Cách cài đặt và cấu hình ClamAV để quét phần mềm độc hại trên máy chủ của bạn định kỳ

Bài viết này giả định rằng bạn sẽ sử dụng Ubuntu Server 20.04 hoặc 24.04.

Động lực

Scan for viruses and malware regularly and directly on the server while consuming low resources.

Các lựa chọn thay thế

LMD (maldet) on your server or the WordPress plugins Wordfence Và NinjaScanner are good options.

Install ClamAV

ClamAV is part of WordOps Stack and can be installed with (we need to also install two additional packages):

wo stack install --clamav
sudo apt install clamav-daemon clamdscan -y

Bạn cũng có thể cài đặt nó trên Ubuntu bằng APT:

sudo apt update
sudo apt install clamav clamav-daemon clamdscan -y

Add custom database signatures

To enhance malware and virus detection capabilities, you can optionally incorporate the database signatures offered by RFXN’s Linux Malware Detect (LMD), commonly referred to as maldet. Append the following configuration to the end of the /etc/clamav/freshclam.conf file:

DatabaseCustomURL https://www.rfxn.com/downloads/rfxn.ndb
DatabaseCustomURL https://www.rfxn.com/downloads/rfxn.hdb
DatabaseCustomURL https://www.rfxn.com/downloads/rfxn.yara

Perform a full scan of your files

Let’s now manually update the virus database before running it (it may be required to stop the clamav-freshclam service so that we can run it manually):

sudo systemctl stop clamav-freshclam.service
sudo freshclam

And run a complete scan on our sites directory:

sudo clamscan -r /var/www

Enable ClamAV as a service and schedule a cron job

There are two ways of running ClamAV, with the standalone command clamscan or with the alternative quét ngao, which access the service daemon and stores the virus database direct on memory, with a much better performance. Let’s start and enable the required daemons with the following:

sudo systemctl start clamav-freshclam.service
sudo systemctl enable clamav-freshclam.service
sudo systemctl start clamav-daemon.service
sudo systemctl enable clamav-daemon.service

The following command is designed to scan only new or modified files within the last 25 hours. You can install it in your sudo crontab. Additionally, you have the option to configure your email at the beginning to receive notifications following each scan.

MAILTO="al****@*****le.com"
0 2 * * * find /var/www -type f -mmin -1500 -print0 | xargs -0 clamdscan --fdpass --multiscan --infected

Tài nguyên: