clamonaccess (ClamAV on-access scanning) setup for Ubuntu 20.04 LTS

clamonaccess.md

You need clamav installed and running.

apt install clamav

Verify with:

systemctl status clamav-daemon | grep Active
  Active: active (running) since Mon 2023-07-10 14:25:52 CEST; 1h 0min ago

You need to set up aclamonaccess systemd service:

1. Switch to admin user or similar, you will need to create files as root. sudo is fine.
2. Edit /etc/clamav/clamd.conf, make sure the following lines are present (at least on 20.04.6 they need to be added). Add them anywhere:

OnAccessExcludeUname clamav
OnAccessIncludePath /home
OnAccessPrevention true

3. Go to /etc/systemd/system
4. Create a /etc/systemd/system/clamonaccess.service file with the following contents:

Description=ClamAV On-Access Scanning
After=clamav-daemon.service
Wants=clamav-daemon.service

[Service]
ExecStart=/usr/sbin/clamonacc --foreground --fdpass --remove
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

4. Run systemctl daemon-reload
5. Run systemctl start clamonaccess
6. Verify that it started with systemctl status clamonaccess and/or view logs with journalctl -fu clamonaccess (make sure you are root to view all messages).

Testing malicious downloads

https://ceplus.getcybersmart.co.uk/ Go there, tell your webpage it's cool to go forward. Then go to AMTSO link and click on the eircar.com link. File should be downloaded, but once you look for it on disk it should be gone.

Password is ceplus