アンチウイルスClam AntiVirus導入
[root@falcon21 ~]# yum -y install clamav clamav-server clamav-server-systemd clamav-update clamav-scanner-systemd
ウイルス定義ファイル更新設定ファイル編集
[root@falcon21 ~]# vi /etc/freshclam.conf
140 NotifyClamd /etc/clamd.d/scan.conf
-------------------
ウイルス定義ファイル自動更新設定ファイル編集
[root@falcon21 ~]# vi /etc/sysconfig/freshclam
--------------------------------
ウイルス定義ファイル最新化
[root@falcon21 ~]# freshclam
ClamAV update process started at Tue May 1 14:31:06 2018
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.99.4 Recommended version: 0.100.0
DON'T PANIC! Read http://www.clamav.net/documents/upgrading-clamav
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
Downloading daily-24529.cdiff [100%]
daily.cld updated (version: 24529, sigs: 1929022, f-level: 63, builder: neo)
bytecode.cvd is up to date (version: 319, sigs: 75, f-level: 63, builder: neo)
Database updated (6495346 signatures) from database.clamav.net (IP: 27.96.54.66)
WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamd.scan/clamd.sock: Permission denied
以後のウイルス定義ファイルのアップデートは、/etc/cron.d/clamav-updateにより定期的に自動で行われる
-----------
WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamd.scan/clamd.sock: Permission denied
[root@falcon21 ~]# ps -ef|grep clamd
root 1635 1 2 4月30 ? 00:40:36 /usr/sbin/clamd -c /etc/clamd.d/scan.conf
root 20168 10409 0 14:35 pts/0 00:00:00 grep --color=auto clamd
-------------------------
[root@falcon21 ~]# vi /etc/clamd.d/scan.conf
195 #User clamscan
------------------------------------
Clam AntiVirus起動
[root@falcon21 ~]# systemctl start clamd@scan
[root@falcon21 ~]# systemctl enable clamd@scan
--------------------------------
ウイルススキャンテスト
[root@falcon21 ~]# clamdscan -c /etc/clamd.d/scan.conf --remove
[root@falcon21 ~]# clamdscan -c /etc/clamd.d/scan.conf --remove
/root: OK
----------- SCAN SUMMARY -----------
Infected files: 0
Time: 371.352 sec (6 m 11 s)
----------------------------------------------
ウイルススキャン日次実行スクリプト作成
[root@falcon21 ~]# vi /etc/cron.daily/clamdscan
#!/bin/sh
# 設定ファイル
CONFIG=/etc/clamd.d/scan.conf
# スキャン実行
# ※ウイルス検知時は隔離ディレクトリへ隔離
CLAMSCANLOG=`mktemp`
QUARANTINEDIR=/tmp/clamdscan-quarantinedir-$(date +%Y%m%d)
mkdir -p ${QUARANTINEDIR}
clamdscan -c ${CONFIG} --move=${QUARANTINEDIR} / > ${CLAMSCANLOG} 2>&1
# ウイルス検知時のみroot宛にメール通知
if [ -z "$(grep FOUND$ ${CLAMSCANLOG})" ]; then
else
fi
# スキャンログをシスログに出力
cat ${CLAMSCANLOG} | logger -t $(basename ${0})
rm -f ${CLAMSCANLOG}
------------------------------------------------
スキャン対象外にする
[root@falcon21 ~]# echo ExcludePath ^/proc/ >> /etc/clamd.d/scan.conf
[root@falcon21 ~]# echo ExcludePath ^/sys/ >> /etc/clamd.d/scan.conf
[root@falcon21 ~]# systemctl restart clamd@scan
**********************************************************