UNIX下的殺毒軟件有好多是商業(yè)版本的。但和Windows系統下一樣，殺毒軟件的質(zhì)量決定于病毒庫的量已及更新的速度。在這里，我們使用自由軟件 Clam AntiVirus 來(lái)建立Linux下的病毒查殺系統。并且為了消除后來(lái)的隱患，建議務(wù)必在服務(wù)器公開(kāi)以前構建病毒查殺系統。
由于Clam Antivirus不存在于CentOS中yum的官方庫中，所以用yum安裝Clam Antivirus需要定義非官方的庫。請先確認相應非官方庫文件的存在。
[root@sample ~]# ls -l /etc/yum.repos.d/dag.repo ← 確認相應庫文件的存在性
-rw-r--r-- 1 root root 143 Oct 1 21:33 /etc/yum.repos.d/dag.repo ← 確認其存在（否則不能通過(guò)yum安裝Clamd） |
如果以上，dag.repo文件不存在，則不能通過(guò)yum安裝Clam Antivirus，需要定義非官方庫。定義非官方庫的方法請見(jiàn) “
CentOS的下載、安裝及初始環(huán)境設置”一節中yum的相關(guān)設置。而且，在此前提下也要
保證所定義的dag.repo文件的語(yǔ)法的正確性。 然后，通過(guò)yum來(lái)在線(xiàn)安裝 Clam Antivirus 。
[root@sample ~]# yum -y install clamd ← 在線(xiàn)安裝 Clam AntiVirus
Setting up Install Process
Setting up repositories
dag 100% |=========================| 1.1 kB 00:00
update 100% |=========================| 951 B 00:00
base 100% |=========================| 1.1 kB 00:00
addons 100% |=========================| 951 B 00:00
extras 100% |=========================| 1.1 kB 00:00
Reading repository metadata in from local files
primary.xml.gz 100% |=========================| 1.6 MB 00:08
dag : ################################################## 4610/4610
Added 4610 new packages, deleted 0 old in 94.91 seconds
primary.xml.gz 100% |=========================| 103 kB 00:05
update : ################################################## 256/256
Added 56 new packages, deleted 0 old in 4.25 seconds
Reducing Dag RPM Repository for Red Hat Enterprise Linux to included packages only
Finished
Parsing package install arguments
Resolving Dependencies
--> Populating transaction set with selected packages. Please wait.
---> Downloading header for clamd to pack into transaction set.
clamd-0.88.4-1.el4.rf.i38 100% |=========================| 5.3 kB 00:00
---> Package clamd.i386 0:0.88.4-1.el4.rf set to be updated
--> Running transaction check
--> Processing Dependency: clamav = 0.88.4-1.el4.rf for package: clamd
--> Processing Dependency: libclamav.so.1 for package: clamd
--> Restarting Dependency Resolution with new changes.
--> Populating transaction set with selected packages. Please wait.
---> Downloading header for clamav to pack into transaction set.
clamav-0.88.4-1.el4.rf.i3 100% |=========================| 8.1 kB 00:00
---> Package clamav.i386 0:0.88.4-1.el4.rf set to be updated
--> Running transaction check
--> Processing Dependency: clamav-db = 0.88.4-1.el4.rf for package: clamav
--> Restarting Dependency Resolution with new changes.
--> Populating transaction set with selected packages. Please wait.
---> Downloading header for clamav-db to pack into transaction set.
clamav-db-0.88.4-1.el4.rf 100% |=========================| 3.2 kB 00:00
---> Package clamav-db.i386 0:0.88.4-1.el4.rf set to be updated
--> Running transaction check Dependencies Resolved =============================================================================
Package Arch Version Repository Size
=============================================================================
Installing:
clamd i386 0.88.4-1.el4.rf dag 64 k
Installing for dependencies:
clamav i386 0.88.4-1.el4.rf dag 724 k
clamav-db i386 0.88.4-1.el4.rf dag 5.6 M Transaction Summary
=============================================================================
Install 3 Package(s)
Update 0 Package(s)
Remove 0 Package(s)
Total download size: 6.4 M
Downloading Packages:
(1/3): clamd-0.88.4-1.el4 100% |=========================| 64 kB 00:01
(2/3): clamav-0.88.4-1.el 100% |=========================| 724 kB 00:04
(3/3): clamav-db-0.88.4-1 100% |=========================| 5.6 MB 00:25
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing: clamav-db ######################### [1/3]
Installing: clamav ######################### [2/3]
Installing: clamd ######################### [3/3] Installed: clamd.i386 0:0.88.4-1.el4.rf
Dependency Installed: clamav.i386 0:0.88.4-1.el4.rf clamav-db.i386 0:0.88.4-1.el4.rf
Complete! ← 安裝完畢！ |
接下來(lái)配置 Clam Antivirus 。
[root@sample ~]# vi /etc/clamd.conf ← 修改clamd的配置文件
ArchiveBlockMax ← 找到這一行，在行首加上“#”（不把大容量的壓縮文件看作被感染病毒的文件）
↓
#ArchiveBlockMax ← 變?yōu)榇藸顟B(tài)
User clamav ← 找到這一行，在行首加上“#”（不允許一般用戶(hù)控制）
↓
#User clamav ← 變?yōu)榇藸顟B(tài) |
讓 Clam Antivirus 開(kāi)始運行，并設置其為自啟動(dòng)。
[root@sample ~]# chkconfig clamd on ← 將其設置為自系統啟動(dòng)后啟動(dòng)
[root@sample ~]# chkconfig --list clamd
clamd 0:off 1:off 2:on 3:on 4:on 5:on 6:off ← 確認2--5為on的狀態(tài)就OK
[root@sample ~]# /etc/rc.d/init.d/clamd start ← 啟動(dòng)clamd服務(wù)（運行Clam AntiVirus）
Starting Clam AntiVirus Daemon: [ OK ] ← 啟動(dòng)成功 |
安裝后建議立即更新病毒庫，以保證最新病毒的查殺。
[root@sample ~]# freshclam ← 更新clam的病毒庫
ClamAV update process started at Fri Aug 25 18:39:26 2006
Downloading main.cvd [*]
main.cvd updated (version: 40, sigs: 64138, f-level: 8, builder: tkojm)
Downloading daily.cvd [*]
daily.cvd updated (version: 1728, sigs: 2565, f-level: 8, builder: ccordes)
Database updated (66703 signatures) from db.cn.clamav.net (IP: 58.221.253.171)
Clamd successfully notified about the update. |
然后進(jìn)行病毒掃描的測試，在這里，我們首先下載測試用的病毒文件。
[root@sample ~]# clamdscan ← 進(jìn)行病毒掃描
/root: OK ----------- SCAN SUMMARY -----------
Infected files: 0 ← 沒(méi)有發(fā)現病毒
Time: 5.074 sec (0 m 5 s)
[root@sample ~]# wget http://www.eicar.org/download/eicar.com ← 下載帶毒文件
[root@sample ~]# wget http://www.eicar.org/download/eicar_com.zip ← 下載帶毒文件 |
然后，再次進(jìn)行病毒到描。附加“remove”選項后，會(huì )在查出病毒后自動(dòng)刪除染毒文件。
[root@sample ~]# clamdscan --remove ← 再次進(jìn)行病毒掃描，并附加刪除選項
/root/eicar.com: Eicar-Test-Signature FOUND ← 發(fā)現被病毒感染的文件
/root/eicar.com: Removed. ← 刪除被病毒感染的文件
/root/eicar_com.zip: Eicar-Test-Signature FOUND ← 發(fā)現被病毒感染的文件
/root/eicar_com.zip: Removed. ← 刪除被病毒感染的文件 ----------- SCAN SUMMARY -----------
Infected files: 2
Time: 2.201 sec (0 m 2 s) |
[root@sample ~]# vi scan.sh ← 建立自動(dòng)掃描腳本，如下：
#!/bin/bash PATH=/usr/bin:/bin
CLAMSCANTMP=`mktemp`
clamdscan --recursive --remove / > $CLAMSCANTMP
[ ! -z "$(grep FOUND$ $CLAMSCANTMP)" ] && \
grep FOUND $CLAMSCANTMP | mail -s "Virus Found in `hostname`" root
rm -f $CLAMSCANTMP
[root@sample ~]# chmod 700 scan.sh ← 賦予腳本可被執行的權限
[root@sample ~]# crontab -e ← 編輯計劃任務(wù)，添加如下行
00 03 * * * /root/scan.sh ← 添加這一行，讓其在每天3點(diǎn)鐘執行掃描 |
