# CentOS Server - Installation

# Server Install Checklist



# Server Checklist

## Server Checklist

<table border="1" id="bkmrk-step-%E2%88%9A-to-do-%C2%A0-%C2%A0-pre" style="border-collapse: collapse; width: 100%; height: 1164px;"><tbody><tr style="height: 28px;"><td style="width: 10%; height: 28px;">Step</td><td style="width: 10%; height: 28px;">√</td><td style="width: 80%; height: 28px;">To Do</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Preparation

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">1</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Install the server image](https://docs.azandi.co.za/books/centos-server-installation/page/server-image-installation)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">2</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Add additional repositories](https://docs.azandi.co.za/books/centos-server-installation/page/add-additional-repositories)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### System Update

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">3</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Update with the latest updates](https://docs.azandi.co.za/books/centos-server-installation/page/update-with-the-latest-update)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">4</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Configure automatic updates](https://docs.azandi.co.za/books/centos-server-installation/page/configure-automatic-updates)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">5</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Configure network time protocol (NTP)](https://docs.azandi.co.za/books/centos-server-installation/page/configure-network-time-protocol-%28ntp%29)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Process Hardening

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">6</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Restrict core dumps](https://docs.azandi.co.za/books/centos-server-installation/page/restrict-core-dumps)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">7</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Enable randomized virtual memory region placement](https://docs.azandi.co.za/books/centos-server-installation/page/enable-randomized-virtual-memory-region-placement)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### OS Hardening

</td></tr><tr style="height: 56px;"><td style="width: 10%; height: 56px;">8</td><td style="width: 10%; height: 56px;"> </td><td style="width: 80%; height: 56px;">[Remove legacy services (e.g., telnetserver; rsh, rlogin, rcp; ypserv, ypbind; tftp, tftp-server; talk, talkserver)](https://docs.azandi.co.za/books/centos-server-installation/page/remove-legacy-services)</td></tr><tr style="height: 56px;"><td style="width: 10%; height: 56px;">9</td><td style="width: 10%; height: 56px;"> </td><td style="width: 80%; height: 56px;">[Disable or remove server services that are not going to be utilized (e.g. FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc.)](https://docs.azandi.co.za/books/centos-server-installation/page/disable-or-remove-server-services)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Network Security and Firewall Configuration

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">10</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Firewall Configuration](https://docs.azandi.co.za/books/centos-server-installation/page/firewall-configuration)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Remote Administration Via SSH

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">11</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Set SSH protocol to 2](https://docs.azandi.co.za/books/centos-server-installation/page/set-ssh-protocol-to-2)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">12</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Disable SSH root login](https://docs.azandi.co.za/books/centos-server-installation/page/disable-ssh-root-login)</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">13</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Set SSH permitemptypasswords to no](https://docs.azandi.co.za/books/centos-server-installation/page/set-ssh-permitemptypasswords-to-no)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### System Integrity and Intrusion Detection

</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">14</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Install and configure Fail2Ban](https://docs.azandi.co.za/books/centos-server-installation/page/install-and-configure-fail2ban)</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">15</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Install and configure AIDE](https://docs.azandi.co.za/books/centos-server-installation/page/install-and-configure-aide)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Anti-Virus Considerations

</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">16</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Install and enable anti-virus software](https://docs.azandi.co.za/books/centos-server-installation/page/install-and-enable-anti-virus-software)</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">17</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Configure daily scan](https://docs.azandi.co.za/books/centos-server-installation/page/configure-daily-scans)</td></tr></tbody></table>

# Preparation



# Server Image Installation

## Server Image Installation

1. Browse to [**konsoleH**](http://myaccount.hetzner.co.za/) and **log in** at[ Admin level](https://hetzner.co.za/help-centre/accounts-and-payments/konsoleh-access-levels/)
2. Select or search for your Self-Managed server in the **Hosting Service** tab
3. Select **Linux Install** under **Recovery Tools** from the left-hand menu  
    [![01.png](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/tXAzvF7hyysFmwgM-01.png)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/tXAzvF7hyysFmwgM-01.png)
4. Select the distribution of the **installation** that you wish to activate  
    [![02.png](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/YuubYLzVdKwgSl5n-02.png)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/YuubYLzVdKwgSl5n-02.png)
5. Select **Activate** on the top right-hand side
6. **Reboot** your server within 10 minutes via the RMM / IPMI device
7. During the server startup process, you have the option to reconfigure your RAID (TruServ Commerce only) via the RAID controller bios.
8. The server will boot into the OS installation environment you selected in step 4
9. Follow the onscreen prompts to install your OS and configure your disks and partition layout
10. Once the install is complete your server will reboot into your installed OS and will be accessible
11. Access your server with the user(s) configured via SSH (some Linux distributions do not allow root logins by default over SSH).

# Add Additional Repositories

## Install additional repositories

### Additional Repositories

1. Using the commands below, install the Epel and PHP repositories:

```
yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum install http://rpms.remirepo.net/enterprise/remi-release-7.rpm
```

### MySQL Repository

##### Replace MariaDB with MySQL

1. Navigate to [https://dev.mysql.com/downloads/repo/yum/](https://dev.mysql.com/downloads/repo/yum/)
2. Select the correct package corresponding to the version running on the server and click download.
3. Scroll down to 'No thanks, just start my download' and right click on the link.
4. Click 'Copy link address.'
5. Run the command below to install the MySQL repository.

```
yum localinstall 'link address copied from MySQL website'
```

##### Enable the correct release series

1. Manually edit the '/etc/yum.repos.d/mysql-community.repo' file with your favorite text editor.
2. Specify enabled=0 to disable a subrepository, or enabled=1 to enable a subrepository, see example below to enable MySQL 5.6 and disable MySQL 5.7 series.

```
# Enable to use MySQL 5.6 & Disabled MySQL 5.7
[mysql56-community]
name=MySQL 5.6 Community Serverbaseurl=http://repo.mysql.com/yum/mysql-5.6-
community/el/6/$basearch/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-mysql
[mysql57-community]
name=MySQL 5.7 Community Serverbaseurl=http://repo.mysql.com/yum/mysql-5.7-
community/el/6/$basearch/
enabled=0
gpgcheck=1gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-mysql
```

<p class="callout info">Note: When sub repositories for more than one release series are enabled, the latest series will be used by Yum.</p>

# System Update



# Update With The Latest Update

## Updating packages

1. Run the command below and press 'y' at the prompt. After the update has finished, restart the server.

```
yum update
```

# Configure Automatic Updates

## Setting Up Automatic Updates

### Install yum-cron

1. Install yum-cron, the package that allows us to do automatic updates

```
yum -y install yum-cron
```

### Configure yum-cron for auto-update

1. Edit the file /etc/yum/yum-cron.conf and change the options below

```
apply_updates = no

to

apply_updates = no
```

```
emit_via = stdio

to

emit_via = email
```

```
email_to = 

to

email_to = sys admin email address
```

### Verify that the service is running

1. Very that the service is running with the command

```
systemctl status yum-cron.service
```

The output should look similar to

```
# /bin/systemctl status  yum-cron.service
yum-cron.service - Run automatic yum updates as a cron job
   Loaded: loaded (/usr/lib/systemd/system/yum-cron.service; enabled)
   Active: active (exited) since sab 2014-08-09 00:37:16 CEST; 16h ago
  Process: 830 ExecStart=/bin/touch /var/lock/subsys/yum-cron (code=exited, status=0/SUCCESS)
 Main PID: 830 (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/yum-cron.service
```

If the service is stopped, start it with the following command

```
systemctl start yum-cron.service
```

# Configure Network Time Protocol (NTP)

### Install NTP Daemon

1. Install NTPd with the following command

```
yum -y install ntp
```

### Configure Firewall

1. Add NTP service to the 'allow' rules and reload the firewall to apply changes

```
firewall-cmd --add-service=ntp --permanent

firewall-cmd --reload
```

### Edit ntp.conf File

1. Change/add the /etc/ntp.conf by removing current time servers and adding new time servers

```
Change from

# hetzner ntp servers
server ntp1.hetzner.de iburst
server ntp2.hetzner.com iburst
server ntp3.hetzner.net iburst

to

# hetzner ntp servers
# server ntp1.hetzner.de iburst
# server ntp2.hetzner.com iburst
# server ntp3.hetzner.net iburst

Add the following time servers
==============================

server 0.pool.ntp.org
server 1.za.pool.ntp.org
server 2.africa.pool.ntp.org
```

### Start And Check NTP service

1. Start NTP service and check to see if it is active

```
Start and enable NTPd
=====================

systemctl start ntpd
systemctl enable ntpd

Check to see if service is enabled
==================================

ntpq -p
```

# Process Hardening



# Restrict Core Dumps

### Ensure core dumps are restricted

1. Edit the /etc/security/limits.conf and /etc/sysctl.conf files, adding the lines below

```
/etc/security/limits.conf
=========================

* hard core 0

/etc/sysctl.conf
================

fs.suid_dumpable = 0
```

### Active kernel parameter

1. Active the kernel parameter by running the following command

```
sysctl -w fs.suid_dumpable=0
```

# Enable Randomized Virtual Memory Region Placement

### Randomized virtual memory region placement

1. Add the line below to the /etc/sysctl.conf file

```
kernel.randomize_va_space = 2 
```

# OS Hardening



# Remove Legacy Services

### The removal of legacy services

#### Check for legacy services

1. To check for legacy services, use the command the below

```
chkconfig --list
```

You should get an output similar to

[![03.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/r6RJro8aFj6SXYaW-03.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/r6RJro8aFj6SXYaW-03.PNG)

#### Disable legacy services

1. Confirm the necessity of the service and disable if not necessary with the below command

```
chkconfig "service name" off

I.e to disable netconsole
=========================

chkconfig netconsole off
```

# Disable Or Remove Server Services

### Disable or remove server services that are not going to be utilized (e.g. FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc.)

#### Display a list of services available

1. To display a list of services available use the command the below

```
systemctl -t service
```

This will display something similar to

[![04.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/aBmv3MhEvlgAvkAf-04.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/aBmv3MhEvlgAvkAf-04.PNG)

#### Disable unnecessary services

1. Stop and turn OFF auto-start services not needed

```
systemctl stop "service name"
systemctl disable "service name"

I.e. to stop and disable the Postfix service
============================================

systemctl stop postfix
systemctl disable postfix
```

# Firewall Configuration



# Firewall Configuration

## Configuring The Firewall

### Start and enable the firewall

1. To start and enable the firewall use the commands below

```
systemctl start firewalld
systemctl enable firewalld
```

### Get an overview

#### Default Zone

1. Find the default zone. The default zone is usually public

```
firewall-cmd --get-default-zone
```

[![05.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/qq582R1Ib8dhdeyF-05.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/qq582R1Ib8dhdeyF-05.PNG)

#### Display Allowed Services

1. Display the allowed services of the zone

```
firewall-cmd --list-service --zone=external
```

By default, "public" zone is applied with a NIC and dhcpv6-client and ssh are allowed.

[![06.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/X2Fl3jKuNdqLgnr5-06.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/X2Fl3jKuNdqLgnr5-06.PNG)

#### Display Services Defined By Default

1. To list all service defined by default use the command below

```
firewall-cmd --get-services
```

It should give you an output similar to

[![07.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/g72icgvW2yZaBApS-07.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/g72icgvW2yZaBApS-07.PNG)

#### Add/Remove services

1. Add or Remove allowed services. The change will be back after rebooting the system. If you change settings permanently, add the "--permanent" option.

[![08.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/7xfmKjboe5rhnrDI-08.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/7xfmKjboe5rhnrDI-08.PNG)

#### Add/Remove Ports

1. Add or remove allowed ports

[![09.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/6FYRgLTU7MwvI6fE-09.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/6FYRgLTU7MwvI6fE-09.PNG)

#### Add/Remove Prohibited ICMP Types

1. Add or remove prohibited ICMP types

[![010.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/o1qWvKWvzUi71dEC-010.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/o1qWvKWvzUi71dEC-010.PNG)

# Remote Administration Via SSH



# Set SSH protocol to 2

### Set SSH protocol to 2

SSH has two protocols it may use, protocol 1 and protocol 2. The older protocol 1 is less secure and should be disabled unless you know that you specifically require it.

1. Open the sshd config  
    `vi /etc/ssh/sshd_config`
2. Add or amend as shown below  
    `# Protocol 2,1<br></br>Protocol 2`
3. Restart the sshd service  
    `systemctl restart sshd.service`

# Disable SSH root login

### Disabling root login via SSH

Disabling SSH root login will add an extra layer of security. It would be more secure to brute force  
attacks or in case your password is stolen.

1. Create a non-root user  
      
    `adduser username`  
    `passwd username`
2. Open the ssh configuration file with your editor.  
      
    `vi /etc/ssh/sshd_config`
3. Add the line “PermitRootLogin no.” Or uncomment the line "#PermitRootLogin yes" and  
    change yes to no.  
      
    `#LoginGraceTime 2m`  
    `#PermitRootLogin yes`  
    `#StrictModes yes`  
    `#MaxAuthTries 6`  
    `#MaxSessions 10`  
    `PermitRootLogin no`
4. Save and exit the file.
5. Restart the ssh service  
      
    `systemctl restart sshd.service`

# Set SSH permitemptypasswords to no

### Set SSH permitemptypasswords to no

1. Open the ssh configuration file with your editor.  
      
    `<span role="presentation" style="padding-right: 0.1px;">vi /etc/ssh/sshd_config</span>`
2. Add or amend as shown below  
      
    `PermitEmptyPasswords no`
3. Restart the sshd service  
      
    `systemctl restart sshd.service`

# System Integrity and Intrusion Detection



# Install And Configure Fail2Ban

### Installation

1. Run the command below to install Fail2Ban

```
yum install fail2ban fail2ban-systemd
```

#### Configuration

1. Copy the “jail.conf” file and re-save it with the name “jail.local”  
      
    `cp -pf /etc/fail2ban/jail.conf /etc/fail2ban/jail.local`
2. Edit the jail.local and add your local IP address onto the ***ignoreip*** line

```
[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1

# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 5
```

### Add a jail file to protect SSH access

1. Create a new file called sshd.local  
      
    `touch /etc/fail2ban/jail.d/sshd.local && chmod +x /etc/fail2ban/jail.d/sshd.local`
2. Edit the file and add the lines below

```
vi /etc/fail2ban/jail.d/sshd.local

Add these lines to the file
===========================

[sshd]
enabled = true
port = ssh
#action = firewallcmd-ipset
logpath = %(sshd_log)s
maxretry = 5
bantime = 86400
```

### Enable and start the FAIL2BAN service

1. Run the following commands to enable and start the Fail2Ban service

```
systemctl enable fail2ban
systemctl start fail2ban
```

# Install and configure AIDE

### Install and configure Host Based IDS (Intrusion Detection System) "AIDE"

1. Install AIDE  
      
    `yum -y install aide`
2. Configure AIDE and initialize database. It's possible to use AIDE with default config but if you'd like to customize settings, change configuration file like follows. Setting rules are written near 26-84 lines, refer to them.  
      
    [![011.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/5pu8grfAPwGzoNoc-011.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/5pu8grfAPwGzoNoc-011.PNG)
3. Execute checking

```
[root@dlp ~]# aide --check
# if thete is no unmatch, it displayed "Okay"

AIDE, version 0.15.1

### All files match AIDE database. Looks okay!

# try to change a file and check again
[root@dlp ~]# chmod 640 /root/anaconda-ks.cfg
[root@dlp ~]# aide --check
# detected differences like follows
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2015-06-17 19:55:20

Summary:
  Total number of files:        39039
  Added files:                  0
  Removed files:                0
  Changed files:                1


---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /root/anaconda-ks.cfg

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------


File: /root/anaconda-ks.cfg
 Perm     : -rw-------                       , -rw-r-----
 Ctime    : 2015-05-24 02:22:04              , 2015-06-19 11:55:15
 ACL      : old = A:
----
user::rw-
group::---
other::---
----
                  D: <NONE>
            new = A:
----
user::rw-
group::r--
other::---
----
                  D: <NONE>
```

#### Update AIDE database

1. If there is no ploblem even if some differences are detected, then update database like follows

```
[root@dlp ~]# aide --update
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2015-06-17 19:56:31

Summary:
  Total number of files:        39039
  Added files:                  0
  Removed files:                0
  Changed files:                1


---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /root/anaconda-ks.cfg
.....
.....

# update database
[root@dlp ~]# cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
```

#### Add Cron job and email logs

1. Add in Cron if check regulary. Log file \[/var/log/aide/aide.log\] is updated every time and if there is no difference, it is updated with zero byte, so if you's like to save log files, it needs to create a shell script or send results via email or others

```
# for example, add daily check in Crontab and send results via email

[root@dlp ~]# vi /etc/cron.d/aide
00 01 * * * /usr/sbin/aide --update | mail -s 'Daily Check by AIDE' root
```

# Anti-Virus Considerations



# Install And Enable Anti-Virus Software

## Clamav installation

### Preparation for ClamAV installation

1. Ensure that the EPEL repository has been installed

```
yum -y install epel-release

yum clean all
```

### ClamAV installation

1. Run the command below to install ClamAV

```
yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd
```

### Configuring ClamAV

1. Remove "Example" string from the configuration file  
      
    `sed -i -e "s/^Example/#Example/" /etc/clamd.d/scan.conf`
2. Edit scan.conf

```
Open scan.conf for editing
==========================

vi /etc/clamd.d/scan.conf

Look for and the change line from
=================================

#LocalSocket /var/run/clamd.scan/clamd.sock

to

LocalSocket /var/run/clamd.scan/clamd.sock
```

### Configure FreshClam

1. Remove "Example" string from ClamAV’s freshclam update engine configuration file  
      
    `sed -i -e "s/^Example/#Example/" /etc/freshclam.conf`
2. Run the virus definition database update  
      
    `freshclam`

### Start and enable Clamd services

1. Use the following commands to start and enable Clamd services

```
systemctl start clamd@scan

systemctl enable clamd@scan
```

# Configure Daily Scans

### Configure ClamAV for daily scans

1. Create and edit the file clamscan\_daily in the folder /etc/cron.daily

```
Create clamscan_daily
=====================

vi /etc/cron.daily

=====================================
Add below to file changing the option

EMAIL_FROM="from email address";
EMAIL_TO="to email address";
DIRTOSCAN="list of directories";

as required
=====================================

#!/bin/bash
LOGFILE="/var/log/clamav/clamav-$(date +'%Y-%m-%d').log";
EMAIL_MSG="Please see the log file attached.";
EMAIL_FROM="from email address";
EMAIL_TO="to email address";
DIRTOSCAN="list of directories";

for S in ${DIRTOSCAN}; do
 DIRSIZE=$(du -sh "$S" 2>/dev/null | cut -f1);

 echo "Starting a daily scan of "$S" directory.
 Amount of data to be scanned is "$DIRSIZE".";

 clamscan -ri "$S" >> "$LOGFILE";

 # get the value of "Infected lines"
 MALWARE=$(tail "$LOGFILE"|grep Infected|cut -d" " -f3);

 # if the value is not equal to zero, send an email with the log file attached
 if [ "$MALWARE" -ne "0" ];then
 # using heirloom-mailx below
 echo "$EMAIL_MSG"|mail -a "$LOGFILE" -s "Malware Found" -r "$EMAIL_FROM" "$EMAIL_TO";
 fi
done

exit 0

```