スポンサードリンク

スポンサードリンク

キーワードに合ったホームページを自動的に作っちゃおうツール

キーワードに合ったホームページを自動的に作っちゃおうツール

最新版のダウンロードはこちら↓
EXCEL版
BlogHPEditTool.exe

※実行ファイル版を作成中の為、
 今後、修正やバージョンアップはありません。m(__)m

EXCEL版の最新版の説明はこちら

最新情報 (RSS)

ご意見・ご感想などはこちらにコメントくださいm(__)m

キーワードに合ったホームページを自動的に作っちゃおうツール

Vine Linux 4.2 Clam AntiVirusでウィルス対策

さて前回は、iptablesでファイアーウォールを設定しました

今回はClam AntiVirusでウィルス対策です


前回「Vine Linux 4.2 iptablesでファイアーウォール


ウィルス。。。

脅威ですよねぇ。。。(汗



って事で

Clam AntiVirus をインストールします

ソース?を更新

# apt-get update



インストールされてますか?

# rpm -q clamav
パッケージ clamav はインストールされていません。





インストール

# apt-get install clamav
パッケージリストを読込んでいます... 完了
依存情報ツリーを作成しています... 完了
以下の追加パッケージがインストールされます:
curl gmp libidn
以下のパッケージが新たにインストールされます:
clamav curl gmp libidn
アップグレード: 0 個, 新規インストール: 4 個, 削除: 0 個, 保留: 0 個
13.9MB のアーカイブを取得する必要があります。
展開後に 15.8MB のディスク容量が追加消費されます。
続行しますか? [Y/n]


y を入力し [Enter]

取得:1 http://updates.vinelinux.org 4.2/i386/main libidn 0.5.18-0vl2 [191kB]
取得:2 http://updates.vinelinux.org 4.2/i386/main curl 7.15.3-0vl1 [416kB]
取得:3 http://updates.vinelinux.org 4.2/i386/plus gmp 4.1.4-6vl1 [156kB]
取得:4 http://updates.vinelinux.org 4.2/i386/plus clamav 0.92.1-0vl0.40.1 [13.1MB]
13.9MB を 7s 秒で取得しました (1854kB/s)
変更を適用しています...
準備中... ########################################### [100%]
1:libidn ########################################### [ 25%]
2:curl ########################################### [ 50%]
3:gmp ########################################### [ 75%]
4:clamav ########################################### [100%]
完了


インストールされました




では、設定ファイルを編集しましょう





# vi /etc/clamd.conf




i を押して挿入モードに

##
## Example config file for the Clam AV daemon
## Please read the clamd.conf(5) manual before editing this file.
##


# Comment or remove the line below.

Example

# Uncomment this option to enable logging.
# LogFile must be writable for the user running daemon.
# A full path is required.
# Default: disabled
#LogFile /tmp/clamd.log


# By default the log file is locked for writing - the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run
# the daemon with --config-file option).
# This option disables log file locking.
# Default: no
#LogFileUnlock yes

# Maximum size of the log file.
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 1M
#LogFileMaxSize 2M

# Log time with each message.
# Default: no
#LogTime yes

# Also log clean files. Useful in debugging but drastically increases the
# log size.
# Default: no
#LogClean yes

# Use system logger (can work together with LogFile).
# Default: no
#LogSyslog yes

# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
# Default: LOG_LOCAL6
#LogFacility LOG_MAIL

# Enable verbose logging.
# Default: no
#LogVerbose yes

# This option allows you to save a process identifier of the listening
# daemon (main thread).
# Default: disabled
#PidFile /var/run/clamd.pid

# Optional path to the global temporary directory.
# Default: system specific (usually /tmp or /var/tmp).
#TemporaryDirectory /var/tmp

# Path to the database directory.
# Default: hardcoded (depends on installation options)
#DatabaseDirectory /var/lib/clamav

# The daemon works in a local OR a network mode. Due to security reasons we
# recommend the local mode.

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)

LocalSocket /tmp/clamd.socket

# Remove stale socket after unclean shutdown.
# Default: yes
#FixStaleSocket yes

# TCP port address.
# Default: no
#TCPSocket 3310

# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
# Default: no
#TCPAddr 127.0.0.1

# Maximum length the queue of pending connections may grow to.
# Default: 15
#MaxConnectionQueueLength 30

# Clamd uses FTP-like protocol to receive data from remote clients.
# If you are using clamav-milter to balance load between remote clamd daemons
# on firewall servers you may need to tune the options below.

# Close the connection when the data size limit is exceeded.
# The value should match your MTA's limit for a maximum attachment size.
# Default: 10M
#StreamMaxLength 20M

# Limit port range.
# Default: 1024
#StreamMinPort 30000
# Default: 2048
#StreamMaxPort 32000

# Maximum number of threads running at the same time.
# Default: 10
#MaxThreads 20

# Waiting for data from a client socket will timeout after this time (seconds).
# Value of 0 disables the timeout.
# Default: 120
#ReadTimeout 300

# Waiting for a new job will timeout after this time (seconds).
# Default: 30
#IdleTimeout 60

# Maximum depth directories are scanned at.
# Default: 15
#MaxDirectoryRecursion 20

# Follow directory symlinks.
# Default: no
#FollowDirectorySymlinks yes

# Follow regular file symlinks.
# Default: no
#FollowFileSymlinks yes

# Perform a database check.
# Default: 1800 (30 min)
#SelfCheck 600

# Execute a command when virus is found. In the command string %v will
# be replaced with the virus name.
# Default: no
#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"

# Run as another user (clamd must be started by root for this option to work)
# Default: don't drop privileges
#User clamav

# Initialize supplementary group access (clamd must be started by root).
# Default: no
#AllowSupplementaryGroups no

# Stop daemon when libclamav reports out of memory condition.
#ExitOnOOM yes

# Don't fork into background.
# Default: no
#Foreground yes

# Enable debug messages in libclamav.
# Default: no
#Debug yes

# Do not remove temporary files (for debug purposes).
# Default: no
#LeaveTemporaryFiles yes

# Detect Possibly Unwanted Applications.
# Default: no
#DetectPUA yes

# In some cases (eg. complex malware, exploits in graphic files, and others),
# ClamAV uses special algorithms to provide accurate detection. This option
# controls the algorithmic detection.
# Default: yes
#AlgorithmicDetection yes


##
## Executable files
##

# PE stands for Portable Executable - it's an executable file format used
# in all 32 and 64-bit versions of Windows operating systems. This option allows
# ClamAV to perform a deeper analysis of executable files and it's also
# required for decompression of popular executable packers such as UPX, FSG,
# and Petite.
# Default: yes
#ScanPE yes

# Executable and Linking Format is a standard format for UN*X executables.
# This option allows you to control the scanning of ELF files.
# Default: yes
#ScanELF yes

# With this option clamav will try to detect broken executables (both PE and
# ELF) and mark them as Broken.Executable.
# Default: no
#DetectBrokenExecutables yes


##
## Documents
##

# This option enables scanning of OLE2 files, such as Microsoft Office
# documents and .msi files.
# Default: yes
#ScanOLE2 yes

# This option enables scanning within PDF files.
# Default: no
#ScanPDF yes


##
## Mail files
##

# Enable internal e-mail scanner.
# Default: yes
#ScanMail yes

# If an email contains URLs ClamAV can download and scan them.
# WARNING: This option may open your system to a DoS attack.
# Never use it on loaded servers.
# Default: no
#MailFollowURLs no

# Recursion level limit for the mail scanner.
# Default: 64
#MailMaxRecursion 128

# With this option enabled ClamAV will try to detect phishing attempts by using
# signatures.
# Default: yes
#PhishingSignatures yes

# Scan URLs found in mails for phishing attempts using heuristics.
# Default: yes
#PhishingScanURLs yes

# Use phishing detection only for domains listed in the .pdb database. It is
# not recommended to have this option turned off, because scanning of all
# domains may lead to many false positives!
# Default: yes
#PhishingRestrictedScan yes

# Always block SSL mismatches in URLs, even if the URL isn't in the database.
# This can lead to false positives.
#
# Default: no
#PhishingAlwaysBlockSSLMismatch no

# Always block cloaked URLs, even if URL isn't in database.
# This can lead to false positives.
#
# Default: no
#PhishingAlwaysBlockCloak no


##
## HTML
##

# Perform HTML normalisation and decryption of MS Script Encoder code.
# Default: yes
#ScanHTML yes


##
## Archives
##

# ClamAV can scan within archives and compressed files.
# Default: yes
#ScanArchive yes

# The options below protect your system against Denial of Service attacks
# using archive bombs.

# Files in archives larger than this limit won't be scanned.
# Value of 0 disables the limit.
# Default: 10M
#ArchiveMaxFileSize 15M

# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
# file, all files within it will also be scanned. This options specifies how
# deeply the process should be continued.
# Value of 0 disables the limit.
# Default: 8
#ArchiveMaxRecursion 10

# Number of files to be scanned within an archive.
# Value of 0 disables the limit.
# Default: 1000
#ArchiveMaxFiles 1500

# If a file in an archive is compressed more than ArchiveMaxCompressionRatio
# times it will be marked as a virus (Oversized.ArchiveType, e.g. Oversized.Zip)
# Value of 0 disables the limit.
# Default: 250
#ArchiveMaxCompressionRatio 300

# Use slower but memory efficient decompression algorithm.
# only affects the bzip2 decompressor.
# Default: no
#ArchiveLimitMemoryUsage yes

# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
# Default: no
#ArchiveBlockEncrypted no

# Mark archives as viruses (e.g. RAR.ExceededFileSize, Zip.ExceededFilesLimit)
# if ArchiveMaxFiles, ArchiveMaxFileSize, or ArchiveMaxRecursion limit is
# reached.
# Default: no
#ArchiveBlockMax no


##
## Clamuko settings
## WARNING: This is experimental software. It is very likely it will hang
## up your system!!!
##

# Enable Clamuko. Dazuko (/dev/dazuko) must be configured and running.
# Default: no
#ClamukoScanOnAccess yes

# Set access mask for Clamuko.
# Default: no
#ClamukoScanOnOpen yes
#ClamukoScanOnClose yes
#ClamukoScanOnExec yes

# Set the include paths (all files inside them will be scanned). You can have
# multiple ClamukoIncludePath directives but each directory must be added
# in a seperate line.
# Default: disabled
#ClamukoIncludePath /home
#ClamukoIncludePath /students

# Set the exclude paths. All subdirectories are also excluded.
# Default: disabled
#ClamukoExcludePath /home/bofh

# Don't scan files larger than ClamukoMaxFileSize
# Value of 0 disables the limit.
# Default: 5M
#ClamukoMaxFileSize 10M



編集が終わったら

[ESC]

[:wq] で上書き保存して終了



すいません
変更ありません。。。m(__)m





もう一つ編集

# vi /etc/freshclam.conf




i を押して挿入モードに

##
## Example config file for freshclam
## Please read the freshclam.conf(5) manual before editing this file.
##


# Comment or remove the line below.

Example
↓変更
#Example

# Path to the database directory.
# WARNING: It must match clamd.conf's directive!
# Default: hardcoded (depends on installation options)
#DatabaseDirectory /var/lib/clamav

# Path to the log file (make sure it has proper permissions)
# Default: disabled
#UpdateLogFile /var/log/freshclam.log

# Maximum size of the log file.
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes).
# in bytes just don't use modifiers.
# Default: 1M
#LogFileMaxSize 2M

# Log time with each message.
# Default: no
#LogTime yes

# Enable verbose logging.
# Default: no
#LogVerbose yes

# Use system logger (can work together with UpdateLogFile).
# Default: no
#LogSyslog yes

# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
# Default: LOG_LOCAL6
#LogFacility LOG_MAIL

# This option allows you to save the process identifier of the daemon
# Default: disabled
#PidFile /var/run/freshclam.pid

# By default when started freshclam drops privileges and switches to the
# "clamav" user. This directive allows you to change the database owner.
# Default: clamav (may depend on installation options)
#DatabaseOwner clamav

# Initialize supplementary group access (freshclam must be started by root).
# Default: no
#AllowSupplementaryGroups yes

# Use DNS to verify virus database version. Freshclam uses DNS TXT records
# to verify database and software versions. With this directive you can change
# the database verification domain.
# WARNING: Do not touch it unless you're configuring freshclam to use your
# own database verification domain.
# Default: current.cvd.clamav.net
#DNSDatabaseInfo current.cvd.clamav.net

# Uncomment the following line and replace XY with your country
# code. See http://www.iana.org/cctld/cctld-whois.htm for the full list.
#DatabaseMirror db.XY.clamav.net


# database.clamav.net is a round-robin record which points to our most
# reliable mirrors. It's used as a fall back in case db.XY.clamav.net is
# not working. DO NOT TOUCH the following line unless you know what you
# are doing.

DatabaseMirror database.clamav.net
↓ウィルスデータベース入手元を日本に変更
DatabaseMirror db.jp.clamav.net

# How many attempts to make before giving up.
# Default: 3 (per mirror)
#MaxAttempts 5

# With this option you can control scripted updates. It's highly recommended
# to keep it enabled.
#ScriptedUpdates yes

# Number of database checks per day.
# Default: 12 (every two hours)
#Checks 24

# Proxy settings
# Default: disabled
#HTTPProxyServer myproxy.com
#HTTPProxyPort 1234
#HTTPProxyUsername myusername
#HTTPProxyPassword mypass

# If your servers are behind a firewall/proxy which applies User-Agent
# filtering you can use this option to force the use of a different
# User-Agent header.
# Default: clamav/version_number
#HTTPUserAgent SomeUserAgentIdString

# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for
# multi-homed systems.
# Default: Use OS'es default outgoing IP address.
#LocalIPAddress aaa.bbb.ccc.ddd

# Send the RELOAD command to clamd.
# Default: no
#NotifyClamd /path/to/clamd.conf

# Run command after successful database update.
# Default: disabled
#OnUpdateExecute command

# Run command when database update process fails.
# Default: disabled
#OnErrorExecute command

# Run command when freshclam reports outdated version.
# In the command string %v will be replaced by the new version number.
# Default: disabled
#OnOutdatedExecute command

# Don't fork into background.
# Default: no
#Foreground yes

# Enable debug messages in libclamav.
# Default: no
#Debug yes

# Timeout in seconds when connecting to database server.
# Default: 30
#ConnectTimeout 60

# Timeout in seconds when reading from database server.
# Default: 30
#ReceiveTimeout 60



編集が終わったら

[ESC]

[:wq] で上書き保存して終了





次にウィルス定義ファイルを更新します

# freshclam
ClamAV update process started at Set Apr 12 20:12:03 2008
Downloading daily.cvd [100%]
daily.cvd updated (version: 6716, sigs: 20923, f-level: 26, builder: ccordes)
Database updated (252757 signatures) from database.clamav.net (IP: 203.212.42.128)



これでウィルス定義が新しくなりました





ウィルススキャンのテストでも実行してみましょう

お試しは /root/ です

# clamscan --infected --remove --recursive /root/

----------- SCAN SUMMARY -----------
Known viruses: 252124
Engine version: 0.92.1
Scanned directories: 87
Scanned files: 88
Infected files: 0 ← 感染ファイル 0 件
Data scanned: 0.24 MB
Time: 4.665 sec (0 m 4 s)




テスト用の無害なウィルスをダウンロードしてテストしてみます

ダウンロード

# wget http://www.eicar.org/download/eicar.com.txt



スキャン

# clamscan --infected --remove --recursive /root/
/root/eicar.com.txt: Eicar-Test-Signature FOUND
/root/eicar.com.txt: Removed

----------- SCAN SUMMARY -----------
Known viruses: 252124
Engine version: 0.92.1
Scanned directories: 87
Scanned files: 89
Infected files: 1 ← 感染ファイル 1 件
Data scanned: 0.24 MB
Time: 4.223 sec (0 m 4 s)



きちんと動いているようです
削除もされてます

ん〜 OKですな(笑)








さて、運用ですが

スキャンしてウィルスが発見された場合
いきなり削除せず
別のディレクトリに移動する場合は
移動させるディレクトリを作成する

ウィルス発見と同時に削除する場合は
ディレクトリは必要ありません


ディレクトリ作成

# mkdir -p /var/clamav/virus


mkdir ← コマンド
-p ← オプション
/var/clamav/virus ← 作成するディレクトリ

-p オプション
 すでにディレクトリがある場合でもエラーとせず
 必要に応じて親ディレクトリも作成する


ディレクトリのオーナー変更

# chown -R clamav:clamav /var/clamav


chown ← コマンド
-R ← オプション
clamav:clamav ← ユーザとグループ
/var/clamav ← 操作するディレクトリ

-R オプション
 ファイルとディレクトリを再帰的に操作する


ん〜。。。
ちょっと意味不明。。。(汗






自動実行スクリプトの作成

# vi /root/clamav.sh




#!/bin/sh

# ログファイル

LOG='/var/log/clamav.log'


# ウィルス定義の更新
# 更新をログに出力

freshclam > $LOG

# ウィルススキャン
# スキャンの場所 [ / ]
# ウィルスが見つかれば移動し、ログに出力

clamscan -i --move=/var/clamav/virus -r / >> $LOG 2>&1

# ウィルスが見つかった時に削除する場合
#clamscan --remove -r / >> $LOG 2>&1


grep "FOUND" $LOG



ダウンロードURL
http://afexcel.up.seesaa.net/rpm/clamav.sh



実行権限を与えて

# chmod 700 /root/clamav.sh




cron で毎日実行させます


# crontab -e



vi エディタが開くので
i で挿入モード



00 03 * * * /root/clamav.sh


これで毎日 03:00 にスクリプトが実行されます


編集が終われば [ESC]

[:wq] で上書き保存して終了





で、

cron を再起動

# service cron restart
Stopping crond: [ OK ]
Starting crond: [ OK ]





これでウィルス対策OK!

この記事へのコメント
コメントを書く
お名前: [必須入力]

メールアドレス:

ホームページアドレス:

コメント: [必須入力]

認証コード: [必須入力]


※画像の中の文字を半角で入力してください。

この記事へのトラックバック

キーワードに合ったホームページを自動的に作っちゃおうツール

キーワードに合ったホームページを自動的に作っちゃおうツール

最新版のダウンロードはこちら↓
EXCEL版
BlogHPEditTool.exe

※実行ファイル版を作成中の為、
 今後、修正やバージョンアップはありません。m(__)m

EXCEL版の最新版の説明はこちら

最新情報 (RSS)

ご意見・ご感想などはこちらにコメントくださいm(__)m

キーワードに合ったホームページを自動的に作っちゃおうツール
×

この広告は1年以上新しい記事の投稿がないブログに表示されております。