ClamAV

2025-10-28T19:32:38Z

Idanka: /* Services */

<languages/>
__TOC__

<translate>
= About = 


[[File:Clam.png|left]] [https://www.clamav.net/ ClamAV] is an open-source antivirus engine for detecting trojans, viruses, malware & other malicious threats. One of its main uses is on mail servers as a server-side email virus scanner. The application was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, OSF (Tru64) and Solaris. As of version <code>0.97.5</code>, ClamAV builds and runs on Microsoft Windows. Both ClamAV and its updates are made available free of charge.

Sourcefire, now acquired by Cisco, a maker of intrusion detection products and the owner of Snort, announced on 17 August 2007 that it had acquired the trademarks and copyrights to ClamAV from five key developers.


ClamAV includes a number of utilities: a command-line scanner, automatic database updater and a scalable multi-threaded daemon, running on an anti-virus engine from a shared library.

The application also features a Milter interface for sendmail and on-demand scanning. It has support for Zip, RAR, Tar, Gzip, Bzip2, OLE2, Cabinet, CHM, BinHex, SIS formats, most mail file formats, ELF executables and Portable Executable (PE) files compressed with UPX, FSG, Petite, NsPack, wwpack32, MEW, Upack and obfuscated with SUE, Y0da Cryptor. It also supports many document formats, including Microsoft Office, HTML, Rich Text Format (RTF) and Portable Document Format (PDF).

The ClamAV virus database is updated several times each day and as of 30 October 2011 contained 1,063,024 virus signatures with the daily update Virus DB number at 13867.


ClamAV is currently tested daily in comparative tests against other antivirus products on Shadowserver. In 2011, Shadowserver tested over 25 million samples against ClamAV and numerous other antivirus products. Out of the 25 million samples tested, ClamAV scored 76.60% ranking 12 out of 19, a higher rating than some much more established competitors.

ClamAV was included in comparative tests against other antivirus products. In the 2008 AV-Test it rated: on-demand: very poor, false positives: poor, on-access: poor, response time: very good, rootkits: very poor.

In a Shadowserver six-month test between June and December 2011, ClamAV detected over 75.45% of all viruses tested, putting it in fifth place behind AhnLab, Avira, BitDefender and Avast. AhnLab, the top antivirus, detected 80.28% [http://en.wikipedia.org/wiki/Clam_AntiVirus]

= Install ClamAV = 


ClamAV is available in the <code>extra</code> repository[https://archlinux.org/packages/extra/x86_64/clamav/]. You can install it by command:


<syntaxhighlight lang="shell">
sudo pacman -S clamav
</syntaxhighlight>

= Set up ClamAV via CLI = 

== Edit Config ==


Edit the contents of the configuration files to suit your preferences:


* <code>/etc/clamav/clamd.conf</code>
* <code>/etc/clamav/freshclam.conf</code>

== Update Database ==


First update database:


<syntaxhighlight lang="shell">
sudo freshclam
</syntaxhighlight>


You may get a notification that <code>clamd</code> was not notified. This is normal because we haven't started the service yet.


Check database version:


<syntaxhighlight lang="shell">
freshclam --version
</syntaxhighlight>

== Services ==

=== clamav / freshclam ===

For automatic updates first create and set the required freshclam.log file:
<syntaxhighlight lang="shell">
touch /var/log/clamav/freshclam.log
chmod 600 /var/log/clamav/freshclam.log
chown clamav /var/log/clamav/freshclam.log
</syntaxhighlight>


Start and enable service:

<syntaxhighlight lang="shell">
sudo systemctl enable --now clamav-daemon
sudo systemctl enable --now clamav-freshclam
</syntaxhighlight>


Check status daemons:


<syntaxhighlight lang="shell">
sudo systemctl status clamav-daemon && sudo systemctl status clamav-freshclam
</syntaxhighlight>

=== cron ===
Make sure a cron daemon (for example 'cronie') is installed, enabled and running, as cronjobs are used in this guide.
See also: [https://wiki.archlinux.org/title/Cron Cron]

Example with 'cronie' (install, enable+start and check status):
<syntaxhighlight lang="shell">
sudo pacman -S cronie
sudo systemctl enable --now cronie.service
sudo systemctl status cronie.service
</syntaxhighlight>

Alternative: Use systemd Timers. See: [https://wiki.archlinux.org/title/Systemd/Timers systemd/Timers]

== Schedule scans through 'cron' == 

=== Edit 'crontab' ===

Run <code>crontab -e</code> to edit your <code>crontab</code> and add the following line, editing it to your needs:

<syntaxhighlight lang="cron">
53 8 * * 5 /usr/bin/clamdscan --fdpass --multiscan --move="$HOME/.clam/quarantine" --log="$HOME/.clam/logs/$(date +\%Y\%m\%d)-weekly.log" "$HOME" 2>/dev/null 1>&2
</syntaxhighlight>

This scans the entire <code>$HOME</code> directory every week on Saturday at 08:53. See <code>man 5 crontab</code> for more info on the formatting of this file and <code>man clamdscan</code> for an explanation of the options used.

=== Create directories 'logs' and 'quarantine' ===

If not already present, the directories for <code>'logs'</code> and <code>'quarantine'</code> are to be created in the <code>$HOME</code> directory:

<syntaxhighlight lang="shell">
mkdir -p "${HOME}/.clam/quarantine" && mkdir -p "${HOME}/.clam/logs"
</syntaxhighlight>

Otherwise, for example, creating the logfile may fail due to missing authorization.

=== Set ExcludePath for 'quarantine' folder ===

To exclude scanning the <code>'quarantine'</code> folder in the <code>$HOME</code> directory, add an <code>'ExcludePath'</code> to <code>'/etc/clamav/clamd.conf'</code> with your prefered editor, for example using 'vim':

<syntaxhighlight lang="shell">
sudo vim /etc/clamav/clamd.conf
</syntaxhighlight>

Search for <code>ExcludePath</code> and add:
<code>ExcludePath ^/home/.*/\.clam/quarantine</code>

Alternative: you can provide a separate config-file.
For more Information see <code>man clamdscan</code> and <code>man clamd.conf</code>.

== Schedule updates through 'cron' ==

A service should already be running for automatic updates, so that configuring updates via a cronjob are no longer necessary.
To check the service run:

<syntaxhighlight lang="shell">
systemctl status clamav-freshclam.service
</syntaxhighlight>

For config see <code>man freshclam.conf</code>.

If the service is not available / can not be started and enabled on your system:
Then run <code>sudo crontab -e -u clamav</code> to set up automatic updates. (These should be run as the <code>clamav</code> user.) Add the following line to update these at 13 past every hour:

<syntaxhighlight lang="cron">
13 * * * * /usr/bin/freshclam --quiet
</syntaxhighlight>

= Set up ClamAV via GUI (ClamTK) = 


[https://archlinux.org/packages/community/any/clamtk/ ClamTK] is a graphical user interface to setup scheduled scans and updates as well as one-off scans. It's available in the <code>community</code> repository[https://archlinux.org/packages/community/any/clamtk/], you can install it with <code>pacman</code>:


<syntaxhighlight lang="shell">
sudo pacman -S clamtk
</syntaxhighlight>

</translate>

[[Category:Contents Page{{#translation:}}]]
[[Category:Applications{{#translation:}}]]

Sync dynamic IP with openDNS service via ddclient

2022-11-02T10:09:59Z

Idanka: https://support.opendns.com/hc/en-us/articles/227986667-Does-OpenDNS-Support-IPv6-

<languages/>
__TOC__

[[File:Open-dns-logo.png|center]]
<translate>
== Requirements - Account on openDNS == 


Service ddclient for sync dynamic IP need account in OpenDNS. You need:
* Create an account on [https://store.opendns.com/get/home-free openDNS] and login to [https://dashboard.opendns.com/ OpenDNS Dashboard]. Create a new Network in the settings.
* Login on [https://www.dnsomatic.com/account/ DNS-O-Matic Site] using e-mail and password from OpenDNS.
* Add new Service. From list select OpenDNS. Click button '''Update account info''' for sync OpenDNS Dashboard settings with DNS-O-Matic.

== Setup openDNS in system settings == 


Set DNS addresses in resolv.conf file:
{{UserCmd|command=sudo nano /etc/resolv.conf.head}}


with code: 
<code>nameserver 208.67.222.222 
nameserver 208.67.220.220 </code>


{{note| If Your ISP provide IPv6 support, add these DNS IPv6 addresses entries in next lines in the ''/etc/resolv.conf.head'' file:

IPv6 DNS server addresses are: 
<code>nameserver 2620:119:35::35 
nameserver 2620:119:53::53</code>

Does not provide any level of filtering: 
<code>nameserver 2620:0:ccc::2 
nameserver 2620:0:ccd::2</code>
}}

== Setup openDNS in ddclient == 


'''#1''' Install ddclient and ddclient dispatcher for NetworkManager:
{{UserCmd|command=pamac build networkmanager-dispatcher-ddclient}}


'''#2''' Create backup a ''ddclient.conf'' file:
{{UserCmd|command=sudo cp /etc/ddclient/ddclient.conf /etc/ddclient/ddclient.conf.skel}}


'''#3''' Open ''ddclient.conf'' file in text editor.
{{UserCmd|command=sudo nano /etc/ddclient/ddclient.conf}}


'''#4''' Delete current content, paste in: 
{{note| '''REMEMBER''' - replace values '''email_address''', '''password''' with correct values.}}


----
<code>
daemon=1800 
syslog=yes 
pid=/var/run/ddclient.pid 
ssl=yes 
use=web, web=myip.dnsomatic.com 
server=updates.dnsomatic.com 
protocol=dyndns2 
login='''email_address''' 
password='''password''' 
all.dnsomatic.com 
</code>
----
 
Save changes in a file.


'''#5''' Run command to enable NetworkManager-dispatcher.service:
{{UserCmd|command=sudo systemctl enable NetworkManager-dispatcher.service}}


'''#6''' Logout and login.


'''#7''' Visit site: [https://dashboard.opendns.com/ openDNS Dashboard] to check sync status.

=See Also= 


* [http://opendns.com openDNS Homepage]
* [https://www.dnsomatic.com/ DNS-O-Matic]
* [https://support.opendns.com/hc/en-us/articles/227986667-Does-OpenDNS-Support-IPv6- Does OpenDNS Support IPv6?]
* [https://en.wikipedia.org/wiki/OpenDNS Wikipedia Article]
* The wiki page on [[Networking|networking]]
* [https://wiki.archlinux.org/index.php/resolv.conf Arch Wiki: resolv.conf]
</translate>
[[Category:Contents Page{{#translation:}}]]

Manjaro - User contributions [en]

ClamAV

Sync dynamic IP with openDNS service via ddclient