How to install ClamAV in Lando for Drupal
Tags: webdev, guide, tutorial, drupal
Published: 2021-02-08 12:44:38

---
title: How to install ClamAV in Lando for Drupal
published: true
date: 2021-02-02 23:00:00 UTC
tags: webdev, guide, tutorial, drupal
canonical_url: https://mnguyen.io/blog/how-to-install-clamav-in-lando-for-drupal/
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/mslg8dsm7xd3p60ggb0t.jpg
---
<p><em>
  Photo by <a href="https://unsplash.com/@nbandana?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" rel="noopener">N Bandaru</a> on <a href="https://unsplash.com/s/photos/shell?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" rel="noopener">Unsplash</a>.
</em></p>

ClamAV is an antivirus software service which allows servers to scan for viruses. While it is notable for use in scanning for viruses on mail servers, we can also use it in our web applications to scan file uploads.

I’m doing some local development on a Drupal based site, which makes use of [ClamAV through a contributed module](https://www.drupal.org/project/clamav) to scan files uploaded to the site.

Having the module enabled but not having ClamAV on the system throws an error:

![Error message from Drupal whilst uploading a file, reading 'The anti-virus scanner could not check the file, so the file cannot be uploaded.'](https://mnguyen.io/static/bfa3a48eea426e8650bce6d1895a8f91/a1dd2/drupal-clamav-upload-error.png "Error message from Drupal whilst uploading a file, reading 'The anti-virus scanner could not check the file, so the file cannot be uploaded.'")

You could just uninstall the ClamAV module and work without it, but that introduces a potential gap in your test coverage—the behaviour of the site operates differently without the module installed, which could lead to issues that you don’t discover until later.

## Prerequisites

- You know how to run [Lando](https://lando.dev/)
- Your application is configured to scan file uploads e.g. in Drupal, the [ClamAV module](https://www.drupal.org/project/clamav)

## Setting up your Landofile

In your Landofile (`.lando.yml`), we will use the services section to modify the main application service—in our case labelled `appserver` to install ClamAV:

```
# .lando.yml
# ...the rest of the YAML config sits above here

services:
  appserver:
    build_as_root:
      - apt-get update -y
      - apt-get install clamav clamav-daemon -y
      - echo "TCPSocket 3310" >> /etc/clamav/clamd.conf
      - freshclam
      - update-rc.d clamav-daemon enable
    run_as_root:
      - service clamav-daemon start
```

This sets up the commands to run that installs ClamAV, sets up the ability to connect to the service on port `3310`, update the database definitions necessary to scan files, and then enable the ClamAV service.

Note here that we are using `apt-get` to install the packages as the base container images that Lando uses are from Debian. You may need to adjust if your base distribution is different.

Once the changes are made, rebuild the service with `lando rebuild`. This will relaunch your application, install ClamAV into your local container, and start it.

I can now load up my environment and confirm that ClamAV is successfully loaded, and that file uploads work:

![File upload success](https://mnguyen.io/static/70dfc84c2f993385858954dcf8c43386/44fd6/drupal-clamav-upload-success.png "File upload success")

Furthermore, we can use the [EICAR test file](https://en.wikipedia.org/wiki/EICAR_test_file) to confirm that it does block viruses from being uploaded:

![A file we try to upload, but was blocked by the anti-virus](https://mnguyen.io/static/59f3aee853e6c0422040c8f353e5b8d1/0ad97/drupal-clamav-upload-blocked.png "A file we try to upload, but was blocked by the anti-virus")

## Possible future changes

I could set out these changes in a custom service, or alternatively use a prebuilt container for ClamAV. Of course, the current hosting environment assumes ClamAV running on `localhost` on a TCP port so it’s not practical to modify it for that yet.

Hopefully this has been a useful guide in how to have ClamAV set up for your Drupal site. If you’re not running Drupal, hopefully you’ll find it useful if you’re integrating ClamAV for your own applications and infrastructure.