アンチウイルスClam AntiVirus導入

[root@falcon21 ~]# yum -y install clamav clamav-server clamav-server-systemd clamav-update clamav-scanner-systemd

ウイルス定義ファイル更新設定ファイル編集
[root@falcon21 ~]# vi /etc/freshclam.conf

8 #Example
140 NotifyClamd /etc/clamd.d/scan.conf

-------------------
ウイルス定義ファイル自動更新設定ファイル編集
[root@falcon21 ~]# vi /etc/sysconfig/freshclam

18 # FRESHCLAM_DELAY=

--------------------------------
ウイルス定義ファイル最新化
[root@falcon21 ~]# freshclam
ClamAV update process started at Tue May 1 14:31:06 2018
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.99.4 Recommended version: 0.100.0
DON'T PANIC! Read http://www.clamav.net/documents/upgrading-clamav
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
Downloading daily-24529.cdiff [100%]
daily.cld updated (version: 24529, sigs: 1929022, f-level: 63, builder: neo)
bytecode.cvd is up to date (version: 319, sigs: 75, f-level: 63, builder: neo)
Database updated (6495346 signatures) from database.clamav.net (IP: 27.96.54.66)
WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamd.scan/clamd.sock: Permission denied

以後のウイルス定義ファイルのアップデートは、/etc/cron.d/clamav-updateにより定期的に自動で行われる
-----------
WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamd.scan/clamd.sock: Permission denied

:

[root@falcon21 ~]# ps -ef|grep clamd
root 1635 1 2 4月30 ? 00:40:36 /usr/sbin/clamd -c /etc/clamd.d/scan.conf
root 20168 10409 0 14:35 pts/0 00:00:00 grep --color=auto clamd

-------------------------
[root@falcon21 ~]# vi /etc/clamd.d/scan.conf

 

85 LocalSocket /var/run/clamd.scan/clamd.sock
195 #User clamscan

------------------------------------
Clam AntiVirus起動
[root@falcon21 ~]# systemctl start clamd@scan
[root@falcon21 ~]# systemctl enable clamd@scan

--------------------------------
ウイルススキャンテスト
[root@falcon21 ~]# clamdscan -c /etc/clamd.d/scan.conf --remove
[root@falcon21 ~]# clamdscan -c /etc/clamd.d/scan.conf --remove
/root: OK

----------- SCAN SUMMARY -----------
Infected files: 0
Time: 371.352 sec (6 m 11 s)

----------------------------------------------
ウイルススキャン日次実行スクリプト作成
[root@falcon21 ~]# vi /etc/cron.daily/clamdscan
#!/bin/sh

# 設定ファイル
CONFIG=/etc/clamd.d/scan.conf

# スキャン実行
# ※ウイルス検知時は隔離ディレクトリへ隔離
CLAMSCANLOG=`mktemp`
QUARANTINEDIR=/tmp/clamdscan-quarantinedir-$(date +%Y%m%d)
mkdir -p ${QUARANTINEDIR}
clamdscan -c ${CONFIG} --move=${QUARANTINEDIR} / > ${CLAMSCANLOG} 2>&1

# ウイルス検知時のみroot宛にメール通知
if [ -z "$(grep FOUND$ ${CLAMSCANLOG})" ]; then

rm -rf ${QUARANTINEDIR}

else

grep -A 1 FOUND$ ${CLAMSCANLOG} | mail -s "Virus Found in `hostname` => ${QUARANTINEDIR}" root

fi

# スキャンログをシスログに出力
cat ${CLAMSCANLOG} | logger -t $(basename ${0})
rm -f ${CLAMSCANLOG}

------------------------------------------------
スキャン対象外にする
[root@falcon21 ~]# echo ExcludePath ^/proc/ >> /etc/clamd.d/scan.conf
[root@falcon21 ~]# echo ExcludePath ^/sys/ >> /etc/clamd.d/scan.conf

[root@falcon21 ~]# systemctl restart clamd@scan

**********************************************************

投票数:1 平均点:10.00
この記事の1行目に飛ぶ
 
Back to Top