File clamd-README of Package clamav

To create individual clamd-instance take the following files and
modify/copy them in the suggested way:

clamd.conf:
  * set LocalSocket (or better: TCPSocket) and User to suitable values;
    avoid PidFile unless it is required by system monitoring or something
    else. Logging through syslog is usually better than an individual
    Logfile.
  * place this file into /etc/clamd.d with an unique service-name;
    e.g. as /etc/clamd.d/<SERVICE>.conf

When using TCPSocket, create iptables rules which are limiting the
  access by source and/or by using '-m owner'.

When LogFile feature is wanted, it must be writable for the assigned
  User. Recommended way to reach this, is to:
  * make it owned by the User's *group*
  * assign at least 0620 (u+rw,g+w) permissions

A suitable command might be
  | # touch <logfile>
  | # chgrp <user> <logfile>
  | # chmod 0620   <logfile>
  | # restorecon <logfile>

NEVER use 'clamav' as the user since he can modify the database.
  This is the user who is running the application; e.g. for mimedefang
  (http://www.roaringpenguin.com/mimedefang), the user might be
  'defang'.Theoretically, distinct users could be used, but it must be
  made sure that the application-user can write into the socket-file,
  and that the clamd-user can access the files asked by the
  application to be checked.

clamd.logrotate: (only when LogFile feature is used)
  * set the correct value for the logfile
  * place it into /etc/logrotate.d

clamd@<SERVICE>.service: (systemd instance)
  * instance of clamd@.service

Additionally, when using LocalSocket instead of TCPSocket, the directory
for the socket file must be created.  For tmpfiles based systems, you
might want to create a file /usr/lib/tmpfiles.d/clamd.<SERVICE>.conf
with a content of

| d /var/run/clamd.<SERVICE> <MODE> <USER> <GROUP>

Adjust <MODE> (0710 should suffice for most cases) and <USER> + <GROUP>
so that the socket can be accessed by clamd and by the applications
using clamd. Make sure that the socket is not world accessible; else,
DOS attacks or worse are trivial.

[Disclaimer:
 this file and the script/configfiles are not part of the official
 clamav package.

Please send complaints and comments to
 mailto:enrico.scholz@informatik.tu-chemnitz.de!]