connect Amavis to an external ClamAV daemon using TCP
I’ve been working in IT since 2009, starting as a system administrator and currently serving as a system engineer. My passion lies in building secure, reliable infrastructure — from enterprise systems to decentralized financial tools like Bitcoin multisig wallets and Shamir backups.
I write about system architecture, deployment strategies, security hardening, and self-custody in crypto. My mission is to help others design IT and financial systems that are resilient by default.
To connect Amavis to an external ClamAV daemon using TCP, update your Amavis configuration (typically in /etc/amavis/conf.d/50-user or /etc/amavisd/amavisd.conf).
1. Update @av_scanners Configuration
Replace or update your @av_scanners array with the following syntax:
@av_scanners = ( ['ClamAV-clamd', &ask_daemon, ["{}/", "clamd:CLAMAV_HOST:3310"], qr/\bOK\(/m, qr/\bFOUND\)/m, qr/^.?: (?!Infected Archive)(.*) FOUND$/m ], );
Replace CLAMAV_HOST with your ClamAV container/server hostname or IP address.
- Crucial Syntax Rules clamd: scheme prefix: Required so ask_daemon matches the protocol to clamav_clamd_internal. Using tcp: or clamav: will cause Unsupported AV protocol name errors.
"{}/*" placeholder: Passes individual extracted MIME files. Using "{}" passes the directory path, causing Is a directory errors during TCP streaming (zINSTREAM).
Single string endpoint: Formatted as "clamd:HOST:PORT". Passing an array reference like ["HOST", 3310] causes Amavis to misinterpret the host as a local UNIX socket.
- Restart and Test Restart the Amavis service or container to reload the configuration:
Bash systemctl restart amavis Inject the EICAR test string to verify the scan:
Bash printf "X5O!P%%@AP[4\PZX54(P^)7CC)7}\(EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\)H+H*" | sendmail postmaster@yourdomain.com Check your mail log for a successful block:
Plaintext amavis[...]: (...) Blocked INFECTED (Eicar-Signature) ...
