GLD Informatique - Dordogne - ClamAV sur RedHat

Installation CLAMAV

Prerequis

useradd clamav

groupadd protect

usermod -g protect clamav

Compilation

cd /usr/local/src

wget http://ovh.dl.sourceforge.net/sourceforge/clamav/clamav-0.88.tar.gz  

tar -xzf clamav-0.88.tar.gz

cd /usr/local/src/clamav-0.88

./configure -sysconfdir=/etc --with-user=clamav --with-group=protect

make

make install

FRESHCLAM

vi /etc/freshclam.conf

UpdateLogFile /var/log/freshclam.log

DatabaseMirror database.clamav.net

MaxAttempts 5

Checks 24

NotifyClamd /etc/clamav.conf

echo "" > /var/log/freshclam.log
chown clamav:protect /var/log/freshclam.log

Rafraichir le fichier de definition de virus
/usr/local/bin/freshclam

Mise en place de LOGROTATE

vi /etc/logrotate.d/freshclam

# Rotate FreshClam daemon log file

/var/log/freshclam.log {

    missingok

    nocompress

    create 640 clamav clamav

    postrotate

# On informe le demon CLAMD

        /bin/kill -HUP `cat /var/run/clamd.pid 2> /dev/null` 2> /dev/null || true

    endscript

    }

test
logrotate /etc/logrotate.conf

Mise en place de la planification de mise a jour

crontab -e
Ajouter

0 8 * * * /usr/local/bin/freshclam --quiet

CLAMD

rm -f /etc/clamav.conf
vi /etc/clamd.conf

LogFile /var/log/clamd.log

LogTime

PidFile /var/run/clamd.pid

TCPSocket 3310

TCPAddr 127.0.0.1

MaxConnectionQueueLength 1

MaxThreads 1

ScanMail

ScanHTML

ScanArchive

ScanRAR

ln -s /etc/clamd.conf /etc/clamav.conf
echo "" > /var/log/clamd.log
chown clamav protect /var/log/clamd.log

Mise en place de LOGROTATE

vi /etc/logrotate.d/clamd

# Rotate Clam daemon log file

/var/log/clamd.log {

    missingok

    nocompress

    create 640 clamav clamav

    postrotate

# On informe le demon CLAMD

        /bin/kill -HUP `cat /var/run/clamd.pid 2> /dev/null` 2> /dev/null || true

    endscript

}

test
logrotate /etc/logrotate.conf

Mise en place du demon CLAMD

vi /etc/init.d/clamd

#!/bin/sh

#

# clamd         Script to start/stop clamd.

#

# chkconfig:    - 61 39

# description:  clamd is an antivirus daemon.

#

# processname: clamd

# config: /etc/clamd.conf

# pidfile: /var/run/clamd.pid

#

# Source function library

. /etc/rc.d/init.d/functions

# Get network config

. /etc/sysconfig/network

#

test -f /etc/clamd.conf || exit 0

#

RETVAL=0

#

start() {

        echo -n $"Starting Clam AV daemon: "

        daemon /usr/local/sbin/clamd

        RETVAL=$?

        echo

        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/clamd

        return $RETVAL

}

#

stop() {

        echo -n $"Stopping Clam AV daemon: "

        killproc clamd

        RETVAL=$?

        echo

        [ $RETVAL -eq 0 ] && rm -f /var/run/clamd.pid /var/lock/subsys/clamd

        return $RETVAL

}

#

restart() {

        stop

        start

}



reload() {

        echo -n $"Reloading DB: "

        killproc clamd -USR2

        RETVAL=$?

        echo

        return $RETVAL

}

#

case "$1" in

  start)

        start

        ;;

  stop)

        stop

        ;;

  status)

        status clamd

        ;;

  restart)

        restart

        ;;

  condrestart)

        [ -f /var/lock/subsys/clamd ] && restart || :

        ;;

  reload)

        reload

        ;;

  *)

        echo $"Usage: $0 {start|stop|status|restart|condrestart|reload}"

        exit 1

esac

#

exit $?

chmod 700 /etc/init.d/clamd
chkconfig —add clamd
chkconfig —level 2345 clamd on
service clamd start