clamav.md

clamav

documentation

install

$ sudo dnf install -y clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

configure selinux

$ sudo setsebool -p antivirus_can_scan_system 1

configure clamd*

config file

copy config file

$ sudo cp /usr/share/clamav/template/clamd.conf /etc/clamd.d/clamd.conf
$ sudo sed -i '/^example/d' /etc/clamd.d/clamd.conf

modify config file

user

before

user <user>

after

user clamscan

localsocket

before

#localsocket /var/run/clamd.<service>/clamd.sock

after

localsocket /var/run/clamd.scan/clamd.sock

rename clamd* services

$ cd /usr/lib/systemd/system
$ sudo mv [email protected] clamd.service
$ sudo mv [email protected] clamdscan.service

update clamdscan service

note: the only change is removing the @ from the top level include statement.

before

.include /lib/systemd/system/[email protected]

after

.include /lib/systemd/system/clamd.service

update clamd service

replace the contents of /usr/lib/systemd/system/clamd.service with:

[unit]
description = clamd scanner daemon
after = syslog.target nss-lookup.target network.target
[service]
type = simple
execstart = /usr/sbin/clamd -c /etc/clamd.d/clamd.conf --foreground=yes
restart = on-failure
privatetmp = true

[install]
wantedby=multi-user.target

enable and start clamd* services

$ sudo systemctl enable clamd.service
$ sudo systemctl start clamd.service
$ sudo systemctl enable clamdscan.service
$ sudo systemctl start clamdscan.service

note: this is performance intensive. it's going to constantly scan the whole system. budgeting hardware resources for this is probably worth it on an exposed production system, but internal systems may be better off with these services installed for convenience, but stopped and disabled most of the time. ymmv.

configure freshclam

$ sudo sed -i '/^example/d' /etc/freshclam.conf

create freshclam service

write the following content to /usr/lib/systemd/system/freshclam.service:

# run the freshclam as daemon
[unit]
description = freshclam scanner
after = network.target
[service]
type = forking
execstart = /usr/bin/freshclam -d -c 4
restart = on-failure
privatetmp = true
[install]
wantedby=multi-user.target

enable and start freshclam service

$ sudo systemctl enable freshclam.service
$ sudo systemctl start freshclam.service