Comments (1)

By Brian, May 28, 2010 12:11 pm

Computer viruses are the bane of most system administrator’s existence and an unavoidable facet of modern online life. Most Linux systems however do not have an antivirus included in their repositories.
There are a few reasons why, including the relatively low-level of Linux viruses and the frequent updating of these packages which are generally more agile than the distribution releases. There is a solution I use that I would like to share.

On home systems, like Ubuntu, you can find a great free system called ClamAV through the package manager, however on more stable systems for servers (such as Centos 5) this option is not available.
This does not mean you should forgo the effort to add one – modern viruses are sophisticated vermin that can exploit a users systems and use them to access and propagate on a web server. Script exploits could bring your server to a crawl as they feed viruses to your customers. A good antivirus is a necessity in this modern age.

Thankfully there is an answer – Dag Wieërs maintains an RPM repository supporting several pieces of software, and ClamAV is one of them. There are three steps to making your system secure – first you need to install the ClamAV packages, second you need a custom script to update and scan the system, and thirdly you need to run the script with cron to automate the process. What follows is a step-by-step tutorial for setting this up on a CentOS 5.5 server, however it should work relatively the same for any RedHat Enterprise based distribution.

Part One : Installing ClamAV from Dag’s RPM Repository

The first step is to add the repository entry:

sudo nano /etc/yum.repos.d/rpmforge.repo

In this file add the following code and save the file, then exit the editor:

[rpmforge]
name = Dag Wieers RPM Repository (rpmforge)
mirrorlist = http://apt.sw.be/redhat/el5/en/mirrors-rpmforge
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY.rpmforge
enabled=0

Next, get the GPG key to ensure you are getting officially signed packages:

sudo wget http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt -P /etc/pki/rpm-gpg/ -O RPM-GPG-KEY.rpmforge

You should now be ready to install the initial package:

sudo yum --enablerepo=rpmforge install clamd -y

The previous command should also install the ‘clamav‘ and ‘clamav-db‘ dependency packages. If all went well, move on to the next step.

Part Two : Creating a Script to Automate ClamAV

First, lets create a new bash script:

sudo nano /usr/local/bin/clamav-cron

The script should look roughly like the one below, change the notification and alert emails as needed:

#!/bin/bash
#============================================
# Update clam av and initiate a full system
# scan excluding virtual directories
# written by Brian Cantin, 2009-2010
#============================================
# User configuration section
#--------------------------------------------

# Notification e-mail sender (could be fake):
CAV_MAILFROM="support@example.com"

# Notification & Alert e-mail recipients:
CAV_NOTIFY_TO="notify@example.com"
CAV_ALERT_TO="alerts@example.com"

# Log file name and its path:
CAV_LOGFILE="/var/log/clamav-cron"

# Scan target
CAV_TARGET='/'

# Directories to exclude from the scan
CAV_EXCLUDE='/proc|/dev|/sys|/mnt'

#===========================================
# script revision
CAV_VERSION='0.4'

# if the log file already exists - delete it
if [ -e $CAV_LOGFILE ]
then
        /bin/rm $CAV_LOGFILE
fi

# printed on the command line:
echo -e `basename $0` "v"$CAV_VERSION

# to be written to the log file:
echo -e $HOSTNAME - $(date) >> $CAV_LOGFILE
echo -e ------------------------ >> $CAV_LOGFILE
echo -e Script : `basename $0` v$CAV_VERSION  >> $CAV_LOGFILE
echo -e Target : $CAV_TARGET on $HOSTNAME >> $CAV_LOGFILE
echo -e Exclude: $CAV_EXCLUDE >> $CAV_LOGFILE
echo -e ------------------------ >> $CAV_LOGFILE

# update the detection database
echo -e "Update (/usr/bin/freshclam):" >> $CAV_LOGFILE
/usr/bin/freshclam >> $CAV_LOGFILE
echo -e ------------------------ >> $CAV_LOGFILE

# run the scan
echo -e "Scan (/usr/bin/clamscan):" >> $CAV_LOGFILE
/usr/bin/clamscan --infected --recursive $CAV_TARGET --exclude $CAV_EXCLUDE >> $CAV_LOGFILE
CLAMSCAN=$?

# if an error or virus is encountered then send an email to alert address
# otherwise send one to the notify
if [ "$CLAMSCAN" -eq "1" ]
then
        CAV_SUBJECT="[VIRUS] ClamAV ("$HOSTNAME") $(date)"
        /bin/mail -s "$CAV_SUBJECT" $CAV_ALERT_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE
elif [ "$CLAMSCAN" -gt "1" ]
then
        CAV_SUBJECT="[ERROR] ClamAV ("$HOSTNAME") $(date)"
	/bin/mail -s "$CAV_SUBJECT" $CAV_ALERT_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE
else
	CAV_SUBJECT="ClamAV ("$HOSTNAME") $(date)"
	/bin/mail -s "$CAV_SUBJECT" $CAV_NOTIFY_TO -- -f $CAV_MAILFROM < $CAV_LOGFILE
fi

I think this shell script is fairly self explanatory and to the point – it will update the ClamAV software and database, run a full system scan (excluding virtual directories) and email the results to the notification address. To accentuate problems it adds [VIRUS] or [ERROR] to the email subject and sends the email instead to the alert address. You can configure these addresses to be the same, depending on your preferences. Please note you must have /bin/mail configured correctly for the email functionality to work but that is outside the scope of this article.

After creating and saving this new script, make it executable:

sudo chmod +x /usr/local/bin/clamav-cron

You should complete a test-run of your script at this point:

sudo /usr/local/bin/clamav-cron

If all goes well it should complete within a few minutes to a few hours (depending on the size of your file system) and send you an email of the results. If there where any errors, go back and correct them before moving on to part three.

Part Three : Automation

Once everything is working to your satisfaction you can edit the crontab file for a daily activation of the script:

sudo nano /etc/crontab

I added the following line to make the script run daily at 2:30am as root:

30 2 * * * root /usr/local/bin/clamav-cron

Congratulations! Your server is now configured to automatically update your antivirus, scan for threats and notify you in a timely manner, every day.

Bookmark It

Hide Sites

Comments (0)

By Brian, September 27, 2009 1:25 pm

One of the nice features of World of Warcraft is the ability to create custom macros to simplify common tasks in the game. I have a nice little on that you can place on a button for fishing.

What it does: If you do not have a fishing rod equipped, clicking the button will equip one. If a fishing rod is equipped, it will cast. If you hold down any modifier key it will re-equip your weapons.

Code (insert your object names where indicated in italics):

/equip [noequipped:Fishing Poles, nomodifier] fishing rod name;
/equip [modifier] main weapon name;
/cast [equipped:Fishing Poles, nomodifier] Fishing;


For example:

/equip [noequipped:Fishing Poles, nomodifier] Nat Pagle's Extreme Angler FC-5000;
/equip [modifier] Staff of Dark Mending;
/cast [equipped:Fishing Poles, nomodifier] Fishing;


If you are not using two handed weapons, you will need to enter an equip command for your offhand weapon as well:


/equip [noequipped:Fishing Poles, nomodifier] fishing rod name;
/equip [modifier] main weapon name;
/equip [modifier] offhand weapon name;
/cast [equipped:Fishing Poles, nomodifier] Fishing;


Happy fishing!

Bookmark It

Hide Sites

Comments (0)

By Brian, November 28, 2008 1:04 pm

Allow me introduce you to my new favorite web tool: jQuery. jQuery is a handy java script that allows you to add AJAX functionality to your website without too much fuss at all.

After placing the jquery.js (obtained from jQuery.com) file in your website’s path (ex. yoursite.com/include/) you simply need to add two javascript references in your page header:

<script src='include/jquery.js'></script>
<script src='include/scripts.js'></script>

The scripts.js file is where all the custom functionality code goes. Here’s an example, where links clicked in a div named #nav will load the new content into the #content div without refreshing the whole page:

$(document).ready(function() {           // after page is loaded, this is called automagically $('#nav li a').click(function() {     var query = $(this).attr('href');                  // this is what appears in the href tag     $('#content').hide('slow',loadContent);            // hides the div, calls loadContent()

     function loadContent() {         $('#content').load(query,'',showNewContent()); // pull the request into the div     }                                                  // calls showNewContent()

     function showNewContent() {         $('#content').show('fast');                    // show the new page content     }     return false; // returning false indicates the event was processed });});

No change to the actual page markup was required to make this happen at all. A small hurdle I encountered working with jQuery was that having an event bound to content inside the div #content would cease to function once new content was brought in. The reason for this is that jQuery loads the event binding based on what is on the page at first load. The easy way to solve this is to add the Live Query plugin for jQuery. Put it in your include directory with the other two scripts, and reference the script after jQuery but before your site’s script:

<script src='include/jquery.js'></script>
<script src='include/jquery.livequery.js'></script>
<script src='include/scripts.js'></script>

You will need to perform the related event binding to use Live Query slightly different from a normal jQuery binding:

$(document).ready(function() {    // after page is loaded, this is called automagically $('#content a').livequery('click', function() {        // livequery auto-binds when tags change     var query = $(this).attr('href');                  // this is what appears in the href tag     alert('You clicked this link: ' + query);     return false; // returning false indicates the event was processed });});

Yup, it’s just that easy – and once again, no change was made to the page markup. There is no end to the applications of jQuery and it’s related plugins. Happy coding, and welcome to Web 2.0!

Bookmark It

Hide Sites