clamav/clamd-README
Enrico Scholz 55b25f143b updated doc
removed obsolete SysV related information; mentioned systemd + tmpfiles.d
2012-02-25 12:03:46 +01:00

60 lines
2.2 KiB
Plaintext

To create individual clamd-instance take the following files and
modify/copy them in the suggested way:
clamd.conf:
* set LocalSocket (or better: TCPSocket) and User to suitable values;
avoid PidFile unless it required by system monitoring or something
else. Logging through syslog is usually better than an indidual
Logfile.
* place this file into /etc/clamd.d with an unique service-name;
e.g. as /etc/clamd.d/<SERVICE>.conf
When using TCPSocket, create iptables rules which are limitting the
access by source and/or by using '-m owner'.
When LogFile feature is wanted, it must be writable for the assigned
User. Recommended way to reach this, is to:
* make it owned by the User's *group*
* assign at least 0620 (u+rw,g+w) permissions
A suitable command might be
| # touch <logfile>
| # chgrp <user> <logfile>
| # chmod 0620 <logfile>
| # restorecon <logfile>
NEVER use 'clamav' as the user since he can modify the database.
This is the user who is running the application; e.g. for mimedefang
(http://www.roaringpenguin.com/mimedefang), the user might be
'defang'.Theoretically, distinct users could be used, but it must be
made sure that the application-user can write into the socket-file,
and that the clamd-user can access the files asked by the
application to be checked.
clamd.logrotate: (only when LogFile feature is used)
* set the correct value for the logfile
* place it into /etc/logrotate.d
clamd@<SERVICE>.service: (systemd instance)
* instance of clamd@.service
Additionally, when using LocalSocket instead of TCPSocket, the directory
for the socket file must be created. For tmpfiles based systems, you
might want to create a file /usr/lib/tmpfiles.d/clamd.<SERVICE>.conf
with a content of
| d /var/run/clamd.<SERVICE> <MODE> <USER> <GROUP>
Adjust <MODE> (0710 should suffice for most cases) and <USER> + <GROUP>
so that the socket can be accessed by clamd and by the applications
using clamd. Make sure that the socket is not world accessible; else,
DOS attacks or worse are trivial.
[Disclaimer:
this file and the script/configfiles are not part of the official
clamav package.
Please send complaints and comments to
mailto:enrico.scholz@informatik.tu-chemnitz.de!]