Introduction:
- Official website: http://www.clamav.net/
- Download: http://sourceforge.net/projects/clamav/files/
- Documents: http://www.clamav.net/doc/latest/html/
- Reference: http://resources.infosecinstitute.com/open-source-antivirus-clamav/
ClamAV has two modes of operation; a program that loads into memory only when you want to scan a file, or for more regular use (such as scanning all incoming e-mail), a program that connects to a daemon that is always running. Database updates can also be downloaded automatically .
- For manual use: install the package clamav.
- For automated use: install the package clamav-daemon.
- Reference: http://notes.sagredo.eu/node/36
- [Comment] Download the tarball and extract it.
- root@sp:~# cd /usr/local/src/
- root@sp:/usr/local/src# wget http://nchc.dl.sourceforge.net/project/clamav/clamav/0.97.6/clamav-0.97.6.tar.gz
- root@sp:/usr/local/src# tar -zxvf clamav-0.97.6.tar.gz
- root@sp:/usr/local/src# cd clamav-0.97.6
- root@sp:/usr/local/src/clamav-0.97.6# chown -R root:root .
- [Comment] Add group and user for ClamAV
- root@sp:/usr/local/src/clamav-0.97.6# groupadd clamav
- root@sp:/usr/local/src/clamav-0.97.6# useradd -g clamav -s /bin/false -c "Clam AntiVirus" clamav
- [Comment] Install ClamAV
- root@sp:/usr/local/src/clamav-0.97.6# mkdir -p /usr/local/clamav
- root@sp:/usr/local/src/clamav-0.97.6# ./configure --prefix=/usr/local/clamav
- root@sp:/usr/local/src/clamav-0.97.6# make
- root@sp:/usr/local/src/clamav-0.97.6# make install
- root@sp:/usr/local/src/clamav-0.97.6# ldconfig
Linking Relationship:
- [Comment] Add man path
- root@sp:~# vim /etc/manpath.config
...
19 #
20 MANDATORY_MANPATH /usr/man
21 MANDATORY_MANPATH /usr/share/man
22 MANDATORY_MANPATH /usr/local/share/man
23 MANDATORY_MANPATH /usr/local/clamav/share/man
24 #---------------------------------------------------------
... - [Comment] Create symbolic links
- root@sp:~# ln -s /usr/local/clamav/sbin/clamd /usr/local/sbin/clamd
- root@sp:~# ln -s /usr/local/clamav/bin/clamav-config /usr/local/bin/clamav-config
- root@sp:~# ln -s /usr/local/clamav/bin/clambc /usr/local/bin/clambc
- root@sp:~# ln -s /usr/local/clamav/bin/clamconf /usr/local/bin/clamconf
- root@sp:~# ln -s /usr/local/clamav/bin/clamdscan /usr/local/bin/clamdscan
- root@sp:~# ln -s /usr/local/clamav/bin/clamdtop /usr/local/bin/clamdtop
- root@sp:~# ln -s /usr/local/clamav/bin/clamscan /usr/local/bin/clamscan
- root@sp:~# ln -s /usr/local/clamav/bin/freshclam /usr/local/bin/freshclam
- root@sp:~# ln -s /usr/local/clamav/bin/sigtool /usr/local/bin/sigtool
- root@sp:~# mkdir -p /usr/local/clamav/var/lib/clamav
- [Comment] Create log directory and link it
- root@sp:~# mkdir -p /usr/local/clamav/var/log/clamd
- root@sp:~# ln -s /usr/local/clamav/var/log/clamd /var/log/
- root@sp:~# chmod -R o-rx /usr/local/clamav/var/log/clamd/
- root@sp:~# touch /usr/local/clamav/var/log/clamd/clamd.log
- root@sp:~# touch /usr/local/clamav/var/log/clamd/freshclam.log
- root@sp:~# chown -R clamav:clamav /usr/local/clamav/var/log/clamd
- root@sp:~# chown -R clamav:clamav /usr/local/clamav/var/lib/clamav
Configuration:
- [Comment] Modify configuration
- root@sp:~# vim /usr/local/clamav/etc/clamd.conf
...
7 # Comment or remove the line below.
8 # Example
...
14 LogFile /usr/local/clamav/var/log/clamd/clamd.log
...
34 LogTime yes
...
69 DatabaseDirectory /usr/local/clamav/var/lib/clamav
...
96 TCPSocket 3310
...
103 TCPAddr 127.0.0.1
...
189 User clamav
... - root@sp:~# vim /usr/local/clamav/etc/freshclam.conf
...
7 # Comment or remove the line below.
8 # Example
...
13 DatabaseDirectory /usr/local/clamav/var/lib/clamav
...
17 UpdateLogFile /usr/local/clamav/var/log/clamd/freshclam.log
...
51 DatabaseOwner clamav
...
68 DatabaseMirror db.us.clamav.net
...
121 NotifyClamd /usr/local/clamav/etc/clamd.conf
... - [Comment] Update signatures and start the daemon
- root@sp:~# freshclam -v
- root@sp:~# clamd
- root@sp:~# freshclam -v
Testing ClamAV:
- [Comment] Test scanning
- root@sp:~# cd /usr/local/src/clamav-0.97.6/test/
- root@sp:/usr/local/src/clamav-0.97.6/test# clamscan -r -l scan.txt
...
----------- SCAN SUMMARY -----------
Known viruses: 1324182
Engine version: 0.97.6
Scanned directories: 2
Scanned files: 143
Infected files: 46
Data scanned: 19.51 MB
Data read: 12.41 MB (ratio 1.57:1)
Time: 5.745 sec (0 m 5 s)
Service Control:
- [Comment] Add startup script for ClamAV
- root@sp:~# vim /usr/local/clamav/sbin/clamdctl
- root@sp:~# chmod 755 /usr/local/clamav/sbin/clamdctl
- root@sp:~# ln -s /usr/local/clamav/sbin/clamdctl /usr/local/sbin/clamdctl
- [Comment] Test startup script
- root@sp:~# clamdctl start; clamdctl restart; clamdctl stop
Uninstall ClamAV:
- [Comment] Remove directory of ClamAV
- root@sp:~# rm -rf /usr/local/clamav/
- [Comment] Remove links of ClamAV
- root@sp:~# rm /usr/local/bin/clam*
- root@sp:~# rm /usr/local/sbin/clam*
- root@sp:~# rm /usr/local/bin/freshclam; rm /usr/local/bin/sigtool
- root@sp:~# rm /var/log/clamd