Installazione Clamav in Debian: Difference between revisions

From RVM Wiki
Jump to navigation Jump to search
← Older edit
VisualWikitext
 
(22 intermediate revisions by the same user not shown)
Line 1: Line 1:
== Aggiunta fonte Apt ==
=Installazione=
==Debian Squeeze==
* Aggiungere la fonte, se non già presente:
* Aggiungere la fonte, se non già presente:
sudoedit /etc/apt/sources.list


<pre>
<pre>
if (grep -q volatile /etc/apt/sources.list)
...
then
deb http://ftp.it.debian.org/debian            squeeze-updates main contrib non-free
  echo "Volatile source is already present. Check it:"
deb http://security.debian.org/                squeeze/updates main contrib non-free
  cat /etc/apt/sources.list | grep volatile
...
else
</pre>
  sudo cat | sudo tee -a /etc/apt/sources.list > /dev/null  <<EOFile
 
deb http://volatile.debian.org/debian-volatile  lenny/volatile  main contrib non-free
 
* Installare
sudo apt-get update && \
sudo apt-get dist-upgrade && \
sudo apt-get install clamav-daemon libclamunrar6
 
 
==Debian >= Wheezy==
* Installare
sudo apt-get update && \
sudo apt-get dist-upgrade && \
sudo apt-get install clamav clamav-daemon libclamunrar\*
 
=Installazione firme aggiuntive=
 
* Sbloccare dal serve rle porte per poter scaricare gli aggiornamenti:
    rsync: TCP port 873
    wget/curl : TCP port 443
 
* Installare il pacchetto RVM, oppure installare dai sorgenti
sudo apt-get install clamav-unofficial-sigs
 
* Registrasi free su https://www.malwarepatrol.net/free-guard-upgrade-option/
 
* Andare nella pagina account e verificare i parametri dell'url di download delle firme per clamav, tipo:
https://lists.malwarepatrol.net/cgi/getfile?receipt=f478726125&product=32&list=clamav_basic
 
* Inserire il prametriin:
sudoedit /etc/clamav-unofficial-sigs/master.conf
 
malwarepatrol_receipt_code="f478726125"
malwarepatrol_product_code="32"
malwarepatrol_list="clamav_basic"
 
* Registrarsi su https://www.securiteinfo.com/clients/customers/signup
 
* Inserire il proprio indicativo contenuto negli url indicati nella tab SETUP del sito, esempio
http://www.securiteinfo.com/get/signatures/a583f5d7113477f99ac6f2f99011897a80399b63212d5cb234c85a84ac7dd3456bd5dfc33a01dab5c31f5bf7b20b2026b6e2c961727adf85777564f9c82abc03/securiteinfo.hdb
 
sudoedit /etc/clamav-unofficial-sigs/master.conf
 
securiteinfo_authorisation_signature="a583f5d7113477f99ac6f2f99011897a80399b63212d5cb234c85a84ac7dd3456bd5dfc33a01dab5c31f5bf7b20b2026b6e2c961727adf85777564f9c82abc03"
 
* '''Attenzione questo codice vale solo per 1 indirizzo IP'''
 
* '''VERIFICARE IL FUNZIONAMENTO DI WGET, ALTRIMENTI FALLIRÀ CERTAMENTE LO SCARICAMENTO DI SANESECURITY'''
 
* Scaricare le firme la prima volta come root, poi come clamav:
sudo [ -x /usr/sbin/clamav-unofficial-sigs ] && sudo  /bin/bash /usr/sbin/clamav-unofficial-sigs
 
sudo -u clamav [ -x /usr/sbin/clamav-unofficial-sigs ] && sudo -u clamav /bin/bash /usr/sbin/clamav-unofficial-sigs
 
* Impostare lo scaricamento delle signatures di Google Safebrowsing per i siti di Phishing e malware:
 
sudoedit /etc/clamav/freshclam.conf
 
SafeBrowsing Yes
 
* Se necessario, impostare un proxy per lo scaricamento degli aggiornamenti:
sudoedit /etc/clamav/freshclam.conf
 
HTTPProxyServer proxy.example.priv
HTTPProxyPort 3128
 
* Fermare il daemon di aggiornamento
sudo /etc/init.d/clamav-freshclam stop
 
* Aggiornare il database, e verificare che scarichi anche le firme di Google Safebrowsing:
sudo freshclam -v
 
* Riattivare il daemon di aggiornamento
sudo /etc/init.d/clamav-freshclam start
 
=Configurazione=
* Per il funzionamento con amavis, impostare:
sudoedit  /etc/clamav/clamd.conf
 
AllowSupplementaryGroups true
 
:Altrimenti la scansione di amavis fallisce con clamd, e si ottiene l'errore:
Mar 11 18:59:40 myserver amavis[18226]: (18226-03) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/lib/amavis/tmp/amavis-20160311T185044-18226-VIje1ebd/parts: lstat() failed: Permission denied. ERROR\n"
* Riavviare clamav-daemon:
sudo /etc/init.d/clamav-daemon stop; sudo /etc/init.d/clamav-daemon start
 
 
=Test Clamav=
 
* Installare i test files:
sudo apt-get install clamav-testfiles
 
clamscan /usr/share/clamav-testfiles/
 
<pre>
----------- SCAN SUMMARY -----------
Known viruses: 8484890
Engine version: 0.99.2
Scanned directories: 1
Scanned files: 46
Infected files: 46
Data scanned: 13.76 MB
Data read: 6.21 MB (ratio 2.22:1)
Time: 23.877 sec (0 m 23 s)
</pre>
 
* Verificare se utilizza le firme di Safebrowsing:
<pre>
cat > /tmp/test-safebrowsing <<EOFile
Return-Path: <username@example.com>
Delivered-To: <destination@example.com>
Received: from servername.example.com
by servername.example.com (Dovecot) with LMTP id xI3QK3XIrVjAYAAA25iMvQ
for <destination@example.com>; Wed, 22 Feb 2017 18:20:53 +0100
Date: Wed, 22 Feb 2017 18:20:58 +0100
To: destination@example.com
From: username@example.com
Subject: test Wed, 22 Feb 2017 18:20:58 +0100
X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
Message-Id: <20170222172053.A4DFADEAEA@servername.example.com>
 
http://malware.testing.google.test/testing/malware/
 
EOFile
EOFile
</pre>
clamscan -v /tmp/test-safebrowsing
<pre>
Scanning /tmp/test-safebrowsing
/tmp/test-safebrowsing: Heuristics.Safebrowsing.Suspected-phishing_safebrowsing.clamav.net FOUND
----------- SCAN SUMMARY -----------
Known viruses: 8484890
Engine version: 0.99.2
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 41.610 sec (0 m 41 s)


  echo "Volatile source added. Check it:"
  cat /etc/apt/sources.list | grep volatile
fi
</pre>
</pre>


* Rimuovere i testfiles:
  sudo apt-get remove --purge clamav-testfiles


== Installazione ==
= Installazione decompressori =
  sudo aptitude update && \
==Debian Squeeze==
sudo aptitude dist-upgrade && \
  sudo apt-get install unrar arj unzip unace
sudo aptitude install clamav-daemon


== Installazione decompressori ==
==Debian >= Wheezy==
  sudo apt-get install unrar-free arj unzip unace
  sudo apt-get install unrar arj unzip unace-nonfree
=Riferimenti=
*[https://sdeziel.info/postfix.html Postfix guide]
*[http://security.stackexchange.com/questions/37383/are-there-faux-fake-malicious-websites-to-test-web-reputation-services-similar-t malware - Are there faux/fake malicious websites to test web reputation services similar to EICAR? - Information Security Stack Exchange]
*[http://www.hidaba.com/installare-definizioni-virus-sanesecurity-su-clamav-in-debian-per-amavis/ Installare definizioni virus Sanesecurity su clamav in Debian per Amavis]
*[http://sanesecurity.com/support/signature-testing/ Signature Testing - Sanesecurity ClamAV: Phishing, Spam & Malware Signatures]
*[https://github.com/extremeshok/clamav-unofficial-sigs extremeshok/clamav-unofficial-sigs: ClamAV Unofficial Signatures Updater maintained by eXtremeSHOK.com]

Latest revision as of 14:34, 11 December 2019

Installazione

Debian Squeeze

  • Aggiungere la fonte, se non già presente:
sudoedit /etc/apt/sources.list

...
deb http://ftp.it.debian.org/debian             squeeze-updates main contrib non-free
deb http://security.debian.org/                 squeeze/updates main contrib non-free
...


  • Installare
sudo apt-get update && \
sudo apt-get dist-upgrade && \
sudo apt-get install clamav-daemon libclamunrar6


Debian >= Wheezy

  • Installare
sudo apt-get update && \
sudo apt-get dist-upgrade && \
sudo apt-get install clamav clamav-daemon libclamunrar\*

Installazione firme aggiuntive

  • Sbloccare dal serve rle porte per poter scaricare gli aggiornamenti:
   rsync: TCP port 873
   wget/curl : TCP port 443
  • Installare il pacchetto RVM, oppure installare dai sorgenti
sudo apt-get install clamav-unofficial-sigs
  • Andare nella pagina account e verificare i parametri dell'url di download delle firme per clamav, tipo:
https://lists.malwarepatrol.net/cgi/getfile?receipt=f478726125&product=32&list=clamav_basic
  • Inserire il prametriin:
sudoedit /etc/clamav-unofficial-sigs/master.conf 

malwarepatrol_receipt_code="f478726125"
malwarepatrol_product_code="32"
malwarepatrol_list="clamav_basic"
  • Inserire il proprio indicativo contenuto negli url indicati nella tab SETUP del sito, esempio
http://www.securiteinfo.com/get/signatures/a583f5d7113477f99ac6f2f99011897a80399b63212d5cb234c85a84ac7dd3456bd5dfc33a01dab5c31f5bf7b20b2026b6e2c961727adf85777564f9c82abc03/securiteinfo.hdb

sudoedit /etc/clamav-unofficial-sigs/master.conf 

securiteinfo_authorisation_signature="a583f5d7113477f99ac6f2f99011897a80399b63212d5cb234c85a84ac7dd3456bd5dfc33a01dab5c31f5bf7b20b2026b6e2c961727adf85777564f9c82abc03"
  • Attenzione questo codice vale solo per 1 indirizzo IP
  • VERIFICARE IL FUNZIONAMENTO DI WGET, ALTRIMENTI FALLIRÀ CERTAMENTE LO SCARICAMENTO DI SANESECURITY
  • Scaricare le firme la prima volta come root, poi come clamav:
sudo [ -x /usr/sbin/clamav-unofficial-sigs ] && sudo  /bin/bash /usr/sbin/clamav-unofficial-sigs

sudo -u clamav [ -x /usr/sbin/clamav-unofficial-sigs ] && sudo -u clamav /bin/bash /usr/sbin/clamav-unofficial-sigs
  • Impostare lo scaricamento delle signatures di Google Safebrowsing per i siti di Phishing e malware:
sudoedit /etc/clamav/freshclam.conf

SafeBrowsing Yes
  • Se necessario, impostare un proxy per lo scaricamento degli aggiornamenti:
sudoedit /etc/clamav/freshclam.conf 

HTTPProxyServer proxy.example.priv
HTTPProxyPort 3128
  • Fermare il daemon di aggiornamento
sudo /etc/init.d/clamav-freshclam stop
  • Aggiornare il database, e verificare che scarichi anche le firme di Google Safebrowsing:
sudo freshclam -v
  • Riattivare il daemon di aggiornamento
sudo /etc/init.d/clamav-freshclam start

Configurazione

  • Per il funzionamento con amavis, impostare:
sudoedit  /etc/clamav/clamd.conf

AllowSupplementaryGroups true
Altrimenti la scansione di amavis fallisce con clamd, e si ottiene l'errore:
Mar 11 18:59:40 myserver amavis[18226]: (18226-03) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/lib/amavis/tmp/amavis-20160311T185044-18226-VIje1ebd/parts: lstat() failed: Permission denied. ERROR\n"
  • Riavviare clamav-daemon:
sudo /etc/init.d/clamav-daemon stop; sudo /etc/init.d/clamav-daemon start


Test Clamav

  • Installare i test files:
sudo apt-get install clamav-testfiles

clamscan /usr/share/clamav-testfiles/

----------- SCAN SUMMARY -----------
Known viruses: 8484890
Engine version: 0.99.2
Scanned directories: 1
Scanned files: 46
Infected files: 46
Data scanned: 13.76 MB
Data read: 6.21 MB (ratio 2.22:1)
Time: 23.877 sec (0 m 23 s)
  • Verificare se utilizza le firme di Safebrowsing:
cat > /tmp/test-safebrowsing <<EOFile
Return-Path: <username@example.com>
Delivered-To: <destination@example.com>
Received: from servername.example.com
	by servername.example.com (Dovecot) with LMTP id xI3QK3XIrVjAYAAA25iMvQ
	for <destination@example.com>; Wed, 22 Feb 2017 18:20:53 +0100
Date: Wed, 22 Feb 2017 18:20:58 +0100
To: destination@example.com
From: username@example.com
Subject: test Wed, 22 Feb 2017 18:20:58 +0100
X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
Message-Id: <20170222172053.A4DFADEAEA@servername.example.com>

http://malware.testing.google.test/testing/malware/

EOFile

clamscan -v /tmp/test-safebrowsing

Scanning /tmp/test-safebrowsing
/tmp/test-safebrowsing: Heuristics.Safebrowsing.Suspected-phishing_safebrowsing.clamav.net FOUND

----------- SCAN SUMMARY -----------
Known viruses: 8484890
Engine version: 0.99.2
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 41.610 sec (0 m 41 s)
  • Rimuovere i testfiles:
 sudo apt-get remove --purge clamav-testfiles

Installazione decompressori

Debian Squeeze

sudo apt-get install unrar arj unzip unace

Debian >= Wheezy

sudo apt-get install unrar arj unzip unace-nonfree

Riferimenti

Retrieved from "https://kb.rvmgroup.it/index.php?title=Installazione_Clamav_in_Debian&oldid=10304"