linux杀毒软件clamav安装
clamav 简介
ClamAV is an open source (GPLv2) anti-virus toolkit, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library.
yum 安装
yum install epel-release -y
yum -y install clamav clamav-update
病毒相关操作
更新病毒库
freshclam
扫描并处理
clamscan –ri / -l clamscan.log –remove
源码安装
安装相关组件
先决条件
yum install -y \
`# install tools` \
gcc gcc-c++ make valgrind \
`# install clamav dependencies` \
bzip2-devel check-devel json-c-devel libcurl-devel libxml2-devel \
ncurses-devel openssl-devel pcre2-devel sendmail-devel zlib-devel
下载并解压
Download the source from the clamav.net downloads page.
tar xzf clamav-[ver].tar.gz
cd clamav-[ver]
添加用户
If installing to the system, and if you intend to run freshclam or clamd as as service, you should create a service account before compiling and installing ClamAV.
groupadd clamav && useradd -g clamav clamav && id clamav
配置安装目录
日志目录
mkdir -p /usr/local/clamav/logs
touch /usr/local/clamav/logs/clamd.log
touch /usr/local/clamav/logs/freshclam.log
chown clamav.clamav /usr/local/clamav/logs/clamd.log
chown clamav.clamav /usr/local/clamav/logs/freshclam.log
病毒存放目录
mkdir -p /usr/local/clamav/updata
chown -R root.clamav /usr/local/clamav/
chown -R clamav.clamav /usr/local/clamav/updata/
编译安装
./configure --prefix=/usr/local/clamav --with-pcre
make && make install
配置clamav
修改clamd.conf文件
cd /usr/local/clamav/etc
cp clamd.conf.sample clamd.conf
vim clamd.conf
#Example 注释掉这一行.
添加下面三行：
LogFile /usr/local/clamav/logs/clamd.log
PidFile /usr/local/clamav/updata/clamd.pid
DatabaseDirectory /usr/local/clamav/updata
修改freshclam.conf文件
cp freshclam.conf.sample freshclam.conf
vim freshclam.conf
#Example 注释掉这一行.
添加下面三行
DatabaseDirectory /usr/local/clamav/updata
UpdateLogFile /usr/local/clamav/logs/freshclam.log
PidFile /usr/local/clamav/updata/freshclam.pid
启动
chown -R clamav.clamav /usr/local/clamav/
systemctl start clamav-freshclam.service
systemctl enable clamav-freshclam.service
systemctl status clamav-freshclam.service
更新病毒库
先停止防护服务
systemctl stop clamav-freshclam.service
更新
/usr/local/clamav/bin/freshclam （根据网络质量确定更新时长）
或者
cd /usr/local/clamav/share/clamav
wget http://database.clamav.net/main.cvd
wget http://database.clamav.net/daily.cvd
wget http://database.clamav.net/bytecode.cvd
重启
systemctl start clamav-freshclam.service
systemctl status clamav-freshclam.service
扫描
clamd
clamd is a multi-threaded daemon that uses libclamav to scan files for viruses. Scanning behavior can be fully configured to fit most needs by modifying clamd.conf.
As clamd requires a virus signature database to run, we recommend setting up ClamAV’s official signatures before running clamd using freshclam.
The daemon works by listening for commands on the sockets specified in clamd.conf. Listening is supported over both unix local sockets and TCP sockets.
IMPORTANT: clamd does not currently protect or authenticate traffic coming over the TCP socket, meaning it will accept any and all of the following commands listed from any source. Thus, we strongly recommend following best networking practices when setting up your clamd instance. I.e. don’t expose your TCP socket to the Internet.
clamscan
clamscan is a command line tool which uses libclamav to scan files and/or directories for viruses. Unlike clamdscan, clamscan does not require a running clamd instance to function. Instead, clamscan will create a new engine and load in the virus database each time it is run. It will then scan the files and/or directories specified at the command line, create a scan report, and exit.
By default, when loading databases, clamscan will check the location to which freshclam installed the virus database signatures. This behavior, along with a myriad of other scanning and engine controls, can be modified by providing flags and other options at the command line.
查看命令
/usr/local/clamav/bin
./clamscan -h
建立软连接
ln -s /usr/local/clamav/bin/clamscan /usr/local/sbin/clamscan
扫描示例
clamscan -ri --no-summary /usr/local/bin/ -l /usr/local/clamav/logs/clamscan.log
#或者
clamscan -ri /usr/local/bin/ -l /usr/local/clamav/logs/clamscan.log
直接扫描，可能比clamdscan慢一些。
clamdscan
clamdscan is a clamd client, which greatly simplifies the task of scanning files with clamd. It sends commands to the clamd daemon across the socket specified in clamd.conf and generates a scan report after all requested scanning has been completed by the daemon.
Thus, to run clamdscan, you must have an instance of clamd already running as well.
Please keep in mind, that as a simple scanning client, clamdscan cannot change scanning and engine configurations. These are tied to the clamd instance and the configuration you set up in clamd.conf. Therefore, while clamdscan will accept many of the same commands as its sister tool clamscan, it will simply ignore most of them as (by design) no mechanism exists to make ClamAV engine configuration changes over the clamd socket.
clamdscan使用
clamdscan 需要与clamd服务配合使用，没有clamd，那就无法进行clamdscan 扫描。
建立clamdscan 软连接
ln -s /usr/local/clamav/bin/clamdscan /usr/local/sbin/clamdscan
查看命令
配置clamd
以上配置如果出问题，可能会报如下错误
ERROR: Please define server type (local and/or TCP)
如果是用yum安装的，则直接修改/etc/clamd.d/文件夹下的scan.conf文件，修改方式与clamd.conf类似。
启动clamd并验证
/usr/local/clamav/sbin/clamd
验证基本没问题。
扫描
clamdscan -i /usr/local/bin/ -l /usr/local/clamav/logs/clamdscan.log
从开始时间和结束时间上对比来看，clamdscan 比clamscan 执行的速度要快的多。
定时扫毒
直接在系统中定时
vim /etc/crontab
定时任务结构说明
设定定时杀毒任务
#凌晨2:01 开始更新病毒库
#凌晨2:20 杀毒并处理
1 2 * * * /usr/local/clamav/bin/freshclam --quiet
20 2 * * * /usr/local/clamav/bin/clamscan -r /home --remove -l /var/log/clamscan.log
立即生效
crontab /etc/crontab
至此，小猿就完成linux 系统中的病毒软件安装完成。
参考网址
1、clamav 官网 https://docs.clamav.net/Introduction.html
2、ClamAV安装使用教程 https://blog.csdn.net/weixin_46011077/article/details/121735970