28e73e95 |
## |
9ed581f8 |
## Example config file for the Clam AV daemon |
b2d28e76 |
## Please read the clamd.conf(5) manual before editing this file. |
28e73e95 |
## |
96b02502 |
|
28e73e95 |
# Comment or remove the line below.
Example
# Uncomment this option to enable logging. |
c6dbfbcb |
# LogFile must be writable for the user running daemon.
# A full path is required.
# Default: disabled |
28e73e95 |
#LogFile /tmp/clamd.log
# By default the log file is locked for writing - the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run |
c6dbfbcb |
# the daemon with --config-file option).
# This option disables log file locking. |
81837459 |
# Default: no
#LogFileUnlock yes |
28e73e95 |
|
f3a638e4 |
# Maximum size of the log file. |
28e73e95 |
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers. |
c6dbfbcb |
# Default: 1M |
28e73e95 |
#LogFileMaxSize 2M
|
c6dbfbcb |
# Log time with each message. |
81837459 |
# Default: no
#LogTime yes |
28e73e95 |
|
c6dbfbcb |
# Also log clean files. Useful in debugging but drastically increases the
# log size. |
81837459 |
# Default: no
#LogClean yes |
ee039e40 |
|
28e73e95 |
# Use system logger (can work together with LogFile). |
81837459 |
# Default: no
#LogSyslog yes |
28e73e95 |
|
c695dab4 |
# Specify the type of syslog messages - please refer to 'man syslog' |
c6dbfbcb |
# for facility names.
# Default: LOG_LOCAL6 |
c695dab4 |
#LogFacility LOG_MAIL
|
28e73e95 |
# Enable verbose logging. |
81837459 |
# Default: no
#LogVerbose yes |
28e73e95 |
|
c6dbfbcb |
# This option allows you to save a process identifier of the listening |
28e73e95 |
# daemon (main thread). |
c6dbfbcb |
# Default: disabled |
28e73e95 |
#PidFile /var/run/clamd.pid
|
ee039e40 |
# Optional path to the global temporary directory. |
c6dbfbcb |
# Default: system specific (usually /tmp or /var/tmp). |
ee039e40 |
#TemporaryDirectory /var/tmp
|
95d401c4 |
# Path to the database directory. |
c6dbfbcb |
# Default: hardcoded (depends on installation options) |
95d401c4 |
#DatabaseDirectory /var/lib/clamav |
96b02502 |
|
c6dbfbcb |
# The daemon works in a local OR a network mode. Due to security reasons we
# recommend the local mode. |
28e73e95 |
|
c6dbfbcb |
# Path to a local socket file the daemon will listen on. |
81837459 |
# Default: disabled (must be specified by a user) |
d239afe1 |
LocalSocket /tmp/clamd.socket |
28e73e95 |
|
049a18b9 |
# Remove stale socket after unclean shutdown. |
81837459 |
# Default: no
#FixStaleSocket yes |
8139fd99 |
|
5def21ff |
# TCP port address. |
81837459 |
# Default: no |
5def21ff |
#TCPSocket 3310
|
8139fd99 |
# TCP address.
# By default we bind to INADDR_ANY, probably not wise. |
78ca83b0 |
# Enable the following to provide some degree of protection |
8139fd99 |
# from the outside world. |
81837459 |
# Default: no |
8139fd99 |
#TCPAddr 127.0.0.1 |
049a18b9 |
|
28e73e95 |
# Maximum length the queue of pending connections may grow to. |
c6dbfbcb |
# Default: 15 |
28e73e95 |
#MaxConnectionQueueLength 30
|
29c4d783 |
# Clamd uses FTP-like protocol to receive data from remote clients.
# If you are using clamav-milter to balance load between remote clamd daemons
# on firewall servers you may need to tune the options below.
# Close the connection when the data size limit is exceeded. |
f3a638e4 |
# The value should match your MTA's limit for a maximum attachment size. |
c6dbfbcb |
# Default: 10M
#StreamMaxLength 20M |
28e73e95 |
|
29c4d783 |
# Limit port range.
# Default: 1024
#StreamMinPort 30000 |
6c7dbf7d |
# Default: 2048 |
29c4d783 |
#StreamMaxPort 32000
|
f3a638e4 |
# Maximum number of threads running at the same time. |
c6dbfbcb |
# Default: 10
#MaxThreads 20 |
28e73e95 |
|
7390dfcd |
# Waiting for data from a client socket will timeout after this time (seconds). |
c6dbfbcb |
# Value of 0 disables the timeout.
# Default: 120 |
7390dfcd |
#ReadTimeout 300 |
28e73e95 |
|
02b4b0c7 |
# Waiting for a new job will timeout after this time (seconds).
# Default: 30
#IdleTimeout 60
|
f3a638e4 |
# Maximum depth directories are scanned at. |
c6dbfbcb |
# Default: 15
#MaxDirectoryRecursion 20 |
28e73e95 |
|
c6dbfbcb |
# Follow directory symlinks. |
81837459 |
# Default: no
#FollowDirectorySymlinks yes |
28e73e95 |
# Follow regular file symlinks. |
81837459 |
# Default: no
#FollowFileSymlinks yes |
28e73e95 |
|
f3a638e4 |
# Perform a database check. |
c6dbfbcb |
# Default: 1800 (30 min) |
28e73e95 |
#SelfCheck 600
|
c6dbfbcb |
# Execute a command when virus is found. In the command string %v will |
f3a638e4 |
# be replaced with the virus name. |
81837459 |
# Default: no |
9cb8aa62 |
#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v" |
0249f9d2 |
|
f3a638e4 |
# Run as another user (clamd must be started by root to make this option
# working). |
81837459 |
# Default: don't drop privileges |
28e73e95 |
#User clamav
|
c6dbfbcb |
# Initialize supplementary group access (clamd must be started by root). |
81837459 |
# Default: no
#AllowSupplementaryGroups no |
28e73e95 |
|
cec8f31f |
# Stop daemon when libclamav reports out of memory condition. |
81837459 |
#ExitOnOOM yes |
f9593781 |
|
c6dbfbcb |
# Don't fork into background. |
81837459 |
# Default: no
#Foreground yes |
28e73e95 |
|
0249f9d2 |
# Enable debug messages in libclamav. |
81837459 |
# Default: no
#Debug yes |
0249f9d2 |
|
590135f9 |
# Do not remove temporary files (for debug purposes). |
81837459 |
# Default: no
#LeaveTemporaryFiles yes |
c6dbfbcb |
|
1b661cef |
# In some cases (eg. complex malware, exploits in graphic files, and others),
# ClamAV uses special algorithms to provide accurate detection. This option
# controls the algorithmic detection.
# Default: yes |
47138a98 |
#AlgorithmicDetection yes |
1b661cef |
|
0518e6c1 |
|
a9082ea2 |
##
## Executable files
##
# PE stands for Portable Executable - it's an executable file format used |
f3a638e4 |
# in all 32 and 64-bit versions of Windows operating systems. This option allows |
a9082ea2 |
# ClamAV to perform a deeper analysis of executable files and it's also |
c6dbfbcb |
# required for decompression of popular executable packers such as UPX, FSG,
# and Petite. |
81837459 |
# Default: yes
#ScanPE yes |
a9082ea2 |
|
3f97a1e7 |
# Executable and Linking Format is a standard format for UN*X executables.
# This option allows you to control the scanning of ELF files.
# Default: yes
#ScanELF yes
# With this option clamav will try to detect broken executables (both PE and
# ELF) and mark them as Broken.Executable. |
81837459 |
# Default: no
#DetectBrokenExecutables yes |
20c3d44d |
|
28e73e95 |
## |
a9082ea2 |
## Documents |
47bbbc56 |
##
|
f3a638e4 |
# This option enables scanning of OLE2 files, such as Microsoft Office
# documents and .msi files. |
81837459 |
# Default: yes
#ScanOLE2 yes |
47bbbc56 |
|
c5107e70 |
# This option enables scanning within PDF files.
# Default: no
#ScanPDF yes
|
0518e6c1 |
|
47bbbc56 |
## |
a9082ea2 |
## Mail files |
28e73e95 |
##
|
a36e6e5c |
# Enable internal e-mail scanner. |
81837459 |
# Default: yes
#ScanMail yes |
a36e6e5c |
# If an email contains URLs ClamAV can download and scan them.
# WARNING: This option may open your system to a DoS attack.
# Never use it on loaded servers. |
81837459 |
# Default: no
#MailFollowURLs no |
a36e6e5c |
|
dab42957 |
# Recursion level limit for the mail scanner.
# Default: 64
#MailMaxRecursion 128
|
af7d0dde |
# With this option enabled ClamAV will try to detect phishing attempts by using
# signatures. |
d6449522 |
# Default: yes |
af7d0dde |
#PhishingSignatures yes |
28e73e95 |
|
0518e6c1 |
# Scan URLs found in mails for phishing attempts. |
88cf728e |
# Default: yes |
961cc653 |
#PhishingScanURLs yes |
88cf728e |
|
19b3e182 |
# Use phishing detection only for domains listed in the .pdb database. It is
# not recommended to have this option turned off, because scanning of all
# domains may lead to many false positives!
# Default: yes
#PhishingRestrictedScan yes
# Always block SSL mismatches in URLs, even if the URL isn't in the database.
# This can lead to false positives.
#
# Default: no
#PhishingAlwaysBlockSSLMismatch no
# Always block cloaked URLs, even if URL isn't in database. |
f3a638e4 |
# This can lead to false positives. |
19b3e182 |
#
# Default: no
#PhishingAlwaysBlockCloak no
|
0518e6c1 |
|
28e73e95 |
## |
a9082ea2 |
## HTML |
888f5794 |
##
|
c6dbfbcb |
# Perform HTML normalisation and decryption of MS Script Encoder code. |
81837459 |
# Default: yes
#ScanHTML yes |
888f5794 |
|
a36e6e5c |
|
888f5794 |
## |
a9082ea2 |
## Archives |
28e73e95 |
##
|
c6dbfbcb |
# ClamAV can scan within archives and compressed files. |
81837459 |
# Default: yes
#ScanArchive yes |
88ab7aee |
|
c6dbfbcb |
# The options below protect your system against Denial of Service attacks
# using archive bombs. |
28e73e95 |
# Files in archives larger than this limit won't be scanned.
# Value of 0 disables the limit. |
c6dbfbcb |
# Default: 10M
#ArchiveMaxFileSize 15M
# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
# file, all files within it will also be scanned. This options specifies how |
f3a638e4 |
# deeply the process should be continued. |
28e73e95 |
# Value of 0 disables the limit. |
f24181ef |
# Default: 8 |
81837459 |
#ArchiveMaxRecursion 10 |
28e73e95 |
|
c6dbfbcb |
# Number of files to be scanned within an archive. |
28e73e95 |
# Value of 0 disables the limit. |
c6dbfbcb |
# Default: 1000
#ArchiveMaxFiles 1500 |
28e73e95 |
|
c6dbfbcb |
# If a file in an archive is compressed more than ArchiveMaxCompressionRatio
# times it will be marked as a virus (Oversized.ArchiveType, e.g. Oversized.Zip)
# Value of 0 disables the limit.
# Default: 250
#ArchiveMaxCompressionRatio 300 |
a6945b5d |
|
c6dbfbcb |
# Use slower but memory efficient decompression algorithm.
# only affects the bzip2 decompressor. |
81837459 |
# Default: no
#ArchiveLimitMemoryUsage yes |
28e73e95 |
|
fb787a06 |
# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR). |
81837459 |
# Default: no
#ArchiveBlockEncrypted no |
0f34221a |
|
221a54da |
# Mark archives as viruses (e.g. RAR.ExceededFileSize, Zip.ExceededFilesLimit)
# if ArchiveMaxFiles, ArchiveMaxFileSize, or ArchiveMaxRecursion limit is
# reached. |
81837459 |
# Default: no
#ArchiveBlockMax no |
d272908a |
|
8765287e |
# Enable support for Sensory Networks' NodalCore hardware accelerator.
# Default: no |
b5456d64 |
#NodalCoreAcceleration yes |
8765287e |
|
0f34221a |
|
28e73e95 |
##
## Clamuko settings
## WARNING: This is experimental software. It is very likely it will hang |
d272908a |
## up your system!!! |
28e73e95 |
##
# Enable Clamuko. Dazuko (/dev/dazuko) must be configured and running. |
81837459 |
# Default: no
#ClamukoScanOnAccess yes |
28e73e95 |
# Set access mask for Clamuko. |
81837459 |
# Default: no
#ClamukoScanOnOpen yes
#ClamukoScanOnClose yes
#ClamukoScanOnExec yes |
28e73e95 |
|
f3a638e4 |
# Set the include paths (all files inside them will be scanned). You can have |
c6dbfbcb |
# multiple ClamukoIncludePath directives but each directory must be added
# in a seperate line.
# Default: disabled
#ClamukoIncludePath /home |
28e73e95 |
#ClamukoIncludePath /students
# Set the exclude paths. All subdirectories are also excluded. |
c6dbfbcb |
# Default: disabled |
81837459 |
#ClamukoExcludePath /home/bofh |
28e73e95 |
|
c6dbfbcb |
# Don't scan files larger than ClamukoMaxFileSize
# Value of 0 disables the limit.
# Default: 5M
#ClamukoMaxFileSize 10M |