clamav 简介
ClamAV is an open source (GPLv2) anti-virus toolkit, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library.
yum 安装
yum install epel-release -yyum -y install clamav clamav-update
病毒相关操作
更新病毒库
freshclam
扫描并处理
clamscan –ri / -l clamscan.log –remove
源码安装
安装相关组件
先决条件
yum install -y \`# install tools` \gcc gcc-c++ make valgrind \`# install clamav dependencies` \bzip2-devel check-devel json-c-devel libcurl-devel libxml2-devel \ncurses-devel openssl-devel pcre2-devel sendmail-devel zlib-devel
下载并解压
Download the source from the downloads page.
tar xzf clamav-[ver].tar.gzcd clamav-[ver]
添加用户
If installing to the system, and if you intend to run freshclam or clamd as as service, you should create a service account before compiling and installing ClamAV.
groupadd clamav && useradd -g clamav clamav && id clamav
配置安装目录
日志目录
mkdir -p /usr/local/clamav/logstouch /usr/local/clamav/logs/clamd.logtouch /usr/local/clamav/logs/freshclam.logchown clamav.clamav /usr/local/clamav/logs/clamd.logchown clamav.clamav /usr/local/clamav/logs/freshclam.log
病毒存放目录
mkdir -p /usr/local/clamav/updatachown -R root.clamav /usr/local/clamav/chown -R clamav.clamav /usr/local/clamav/updata/
编译安装
./configure --prefix=/usr/local/clamav --with-pcremake && make install
配置clamav
修改clamd.conf文件
cd /usr/local/clamav/etccp clamd.conf.sample clamd.confvim clamd.conf#Example 注释掉这一行.添加下面三行:LogFile /usr/local/clamav/logs/clamd.log PidFile /usr/local/clamav/updata/clamd.pidDatabaseDirectory /usr/local/clamav/updata
修改freshclam.conf文件
cp freshclam.conf.sample freshclam.confvim freshclam.conf#Example 注释掉这一行. 添加下面三行 DatabaseDirectory /usr/local/clamav/updataUpdateLogFile /usr/local/clamav/logs/freshclam.logPidFile /usr/local/clamav/updata/freshclam.pid
启动
chown -R clamav.clamav /usr/local/clamav/systemctl start clamav-freshclam.servicesystemctl enable clamav-freshclam.service systemctl status clamav-freshclam.service
更新病毒库
先停止防护服务
systemctl stop clamav-freshclam.service
更新
/usr/local/clamav/bin/freshclam (根据网络质量确定更新时长)或者cd /usr/local/clamav/share/clamavwget /main.cvdwget /daily.cvdwget /bytecode.cvd
重启
systemctl start clamav-freshclam.servicesystemctl status clamav-freshclam.service
扫描
clamd
clamd is a multi-threaded daemon that uses libclamav to scan files for viruses. Scanning behavior can be fully configured to fit most needs by modifying clamd.conf.
As clamd requires a virus signature database to run, we recommend setting up ClamAV’s official signatures before running clamd using freshclam.
The daemon works by listening for commands on the sockets specified in clamd.conf. Listening is supported over both unix local sockets and TCP sockets.
IMPORTANT: clamd does not currently protect or authenticate traffic coming over the TCP socket, meaning it will accept any and all of the following commands listed from any source. Thus, we strongly recommend following best networking practices when setting up your clamd instance. I.e. don’t expose your TCP socket to the Internet.
clamscan
clamscan is a command line tool which uses libclamav to scan files and/or directories for viruses.Unlike clamdscan, clamscan does not require a running clamd instance to function. Instead, clamscan will create a new engine and load in the virus database each time it is run.It will then scan the files and/or directories specified at the command line, create a scan report, and exit.
By default, when loading databases, clamscan will check the location to which freshclam installed the virus database signatures. This behavior, along with a myriad of other scanning and engine controls, can be modified by providing flags and other options at the command line.
查看命令
/usr/local/clamav/bin./clamscan -h
建立软连接
ln -s /usr/local/clamav/bin/clamscan /usr/local/sbin/clamscan
扫描示例
clamscan -ri --no-summary /usr/local/bin/ -l /usr/local/clamav/logs/clamscan.log#或者clamscan -ri /usr/local/bin/ -l /usr/local/clamav/logs/clamscan.log
直接扫描,可能比clamdscan慢一些。
clamdscan
clamdscan is a clamd client,which greatly simplifies the task of scanning files with clamd. It sends commands to the clamd daemon across the socket specified in clamd.conf and generates a scan report after all requested scanning has been completed by the daemon.
Thus, to run clamdscan, you must have an instance of clamd already running as well.
Please keep in mind, that as a simple scanning client, clamdscan cannot change scanning and engine configurations. These are tied to the clamd instance and the configuration you set up in clamd.conf. Therefore, while clamdscan will accept many of the same commands as its sister tool clamscan, it will simply ignore most of them as (by design) no mechanism exists to make ClamAV engine configuration changes over the clamd socket.
clamdscan使用
clamdscan 需要与clamd服务配合使用,没有clamd,那就无法进行clamdscan 扫描。
建立clamdscan 软连接
ln -s /usr/local/clamav/bin/clamdscan /usr/local/sbin/clamdscan
查看命令
配置clamd
以上配置如果出问题,可能会报如下错误
ERROR: Please define server type (local and/or TCP)
如果是用yum安装的,则直接修改/etc/clamd.d/文件夹下的scan.conf文件,修改方式与clamd.conf类似。
启动clamd并验证
/usr/local/clamav/sbin/clamd
验证基本没问题。
扫描
clamdscan -i /usr/local/bin/ -l /usr/local/clamav/logs/clamdscan.log
从开始时间和结束时间上对比来看,clamdscan 比clamscan 执行的速度要快的多。
定时扫毒
直接在系统中定时
vim /etc/crontab
定时任务结构说明
设定定时杀毒任务
#凌晨2:01 开始更新病毒库#凌晨2:20 杀毒并处理1 2 * * * /usr/local/clamav/bin/freshclam --quiet20 2 * * * /usr/local/clamav/bin/clamscan -r /home --remove -l /var/log/clamscan.log
立即生效
crontab /etc/crontab
至此,小猿就完成linux 系统中的病毒软件安装完成。
参考网址
1、clamav 官网 /Introduction.html
2、ClamAV安装使用教程 /weixin_46011077/article/details/121735970
如果觉得《linux杀毒软件clamav安装》对你有帮助,请点赞、收藏,并留下你的观点哦!