失眠网 > linux杀毒软件clamav安装

linux杀毒软件clamav安装

时间：2019-06-17 23:45:21

相关推荐

linux杀毒软件clamav安装

clamav 简介

ClamAV is an open source (GPLv2) anti-virus toolkit, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library.

yum 安装

yum install epel-release -yyum -y install clamav clamav-update

病毒相关操作

更新病毒库

freshclam

扫描并处理

clamscan –ri / -l clamscan.log –remove

源码安装

安装相关组件

先决条件

yum install -y \`# install tools` \gcc gcc-c++ make valgrind \`# install clamav dependencies` \bzip2-devel check-devel json-c-devel libcurl-devel libxml2-devel \ncurses-devel openssl-devel pcre2-devel sendmail-devel zlib-devel

下载并解压

Download the source from the downloads page.

tar xzf clamav-[ver].tar.gzcd clamav-[ver]

添加用户

If installing to the system, and if you intend to run freshclam or clamd as as service, you should create a service account before compiling and installing ClamAV.

groupadd clamav && useradd -g clamav clamav && id clamav

配置安装目录

日志目录

mkdir -p /usr/local/clamav/logstouch /usr/local/clamav/logs/clamd.logtouch /usr/local/clamav/logs/freshclam.logchown clamav.clamav /usr/local/clamav/logs/clamd.logchown clamav.clamav /usr/local/clamav/logs/freshclam.log

病毒存放目录

mkdir -p /usr/local/clamav/updatachown -R root.clamav /usr/local/clamav/chown -R clamav.clamav /usr/local/clamav/updata/

编译安装

./configure --prefix=/usr/local/clamav --with-pcremake && make install

配置clamav

修改clamd.conf文件

cd /usr/local/clamav/etccp clamd.conf.sample clamd.confvim clamd.conf#Example 注释掉这一行.添加下面三行：LogFile /usr/local/clamav/logs/clamd.log PidFile /usr/local/clamav/updata/clamd.pidDatabaseDirectory /usr/local/clamav/updata

修改freshclam.conf文件

cp freshclam.conf.sample freshclam.confvim freshclam.conf#Example 注释掉这一行. 添加下面三行 DatabaseDirectory /usr/local/clamav/updataUpdateLogFile /usr/local/clamav/logs/freshclam.logPidFile /usr/local/clamav/updata/freshclam.pid

启动

chown -R clamav.clamav /usr/local/clamav/systemctl start clamav-freshclam.servicesystemctl enable clamav-freshclam.service systemctl status clamav-freshclam.service

更新病毒库

先停止防护服务

systemctl stop clamav-freshclam.service

更新

/usr/local/clamav/bin/freshclam （根据网络质量确定更新时长）或者cd /usr/local/clamav/share/clamavwget /main.cvdwget /daily.cvdwget /bytecode.cvd

重启

systemctl start clamav-freshclam.servicesystemctl status clamav-freshclam.service

扫描

clamd

clamd is a multi-threaded daemon that uses libclamav to scan files for viruses. Scanning behavior can be fully configured to fit most needs by modifying clamd.conf.

As clamd requires a virus signature database to run, we recommend setting up ClamAV’s official signatures before running clamd using freshclam.

The daemon works by listening for commands on the sockets specified in clamd.conf. Listening is supported over both unix local sockets and TCP sockets.

IMPORTANT: clamd does not currently protect or authenticate traffic coming over the TCP socket, meaning it will accept any and all of the following commands listed from any source. Thus, we strongly recommend following best networking practices when setting up your clamd instance. I.e. don’t expose your TCP socket to the Internet.

clamscan

clamscan is a command line tool which uses libclamav to scan files and/or directories for viruses.Unlike clamdscan, clamscan does not require a running clamd instance to function. Instead, clamscan will create a new engine and load in the virus database each time it is run.It will then scan the files and/or directories specified at the command line, create a scan report, and exit.

By default, when loading databases, clamscan will check the location to which freshclam installed the virus database signatures. This behavior, along with a myriad of other scanning and engine controls, can be modified by providing flags and other options at the command line.

查看命令

/usr/local/clamav/bin./clamscan -h

建立软连接

ln -s /usr/local/clamav/bin/clamscan /usr/local/sbin/clamscan

扫描示例

clamscan -ri --no-summary /usr/local/bin/ -l /usr/local/clamav/logs/clamscan.log#或者clamscan -ri /usr/local/bin/ -l /usr/local/clamav/logs/clamscan.log

直接扫描，可能比clamdscan慢一些。

clamdscan

clamdscan is a clamd client,which greatly simplifies the task of scanning files with clamd. It sends commands to the clamd daemon across the socket specified in clamd.conf and generates a scan report after all requested scanning has been completed by the daemon.

Thus, to run clamdscan, you must have an instance of clamd already running as well.

Please keep in mind, that as a simple scanning client, clamdscan cannot change scanning and engine configurations. These are tied to the clamd instance and the configuration you set up in clamd.conf. Therefore, while clamdscan will accept many of the same commands as its sister tool clamscan, it will simply ignore most of them as (by design) no mechanism exists to make ClamAV engine configuration changes over the clamd socket.

clamdscan使用

clamdscan 需要与clamd服务配合使用，没有clamd，那就无法进行clamdscan 扫描。

建立clamdscan 软连接

ln -s /usr/local/clamav/bin/clamdscan /usr/local/sbin/clamdscan

查看命令

配置clamd

以上配置如果出问题，可能会报如下错误

ERROR: Please define server type (local and/or TCP)

如果是用yum安装的，则直接修改/etc/clamd.d/文件夹下的scan.conf文件，修改方式与clamd.conf类似。

启动clamd并验证

/usr/local/clamav/sbin/clamd

验证基本没问题。

扫描

clamdscan -i /usr/local/bin/ -l /usr/local/clamav/logs/clamdscan.log

从开始时间和结束时间上对比来看，clamdscan 比clamscan 执行的速度要快的多。

定时扫毒

直接在系统中定时

vim /etc/crontab

定时任务结构说明

设定定时杀毒任务

#凌晨2:01 开始更新病毒库#凌晨2:20 杀毒并处理1 2 * * * /usr/local/clamav/bin/freshclam --quiet20 2 * * * /usr/local/clamav/bin/clamscan -r /home --remove -l /var/log/clamscan.log