ClamAV on RedHat Enterprise Linux (RHEL) and CentOS 7 can be installed from Extra Packages for Enterprise Linux (EPEL) repository.
One liner to install EPEL repo, ClamAV packages, and correct configuration files.
yum -y install epel-release; yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd; sed -i '/^Example$/d' /etc/freshclam.conf; sed -i '/^Example$/d' /etc/clamd.d/scan.conf; sed -i -e 's/#LocalSocket \/var\/run\/clamd.scan\/clamd.sock/LocalSocket \/var\/run\/clamd.scan\/clamd.sock/g' /etc/clamd.d/scan.conf; sed -i '/REMOVE ME/d' /etc/sysconfig/freshclam; systemctl enable clamd@scan; freshclam; systemctl start clamd@scan; systemctl status clamd@scan;
If everything is OK, output should end something like this.
Downloading daily.cvd [100%]
daily.cvd updated (version: 20882, sigs: 1566229, f-level: 63, builder: neo)
Downloading bytecode.cvd [100%]
bytecode.cvd updated (version: 268, sigs: 47, f-level: 63, builder: anvilleg)
Database updated (3990501 signatures) from database.clamav.net (IP: 104.131.196.175)
clamd@scan.service - Generic clamav scanner daemon
Loaded: loaded (/usr/lib/systemd/system/clamd@scan.service; enabled)
Active: active (running) since Sun 2015-09-06 09:24:37 EDT; 16ms ago
Main PID: 707 (clamd)
CGroup: /system.slice/system-clamd.slice/clamd@scan.service
└─707 /usr/sbin/clamd -c /etc/clamd.d/scan.conf --nofork=yes
Sep 06 09:24:37 test.demo.local systemd[1]: Started Generic clamav scanner daemon.
Sep 06 09:24:37 test.demo.local clamd[707]: clamd daemon 0.98.7 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Sep 06 09:24:37 test.demo.local clamd[707]: Running as user clamscan (UID 998, GID 997)
Sep 06 09:24:37 test.demo.local clamd[707]: Log file size limited to 1048576 bytes.
Sep 06 09:24:37 test.demo.local clamd[707]: Reading databases from /var/lib/clamav
Sep 06 09:24:37 test.demo.local clamd[707]: Not loading PUA signatures.
Sep 06 09:24:37 test.demo.local clamd[707]: Bytecode: Security mode set to "TrustSigned".
[root@test ~]#
ClamAV Installation details:
Install EPEL repo:
EPEL can be installed from CentOS Extras repository, which is enabled by default, with the following command.
yum -y install epel-release
In case epel-release package is not available for any reason, it can be installed from Webtatic or Fedora servers, with following commands.
rpm -Uvh https://mirror.webtatic.com/yum/el7/epel-release.rpm
or
rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
Install ClamAV packages:
Once EPEL is installed ClamAV packages can be installed with the following command.
yum -y install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd
Once all necessary packages have been installed, freshclam.conf file needs to be edited, for ClamAV update to work.
Correct freshclam.conf file:
Default installation will return the following error when “freshclam” command is run, due to file being marked as example config file.
# freshclam ERROR: Please edit the example config file /etc/freshclam.conf ERROR: Can't open/parse the config file /etc/freshclam.conf
Error is caused by the following section in the freshclam.conf configuration file.
## Example config file for freshclam ## Please read the freshclam.conf(5) manual before editing this file. ## # Comment or remove the line below. Example
As specified in the file, last line in this snippet, needs to be removed, or commented out, in order for “freshclam” command to work.
Line can be removed with the following command.
sed -i '/^Example$/d' /etc/freshclam.conf
Enable automatic Updates:
By default freshclam cronjob is disabled, and last line needs to be removed or commented out from /etc/sysconfig/freshclam in order for automatic updates to run.
[root@test ~]# cat /etc/sysconfig/freshclam ## When changing the periodicity of freshclam runs in the crontab, ## this value must be adjusted also. Its value is the timespan between ## two subsequent freshclam runs in minutes. E.g. for the default ## ## | 0 */3 * * * ... ## ## crontab line, the value is 180 (minutes). # FRESHCLAM_MOD= ## A predefined value for the delay in seconds. By default, the value is ## calculated by the 'hostid' program. This predefined value guarantees ## constant timespans of 3 hours between two subsequent freshclam runs. ## ## This option accepts two special values: ## 'disabled-warn' ... disables the automatic freshclam update and ## gives out a warning ## 'disabled' ... disables the automatic freshclam silently # FRESHCLAM_DELAY= ### !!!!! REMOVE ME !!!!!! ### REMOVE ME: By default, the freshclam update is disabled to avoid ### REMOVE ME: network access without prior activation FRESHCLAM_DELAY=disabled-warn # REMOVE ME [root@test ~]#
Lines can be removed with following command.
sed -i '/REMOVE ME/d' /etc/sysconfig/freshclam
Correct scan.conf file:
Same needs to be done for scan.conf file
## ## Example config file for the Clam AV daemon ## Please read the clamd.conf(5) manual before editing this file. ## # Comment or remove the line below. Example
Following command removes the line from scan.conf file.
sed -i '/^Example$/d' /etc/clamd.d/scan.conf
We also need to define the socket file.
If we try to run clamd, following error is returned.
[root@test ~]# clamd -c /etc/clamd.d/scan.conf ERROR: Please define server type (local and/or TCP). [root@test ~]#
Checking the scan.conf file, we see socket file is commented out.
# Path to a local socket file the daemon will listen on. # Default: disabled (must be specified by a user) #LocalSocket /var/run/clamd.scan/clamd.sock
Comment can be removed with following command.
sed -i -e 's/#LocalSocket \/var\/run\/clamd.scan\/clamd.sock/LocalSocket \/var\/run\/clamd.scan\/clamd.sock/g' /etc/clamd.d/scan.conf