Installing and configuring ClamAV on Ubuntu

On a dedicated server or VPS, it is important to maintain system security and regularly check for malware.

ClamAV is a free solution that allows for both manual and automatic database updates as well as file scanning. This article guides the process of installing, configuring, updating, and removing ClamAV on Debian and Ubuntu.

Install and configure ClamAV

To install the antivirus on a server running Debian or Ubuntu, execute the following command:

sudo apt install clamav clamav-daemon

After installation, it is recommended to configure automatic database updates and regular system scans.

Update antivirus databases

To update antivirus databases manually, follow these steps:

1. Stop the automatic update service:

sudo systemctl stop clamav-freshclam

2. Update the databases:

sudo freshclam

3. After the update is complete, restart the automatic update service:

sudo systemctl start clamav-freshclam

If you want to update the databases manually, download the files main.cvd, daily.cvd, and bytecode.cvd from the official ClamAV website.

4. Move the downloaded files in the /var/lib/clamav/ folder:

cp ~/Downloads/*.cvd /var/lib/clamav/

5. Set the correct owner and permissions:

chown clamav:clamav /var/lib/clamav/*.cvd
chmod 644 /var/lib/clamav/*.cvd

6. To ensure the databases are reloaded, restart the ClamAV service:

sudo systemctl restart clamav

To check the antivirus version, run the command:

clamd --version

Example output:

root@host:~# clamd --version
ClamAV 0.103.5

ClamTK graphical utility interface

If you prefer to work through a graphical interface, install ClamTK — a convenient tool for managing ClamAV.

The utility is available in the official repositories:

sudo apt install clamtk

Automating scanning in ClamAV

To schedule automatic scanning, add the appropriate script to cron.

Cron is a tool for automating task execution on the server at specified intervals.

Edit the cron jobs:

# crontab -e

Add the following line for daily execution:

39 3 1-5 * * /root/clamav.sh

In this example 39 3 1-5 * * /root/clamav.sh:

• 39 — minutes.
• 3 — hours.
• 1-5 — days of the month (from the 1st to the 5th of each month).
• The remaining asterisks — execution every month and every day of the week, respectively.

Thus, this line will configure Cron to run the clamav.sh script daily at 3:39 AM from the 1st to the 5th of each month.

Remove ClamAV

If you need to remove the antivirus, run the following commands:

sudo apt remove clamav clamav-daemon

If you manually downloaded the databases, remove them as well:

sudo rm -Rf /var/lib/clamav