Security Setup - ClamAV

ClamAV Setup for Linux

This guide covers setting up automated ClamAV virus scanning with desktop notifications.

Installation

Create the following three files:

1. /usr/local/bin/clamscan_notify.sh

#!/bin/bash

# Check if scan directory is provided
if [ -z "$1" ]; then
    echo "Usage: $0 <directory_to_scan> [--last-day]"
    exit 1
fi

SCAN_DIR="$1"
LOG_FILE="/var/log/clamav/scan_$(date +'%Y-%m-%d').log"

# Update virus definitions first
freshclam

if [ "$2" = "--last-day" ]; then
    # Pipe find directly to xargs to scan recent files
    find "$SCAN_DIR" -mtime -1 -type f -print0 | xargs -0 clamscan --log="$LOG_FILE"
else
    # Regular recursive scan
    clamscan -r "$SCAN_DIR" --log="$LOG_FILE"
fi

# Get the active user's ID and their bus address
ACTIVE_USER=$(who | grep -m1 '(:0)' | cut -d' ' -f1)
USER_ID=$(id -u "$ACTIVE_USER")
DBUS_ADDRESS="unix:path=/run/user/$USER_ID/bus"

# Check if any viruses were found and send notification as the active user
if [ $? -eq 1 ]; then
    sudo -u "$ACTIVE_USER" DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS="$DBUS_ADDRESS" \
        notify-send -u critical "ClamAV - Threats Found!" "Check $LOG_FILE for details"
else
    sudo -u "$ACTIVE_USER" DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS="$DBUS_ADDRESS" \
        notify-send -u normal "ClamAV Scan Complete" "No threats found in $SCAN_DIR"
fi

2. /etc/systemd/system/clamav-scan.service

[Unit]
Description=ClamAV Daily Scan
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/clamscan_notify.sh /path/to/scan --last-day

[Install]
WantedBy=multi-user.target

3. /etc/systemd/system/clamav-scan.timer

[Unit]
Description=Run ClamAV scan daily

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

Configuration

After creating these files:

Make the script executable:

sudo chmod +x /usr/local/bin/clamscan_notify.sh

Replace /path/to/scan in the service file with your desired scan directory (e.g. /home/rfirmin)

Enable and start the timer:

sudo systemctl daemon-reload
sudo systemctl enable clamav-scan.timer
sudo systemctl start clamav-scan.timer

Do the first run on ALL files (without the –last-day param):
Terminal window
```
sudo /usr/local/bin/clamscan_notify.sh /home/rfirmin
```

Usage Notes

The timer runs daily and scans only files modified in the last 24 hours (–last-day flag)
Full scans can be run manually without the –last-day flag
Notifications appear as desktop alerts
Scan logs are stored in /var/log/clamav/ with date-based filenames