Computer viruses are the bane of most system administrator’s existence and an unavoidable facet of modern online life. Most Linux systems however do not have an antivirus included in their repositories.
There are a few reasons why, including the relatively low-level of Linux viruses and the frequent updating of these packages which are generally more agile than the distribution releases. There is a solution I use that I would like to share.
On home systems, like Ubuntu, you can find a great free system called ClamAV through the package manager, however on more stable systems for servers (such as Centos 5) this option is not available.
This does not mean you should forgo the effort to add one – modern viruses are sophisticated vermin that can exploit a users systems and use them to access and propagate on a web server. Script exploits could bring your server to a crawl as they feed viruses to your customers. A good antivirus is a necessity in this modern age.
Thankfully there is an answer – Dag Wieërs maintains an RPM repository supporting several pieces of software, and ClamAV is one of them. There are three steps to making your system secure – first you need to install the ClamAV packages, second you need a custom script to update and scan the system, and thirdly you need to run the script with cron to automate the process. What follows is a step-by-step tutorial for setting this up on a CentOS 5.5 server, however it should work relatively the same for any RedHat Enterprise based distribution.
Part One : Installing ClamAV from Dag’s RPM Repository
The first step is to add the repository entry:
sudo nano /etc/yum.repos.d/rpmforge.repo
In this file add the following code and save the file, then exit the editor:
name = Dag Wieers RPM Repository (rpmforge)
mirrorlist = http://apt.sw.be/redhat/el5/en/mirrors-rpmforge
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY.rpmforge
Next, get the GPG key to ensure you are getting officially signed packages:
sudo wget http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt -P /etc/pki/rpm-gpg/ -O RPM-GPG-KEY.rpmforge
You should now be ready to install the initial package:
sudo yum --enablerepo=rpmforge install clamd -y
The previous command should also install the ‘
clamav‘ and ‘
clamav-db‘ dependency packages. If all went well, move on to the next step.
Part Two : Creating a Script to Automate ClamAV
First, lets create a new bash script:
sudo nano /usr/local/bin/clamav-cron
The script should look roughly like the one below, change the notification and alert emails as needed:
#!/bin/bash #============================================ # Update clam av and initiate a full system # scan excluding virtual directories # written by Brian Cantin, 2009-2010 #============================================ # User configuration section #-------------------------------------------- # Notification e-mail sender (could be fake): CAV_MAILFROM="email@example.com" # Notification & Alert e-mail recipients: CAV_NOTIFY_TO="firstname.lastname@example.org" CAV_ALERT_TO="email@example.com" # Log file name and its path: CAV_LOGFILE="/var/log/clamav-cron" # Scan target CAV_TARGET='/' # Directories to exclude from the scan CAV_EXCLUDE='/proc|/dev|/sys|/mnt' #=========================================== # script revision CAV_VERSION='0.4' # if the log file already exists - delete it if [ -e $CAV_LOGFILE ] then /bin/rm $CAV_LOGFILE fi # printed on the command line: echo -e `basename $0` "v"$CAV_VERSION # to be written to the log file: echo -e $HOSTNAME - $(date) >> $CAV_LOGFILE echo -e ------------------------ >> $CAV_LOGFILE echo -e Script : `basename $0` v$CAV_VERSION >> $CAV_LOGFILE echo -e Target : $CAV_TARGET on $HOSTNAME >> $CAV_LOGFILE echo -e Exclude: $CAV_EXCLUDE >> $CAV_LOGFILE echo -e ------------------------ >> $CAV_LOGFILE # update the detection database echo -e "Update (/usr/bin/freshclam):" >> $CAV_LOGFILE /usr/bin/freshclam >> $CAV_LOGFILE echo -e ------------------------ >> $CAV_LOGFILE # run the scan echo -e "Scan (/usr/bin/clamscan):" >> $CAV_LOGFILE /usr/bin/clamscan --infected --recursive $CAV_TARGET --exclude $CAV_EXCLUDE >> $CAV_LOGFILE CLAMSCAN=$? # if an error or virus is encountered then send an email to alert address # otherwise send one to the notify if [ "$CLAMSCAN" -eq "1" ] then CAV_SUBJECT="[VIRUS] ClamAV ("$HOSTNAME") $(date)" /bin/mail -s "$CAV_SUBJECT" $CAV_ALERT_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE elif [ "$CLAMSCAN" -gt "1" ] then CAV_SUBJECT="[ERROR] ClamAV ("$HOSTNAME") $(date)" /bin/mail -s "$CAV_SUBJECT" $CAV_ALERT_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE else CAV_SUBJECT="ClamAV ("$HOSTNAME") $(date)" /bin/mail -s "$CAV_SUBJECT" $CAV_NOTIFY_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE fi
I think this shell script is fairly self explanatory and to the point – it will update the ClamAV software and database, run a full system scan (excluding virtual directories) and email the results to the notification address. To accentuate problems it adds [VIRUS] or [ERROR] to the email subject and sends the email instead to the alert address. You can configure these addresses to be the same, depending on your preferences. Please note you must have
/bin/mail configured correctly for the email functionality to work but that is outside the scope of this article.
After creating and saving this new script, make it executable:
sudo chmod +x /usr/local/bin/clamav-cron
You should complete a test-run of your script at this point:
If all goes well it should complete within a few minutes to a few hours (depending on the size of your file system) and send you an email of the results. If there where any errors, go back and correct them before moving on to part three.
Part Three : Automation
Once everything is working to your satisfaction you can edit the crontab file for a daily activation of the script:
sudo nano /etc/crontab
I added the following line to make the script run daily at 2:30am as root:
30 2 * * * root /usr/local/bin/clamav-cron
Congratulations! Your server is now configured to automatically update your antivirus, scan for threats and notify you in a timely manner, every day.