RoboticCheese/clamav-chef

##
## Example config file for the Clam AV daemon
## Please read the clamd.conf(5) manual before editing this file.
##


# Comment or remove the line below.
#Example

# Uncomment this option to enable logging.
# LogFile must be writable for the user running daemon.
# A full path is required.
# Default: disabled
<%= @clamd["log_file"] ? "LogFile #{@clamd["log_file"]}" : "#LogFile /var/log/clamav/clamd.log" %>

# By default the log file is locked for writing - the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run
# the daemon with --config-file option).
# This option disables log file locking.
# Default: no
<%= @clamd["log_file_unlock"] ? "LogFileUnlock #{@clamd["log_file_unlock"]}" : "#LogFileUnlock yes" %>

# Maximum size of the log file.
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 1M
<%= @clamd["log_file_max_size"] ? "LogFileMaxSize #{@clamd["log_file_max_size"]}" : "LogFileMaxSize 1M" %>

# Log time with each message.
# Default: no
<%= @clamd["log_time"] ? "LogTime #{@clamd["log_time"]}" : "#LogTime yes" %>

# Also log clean files. Useful in debugging but drastically increases the
# log size.
# Default: no
<%= @clamd["log_clean"] ? "LogClean #{@clamd["log_clean"]}" : "#LogClean yes" %>

# Use system logger (can work together with LogFile).
# Default: no
<%= @clamd["log_syslog"] ? "LogSyslog #{@clamd["log_syslog"]}" : "#LogSyslog yes" %>

# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
# Default: LOG_LOCAL6
<%= @clamd["log_facility"] ? "LogFacility #{@clamd["log_facility"]}" : "#LogFacility LOG_MAIL" %>

# Enable verbose logging.
# Default: no
<%= @clamd["log_verbose"] ? "LogVerbose #{@clamd["log_verbose"]}" : "#LogVerbose yes" %>

# Log additional information about the infected file, such as its
# size and hash, together with the virus name.
<%= @clamd["extended_detection_info"] ? "ExtendedDetectionInfo #{@clamd["extended_detection_info"]}" : "#ExtendedDetectionInfo yes" %>

# This option allows you to save a process identifier of the listening
# daemon (main thread).
# Default: disabled
<%= @clamd["pid_file"] ? "PidFile #{@clamd["pid_file"]}" : "#PidFile /var/run/clamav/clamd.pid" %>

# Optional path to the global temporary directory.
# Default: system specific (usually /tmp or /var/tmp).
<%= @clamd["temporary_directory"] ? "TemporaryDirectory #{@clamd["temporary_directory"]}" : "TemporaryDirectory /tmp" %>

# Path to the database directory.
# Default: hardcoded (depends on installation options)
<%= @database_directory ? "DatabaseDirectory #{@database_directory}" : "DatabaseDirectory /var/clamav" %>

# Only load the official signatures published by the ClamAV project.
# Default: no
<%= @clamd["official_database_only"] ? "OfficialDatabaseOnly #{@clamd["official_database_only"]}" : "#OfficialDatabaseOnly no" %>

# The daemon can work in local mode, network mode or both. 
# Due to security reasons we recommend the local mode.

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
<%= @clamd["local_socket"] ? "LocalSocket #{@clamd["local_socket"]}" : "#LocalSocket /tmp/clamd" %>

# Sets the group ownership on the unix socket.
# Default: disabled (the primary group of the user running clamd)
<%= @clamd["local_socket_group"] ? "LocalSocketGroup #{@clamd["local_socket_group"]}" : "#LocalSocketGroup virusgroup" %>

# Sets the permissions on the unix socket to the specified mode.
# Default: disabled (socket is world accessible)
<%= @clamd["local_socket_mode"] ? "LocalSocketMode #{@clamd["local_socket_mode"]}" : "#LocalSocketMode 660" %>

# Remove stale socket after unclean shutdown.
# Default: yes
<%= @clamd["fix_stale_socket"] ? "FixStaleSocket #{@clamd["fix_stale_socket"]}" : "FixStaleSocket yes" %>

# TCP port address.
# Default: no
<%= @clamd["tcp_socket"] ? "TCPSocket #{@clamd["tcp_socket"]}" : "#TCPSocket 3310" %>

# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
# Default: no
<%= @clamd["tcp_addr"] ? "TCPAddr #{@clamd["tcp_addr"]}" : "#TCPAddr 127.0.0.1" %>

# Maximum length the queue of pending connections may grow to.
# Default: 200
<%= @clamd["max_connection_queue_length"] ? "MaxConnectionQueueLength #{@clamd["max_connection_queue_length"]}" : "MaxConnectionQueueLength 200" %>

# Clamd uses FTP-like protocol to receive data from remote clients.
# If you are using clamav-milter to balance load between remote clamd daemons
# on firewall servers you may need to tune the options below.

# Close the connection when the data size limit is exceeded.
# The value should match your MTA's limit for a maximum attachment size.
# Default: 25M
<%= @clamd["stream_max_length"] ? "StreamMaxLength #{@clamd["stream_max_length"]}" : "#StreamMaxLength 10M" %>

# Limit port range.
# Default: 1024
<%= @clamd["stream_min_port"] ? "StreamMinPort #{@clamd["stream_min_port"]}" : "#StreamMinPort 30000" %>
# Default: 2048
<%= @clamd["stream_max_port"] ? "StreamMaxPort #{@clamd["stream_max_port"]}" : "#StreamMaxPort 32000" %>

# Maximum number of threads running at the same time.
# Default: 10
<%= @clamd["max_threads"] ? "MaxThreads #{@clamd["max_threads"]}" : "#MaxThreads 50" %>

# Waiting for data from a client socket will timeout after this time (seconds).
# Default: 120
<%= @clamd["read_timeout"] ? "ReadTimeout #{@clamd["read_timeout"]}" : "#ReadTimeout 300" %>

# This option specifies the time (in seconds) after which clamd should
# timeout if a client doesn't provide any initial command after connecting.
# Default: 5
<%= @clamd["command_read_timeout"] ? "CommandReadTimeout #{@clamd["command_read_timeout"]}" : "#CommandReadTimeout 5" %>

# This option specifies how long to wait (in miliseconds) if the send buffer is full.
# Keep this value low to prevent clamd hanging
#
# Default: 500
<%= @clamd["send_buf_timeout"] ? "SendBufTimeout #{@clamd["send_buf_timeout"]}" : "#SendBufTimeout 200" %>

# Maximum number of queued items (including those being processed by MaxThreads threads)
# It is recommended to have this value at least twice MaxThreads if possible.
# WARNING: you shouldn't increase this too much to avoid running out  of file descriptors,
# the following condition should hold:
# MaxThreads*MaxRecursion + (MaxQueue - MaxThreads) + 6< RLIMIT_NOFILE (usual max is 1024)
#
# Default: 100
<%= @clamd["max_queue"] ? "MaxQueue #{@clamd["max_queue"]}" : "#MaxQueue 200" %>

# Waiting for a new job will timeout after this time (seconds).
# Default: 30
<%= @clamd["idle_timeout"] ? "IdleTimeout #{@clamd["idle_timeout"]}" : "#IdleTimeout 60" %>

# Don't scan files and directories matching regex
# This directive can be used multiple times
# Default: scan all
#ExcludePath ^/proc/
#ExcludePath ^/sys/
<% @clamd["exclude_paths"].each do |p| %>
<%= "ExcludePath #{p}" %>
<% end %>

# Maximum depth directories are scanned at.
# Default: 15
<%= @clamd["max_directory_recursion"] ? "MaxDirectoryRecursion #{@clamd["max_directory_recursion"]}" : "#MaxDirectoryRecursion 20" %>

# Follow directory symlinks.
# Default: no
<%= @clamd["follow_directory_symlinks"] ? "FollowDirectorySymlinks #{@clamd["follow_directory_symlinks"]}" : "#FollowDirectorySymlinks yes" %>

# Follow regular file symlinks.
# Default: no
<%= @clamd["follow_file_symlinks"] ? "FollowFileSymlinks #{@clamd["follow_file_symlinks"]}" : "#FollowFileSymlinks yes" %>

# Scan files and directories on other filesystems.
# Default: yes
<%= @clamd["cross_filesystems"] ? "CrossFilesystems #{@clamd["cross_filesystems"]}" : "#CrossFilesystems yes" %>

# Perform a database check.
# Default: 600 (10 min)
<%= @clamd["self_check"] ? "SelfCheck #{@clamd["self_check"]}" : "#SelfCheck 600" %>

# Execute a command when virus is found. In the command string %v will
# be replaced with the virus name.
# Default: no
<%= @clamd["virus_event"] ? "VirusEvent #{@clamd["virus_event"]}" : "#VirusEvent /usr/local/bin/send_sms 123456789 \"VIRUS ALERT: %v\"" %>

# Run as another user (clamd must be started by root for this option to work)
# Default: don't drop privileges
<%= @user ? "User #{@user}" : "User clamav" %>

# Initialize supplementary group access (clamd must be started by root).
# Default: no
<%= @allow_supplementary_groups ? "AllowSupplementaryGroups #{@allow_supplementary_groups}" : "#AllowSupplementaryGroups yes" %>

# Stop daemon when libclamav reports out of memory condition.
<%= @clamd["exit_on_oom"] ? "ExitOnOOM #{@clamd["exit_on_oom"]}" : "#ExitOnOOM yes" %>

# Don't fork into background.
# Default: no
<%= @clamd["foreground"] ? "Foreground #{@clamd["foreground"]}" : "#Foreground yes" %>

# Enable debug messages in libclamav.
# Default: no
<%= @clamd["debug"] ? "Debug #{@clamd["debug"]}" : "#Debug yes" %>

# Do not remove temporary files (for debug purposes).
# Default: no
<%= @clamd["leave_temporary_files"] ? "LeaveTemporaryFiles #{@clamd["leave_temporary_files"]}" : "#LeaveTemporaryFiles yes" %>

# Detect Possibly Unwanted Applications.
# Default: no
<%= @clamd["detect_pua"] ? "DetectPUA #{@clamd["detect_pua"]}" : "#DetectPUA yes" %>

# Exclude a specific PUA category. This directive can be used multiple times.
# See http://www.clamav.net/support/pua for the complete list of PUA
# categories.
# Default: Load all categories (if DetectPUA is activated)
#ExcludePUA NetTool
#ExcludePUA PWTool
<% @clamd["exclude_puas"].each do |ep| %>
<%= "ExcludePUA #{ep}" %>
<% end %>

# Only include a specific PUA category. This directive can be used multiple
# times.
# Default: Load all categories (if DetectPUA is activated)
#IncludePUA Spy
#IncludePUA Scanner
#IncludePUA RAT
<% @clamd["include_puas"].each do |ip| %>
<%= "IncludePUA #{ip}" %>
<% end %>

# In some cases (eg. complex malware, exploits in graphic files, and others),
# ClamAV uses special algorithms to provide accurate detection. This option
# controls the algorithmic detection.
# Default: yes
<%= @clamd["algorithmic_detection"] ? "AlgorithmicDetection #{@clamd["algorithmic_detection"]}" : "#AlgorithmicDetection yes" %>


##
## Executable files
##

# PE stands for Portable Executable - it's an executable file format used
# in all 32 and 64-bit versions of Windows operating systems. This option allows
# ClamAV to perform a deeper analysis of executable files and it's also
# required for decompression of popular executable packers such as UPX, FSG,
# and Petite. If you turn off this option, the original files will still be
# scanned, but without additional processing.
# Default: yes
<%= @clamd["scan_pe"] ? "ScanPE #{@clamd["scan_pe"]}" : "ScanPE yes" %>

# Executable and Linking Format is a standard format for UN*X executables.
# This option allows you to control the scanning of ELF files.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
<%= @clamd["scan_elf"] ? "ScanELF #{@clamd["scan_elf"]}" : "ScanELF yes" %>

# With this option clamav will try to detect broken executables (both PE and
# ELF) and mark them as Broken.Executable.
# Default: no
<%= @clamd["detect_broken_executables"] ? "DetectBrokenExecutables #{@clamd["detect_broken_executables"]}" : "DetectBrokenExecutables no" %>


##
## Documents
##

# This option enables scanning of OLE2 files, such as Microsoft Office
# documents and .msi files.
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
# Default: yes
<%= @clamd["scan_ole2"] ? "ScanOLE2 #{@clamd["scan_ole2"]}" : "ScanOLE2 yes" %>


# With this option enabled OLE2 files with VBA macros, which were not
# detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros".
# Default: no
<%= @clamd["ole2_block_macros"] ? "OLE2BlockMacros #{@clamd["ole2_block_macros"]}" : "#OLE2BlockMacros no" %>

# This option enables scanning within PDF files.
# If you turn off this option, the original files will still be scanned, but
# without decoding and additional processing.
# Default: yes
<%= @clamd["scan_pdf"] ? "ScanPDF #{@clamd["scan_pdf"]}" : "#ScanPDF yes" %>


##
## Mail files
##

# Enable internal e-mail scanner.
# If you turn off this option, the original files will still be scanned, but
# without parsing individual messages/attachments.
# Default: yes
<%= @clamd["scan_mail"] ? "ScanMail #{@clamd["scan_mail"]}" : "ScanMail yes" %>

# Scan RFC1341 messages split over many emails.
# You will need to periodically clean up $TemporaryDirectory/clamav-partial directory.
# WARNING: This option may open your system to a DoS attack.
#       Never use it on loaded servers.
# Default: no
<%= @clamd["scan_partial_messages"] ? "ScanPartialMessages #{@clamd["scan_partial_messages"]}" : "#ScanPartialMessages yes" %>


# With this option enabled ClamAV will try to detect phishing attempts by using
# signatures.
# Default: yes
<%= @clamd["phishing_signatures"] ? "PhishingSignatures #{@clamd["phishing_signatures"]}" : "#PhishingSignatures yes" %>

# Scan URLs found in mails for phishing attempts using heuristics.
# Default: yes
<%= @clamd["phishing_scan_urls"] ? "PhishingScanURLs #{@clamd["phishing_scan_urls"]}" : "#PhishingScanURLs yes" %>

# Always block SSL mismatches in URLs, even if the URL isn't in the database.
# This can lead to false positives.
#
# Default: no
<%= @clamd["phishing_always_block_ssl_mismatch"] ? "PhishingAlwaysBlockSSLMismatch #{@clamd["phishing_always_block_ssl_mismatch"]}" : "#PhishingAlwaysBlockSSLMismatch no" %>

# Always block cloaked URLs, even if URL isn't in database.
# This can lead to false positives.
#
# Default: no
<%= @clamd["phishing_always_block_cloak"] ? "PhishingAlwaysBlockCloak #{@clamd["phishing_always_block_cloak"]}" : "#PhishingAlwaysBlockCloak no" %>

# Allow heuristic match to take precedence.
# When enabled, if a heuristic scan (such as phishingScan) detects
# a possible virus/phish it will stop scan immediately. Recommended, saves CPU
# scan-time.
# When disabled, virus/phish detected by heuristic scans will be reported only at
# the end of a scan. If an archive contains both a heuristically detected
# virus/phish, and a real malware, the real malware will be reported
#
# Keep this disabled if you intend to handle "*.Heuristics.*" viruses 
# differently from "real" malware.
# If a non-heuristically-detected virus (signature-based) is found first, 
# the scan is interrupted immediately, regardless of this config option.
#
# Default: no
<%= @clamd["heuristic_scan_precedence"] ? "HeuristicScanPrecedence #{@clamd["heuristic_scan_precedence"]}" : "#HeuristicScanPrecedence yes" %>

##
## Data Loss Prevention (DLP)
##

# Enable the DLP module
# Default: No
<%= @clamd["structured_data_detection"] ? "StructuredDataDetection #{@clamd["structured_data_detection"]}" : "#StructuredDataDetection yes" %>

# This option sets the lowest number of Credit Card numbers found in a file
# to generate a detect.
# Default: 3
<%= @clamd["structured_min_credit_card_count"] ? "StructuredMinCreditCardCount #{@clamd["structured_min_credit_card_count"]}" : "#StructuredMinCreditCardCount 5" %>

# This option sets the lowest number of Social Security Numbers found
# in a file to generate a detect.
# Default: 3
<%= @clamd["structured_min_ssn_count"] ? "StructuredMinSSNCount #{@clamd["structured_min_ssn_count"]}" : "#StructuredMinSSNCount 5" %>

# With this option enabled the DLP module will search for valid
# SSNs formatted as xxx-yy-zzzz
# Default: yes
<%= @clamd["structured_ssn_format_normal"] ? "StructuredSSNFormatNormal #{@clamd["structured_ssn_format_normal"]}" : "#StructuredSSNFormatNormal yes" %>

# With this option enabled the DLP module will search for valid
# SSNs formatted as xxxyyzzzz
# Default: no
<%= @clamd["structured_ssn_format_stripped"] ? "StructuredSSNFormatStripped #{@clamd["structured_ssn_format_stripped"]}" : "#StructuredSSNFormatStripped yes" %>


##
## HTML
##

# Perform HTML normalisation and decryption of MS Script Encoder code.
# Default: yes
# If you turn off this option, the original files will still be scanned, but
# without additional processing.
<%= @clamd["scan_html"] ? "ScanHTML #{@clamd["scan_html"]}" : "#ScanHTML yes" %>


##
## Archives
##

# ClamAV can scan within archives and compressed files.
# If you turn off this option, the original files will still be scanned, but
# without unpacking and additional processing.
# Default: yes
<%= @clamd["scan_archive"] ? "ScanArchive #{@clamd["scan_archive"]}" : "ScanArchive yes" %>

# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
# Default: no
<%= @clamd["archive_block_encrypted"] ? "ArchiveBlockEncrypted #{@clamd["archive_block_encrypted"]}" : "ArchiveBlockEncrypted no" %>


##
## Limits
##

# The options below protect your system against Denial of Service attacks
# using archive bombs.

# This option sets the maximum amount of data to be scanned for each input file.
# Archives and other containers are recursively extracted and scanned up to this
# value.
# Value of 0 disables the limit
# Note: disabling this limit or setting it too high may result in severe damage
# to the system.
# Default: 100M
<%= @clamd["max_scan_size"] ? "MaxScanSize #{@clamd["max_scan_size"]}" : "#MaxScanSize 150M" %>

# Files larger than this limit won't be scanned. Affects the input file itself
# as well as files contained inside it (when the input file is an archive, a
# document or some other kind of container).
# Value of 0 disables the limit.
# Note: disabling this limit or setting it too high may result in severe damage
# to the system.
# Default: 25M
<%= @clamd["max_file_size"] ? "MaxFileSize #{@clamd["max_file_size"]}" : "#MaxFileSize 30M" %>

# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
# file, all files within it will also be scanned. This options specifies how
# deeply the process should be continued.
# Note: setting this limit too high may result in severe damage to the system.
# Default: 16
<%= @clamd["max_recursion"] ? "MaxRecursion #{@clamd["max_recursion"]}" : "#MaxRecursion 10" %>

# Number of files to be scanned within an archive, a document, or any other
# container file.
# Value of 0 disables the limit.
# Note: disabling this limit or setting it too high may result in severe damage
# to the system.
# Default: 10000
<%= @clamd["max_files"] ? "MaxFiles #{@clamd["max_files"]}" : "#MaxFiles 15000" %>


##
## Clamuko settings
##

# The number of scanner threads that will be started (DazukoFS only).
# Having multiple scanner threads allows Clamuko to serve multiple
# processes simultaneously. This is particularly beneficial on SMP machines.
# Default: 3
<%= @clamd["clamuko_scanner_count"] ? "ClamukoScannerCount #{@clamd["clamuko_scanner_count"]}" : "#ClamukoScannerCount 3" %>

# Don't scan files larger than ClamukoMaxFileSize
# Value of 0 disables the limit.
# Default: 5M
<%= @clamd["clamuko_max_file_size"] ? "ClamukoMaxFileSize #{@clamd["clamuko_max_file_size"]}" : "#ClamukoMaxFileSize 10M" %>

# Set access mask for Clamuko (Dazuko only).
# Default: no
<%= @clamd["clamuko_scan_on_open"] ? "ClamukoScanOnOpen #{@clamd["clamuko_scan_on_open"]}" : "#ClamukoScanOnOpen yes" %>
<%= @clamd["clamuko_scan_on_close"] ? "ClamukoScanOnClose #{@clamd["clamuko_scan_on_close"]}" : "#ClamukoScanOnClose yes" %>
<%= @clamd["clamuko_scan_on_exec"] ? "ClamukoScanOnExec #{@clamd["clamuko_scan_on_exec"]}" : "#ClamukoScanOnExec yes" %>

# Set the include paths (all files inside them will be scanned). You can have
# multiple ClamukoIncludePath directives but each directory must be added
# in a seperate line. (Dazuko only)
# Default: disabled
#ClamukoIncludePath /home
#ClamukoIncludePath /students
<% @clamd["clamuko_include_paths"].each do |cip| %>
<%= "ClamukoIncludePath #{cip}" %>
<% end %>

# Set the exclude paths. All subdirectories are also excluded. (Dazuko only)
# Default: disabled
#ClamukoExcludePath /home/bofh
<% @clamd["clamuko_exclude_paths"].each do |cep| %>
<%= "ClamukoExcludePath #{cep}" %>
<% end %>

# With this option you can whitelist specific UIDs. Processes with these UIDs
# will be able to access all files.
# This option can be used multiple times (one per line).
# Default: disabled
#ClamukoExcludeUID 0
<% @clamd["clamuko_exclude_uids"].each do |ceu| %>
<%= "ClamukoExcludeUID #{ceu}" %>
<% end %>

# With this option enabled ClamAV will load bytecode from the database. 
# It is highly recommended you keep this option on, otherwise you'll miss detections for many new viruses.
# Default: yes
<%= @bytecode ? "Bytecode #{@bytecode}" : "#Bytecode yes" %>

# Set bytecode security level.
# Possible values:
#       None - no security at all, meant for debugging. DO NOT USE THIS ON PRODUCTION SYSTEMS
#         This value is only available if clamav was built with --enable-debug!
#       TrustSigned - trust bytecode loaded from signed .c[lv]d files,
#                insert runtime safety checks for bytecode loaded from other sources
#       Paranoid - don't trust any bytecode, insert runtime checks for all
# Recommended: TrustSigned, because bytecode in .cvd files already has these checks
# Note that by default only signed bytecode is loaded, currently you can only
# load unsigned bytecode in --enable-debug mode.
#
# Default: TrustSigned
<%= @clamd["bytecode_security"] ? "BytecodeSecurity #{@clamd["bytecode_security"]}" : "#BytecodeSecurity TrustSigned" %>

# Set bytecode timeout in miliseconds.
# 
# Default: 5000
<%= @clamd["bytecode_timeout"] ? "BytecodeTimeout #{@clamd["bytecode_timeout"]}" : "#BytecodeTimeout 1000" %>