Skip to content

clamav sigs #3205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
doomedraven wants to merge 2 commits into
base: master
Choose a base branch
from
+39 −121
Open

clamav sigs #3205

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2f3c198
Update cape2.sh
doomedraven Sep 2, 2026
67e59c5
Update cape2.sh
doomedraven Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
160 changes: 39 additions & 121 deletions installer/cape2.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1220,132 +1220,50 @@ EOF

function install_clamav() {
echo "[+] Installing clamav"
sudo apt-get install -y clamav clamav-daemon clamav-freshclam clamav-unofficial-sigs python3-pyclamd

cat >> /usr/share/clamav-unofficial-sigs/conf.d/00-clamav-unofficial-sigs.conf << EOF
# This file contains user configuration settings for the clamav-unofficial-sigs.sh
# Script provide by Bill Landry (unofficialsigs@gmail.com).
# Script updates can be found at: http://sourceforge.net/projects/unofficial-sigs
# License: BSD (Berkeley Software Distribution)
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
export PATH
clam_user="clamav"
clam_group="clamav"
setmode="yes"
clam_dbs="/var/lib/clamav"
clamd_pid="/var/run/clamd.pid"
reload_dbs="no"
reload_opt="clamdscan --reload" # Default
enable_random="yes"
min_sleep_time="60" # Default minimum is 60 seconds (1 minute).
max_sleep_time="600" # Default maximum is 600 seconds (10 minutes).
# ========================
# Sanesecurity Database(s)
# ========================
# http://www.sanesecurity.com/clamav/databases.htm
ss_dbs="
blurl.ndb
junk.ndb
jurlbl.ndb
phish.ndb
rogue.hdb
sanesecurity.ftm
scam.ndb
sigwhitelist.ign2
spamattach.hdb
spamimg.hdb
winnow.attachments.hdb
winnow_bad_cw.hdb
winnow_extended_malware.hdb
winnow_malware.hdb
winnow_malware_links.ndb
doppelstern.hdb
bofhland_cracked_URL.ndb
bofhland_malware_attach.hdb
bofhland_malware_URL.ndb
bofhland_phishing_URL.ndb
crdfam.clamav.hdb
phishtank.ndb
porcupine.ndb
foxhole_filename.cdb
foxhole_all.cdb
"
# ========================
# SecuriteInfo Database(s)
# ========================
si_dbs="
honeynet.hdb
securiteinfo.hdb
securiteinfobat.hdb
securiteinfodos.hdb
securiteinfoelf.hdb
securiteinfohtml.hdb
securiteinfooffice.hdb
securiteinfopdf.hdb
securiteinfosh.hdb
"
si_update_hours="4" # Default is 4 hours (6 update checks daily).
mbl_dbs="
mbl.ndb
"
mbl_update_hours="6" # Default is 6 hours (4 downloads daily).
rsync_connect_timeout="15"
rsync_max_time="60"
curl_connect_timeout="15"
curl_max_time="90"
work_dir="/usr/unofficial-dbs" #Top level working directory
# Sub-directory names:
ss_dir="$work_dir/ss-dbs" # Sanesecurity sub-directory
si_dir="$work_dir/si-dbs" # SecuriteInfo sub-directory
mbl_dir="$work_dir/mbl-dbs" # MalwarePatrol sub-directory
config_dir="$work_dir/configs" # Script configs sub-directory
gpg_dir="$work_dir/gpg-key" # Sanesecurity GPG Key sub-directory
add_dir="$work_dir/add-dbs" # User defined databases sub-directory
# If you would like to make a backup copy of the current running database
# file before updating, leave the following variable set to "yes" and a
# backup copy of the file will be created in the production directory
# with -bak appended to the file name.
keep_db_backup="no"
# If you want to silence the information reported by curl, rsync, gpg
# or the general script comments, change the following variables to
# "yes". If all variables are set to "yes", the script will output
# nothing except error conditions.
curl_silence="no" # Default is "no" to report curl statistics
rsync_silence="no" # Default is "no" to report rsync statistics
gpg_silence="no" # Default is "no" to report gpg signature status
comment_silence="no" # Default is "no" to report script comments
# Log update information to '$log_file_path/$log_file_name'.
enable_logging="yes"
log_file_path="/var/log"
log_file_name="clamav-unofficial-sigs.log"
# If necessary to proxy database downloads, define the rsync and/or curl
# proxy settings here. For rsync, the proxy must support connections to
# port 873. Both curl and rsync proxy setting need to be defined in the
# format of "hostname:port". For curl, also note the -x and -U flags,
# which must be set as "-x hostname:port" and "-U username:password".
rsync_proxy=""
curl_proxy=""
# After you have completed the configuration of this file, set the
# following variable to "yes".
user_configuration_complete="no"
################################################################################
# END OF USER CONFIGURATION #
################################################################################
add_dbs="
https://raw.githubusercontent.com/wmetcalf/clam-punch/master/miscreantpunch099.ldb
https://raw.githubusercontent.com/wmetcalf/clam-punch/master/exexor99.ldb
https://raw.githubusercontent.com/twinwave-security/twinclams/master/twinclams.ldb
https://raw.githubusercontent.com/twinwave-security/twinclams/master/twinwave.ign2
"
sudo apt-get install -y clamav clamav-daemon clamav-freshclam python3-pyclamd

# Create configuration and working directories
sudo mkdir -p /etc/clamav-unofficial-sigs
sudo mkdir -p /var/lib/clamav-unofficial-sigs
sudo mkdir -p /var/log/clamav-unofficial-sigs
sudo chown -R clamav:clamav /var/lib/clamav-unofficial-sigs
sudo chown -R clamav:clamav /var/log/clamav-unofficial-sigs

# Download script and configuration templates from extremeshok's official repo
sudo wget https://raw.githubusercontent.com/extremeshok/clamav-unofficial-sigs/master/clamav-unofficial-sigs.sh -O /usr/local/sbin/clamav-unofficial-sigs.sh
sudo chmod 755 /usr/local/sbin/clamav-unofficial-sigs.sh
sudo ln -sf /usr/local/sbin/clamav-unofficial-sigs.sh /usr/local/sbin/clamav-unofficial-sigs

sudo wget https://raw.githubusercontent.com/extremeshok/clamav-unofficial-sigs/master/config/master.conf -O /etc/clamav-unofficial-sigs/master.conf
sudo wget https://raw.githubusercontent.com/extremeshok/clamav-unofficial-sigs/master/config/user.conf -O /etc/clamav-unofficial-sigs/user.conf
sudo wget https://raw.githubusercontent.com/extremeshok/clamav-unofficial-sigs/master/config/os/os.ubuntu.conf -O /etc/clamav-unofficial-sigs/os.conf

# Override configurations in user.conf
sudo tee -a /etc/clamav-unofficial-sigs/user.conf > /dev/null << EOF

# CAPEv2 custom additions
user_configuration_complete="yes"
additional_dbs=(
"https://raw.githubusercontent.com/wmetcalf/clam-punch/master/miscreantpunch099.ldb"
"https://raw.githubusercontent.com/wmetcalf/clam-punch/master/exexor99.ldb"
"https://raw.githubusercontent.com/twinwave-security/twinclams/master/twinclams.ldb"
"https://raw.githubusercontent.com/twinwave-security/twinclams/master/twinwave.ign2"
)
EOF
chown root:root /usr/share/clamav-unofficial-sigs/conf.d/00-clamav-unofficial-sigs.conf
chmod 644 /usr/share/clamav-unofficial-sigs/conf.d/00-clamav-unofficial-sigs.conf
usermod -a -G ${USER} clamav

sudo usermod -a -G ${USER} clamav
echo "$CAPE_ROOT/storage/** r," | sudo tee -a /etc/apparmor.d/local/usr.sbin.clamd
sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
sudo systemctl enable clamav-daemon
sudo systemctl start clamav-daemon
sudo -u clamav /usr/sbin/clamav-unofficial-sigs

# Run setup/installation commands of the unofficial sigs script
sudo /usr/local/sbin/clamav-unofficial-sigs.sh --install-cron
sudo /usr/local/sbin/clamav-unofficial-sigs.sh --install-logrotate
sudo /usr/local/sbin/clamav-unofficial-sigs.sh --install-man

# Run the script to download the initial signatures as clamav user
sudo -u clamav /usr/local/sbin/clamav-unofficial-sigs.sh
}

function install_CAPE() {
Expand Down
Loading