Featured Maldet - Linux Malware Detect Addon (discussion)

Neither

Code:

[ QUARANTINE OPTIONS ]
##
# The default quarantine action for malware hits
# [0 = alert only, 1 = move to quarantine & alert]
quarantine_hits="0"

Update: [root@server maldetect]# cat conf.maldet ## # Linux Malware Detect v1.5 # - Pastebin.com the complete config file (quar options are adjusted by me, they were set to 0 as well)

---

 

Shouldn't it be quarantine_hits and not quar_hits though?

Code:

[root@server ~]# cat /usr/local/maldetect/conf.maldet | grep quar_hits
[root@server ~]# cat /usr/local/maldetect/conf.maldet | grep quarantine_hits
quarantine_hits="1"
# [NOTE: quarantine_hits=1 required]
# [NOTE: quarantine_hits=1 required]

 

Yup it has indeed changed. Running CentOS 7.2 but checked on my CentOS 6 server and the config is the same. Seems to have changed in some version of maldetect.
# [ EMAIL ALERTS ] ## # The default email alert toggle # [0 = disabled, 1 = e - Pastebin.com

 

Using clamdscan returns a permission error for me, the capital X also doesn't seem to adjust the permissions.

Code:

#!/bin/bash

sed -i 's|^#CallUploadScript yes|CallUploadScript yes|g' /etc/pure-ftpd/pure-ftpd.conf

cat >/etc/pure-ftpd/clamscan.sh<< EOF
#!/bin/bash
/usr/bin/clamscan --remove --quiet --no-summary "\$1" --log=/var/log/clamscan-pureftpd.log
EOF

chmod +x /etc/pure-ftpd/clamscan.sh

pure-uploadscript -B -r /etc/pure-ftpd/clamscan.sh

echo "pure-uploadscript -B -r /etc/pure-ftpd/clamscan.sh" >> /etc/rc.local

service pure-ftpd restart

then chmod +x and run script

Code:

chmod +x setup-callupload.sh
./setup-callupload.sh

In short, if this doesn't work for anyone, try to change clamdscan to clamscan and the capital X to x.

 

I've started to using maldet today and when i look the "/usr/local/maldetect/conf.maldet" configuration file, i can't see or find these values like;

Code:

email_subj="maldet alert from $(hostname)"

and

Code:

# [ QUARANTINE OPTIONS ]
quar_hits=1

# Try to clean string based malware injections
# [NOTE: quar_hits=1 required]
# [0 = disabled, 1 = clean]
quar_clean=1

# The default suspend action for users wih hits
# Cpanel suspend or set shell /bin/false on non-Cpanel
# [NOTE: quar_hits=1 required]
# [0 = disabled, 1 = suspend account]
quar_susp=0
# minimum userid that can be suspended
quar_susp_minuid=500

why? They are default and not important on latest version?

 

Centos 7.2 and centmin mod 123.09beta01.

I installed the maldet to my another server which running on centos 6.5 and cpanel, i see these options even so. But i can't see these options from centmin mod maldet installer.

 

how to update my clamav? yum update doesn't work

Code:

 freshclam
ClamAV update process started at Mon Dec 12 12:10:33 2016
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.98.4 Recommended version: 0.99.2

 

clamav use about 500MB ram all the time.
Is it wise to stop clamav and (somehow) start only when need it (when maldet need it)?
So, how to stop clamav from automatic start on boot
How to stop it right now
How to start it right now

 

Code:

systemctl status clamd

Should get you a status, then swap status for stop or start.

Is 500MB alot of ram, whats your total?

 

Code:

------------------------------------------------------------------
 Centmin Mod Quick Info:
------------------------------------------------------------------
Server Location Info

  ip: 94.237.29.18
  city: Paderborn
  region: North Rhine-Westphalia
  country: DE

Processors physical = 4, cores = 4, virtual = 4, hyperthreading = no

      4  2999.998
      4  Intel(R) Xeon(R) CPU E5-2687W v4 @ 3.00GHz
      4  30720 KB

 System Up Since:       2016-12-31 03:40:19
 System Uptime:         up 2 weeks, 3 days, 12 hours, 58 minutes
 MySQL Server Started   2017-01-10 04:01:45
 MySQL Uptime:          7 days 12 hours 36 min 43 sec
 MySQL Uptime (secs):   650203
 Server Type:           kvm
 CentOS Version:        7.3
 Centmin Mod:           1.2.3-eva2000.09.001
 Nginx PageSpeed:       OFF
 Nginx Version:         1.11.8
 PHP-FPM Version:       7.1.0
 MariaDB Version:       10.1.20
 CSF Firewall:          v9.28
 Memcached Server:      1.4.33
 NSD Version:           66:
 Siege Version:         4.0.2
 Maldet Version:        v1.5
 ClamAV Version:        0.98.4
 ElasticSearch:         5.1.2
------------------------------------------------------------------

Code:

[root@upcloud ~]# free -m
              total        used        free      shared  buff/cache   available
Mem:           3790        2748         175         139         866         532
Swap:          1023        1022           1

4GB is total

2Gb for mysql
0,5GB for elasticsearch

Code:

[root@upcloud ~]# systemctl status clamd -l
â— clamd.service - SYSV: Clam AntiVirus Daemon is a TCP/IP or socket protocol server.
   Loaded: loaded (/etc/rc.d/init.d/clamd; bad; vendor preset: disabled)
   Active: active (running) since Mon 2017-01-09 12:15:30 CET; 1 weeks 1 days ago
     Docs: man:systemd-sysv-generator(8)
 Main PID: 11994 (clamd)
   CGroup: /system.slice/clamd.service
           └─11994 clamd

Jan 17 14:52:36 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 15:02:36 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 15:12:37 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 15:22:37 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 15:32:37 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 15:42:37 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 15:52:37 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 16:02:37 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 16:12:37 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.
Jan 17 16:22:37 upcloud.pijanitvor.com clamd[11994]: SelfCheck: Database status OK.

It seems that run every 10 minutes, but 500MB ram is consumed all the time

Any chance to setup in that way so it uses 500MB but not all the time?

​

 

Maldet is not in real time? I mean, it is not scanning 0/24h in real time.
If not, is it possible to enable automatically clamd service when maldet need it?