Anti-Virus Considerations



Install And Enable Anti-Virus Software

Clamav installation

Preparation for ClamAV installation

Ensure that the EPEL repository has been installed

yum -y install epel-release

yum clean all

ClamAV installation

Run the command below to install ClamAV

yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd

Configuring ClamAV

Remove "Example" string from the configuration filesed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf

Edit scan.conf

Open scan.conf for editing

==========================

vi /etc/clamd.d/scan.conf

Look for and the change line from

=================================

#LocalSocket /var/run/clamd.scan/clamd.sock

to

LocalSocket /var/run/clamd.scan/clamd.sock

Configure FreshClam

Remove "Example" string from ClamAV’s freshclam update engine configuration filesed -i -e "s/^Example/#Example/" /etc/freshclam.conf

Run the virus definition database updatefreshclam

Start and enable Clamd services

Use the following commands to start and enable Clamd services

systemctl start clamd@scan

systemctl enable clamd@scanConfigure Daily Scans

Configure ClamAV for daily scans

Create and edit the file clamscan_daily in the folder /etc/cron.daily

Create clamscan_daily

=====================

vi /etc/cron.daily

=====================================

Add below to file changing the option

EMAIL_FROM="from email address";

EMAIL_TO="to email address";

DIRTOSCAN="list of directories";

as required

=====================================

#!/bin/bash

LOGFILE="/var/log/clamav/clamav-$(date +'%Y-%m-%d').log";

EMAIL_MSG="Please see the log file attached.";

EMAIL_FROM="from email address";

EMAIL_TO="to email address";

DIRTOSCAN="list of directories";

for S in ${DIRTOSCAN}; do

 DIRSIZE=$(du -sh "$S" 2>/dev/null | cut -f1);

 echo "Starting a daily scan of "$S" directory.

 Amount of data to be scanned is "$DIRSIZE".";

 clamscan -ri "$S" >> "$LOGFILE";

 # get the value of "Infected lines"

 MALWARE=$(tail "$LOGFILE"|grep Infected|cut -d" " -f3);

 # if the value is not equal to zero, send an email with the log file attached

 if [ "$MALWARE" -ne "0" ];then

 # using heirloom-mailx below

 echo "$EMAIL_MSG"|mail -a "$LOGFILE" -s "Malware Found" -r "$EMAIL_FROM" "$EMAIL_TO";

 fi

done

exit 0