ClamAV Anti-Virus toolkit

ClamAV is a UNIX Anti-virus tool designed to work directly with your E-Mail server (through procmail) to scan and filter message attachments containing viruses. While the ClamAV virus database is built off the OpenAntiVirus database, ClamAV contains additional signatures (virus definitions) and is kept up to date.

NOTE: While ClamAV is an excellent anti-virus program, it should not be used as a replacement for anti-virus software on your local PC. ClamAV is designed to suplement such programs and provide additional safeguards, but does not provide the extensive anti-virus capabilities (including protection from Web based or TCP/IP based attacks) that a local anti-virus program can provide.

Installation

To install ClamAV on your server, simply SSH to your VPS, su to root and run the following command at the prompt:

# vinstall clamav

During the vinstall, you will be prompted to configure ClamAV's scanning behavior (either to automatically scan incoming mail or not), and where to quarantine infected files. We recomend selecting the default for both these options. After the install completes, tcsh users may need to run rehash to load the ClamAV program paths into their PATH and MANPATH.

If you don't already have procmail installed on your server, the ClamAV install will install it and set it up as your LDA. If you already have procmail installed and have your own recipies in use, you should check your /usr/local/etc/procmailrc to see that the ClamAV recipies get put where you need them to be (depending on how you are filtering messages, you may want the ClamAV recipies to be at the beginning of your file).

When ClamAV is installed, a crontab entry is added to the system crontab file (/etc/crontab) to update your virus database twice daily using the freshclam program.

Documentation

For documentation of ClamAV, you may want to consult the clamscan(1), clamd(1), freshclam(1), and clamav.conf(5) manpages. You can also find documentation on the ClamAV Web site:

ClamAV User Manual