clamavインストール

[root@falcon21 ~]# yum install --enablerepo=epel clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

インストール:
  clamav-devel.x86_64 0:0.99.4-1.el7                                           

完了しました!

----------------------------

[root@falcon21 ~]# cd /etc/clamd.d/
[root@falcon21 clamd.d]# cp -p scan.conf scan.conf_yyyymmdd
[root@falcon21 clamd.d]# vi scan.conf
     14 LogFile /var/log/clamd.scan
     31 LogFileMaxSize 2M
     35 LogTime yes
     57 LogRotate yes
     97 FixStaleSocket yes
    165 ExcludePath ^/proc/
    166 ExcludePath ^/sys/
    167 ExcludePath ^/dev/
    196 User root

----------------------------------
clamd@scanを起動
[root@falcon21 clamd.d]# systemctl start clamd@scan
[root@falcon21 clamd.d]# systemctl enable clamd@scan
[root@falcon21 clamd.d]# systemctl status clamd@scan
● clamd@scan.service - Generic clamav scanner daemon
   Loaded: loaded (/usr/lib/systemd/system/clamd@scan.service; enabled; vendor preset: disabl[root@falcon21 ~]# ed)
   Active: active (running) since 火 2018-05-01 23:06:02 JST; 2 days ago
 Main PID: 1755 (clamd)
   CGroup: /system.slice/system-clamd.slice/clamd@scan.service
           └─1755 /usr/sbin/clamd -c /etc/clamd.d/scan.conf

 5月 04 08:53:23 falcon21.space clamd[1755]: SelfCheck: Database status OK.
 5月 04 09:03:23 falcon21.space clamd[1755]: SelfCheck: Database status OK.
 5月 04 09:13:23 falcon21.space clamd[1755]: SelfCheck: Database status OK.
 5月 04 09:23:23 falcon21.space clamd[1755]: SelfCheck: Database status OK.
 5月 04 09:33:23 falcon21.space clamd[1755]: SelfCheck: Database status OK.
 5月 04 09:43:23 falcon21.space clamd[1755]: SelfCheck: Database status OK.
 5月 04 09:53:23 falcon21.space clamd[1755]: SelfCheck: Database modificati....
 5月 04 09:53:25 falcon21.space clamd[1755]: Reading databases from /var/li...v
 5月 04 09:53:55 falcon21.space clamd[1755]: Database correctly reloaded (6...)
 5月 04 10:03:55 falcon21.space clamd[1755]: SelfCheck: Database status OK.
Hint: Some lines were ellipsized, use -l to show in full.

-----------------------------------
「/etc/freshclam.conf」を編集
[root@falcon21 ~]# vi /etc/freshclam.conf

    25 LogFileMaxSize 2M
    29 LogTime yes
    46 LogRotate yes
    56 DatabaseOwner root

--------------------------------------- 
手動で「freshclam」を実行してウイルスデータベースが更新できることを確認

[root@falcon21 ~]# freshclam -u root
ClamAV update process started at Fri May  4 10:24:53 2018
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.99.4 Recommended version: 0.100.0
DON'T PANIC! Read http://www.clamav.net/documents/upgrading-clamav
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
daily.cld is up to date (version: 24537, sigs: 1932498, f-level: 63, builder: neo)
bytecode.cvd is up to date (version: 319, sigs: 75, f-level: 63, builder: neo)

-------------------------------
[root@falcon21 ~]# clamdscan
ERROR: Can't parse clamd configuration file /etc/clamd.conf

[root@falcon21 ~]# ln -s /etc/clamd.d/scan.conf /etc/clamd.conf

clamdscan実行   ーーーー 時間がかかる
[root@falcon21 ~]# clamdscan
/root: OK

----------- SCAN SUMMARY -----------
Infected files: 0
Time: 770.877 sec (12 m 50 s)

----------------------------
clamdscanオプション

ディレクトリを指定して、ウイルススキャン
[root@falcon21 ~]# clamdscan /home
/home: OK

----------- SCAN SUMMARY -----------
Infected files: 0
Time: 790.635 sec (13 m 10 s)

--------------------------------------------
定期実行 ウイルススキャンスクリプトを作成
[root@falcon21 ~]# vi virus_scan.sh
#!/bin/bash
 
SCANDIR=/
VIRUS_MVDIR=/root/virus
MAILADDR=root@falcon21.space

CLAMDSCAN=/bin/clamdscan
HOSTNAME=`hostname`
RUNDATE=`date +%Y%m%d-%H%M%S`
SCANTMP=/tmp/clamdscan_$RUNDATE

CLAMUPDATE="clamav-server \
clamav-data \
clamav-update \
clamav-filesystem \
clamav \
clamav-scanner \
clamav-scanner-systemd \
clamav-devel \
clamav-lib \
clamav-server-systemd"
 
-------------------------------
[root@falcon21 ~]# chmod 744 /root/virus_scan.sh

スクリプト動作テスト
[root@falcon21 ~]# sh -x virus_scan.sh
+ SCANDIR=/
+ VIRUS_MVDIR=/root/virus
+ MAILADDR=root@falcon21.space
+ CLAMDSCAN=/bin/clamdscan
++ hostname
+ HOSTNAME=falcon21.space
++ date +%Y%m%d-%H%M%S
+ RUNDATE=20180504-114534
+ SCANTMP=/tmp/clamdscan_20180504-114534
+ CLAMUPDATE='clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd'
+ yum -y update --enablerepo=epel clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd
読み込んだプラグイン:fastestmirror, langpacks, priorities
milter-manager_repos/x86_64/signature                    |  836 B     00:00    
milter-manager_repos/x86_64/signature                    | 1.0 kB     00:00 !!!
milter-manager_repos-source/signature                    |  836 B     00:00    
milter-manager_repos-source/signature                    | 1.0 kB     00:00 !!!
Loading mirror speeds from cached hostfile
 * base: ftp.iij.ad.jp
 * extras: ftp.iij.ad.jp
 * remi-safe: mirrors.tuna.tsinghua.edu.cn
 * updates: ftp.iij.ad.jp
156 packages excluded due to repository priority protections
No packages marked for update
+ /bin/clamdscan /
++ grep 'FOUND$' /tmp/clamdscan_20180504-114534
+ '[' '!' -z '' ']'
++ grep 'FOUND$' /tmp/clamdscan_20180504-114534
+ '[' -z '' ']'
+ cat /tmp/clamdscan_20180504-114534
+ mail -s '[Virus Not Found] falcon21.space 20180504-114534' root@falcon21.space
+ rm -f /tmp/clamdscan_20180504-114534


--------------------------------------