ClamAV Scanning On Loopback, Signatures Kept Current

clamav

ClamAV from EPEL: the clamd scanning daemon on a local socket and loopback TCP, with freshclam keeping the signatures current, for clamdscan on the host and for any client that speaks INSTREAM. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No download, and no version to pin. EL 10 packages clamd in EPEL, so the role installs it by name and takes what the distribution ships: a security update arrives through dnf, not through a new release of this role. What the role owns is the configuration and the proof that the service works.

The distribution's unit, our configuration. The role installs clamav, clamd, writes the configuration the package leaves open, and enables the unit the package ships: systemctl cat clamd@scan shows the distribution's own unit, not one this role invented. The listener is 127.0.0.1:3310 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

Every ClamAV unit ships disabled, freshclam's included, and clamd refuses to start without signatures. The role fetches the first set before enabling the daemon (113 MB, 25-40 s in the lane) and then enables clamav-freshclam, so a host never runs a scanner that cannot be updated. Plan for memory: with the full signature set clamd held about 1 GB RSS.

A size limit fails open on two of three paths. clamd does not scan past MaxFileSize. Measured with clamav_max_file_size at 10 bytes, the EICAR test file came back OK, exit 0, through clamdscan --fdpass and through clamdscan --stream; only a client that sent the whole file over INSTREAM got an error (INSTREAM size limit exceeded). So clamdscan sends no more than StreamMaxLength - the role sets both limits from one variable - and clamd never sees a limit crossed. clamav_alert_exceeds_max: true (AlertExceedsMax) reports a skipped file as Heuristics.Limits.Exceeded.MaxFileSize on the --fdpass path and changes nothing on the --stream path, also measured. It is off by default, as upstream, because it flags every legitimate file over the limit as well. Keep the limit above the largest file you need scanned.

Proven on EICAR, without carrying it. The live test decodes the standard EICAR test file on the target - no file in this role contains the string, so neither your antivirus nor ours flags the role - and asserts the signature BY NAME through clamdscan --fdpass, clamdscan --stream and a raw INSTREAM over TCP, with a clean file reported OK both ways. A bare FOUND would not do: a skipped file prints it too, as a heuristic.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.