3.0.tar.gz
Processing /share/MD0_DATA/Download/cvdupdate-0.3.0.tar.gz
Collecting click>=7.0
Downloading click-7.1.2-py2.py3-none-any.whl (82 kB)
|████████████████████████████████| 82 kB 695 kB/s
Collecting colorama
Downloading colorama-0.4.4-py2.py3-none-any.whl (16 kB)
Collecting coloredlogs>=10.0
Downloading coloredlogs-15.0-py2.py3-none-any.whl (45 kB)
|████████████████████████████████| 45 kB 2.0 MB/s
Collecting dnspython
Downloading dnspython-2.1.0-py3-none-any.whl (241 kB)
|████████████████████████████████| 241 kB 4.9 MB/s
Collecting rangehttpserver
Downloading rangehttpserver-1.2.0-py2.py3-none-any.whl (4.2 kB)
Collecting requests
Downloading requests-2.25.1-py2.py3-none-any.whl (61 kB)
|████████████████████████████████| 61 kB 3.5 MB/s
Collecting humanfriendly>=9.1
Downloading humanfriendly-9.1-py2.py3-none-any.whl (86 kB)
|████████████████████████████████| 86 kB 3.1 MB/s
Collecting chardet<5,>=3.0.2
Downloading chardet-4.0.0-py2.py3-none-any.whl (178 kB)
|████████████████████████████████| 178 kB 4.9 MB/s
Collecting idna<3,>=2.5
Downloading idna-2.10-py2.py3-none-any.whl (58 kB)
|████████████████████████████████| 58 kB 3.3 MB/s
Collecting urllib3<1.27,>=1.21.1
Downloading urllib3-1.26.4-py2.py3-none-any.whl (153 kB)
|████████████████████████████████| 153 kB 6.6 MB/s
Collecting certifi>=2017.4.17
Downloading certifi-2020.12.5-py2.py3-none-any.whl (147 kB)
|████████████████████████████████| 147 kB 7.1 MB/s
Using legacy 'setup.py install' for cvdupdate, since package 'wheel' is not installed.
Installing collected packages: click, colorama, humanfriendly, coloredlogs, dnspython, rangehttpserver, chardet, idna, urllib3, certifi, requests, cvdupdate
WARNING: The script humanfriendly is installed in '/root/.local/bin' which is not on PATH.
Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.
WARNING: The script coloredlogs is installed in '/root/.local/bin' which is not on PATH.
Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.
WARNING: The script chardetect is installed in '/root/.local/bin' which is not on PATH.
Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.
Running setup.py install for cvdupdate ... done
Successfully installed certifi-2020.12.5 chardet-4.0.0 click-7.1.2 colorama-0.4.4 coloredlogs-15.0 cvdupdate-0.3.0 dnspython-2.1.0 humanfriendly-9.1 idna-2.10 rangehttpserver-1.2.0 requests-2.25.1 urllib3-1.26.4
WARNING: You are using pip version 20.2.3; however, version 21.0.1 is available.
You should consider upgrading via the '/opt/bin/python3 -m pip install --upgrade pip' command.

Added /root/.local/bin as additional path into .bash_profile file

-- job done-- next stop configuration and DNS setup..

[FSC830]

Ok, you like to install the package at the NAS itself.
I did not check this, because this busybox Linux is not something I like. Just sufficient to maintain some NAS tasks, but I am missing to much commands.
Also I do not like to patch QTS with entware or optware when an update (from todays point of view very unlikely that a new update will be published) may override some patches.

So I installed this at my Pi with raspiOS and I am happy with it .

Regards