How to Install ClamAV on CentOS 7

àì夳堔傛蜴生んèń 2022-05-14 10:22 230阅读 0赞

ClamAV or Clam Antivirus is an open source antivirus tool for UNIX. It was built specially for scanning emails at mail gateways but these days it is used for securing various types of systems and applications. ClamAV provides a number of utilities including a ﬂexible multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. ClamAV is used widely for securing Linux servers, mail gateways. It is also used along with CPanel to secure the file system.

A few notable features of ClamAV are:

*  It is opensource, POSIX compliant, portable software licensed under GNU general public licence.
 *  It provides fast scanning and supports on access scanning of a file.
 *  It claims to detect over 1 million viruses, worms and Trojans, including Microsoft Ofﬁce macro viruses, mobile malware, and other threats.
 *  Capable of scanning within various types of archives and compressed ﬁles.
 *  Supports Portable Executable files, ELF and Mach-O files as well.
 *  Supports almost all mail formats and special files and formats.
 *  Advanced database updater with support for scripted updates, digital signatures and DNS based database version queries.

## Requirements ##

ClamAV does not require any special hardware, you will only need a server with CentOS 7.x installed. You will need root or sudo access to your system. If you are logged in as non root user, you can either execute `sudo -i` to switch to root account or you can use `sudo` command at the start of all the administrative command.

## Installing ClamAV ##

Before installing any package, it is recommended to update the system and packages using the following command.

yum -y update

After updating the system we will need to add the EPEL repository into our system as ClamAV is not available in the default repository of CentOS 7. To add EPEL repository run the following command.

yum -y install epel-release
        yum -y update
        yum clean all

Now run the following command to install ClamAV antivirus.

yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

Before running Clam antivirus you will need to configure few things.

As we are working on CentOS, it comes comes with SELinux. SELinux may deny access to few files, which will generate errors and warning. You can either disable SELinux or modify it's configuration so that ClamAV can access all the files on the disk.

To disable SELinux run the following command.

setenforce 0

To modify its configuration to allow ClamAV, run the following command.

setsebool -P antivirus_can_scan_system 1
        setsebool -P clamd_use_jit 1

To check the status of SELinux configuration for antivirus, run the following command.

getsebool -a | grep antivirus

You will get following output.

[root@ip-172-31-16-226 ~]# getsebool -a | grep antivirus
        antivirus_can_scan_system --> on
        antivirus_use_jit --> off

Once we have adjusted SELinux, we will now need to modify the scanner configuration files of ClamAV. By default a configuration file is created at `/etc/clamd.d/scan.conf`, hence you will only need to modify the configuration. Before we can use the configuration, we must need to remove or comment out the `Example` word from the configuration. You can run the following command to remove the example word directly.

cp /etc/clamd.d/scan.conf /etc/clamd.d/scan.conf.backup
        sed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf

If the above command results in an error then open the file in your favourite editor and remove the text `Example` from the file.

You also have the option of which user will run ClamAV. You can either run ClamAV with the root user or any other user like clamscan etc. By default ClamAV creates a user in your system which we can use to run the scanner service. To find the user, you can run the following command.

cat /etc/passwd | grep clam

You will likely see the following output.

[root@ip-172-31-7-222 ~]# cat /etc/passwd | grep clam
        clamupdate:x:995:992:Clamav database update user:/var/lib/clamav:/sbin/nologin
        clamscan:x:994:991:Clamav scanner user:/:/sbin/nologin

We can use the above `clamscan` user to run the ClamAV scanner. Open the scanner configuration file in your favourite editor. In this tutorial we will be using nano editor, if you don't have nano installed, you can run `yum -y install nano` command to install nano editor in your computer.

nano /etc/clamd.d/scan.conf

Scroll down to find the following lines.

# Run as another user (clamd must be started by root for this option to work)
        # Default: don't drop privileges
        User clamscan

If you are using the ClamAV user, then you will need to start the daemon as root. As we are logged in as root, we can keep using this user. If you want you can also switch to root user here.

Next you will need to define the server type in the configuration, scroll down to find the following lines.

# The daemon can work in local mode, network mode or both.
        # Due to security reasons we recommend the local mode.

`# Path to a local socket file the daemon will listen on. # Default: disabled (must be specified by a user) #LocalSocket /var/run/clamd.scan/clamd.sock`

Uncomment the line `#LocalSocket /var/run/clamd.scan/clamd.sock` to

LocalSocket /var/run/clamd.scan/clamd.sock

Save and exit from editor. But before we can run the scanner service, we will need to configure and run Freshclam.

Freshclam is used to update the database of virus definitions into the server. Freshclam configuration file is located at `/etc/freshclam.conf`. We will take a backup of the file and then we will comment out the `Example` line from the file.

cp /etc/freshclam.conf /etc/freshclam.conf.bakup
        sed -i -e "s/^Example/#Example/" /etc/freshclam.conf

We can now run Freshclam using the following command.

freshclam

You will get following output.

[root@ip-172-31-7-222 ~]# freshclam
        ClamAV update process started at Tue Nov  1 08:44:10 2016
        main.cvd is up to date (version: 57, sigs: 4218790, f-level: 60, builder: amishhammer)
        Trying host database.clamav.net (27.96.54.66)...
        Downloading daily.cvd [100%]
        daily.cvd updated (version: 22463, sigs: 804704, f-level: 63, builder: neo)
        Downloading bytecode-279.cdiff [100%]
        Downloading bytecode-280.cdiff [100%]
        Downloading bytecode-281.cdiff [100%]
        Downloading bytecode-282.cdiff [100%]
        Downloading bytecode-283.cdiff [100%]
        bytecode.cld updated (version: 283, sigs: 53, f-level: 63, builder: neo)
        Database updated (5023547 signatures) from database.clamav.net (IP: 27.96.54.66)

To check if the database is up to date or not, run the same command `freshclam` again, if any update is available, it will update it or it will show you that everything is up to date.

[root@ip-172-31-7-222 ~]# freshclam
        ClamAV update process started at Tue Nov  1 08:51:46 2016
        main.cvd is up to date (version: 57, sigs: 4218790, f-level: 60, builder: amishhammer)
        daily.cvd is up to date (version: 22463, sigs: 804704, f-level: 63, builder: neo)
        bytecode.cld is up to date (version: 283, sigs: 53, f-level: 63, builder: neo)

As freshclam updates the virus database, it is recommended to run it frequently to download the latest malware signatures. To run it automatically, you either create a cron job or you can create a systemd service file.

To create a cron job run the following command.

crontab -e

This will open the cron job file in VI text editor, go to insert mode by pressing i and then enter the following line into the file.

00 01,13 * * *  /usr/bin/freshclam --quiet

Now press Esc and then in command mode type `:wq` to save and exit from editor. The above cron job will execute the the `freshclam` command, twice a day, once at 1AM and then again at 1PM.

You can also create a systemd service if you do not want to use cron jobs. Create a new text file using your favourite editor.

nano /usr/lib/systemd/system/freshclam.service

Now add the following lines into the file.

[Unit]
        Description = freshclam scanner
        After = network.target[Service]
        Type = forking
        ExecStart = /usr/bin/freshclam -d -c 2
        Restart = on-failure
        PrivateTmp = true

`[Install] WantedBy=multi-user.target`

Now save and exit from the editor. To start the service and enable it to automatically start at boot time, run the following command.

systemctl start freshclam
        systemctl enable freshclam

Now the systemd service will run freshclam twice a day to update the database. You can also check the status of our newly created freshclam service using the following command.

systemctl status freshclam

You should see following output.

[root@ip-172-31-7-222 ~]# systemctl status freshclam
        ● freshclam.service - freshclam scanner
           Loaded: loaded (/usr/lib/systemd/system/freshclam.service; enabled; vendor preset: disabled)
           Active: active (running) since Tue 2016-11-01 09:07:06 UTC; 1min 7s ago
         Main PID: 4488 (freshclam)
           CGroup: /system.slice/freshclam.service
                   └─4488 /usr/bin/freshclam -d -c 2

`Nov 01 09:07:06 ip-172-31-7-222 systemd[1]: Starting freshclam scanner... Nov 01 09:07:06 ip-172-31-7-222 systemd[1]: Started freshclam scanner. Nov 01 09:07:06 ip-172-31-7-222 freshclam[4488]: freshclam daemon 0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Nov 01 09:07:06 ip-172-31-7-222 freshclam[4488]: ClamAV update process started at Tue Nov 1 09:07:06 2016 Nov 01 09:07:06 ip-172-31-7-222 freshclam[4488]: main.cvd is up to date (version: 57, sigs: 4218790, f-level: 60, builder: amishhammer) Nov 01 09:07:06 ip-172-31-7-222 freshclam[4488]: daily.cvd is up to date (version: 22463, sigs: 804704, f-level: 63, builder: neo) Nov 01 09:07:06 ip-172-31-7-222 freshclam[4488]: bytecode.cld is up to date (version: 283, sigs: 53, f-level: 63, builder: neo) Nov 01 09:07:06 ip-172-31-7-222 freshclam[4488]: -------------------------------------- Hint: Some lines were ellipsized, use -l to show in full.`

Now as we have our virus definitions updated, we can proceed further to run the scanner service of ClamAV. To start the scanner service run the following command.

systemctl start clamd@scan

To automatically start the service at boot time, run the following command.

systemctl enable clamd@scan

To check the status of scanner service, run the following command.

systemctl status clamd@scan

It should produce the following output when running normally.

[root@ip-172-31-7-222 ~]# systemctl status clamd@scan
        ● clamd@scan.service - Generic clamav scanner daemon
           Loaded: loaded (/usr/lib/systemd/system/clamd@scan.service; disabled; vendor preset: disabled)
           Active: active (running) since Tue 2016-11-01 11:20:36 UTC; 12s ago
         Main PID: 4956 (clamd)
           CGroup: /system.slice/system-clamd.slice/clamd@scan.service
                   └─4956 /usr/sbin/clamd -c /etc/clamd.d/scan.conf --foreground=yes

`Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: HTML support enabled. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: XMLDOCS support enabled. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: HWP3 support enabled. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: Self checking every 600 seconds. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: PDF support enabled. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: SWF support enabled. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: HTML support enabled. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: XMLDOCS support enabled. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: HWP3 support enabled. Nov 01 11:20:45 ip-172-31-7-222 clamd[4956]: Self checking every 600 seconds.`

You can also use `clamconf` utility to check the configuration files. This utility will display the configuration of config file `clam.conf` and `freshclam.conf`. It will display information about software settings, database, platform, and build information. To use this utility run the following command.

clamconf

The sample output of the command is:

[root@ip-172-31-7-222 ~]# clamconf
        Checking configuration files in /etcConfig file: clamd.conf 
        ERROR: Please edit the example config file /etc/clamav/clamd.confConfig file: freshclam.conf
        ---------------------------
        StatsHostID disabled
        StatsEnabled disabled
        StatsTimeout disabled
        LogFileMaxSize = "1048576"
        LogTime disabled
        LogSyslog = "yes"
        LogFacility = "LOG_LOCAL6"
        LogVerbose disabled
        LogRotate disabled
        PidFile disabled
        DatabaseDirectory = "/var/lib/clamav"
        Foreground disabled
        Debug disabled
        AllowSupplementaryGroups disabled
        UpdateLogFile disabled
        DatabaseOwner = "clamupdate"
        Checks = "12"
        DNSDatabaseInfo = "current.cvd.clamav.net"
        DatabaseMirror = "database.clamav.net"
        PrivateMirror disabled
        MaxAttempts = "3"
        ScriptedUpdates = "yes"
        TestDatabases = "yes"
        CompressLocalDatabase disabled
        ExtraDatabase disabled
        DatabaseCustomURL disabled
        HTTPProxyServer disabled
        HTTPProxyPort disabled
        HTTPProxyUsername disabled
        HTTPProxyPassword disabled
        HTTPUserAgent disabled
        NotifyClamd = "/etc/clamd.conf"
        OnUpdateExecute disabled
        OnErrorExecute disabled
        OnOutdatedExecute disabled
        LocalIPAddress disabled
        ConnectTimeout = "30"
        ReceiveTimeout = "30"
        SubmitDetectionStats disabled
        DetectionStatsCountry disabled
        DetectionStatsHostID disabled
        SafeBrowsing disabled
        Bytecode = "yes"clamav-milter.conf not foundSoftware settings
        -----------------
        Version: 0.99.2
        Optional features supported: MEMPOOL IPv6 AUTOIT_EA06 BZIP2 LIBXML2 PCRE ICONV JITDatabase information
        --------------------
        Database directory: /var/lib/clamav
        main.cvd: version 57, sigs: 4218790, built on Wed Mar 16 23:17:06 2016
        bytecode.cld: version 283, sigs: 53, built on Thu Jun 23 15:01:37 2016
        daily.cld: version 22464, sigs: 804704, built on Tue Nov  1 10:03:49 2016
        Total number of signatures: 5023547Platform information
        --------------------
        uname: Linux 3.10.0-327.10.1.el7.x86_64 #1 SMP Tue Feb 16 17:03:50 UTC 2016 x86_64
        OS: linux-gnu, ARCH: x86_64, CPU: x86_64
        zlib version: 1.2.7 (1.2.7), compile flags: a9
        Triple: x86_64-redhat-linux-gnu
        CPU: i686, Little-endian
        platform id: 0x0a2152520804080503040805

`Build information ----------------- GNU C: 4.8.5 20150623 (Red Hat 4.8.5-4)(4.8.5) GNU C++: 4.8.5 20150623 (Red Hat 4.8.5-4) (4.8.5) CPPFLAGS: CFLAGS: -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -Wall -W -Wmissing-prototypes -Wmissing-declarations -std=gnu99 -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE CXXFLAGS: -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu++98 LDFLAGS: -Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,--as-needed sizeof(void*) = 8 Engine flevel: 82, dconf: 82`

To scan the files in a directory, you can use `clamscan` utility. Clamscan is the command line scanner utility in antivirus. To scan your home directory run the following command.

clamscan --infected --remove --recursive /home /root

The above command will scan the directory `/home` and `/root`. `--infected` option will print the list of infected files, `--remove` options will remove the virus detected and `--recursive` option will enable clamscan to scan all the sub-directories and files. You will find the following output.

[root@ip-172-31-7-222 ~]# clamscan --infected --remove --recursive /home /root

`----------- SCAN SUMMARY ----------- Known viruses: 5018129 Engine version: 0.99.2 Scanned directories: 7 Scanned files: 12 Infected files: 0 Data scanned: 0.00 MB Data read: 0.00 MB (ratio 0.00:1) Time: 10.117 sec (0 m 10 s)`

To verify that ClamAV is working correctly, you can use the EICAR Standard Anti-Virus Test File. It is simply a signature of a virus but not an actual virus. Download the file using following command.

wget http://www.eicar.org/download/eicar_com.zip

Now scan the current directory using the following command.

clamscan --infected --remove --recursive .

You should get following output.

[root@ip-172-31-7-222 ~]# clamscan --infected --remove --recursive .
        ./eicar_com.zip: Eicar-Test-Signature FOUND
        ./eicar_com.zip: Removed.

`----------- SCAN SUMMARY ----------- Known viruses: 5018129 Engine version: 0.99.2 Scanned directories: 4 Scanned files: 8 Infected files: 1 Data scanned: 0.00 MB Data read: 0.00 MB (ratio 0.00:1) Time: 10.758 sec (0 m 10 s)`

To scan the whole system, you can run the following command.

clamscan --infected --recursive --exclude-dir="^/sys" /

The above command will scan the whole server but excluding the `/sys` directory. `/sys` directory contains few unreachable files, hence scanning them will print unnecessary warnings.

The above commands can be used to scan the system, although be careful with `--remove` option, you can simply run the command without this option and then check for the files containing virus. Once you are sure of the files are containing virus, you can remove them manually or simply run the command again with `--remove` option.

## Conclusion ##

以上病毒库签名文件总结如下：

<table> 
 <thead> 
  <tr> 
   <th>签名文件后缀名</th> 
   <th>签名类型</th> 
   <th>签名格式</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>*.hdb</td> 
   <td>基于md5 hash的签名</td> 
   <td>HashString:FileSize:MalwareName</td> 
  </tr> 
  <tr> 
   <td>*.hsb</td> 
   <td>基于sha1和sha256 hash的签名</td> 
   <td>HashString:FileSize:MalwareName</td> 
  </tr> 
  <tr> 
   <td>*.mdb</td> 
   <td>基于PE section hash的签名</td> 
   <td>PESectionSize:PESectionHash:MalwareName</td> 
  </tr> 
  <tr> 
   <td>*.db</td> 
   <td>Body-based的基本签名</td> 
   <td>MalwareName=HexSignature</td> 
  </tr> 
  <tr> 
   <td>*.ndb</td> 
   <td>Body-based的扩展签名</td> 
   <td>MalwareName:TargetType:Offset:HexSignature[:MinFL:[MaxFL]]</td> 
  </tr> 
  <tr> 
   <td>*.ldb</td> 
   <td>Body-based的逻辑签名</td> 
   <td>SignatureName;TargetDescriptionBlock;LogicalExpression;Subsig0; Subsig1;Subsig2;…</td> 
  </tr> 
  <tr> 
   <td>*.idb</td> 
   <td>PE文件的图标签名</td> 
   <td>ICONNAME:GROUP1:GROUP2:ICON_HASH</td> 
  </tr> 
  <tr> 
   <td>*.ndb</td> 
   <td>PE文件版本信息元数据签名</td> 
   <td>my_test_vi_sig:1:VI:paste_your_hex_sig_here</td> 
  </tr> 
  <tr> 
   <td><em>.crb,&nbsp;</em>.crtdb</td> 
   <td>信任和撤销的证书签名</td> 
   <td>Name;Trusted;Subject;Serial;Pubkey;Exponent;CodeSign;TimeSign;CertSign; NotBefore;Comment[;minFL[;maxFL]]</td> 
  </tr> 
  <tr> 
   <td>*.cdb</td> 
   <td>容器元数据签名</td> 
   <td>VirusName:ContainerType:ContainerSize:FileNameREGEX:FileSizeInContainer:FileSizeReal:IsEncrypted:FilePos:Res1:Res2[:MinFL[:MaxFL]]</td> 
  </tr> 
  <tr> 
   <td>.zmd(zip)和*.rmd(rar)</td> 
   <td>只基于ZIP/RAR元数据的签名</td> 
   <td>virname:encrypted:filename:normal size:csize:crc32:cmethod:fileno:max depth</td> 
  </tr> 
  <tr> 
   <td><em>.fp（md5）和</em>.sfp（sha1和sha256）</td> 
   <td>白名单数据库</td> 
   <td>HashString:FileSize:MalwareName</td> 
  </tr> 
  <tr> 
   <td>*.pdb</td> 
   <td>钓鱼url/host签名</td> 
   <td>R[Filter]:RealURL:DisplayedURL[:FuncLevelSpec]或H[Filter]:DisplayedHostname[:FuncLevelSpec]</td> 
  </tr> 
  <tr> 
   <td>*.gdb</td> 
   <td>钓鱼URL hash签名</td> 
   <td>S:P:HostPrefix[:FuncLevelSpec]或S:F:Sha256hash[:FuncLevelSpec]或S1:P:HostPrefix[:FuncLevelSpec]或S1:F:Sha256hash[:FuncLevelSpec]或S2:P:HostPrefix[:FuncLevelSpec]或S2:F:Sha256hash[:FuncLevelSpec]或S:W:Sha256hash[:FuncLevelSpec]</td> 
  </tr> 
  <tr> 
   <td>*.wdb</td> 
   <td>钓鱼URL白名单签名</td> 
   <td>X:RealURL:DisplayedURL[:FuncLevelSpec]或M:RealHostname:DisplayedHostname[:FuncLevelSpec]</td> 
  </tr> 
 </tbody> 
</table>

sigtool查看cvd的信息 ： sigtool -i main.cvd
    sigtool解压cvd的信息 ： sigtool -u main.cvd
    sigtool生成指纹的方法： sigtool –md5 test.exe > test.hdb  
    sigtool生成指纹的方法： sigtool –sha1 test.exe > test.hsb 
    sigtool生成指纹的方法： sigtool –sha256 test.exe >test.hsb
    sigtool生成指纹的方法： sigtool –mdb test.exe > test.mdb

## 遗留问题： ##

1.  但是sigtool关于如何重新打包，研究许久 尚未解决。

参考： [https://blog.csdn.net/zourzh123/article/details/45719757][https_blog.csdn.net_zourzh123_article_details_45719757]

[https_blog.csdn.net_zourzh123_article_details_45719757]: https://blog.csdn.net/zourzh123/article/details/45719757