On Fri, Feb 27, 2004 at 11:16:23PM -0500, jef moskot wrote:
> I know this has been asked a long time ago, but with all the new mirrors
> up and the recent barrage of new worms, I've been wondering what the
> ClamAV team suggests for a reasonable update rate?
>
> One of my users has suggested once every 5 minutes, but that sounds
> excessive and would probably be a bad idea if EVERYONE did that.
>
> So, what would the ClamAV team prefer?
I have a script that I run once an hour (at a random minute):
#!/bin/bash
export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin
if [ /usr/users/erik/Mail/clamav-virusdb -nt /usr/local/var/clamav-updated ]
then
touch /usr/local/var/clamav-updated
freshclam > /dev/null
fi
I use procmail to put mails from the clamav-virusdb list in the folder
above.
This way I update within one hour if there is an update, otherwise
nothing happens. You could up this to once every half hour without
overloading the servers I think.
Just in case, I update once a day even if nothing arrives on the list.
A useful addition would be if the mails to the virusdb list were
always signed with the same PGP key, otherwise there's an obvious
DoS on this scheme if it caught on.
As an alternative, the mails could contain a signed attachment
that actually contained the update.
This will give you a random minute to put in your crontab file:
awk 'BEGIN{srand(systime()); print int(rand()*59+1)}'
Alternatively just look at the clock at the moment you edit the
crontab file and use that...
--
Erik Corry I'd be a Libertarian, if they weren't all a
[EMAIL PROTECTED] bunch of tax-dodging professional whiners. - B. Breathed.
-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
