search

Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.21k stars 686 forks source link

RFE: Allow use of SSL client key/certificate for authenticating to DatabaseMirror #1194

Open opoplawski opened 6 months ago

opoplawski commented 6 months ago

Describe the bug

We run local database mirrors that we protect by requiring SSL client certificates for authentication, but freshclam does not appear to have an option to use a client certificate when connecting to the database mirror.

micahsnyder commented 6 months ago

Can you use the CURL_CA_BUNDLE environment variable? https://docs.clamav.net/faq/faq-freshclam.html#problem-with-the-ssl-ca-cert

opoplawski commented 6 months ago

That's not appropriate here - that is for having the client validate the certificate of the database mirror. I need the freshclam client to present a SSL certificate to the server that it will verify to allow access. The equivalent of the --cert and --key options to curl.

micahsnyder commented 6 months ago

Ooohhh I see. Sorry I misunderstood.

Kangie commented 5 months ago

Just out of curiousity, what drives your requirement to hide your clamav update mirror behind mTLS authentication? It's an update server - it doesn't really matter if excess clients are getting updates from you, outside of bandwidth usage.

If you're building out a commercial product based on clamav this sounds like a great PR. If it's driven by internal cyber-security concerns, well, your cyber-sec team is "holding it wrong".

opoplawski commented 5 months ago

I feel like you are overly dismissive of our not wanting systems outside of our organization possibly using our server resources and network bandwidth. That feels like a valid concern to me.

Kangie commented 5 months ago

Do you just have your internal update server exposed to the world? That's an unusual choice, but it's your org's choice to make.

I would consider options including exposing it only to internal networks, whitelisting IP blocks, VPN access for your staff, etc as alternatives.

If you'd like to see this support implemented quickly though, I'm sure that Micah would welcome a PR.

opoplawski commented 5 months ago

We do have them public facing to serve our roaming users. Yeah, if this rises to a higher pain point and I ever have free time I'll try to do a PR.