Go to Qiita Advent Calendar 2024 Top
LoginSignup
77
73

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

@bezeklik(Bezeklik)

Linuxアンチウイルスソフト ClamAV

Last updated at Posted at 2016-08-10

ClamAV

https://www.clamav.net/
オープンソースのアンチウイルスソフト。
最新版は 2018-07-09 リリースの ClamAV 0.100.1 になる。

パッケージ

諸君らが愛してくれた RPMForge は死んだ！
RPMForge (RepoForge) リポジトリでは clamd というパッケージ名だったデーモンは EPEL リポジトリでは clamav-scanner として存在している。なお Atomic リポジトリでは clamd パッケージが存在している。
以下は EPEL リポジトリにおけるパッケージの一覧。

パッケージ名 説明
clamav End-user tools for the Clam Antivirus scanner
clamav-data Virus signature data for the Clam Antivirus scanner
clamav-data-empty Empty data package for the Clam Antivirus scanner
clamav-devel Header files and libraries for the Clam Antivirus scanner
clamav-filesystem Filesystem structure for clamav
clamav-lib Dynamic libraries for the Clam Antivirus scanner
clamav-milter Milter module for the Clam Antivirus scanner
clamav-milter-systemd Systemd initscripts for the clamav
clamav-milter-sysvinit SysV initscripts for the clamav sendmail-milter
clamav-scanner Clamav scanner daemon
clamav-scanner-systemd Systemd initscripts for clamav scanner daemon
clamav-scanner-sysvinit SysV initscripts for clamav scanner daemon
clamav-server Clam Antivirus scanner server
clamav-server-systemd Systemd initscripts for clamav server
clamav-server-sysvinit SysV initscripts for clamav server
clamav-unofficial-sigs Scripts to download unoffical clamav signatures
clamav-update Auto-updater for the Clam Antivirus scanner data-files

インストール

yum install epel-release
yum install clamav clamav-{update,scanner-systemd}

EPEL のパッケージは 2018-03-02 に 0.99.4 がビルドされている。
CentOS 7 では clamav-scanner-systemd を、 CentOS 6 では clamav-scanner-sysvinit をインストールすればよいものと思われる。
上記指定だけで依存関係により以下もインストールされるのでばかすか指定する必要はない。

 clamav-data
 clamav-filesystem
 clamav-lib
 clamav-scanner
 clamav-server
 clamav-server-systemd
 nmap-ncat

更新

cp -a /etc/freshclam.conf{,.org}
cp -a /etc/sysconfig/freshclam{,.org}
sed -i '/^Example/s/^/#/' /etc/freshclam.conf
sed -i 's/^#DatabaseMirror db.XY/DatabaseMirror db.jp/' /etc/freshclam.conf
sed -i '/^FRESHCLAM_DELAY=disabled/s/^/#/' /etc/sysconfig/freshclam
freshclam
出力例
ClamAV update process started at Mon Aug  8 16:00:00 2016
main.cvd is up to date (version: 57, sigs: 4218790, f-level: 60, builder: amishhammer)
daily.cvd is up to date (version: 22049, sigs: 491550, f-level: 63, builder: neo)
bytecode.cld is up to date (version: 283, sigs: 53, f-level: 63, builder: neo)

なぜか freshclam.conf の Example を消さないと freshclam コマンドが動作しない。中身をちゃんと見ろということか。

スキャン

検出サンプル (Eicar-Test-Signature) 1 

curl -O http://www.eicar.org/download/eicar.com

スキャン実行

clamscan -r -i ~
出力例
/root/eicar.com: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 4704996
Engine version: 0.99.2
Scanned directories: 184
Scanned files: 202
Infected files: 1
Data scanned: 167.39 MB
Data read: 45.88 MB (ratio 3.65:1)
Time: 40.700 sec (0 m 40 s)

デーモンの起動

ln -s /etc/clamd.d/scan.conf /etc/clamd.conf
sed -i '/^Example/s/^/#/' /etc/clamd.conf
sed -i '/TCPSocket/s/^#//' /etc/clamd.conf
sed -i '/TCPAddr/s/^#//' /etc/clamd.conf
sed -i '/clamd.sock/s/^#//' /etc/clamd.conf
clamd
pgrep -a clamd

systemctl enable clamd@scan
出力例
Created symlink from /etc/systemd/system/multi-user.target.wants/clamd@scan.service to /usr/lib/systemd/system/clamd@scan.service.

systemctl start clamd@scan
systemctl status clamd@scan
出力例
● clamd@scan.service - Generic clamav scanner daemon
   Loaded: loaded (/usr/lib/systemd/system/clamd@scan.service; enabled; vendor preset: disabled)
   Active: active (running) since 木 2016-08-11 03:00:11 JST; 5s ago
 Main PID: 32109 (clamd)
   CGroup: /system.slice/system-clamd.slice/clamd@scan.service
           └─32109 /usr/sbin/clamd -c /etc/clamd.d/scan.conf --foreground=yes

 8月 11 03:00:11 localhost.localdomain clamd[32109]: clamd daemon 0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
 8月 11 03:00:11 localhost.localdomain clamd[32109]: Running as user clamscan (UID 993, GID 992)
 8月 11 03:00:11 localhost.localdomain clamd[32109]: Log file size limited to 1048576 bytes.
 8月 11 03:00:11 localhost.localdomain clamd[32109]: Reading databases from /var/lib/clamav
 8月 11 03:00:11 localhost.localdomain clamd[32109]: Not loading PUA signatures.
 8月 11 03:00:11 localhost.localdomain clamd[32109]: Bytecode: Security mode set to "TrustSigned".
 8月 11 03:00:11 localhost.localdomain clamd[32109]: LibClamAV Warning: ******************************************************
 8月 11 03:00:11 localhost.localdomain clamd[32109]: LibClamAV Warning: ***      Virus database timestamp in the future!   ***
 8月 11 03:00:11 localhost.localdomain clamd[32109]: LibClamAV Warning: ***  Please check the timezone and clock settings  ***
 8月 11 03:00:11 localhost.localdomain clamd[32109]: LibClamAV Warning: ******************************************************

デフォルト設定ファイル

/etc/cron.d/clamav-update
## Adjust this line...
MAILTO=root

## It is ok to execute it as root; freshclam drops privileges and becomes
## user 'clamupdate' as soon as possible
0  */3 * * * root /usr/share/clamav/freshclam-sleep
/etc/logrotate.d/clamav-update
/var/log/freshclam.log {
        monthly
        notifempty
}
/etc/sysconfig/freshclam
## When changing the periodicity of freshclam runs in the crontab,
## this value must be adjusted also. Its value is the timespan between
## two subsequent freshclam runs in minutes. E.g. for the default
##
## | 0 */3 * * *  ...
##
## crontab line, the value is 180 (minutes).
# FRESHCLAM_MOD=

## A predefined value for the delay in seconds. By default, the value is
## calculated by the 'hostid' program. This predefined value guarantees
## constant timespans of 3 hours between two subsequent freshclam runs.
##
## This option accepts two special values:
## 'disabled-warn'  ...  disables the automatic freshclam update and
##                         gives out a warning
## 'disabled'       ...  disables the automatic freshclam silently
# FRESHCLAM_DELAY=


### !!!!! REMOVE ME !!!!!!
### REMOVE ME: By default, the freshclam update is disabled to avoid
### REMOVE ME: network access without prior activation
FRESHCLAM_DELAY=disabled-warn	# REMOVE ME
/etc/freshclam.conf
Example
#DatabaseDirectory /var/lib/clamav
#UpdateLogFile /var/log/freshclam.log
#LogFileMaxSize 2M
#LogTime yes
#LogVerbose yes
LogSyslog yes
#LogFacility LOG_MAIL
#LogRotate yes
#PidFile /var/run/freshclam.pid
#DatabaseOwner clamupdate
#AllowSupplementaryGroups yes
#DNSDatabaseInfo current.cvd.clamav.net
#DatabaseMirror db.XY.clamav.net
DatabaseMirror database.clamav.net
#MaxAttempts 5
#ScriptedUpdates yes
#CompressLocalDatabase no
#DatabaseCustomURL http://myserver.com/mysigs.ndb
#DatabaseCustomURL file:///mnt/nfs/local.hdb
#PrivateMirror mirror1.mynetwork.com
#PrivateMirror mirror2.mynetwork.com
#Checks 24
#HTTPProxyServer myproxy.com
#HTTPProxyPort 1234
#HTTPProxyUsername myusername
#HTTPProxyPassword mypass
#HTTPUserAgent SomeUserAgentIdString
#LocalIPAddress aaa.bbb.ccc.ddd
#NotifyClamd /path/to/clamd.conf
#OnUpdateExecute command
#OnErrorExecute command
#OnOutdatedExecute command
#Foreground yes
#Debug yes
#ConnectTimeout 60
#ReceiveTimeout 60
#TestDatabases yes
#SubmitDetectionStats /path/to/clamd.conf
#DetectionStatsCountry country-code
#DetectionStatsHostID unique-id
#SafeBrowsing yes
#Bytecode yes
#ExtraDatabase dbname1
#ExtraDatabase dbname2

セキュリティ関連記事

  1. EICARテストファイル - Wikipedia ↩

77
73
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
77
73

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?