How To Install ClamAV on Rocky Linux 10

In this tutorial, we will show you how to install ClamAV on Rocky Linux 10. ClamAV stands as one of the most trusted open-source antivirus solutions available for Linux systems today. This powerful antivirus engine provides robust protection against trojans, viruses, malware, and other malicious threats that can compromise your Rocky Linux 10 server. Whether you’re managing a single server or an entire enterprise infrastructure, implementing ClamAV ensures your systems remain secure and operational.

Rocky Linux 10, being an enterprise-grade distribution, demands reliable security solutions. ClamAV perfectly fills this role by offering free, regularly updated virus definitions and comprehensive scanning capabilities. This guide will walk you through every aspect of installing, configuring, and optimizing ClamAV on your Rocky Linux 10 system, ensuring you have enterprise-level antivirus protection without the commercial licensing costs.

Prerequisites and System Requirements

Before diving into the ClamAV installation process, ensure your Rocky Linux 10 environment meets the necessary requirements. A fresh Rocky Linux 10 installation provides the optimal foundation for this setup, though existing systems work equally well with proper preparation.

Your system requires root privileges or sudo access to execute the installation commands successfully. The minimum system requirements include at least 2GB of RAM for optimal performance, though 4GB provides better scanning efficiency for larger filesystems. Disk space requirements vary depending on your scanning needs, but allocating at least 10GB ensures adequate space for virus definitions, logs, and quarantine storage.

Internet connectivity remains essential throughout the installation process. ClamAV downloads virus definition databases from external sources, and the initial database download can be substantial. SSH access or direct terminal access enables remote administration, while basic Linux command-line knowledge helps navigate the configuration process smoothly.

Understanding ClamAV Architecture and Components

ClamAV operates through several interconnected components that work together to provide comprehensive antivirus protection. Understanding these components helps optimize your installation and troubleshoot potential issues effectively.

The clamscan utility serves as the primary command-line scanner, enabling on-demand file and directory scanning. This component handles individual scan requests and provides detailed output about detected threats. System administrators frequently use clamscan for manual security audits and scheduled maintenance scans.

Clamd functions as the background daemon, providing real-time scanning capabilities and improved performance through persistent memory usage. This daemon processes scan requests more efficiently than standalone clamscan operations, making it ideal for high-volume scanning scenarios.

Freshclam manages virus definition updates automatically, ensuring your system maintains current threat protection. This component downloads and installs the latest virus signatures from ClamAV’s update servers, typically updating multiple times daily to combat emerging threats.

The clamav-milter component integrates with email servers, providing email scanning capabilities for mail systems like Postfix and Sendmail. This integration enables real-time email threat detection without impacting mail flow performance.

ClamAV’s database structure utilizes signature-based detection methods, storing virus definitions in compressed formats to minimize disk usage while maximizing detection capabilities. Performance considerations vary based on scanning frequency, file system size, and available system resources.

Step-by-Step Installation Process

System Update and EPEL Repository Configuration

Begin the installation process by updating your Rocky Linux 10 system to ensure all packages remain current and compatible. Execute the system update command to refresh package repositories and install available updates:

sudo dnf update -y

This command downloads and installs all available package updates, establishing a stable foundation for the ClamAV installation.

ClamAV packages reside in the Extra Packages for Enterprise Linux (EPEL) repository rather than Rocky Linux’s default repositories. Install the EPEL repository using the following command:

sudo dnf install epel-release -y

Verify the EPEL installation by checking the available repositories:

sudo dnf repolist

The output should display the EPEL repository among the enabled repositories, confirming successful installation and access to ClamAV packages.

Installing ClamAV Core Packages

With EPEL properly configured, proceed to install the essential ClamAV packages. The installation requires multiple packages to ensure complete functionality:

sudo dnf install clamav clamd clamav-update clamav-filesystem clamav-data -y

This comprehensive installation includes the core ClamAV engine, daemon services, update utilities, and necessary filesystem components. The installation process downloads approximately 50-100MB of packages, depending on existing system dependencies.

Verify the installation success by checking the installed ClamAV version:

clamscan --version

The command output displays the ClamAV version, build date, and signature database information, confirming successful installation.

User and Group Configuration

ClamAV automatically creates dedicated user and group accounts during installation, following security best practices for service isolation. These accounts limit ClamAV’s system access to necessary resources only, reducing potential security risks.

Verify the ClamAV user creation:

id clamav

The output confirms the clamav user exists with appropriate group memberships and system privileges for antivirus operations.

Initial Configuration and Database Setup

Virus Definition Database Initialization

ClamAV requires current virus definitions before performing any scanning operations. The initial database remains empty, necessitating an immediate update through freshclam.

Stop the freshclam service temporarily to perform manual database initialization:

sudo systemctl stop clamav-freshclam

Execute the initial virus definition download:

sudo freshclam

The freshclam process downloads several database files, including main.cvd, daily.cvd, and bytecode.cvd. This initial download typically requires 10-20 minutes depending on internet connection speed, as the complete database exceeds 100MB.

Monitor the download progress through the detailed output freshclam provides. Successful completion displays database version information and total signatures loaded.

SELinux Configuration for ClamAV

Rocky Linux 10 ships with SELinux enabled by default, requiring specific policy adjustments for ClamAV operation. Check your current SELinux status:

sestatus

If SELinux shows as “enabled” or “enforcing,” configure the necessary boolean settings:

sudo setsebool -P antivirus_can_scan_system 1
sudo setsebool -P clamd_use_jit 1

These settings permit ClamAV to access system files for scanning while maintaining SELinux security policies. The -P flag makes these changes persistent across system reboots.

Configuration File Modifications

ClamAV ships with example configuration files requiring customization before operation. Edit the main daemon configuration file:

sudo nano /etc/clamd.d/scan.conf

Comment out or remove the “Example” line near the beginning of the file, as this line prevents the daemon from starting. Additionally, locate and uncomment the LocalSocket configuration:

LocalSocket /var/run/clamd.scan/clamd.sock

Similarly, modify the freshclam configuration:

sudo nano /etc/freshclam.conf

Comment out the “Example” line in this file as well to enable automatic updates.

Service Management and Automation

Systemd Service Configuration

Rocky Linux 10 utilizes systemd for service management, requiring proper service enablement for automatic ClamAV operation. Enable and start the freshclam service for automatic virus definition updates:

sudo systemctl enable --now clamav-freshclam

Enable the ClamAV daemon service:

sudo systemctl enable --now clamd@scan

Verify both services are running correctly:

sudo systemctl status clamav-freshclam
sudo systemctl status clamd@scan

Both services should display “active (running)” status, indicating successful configuration and operation.

Automated Database Updates

Freshclam automatically schedules virus definition updates, but you can customize the update frequency by modifying the freshclam configuration file. The default configuration updates virus definitions several times daily, providing current threat protection.

Monitor update logs to ensure proper functionality:

sudo tail -f /var/log/clamav/freshclam.log

This log file records all update attempts, successful downloads, and any encountered errors during the update process.

Comprehensive Scanning Operations

Basic Command-Line Scanning

ClamAV provides extensive scanning options through the clamscan command. Perform a basic file scan:

clamscan /path/to/file

Scan an entire directory recursively:

clamscan -r /path/to/directory

Execute a comprehensive system scan with detailed output:

sudo clamscan -r --bell -i --log=/var/log/clamav/scan.log /

This command performs recursive scanning (-r), rings the system bell for infected files (--bell), displays only infected files (-i), and logs results to a specified file.

Advanced Scanning Configuration

Optimize scanning performance by excluding specific file types or directories. Create an exclusion file listing directories to skip:

echo "/proc" >> /etc/clamav/exclude.txt
echo "/sys" >> /etc/clamav/exclude.txt
echo "/dev" >> /etc/clamav/exclude.txt

Use the exclusion file during scanning:

sudo clamscan -r --exclude-dir="$(cat /etc/clamav/exclude.txt | tr '\n' '|' | sed 's/|$//')" /

This approach improves scanning efficiency by skipping virtual filesystems and other non-essential directories.

Real-Time Protection Implementation

Configure real-time scanning using the ClamAV daemon for continuous protection. The daemon provides faster scanning performance through persistent memory usage and immediate threat detection.

Test daemon connectivity:

clamdscan --ping

Perform daemon-based scanning:

clamdscan --multiscan --fdpass /path/to/scan

The --multiscan option enables multi-threaded scanning for improved performance, while --fdpass uses file descriptor passing for enhanced security.

Automation and Maintenance Strategies

Scheduled Scanning with Cron

Implement automated scanning schedules using cron jobs for consistent system protection. Create a comprehensive scanning script:

sudo nano /usr/local/bin/clamav-scan.sh

Add the following script content:

#!/bin/bash
LOGFILE="/var/log/clamav/scheduled-scan.log"
EMAILTO="admin@yourdomain.com"

echo "Starting ClamAV scan: $(date)" >> $LOGFILE
clamscan -r --bell -i / >> $LOGFILE 2>&1

if [ $? -eq 1 ]; then
    echo "Threats detected during scan" | mail -s "ClamAV Alert" $EMAILTO
fi

echo "Scan completed: $(date)" >> $LOGFILE

Make the script executable:

sudo chmod +x /usr/local/bin/clamav-scan.sh

Configure a daily scan schedule:

sudo crontab -e

Add the following cron entry for daily 2 AM scanning:

0 2 * * * /usr/local/bin/clamav-scan.sh

Monitoring and Alert Configuration

Implement comprehensive monitoring to track ClamAV performance and threat detection. Configure log rotation to manage disk space:

sudo nano /etc/logrotate.d/clamav

Add log rotation configuration:

/var/log/clamav/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
}

Create a monitoring script to check service status:

#!/bin/bash
if ! systemctl is-active --quiet clamd@scan; then
    echo "ClamAV daemon is not running" | mail -s "ClamAV Service Alert" admin@yourdomain.com
fi

if ! systemctl is-active --quiet clamav-freshclam; then
    echo "Freshclam service is not running" | mail -s "Freshclam Service Alert" admin@yourdomain.com
fi

Troubleshooting Common Issues

Installation and Repository Problems

EPEL repository access issues occasionally occur due to network connectivity or repository configuration problems. Verify EPEL installation and configuration:

sudo dnf clean all
sudo dnf makecache

If package installation fails, check available ClamAV packages:

sudo dnf search clamav

Dependency conflicts may arise with existing packages. Resolve conflicts by updating all packages before ClamAV installation:

sudo dnf update -y
sudo dnf autoremove

Service Configuration Issues

Freshclam update failures commonly result from network connectivity issues or server overload. Check the freshclam log for specific error messages:

sudo tail -n 50 /var/log/clamav/freshclam.log

DNS resolution problems can prevent database updates. Test connectivity to ClamAV update servers:

nslookup database.clamav.net

Service startup problems often stem from configuration file errors. Validate configuration syntax:

sudo clamd -c /etc/clamd.d/scan.conf --config-check

Performance Optimization

High CPU usage during scans affects system performance. Limit scanning impact by adjusting process priority:

nice -n 19 clamscan -r /path/to/scan

Memory consumption optimization involves adjusting daemon settings in the configuration file:

MaxThreads 4
MaxQueue 200

These settings balance performance with resource usage for typical server environments.

Security Best Practices and Compliance

Regular Maintenance Procedures

Maintain ClamAV effectiveness through consistent update schedules and monitoring. Virus definitions typically update multiple times daily, requiring reliable internet connectivity and sufficient disk space.

Implement database integrity verification:

sigtool --info /var/lib/clamav/main.cvd

This command displays database version, signatures count, and creation date, confirming database validity.

Integration with Security Systems

ClamAV integrates with various security tools and monitoring systems. Configure rsyslog to centralize ClamAV logs:

sudo nano /etc/rsyslog.d/49-clamav.conf

Add log forwarding configuration:

$ModLoad imfile
$InputFileName /var/log/clamav/clamav.log
$InputFileTag clamav:
$InputFileStateFile stat-clamav
$InputFileSeverity info
$InputFileFacility local6
$InputRunFileMonitor
local6.* @@log-server:514

Backup and Recovery Considerations

Implement comprehensive backup strategies including ClamAV configuration files, custom scripts, and quarantine directories. Critical files for backup include:

• /etc/clamd.d/scan.conf
• /etc/freshclam.conf
• Custom scanning scripts
• Quarantine directory contents
• Log files for audit purposes

Regular configuration backups ensure rapid recovery following system failures or security incidents.

Advanced Configuration Options

Email Integration Setup

Configure ClamAV for email scanning integration with mail servers. Install the milter component:

sudo dnf install clamav-milter -y

Configure Postfix integration by editing the main configuration:

sudo nano /etc/postfix/main.cf

Add milter configuration:

smtpd_milters = unix:/var/run/clamav-milter/clamav-milter.sock
milter_default_action = tempfail

This configuration enables real-time email scanning without impacting mail flow performance.

Network Scanning Configuration

Configure ClamAV for network-based scanning operations. Edit the daemon configuration to enable network access:

sudo nano /etc/clamd.d/scan.conf

Add network socket configuration:

TCPSocket 3310
TCPAddr 127.0.0.1

This configuration enables remote scanning requests while maintaining security through localhost binding.

Congratulations! You have successfully installed ClamAV. Thanks for using this tutorial for installing ClamAV open-source antivirus on your Rocky Linux 10 system. For additional help or useful information, we recommend you check the official ClamAV website.