Up clam ex.sh

#!/bin/sh

# update_clamd_extra_sigs.sh v0.2 by Dan Larsson <dl|at|tyfon|dot|net>
# ==============================================================================
# LICENSE
# ==============================================================================
# "THE BEER-WARE LICENSE" (Revision 42):
# <dl|at|tyfon|dot|net> wrote this file. As long as you retain this
# notice you can do whatever you want with this stuff. If we meet
# some day, and you think this stuff is worth it, you can buy me a
# beer in return. Dan Larsson
#
# ==============================================================================
# VERSION INFO
# ==============================================================================
# v0.2 - 2008-08-23
#   * Don't use non-word chars in function names
#   * Changed the SecuriteInfo signature source url
#     (Thank's to Bill Landry for pointing out the above two)
#   * Cleaned up and added comments
#   * Misc cosmetic changes
#
# v0.1 - 2008-08-22
#   * Initial release, branched from v1.4 of Bill Landry's
#     ss-msrbl.sh script
#
# ==============================================================================
# README
# ==============================================================================
# In order to run this script you need to have curl, rsync and clamd installed
# on your machine aswell as the basic set of unix-like tools (i.e. awk, sed,
# cat, cp, gunzip etc...).
#
# If this script fails to run on your system or you have made improvements that
# you wish to share, you're welcome to drop me a line.
#
# ==============================================================================
# USAGE
# ==============================================================================
# Using this script is easy, just configure the parameters, save the changes
# and execute from the prompt (or via cron). Should you want to add additional
# signature databases simply add their download urls to the appropriate
# section(s) here below and you're done! Naturally, it's just as easy to remove
# and edit :-) No script coding necessary!
#
# ==============================================================================
# SIGNATURE SOURCES
# ==============================================================================
# SaneSecurity (phish.ndb, scam.ndb)
# http://www.sanesecurity.com/clamav/usage.htm
#
# SecuriteInfo (vx.hdb)
# http://www.securiteinfo.com/services/clamav_unofficial_malwares_signatures.shtml
#
# MalwareBlockList (mbl.db)
# http://www.malware.com.br/clamav.txt
#
# MSRBL (MSRBL-Images.hdb, MSRBL-SPAM.ndb)
# http://www.msrbl.com/site/msrblimagesdownload
# http://www.msrbl.com/site/msrblspamdownload
#
# ==============================================================================
# SOURCE ARGUMENTS ( see below for more info in source arguments )
# ==============================================================================
# Name                Value        Comment
# ------------------- --------- ------------------------------------------------
# fetch_interval      integer   Forced delay in seconds between download
#                               attempts
# target_file         string    Use this name for the signature database
#                               (instead of extracting it from the source file)

################################################################################
#       SCRIPT USER EDIT SECTION - SET PROGRAM PATHS AND OTHER VARIABLES       #
################################################################################

# *** COMMENT OUT THE BELOW LINE WHEN YOU HAVE CONFIGURED THIS SCRIPT ***
#script_not_configured=1

# Set and export the command searchpaths
PATH=/root/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
export PATH

# Set path to ClamAV database dir location as well as
# the clamd user and group account
clamd_dbdir=/var/lib/clamav
clamd_user=clamav
clamd_group=clamav

# Set path to the clamd pidfile
# (comment out to disable forced database reload)
clamd_pidfile=/var/run/clamav/clamd.pid

# Set backup and temp working directory paths
# (edit to meet your own needs)
backup_dir=/var/backups/clamav
tmp_dir=/var/tmp/clamdb
rsync_dir=/var/tmp/rsync

# HTTP source urls - *MUST* be HTTP urls, one url per line
# (add/remove/modify urls as per preference and/or need,
# to disable, comment out the below six lines)
http_source_urls="
   http://www.sanesecurity.com/clamav/phishsigs/phish.ndb.gz
   http://www.sanesecurity.com/clamav/scamsigs/scam.ndb.gz
   http://clamav.securiteinfo.com/vx.hdb.gz
   http://www.malware.com.br/cgi/submit?action=list_clamav,fetch_interval=86400,target_file=mbl.db
"

# RSYNC source urls - *MUST* be RSYNC urls, one url per line
# (add/remove/modify urls as per preference and/or need,
# to disable, comment out the below four lines)
rsync_source_urls="
   rsync://rsync.mirror.msrbl.com/msrbl/MSRBL-Images.hdb
   rsync://rsync.mirror.msrbl.com/msrbl/MSRBL-SPAM.ndb
"

# Arguments can be appended to the source_url, if you do so
# seperate them from the source url and eachother with commas
# ( e.g. scheme://hostname/path,arg1=123,arg2=abc )
# Please note that it's very important you null their value when
# they've served their purpose, not doing so will lead to weird
# results

# Enable random sleeping before processing
# - recommeded when running via cron!
# (to disable this comment out the below line)
#sleep_enabled=1

# Show each slept second visually
# - disabled when running via cron.
# (to disable this comment out the below line)
sleep_visual=1

# Compress all downloaded *source files* with gzip
# (to disable this comment out the below line)
keep_sources_gzipped=1

################################################################################
# END OF SCRIPT USER EDIT SECTION - YOU SHOULD NOT NEED TO EDIT ANYTHING BELOW #
################################################################################

# Initializes the source arguments
sarg_init() {
   sarg_init_success=
   if [ -n "$source_args" ] ; then
      for arg in `echo $source_args | sed 's/,/ /g'` ; do
         eval $arg
         sarg_init_success=1
      done
      source_url=`echo $source_url | awk -F, '{print $1}'`
   fi
   source_args=
}

# Runs all source argument subroutines. If you add your own
# checks/processing add them to this function.
sarg_process() {
   # Check for fetch interval restriction
   if [ -n "$fetch_interval" ] && ! sarg_check_fetch_interval ; then
      echo
      echo Skipped due to interval restriction in effect
      continue
   fi
   # Insert your own argument processing here
}

# Handles processing of the "$fetch_interval" source argument
# Returns 0 when fetching is permitted ( i.e. elapsed seconds
# since last fetch is equal or greater than $fetch_interval )
# respectively returns 1 when fetching is not permitted.
sarg_check_fetch_interval() {
   local fetch_lastrun fetch_rundiff fetch_stampfile fetch_thisrun
   fetch_stampfile=$backup_dir/FETCHSTAMP.$source_file
   fetch_thisrun=`date +%s`

   fetch_stampfile_old=$backup_dir/LASTRUN.$source_file
   if [ -f $fetch_stampfile_old ] ; then
      mv $fetch_stampfile_old $fetch_stampfile
   fi

   if [ -f $fetch_stampfile ] ; then
      fetch_lastrun=`cat $fetch_stampfile`
      fetch_rundiff=$(($fetch_thisrun - $fetch_lastrun))
      if [ $fetch_rundiff -lt $fetch_interval ] ; then
         fetch_interval=
         return 1
      fi
   fi
   echo $fetch_thisrun > $fetch_stampfile
   fetch_interval=
   return 0
}

# Shows the source header
# (the below function also calls the source argument
# init and processing functions)
show_source_header() {
   sarg_init
   echo
   echo ====================================================
   echo Processing signature database: $target_file
   echo ====================================================
   # Process arguments if any are set for this source
   [ -n "$sarg_init_success" ] && sarg_process
}

#### actual script execution begins here ####
if [ -n "$script_not_configured" ] ; then
   echo '*** SCRIPT NOT CONFIGURED ***'
   echo Please take the time to configure this script before running it.
   echo When you have, comment out the \'script_not_configured=1\' line at
   echo the top in the user editables section and execute the script again
   exit 1
fi
echo "Script started: "`date`

# Check to see if the working directories exist.
# If not, create them. Otherwise, ignore and proceed with script
mkdir -p $tmp_dir $rsync_dir $backup_dir

# Change working directory to ClamAV database directory
cd $clamd_dbdir

# Get the timestamp from the previous run if it exists and
# update it.
stamp_lastrun=0
stamp_thisrun=`date +%s`
if [ -f $backup_dir/LASTRUN ] ; then
   stamp_lastrun=`cat $backup_dir/LASTRUN`
fi
echo $stamp_thisrun > $backup_dir/LASTRUN

# To "play nice" with the source servers don't run more frequently
# than once every hour. Also, attempt to keep off any peak crontimes
# by adding a randomized (between 30 seconds and 10 minutes) sleep period.
#  --- Idea inspired by Rick Cooper's "UpdateSaneSecurity" script.
# ( You can ofcourse disable the sleep-feature by commenting out the
# 'sleep_enabled=1' line in the user editables section here above )
if [ -n "$sleep_enabled" ] ; then
   # Calculate if we have run in the last hour. If we have add the
   # remainder to the sleep time
   sleep_forced=0
   if [ $stamp_lastrun -gt 0 ] ; then
      stamp_rundiff=$(($stamp_thisrun - $stamp_lastrun))
      if [ $stamp_rundiff -lt 3600 ] ; then
         sleep_forced=$((3600 - $stamp_rundiff))
      fi
   fi

   # NOTE:
   # Please note that I'm very well aware of the $RANDOM variable, however
   # since it is not a FreeBSD sh(1) native variable (which is the O/S and
   # shell I'm running this script under) I'm staying off that path. Feel
   # free to implement and use the $RANDOM method, if you want to :-)

   # Get a random number between 30 and 600. First attempt this by using
   # the jot(1) utility (installed by default on *BSD systems)...
   sleep_random=`jot -r 1 30 600 2>/dev/null`

   # ...if jot(1) failed attempt another (more portable?) method
   if [ -z "$sleep_random" ] ; then
      sleep_random=0
      while [ $sleep_random -lt 30 ] || [ $sleep_random -gt 600 ] ; do
         sleep_random=`head -1 /dev/urandom | od -N 1 | awk '$2~/^0/{ print $2 / 1 }'`
      done
   fi

   # Add the two values together and sleep for that amount of seconds.
   # If the $TERM variable isn't set we're probably running from cron so
   # disable visual sleeping in that case
   sleep_forced=$(($sleep_forced + $sleep_random))
   echo ====================================================
   echo Sleeping $sleep_forced seconds before proceeding...
   echo ====================================================
   if [ -n "$TERM" -a -n "$sleep_visual" ] ; then
      while [ $sleep_forced -gt 0 ] ; do
         sleep_forced=$(($sleep_forced - 1))
         echo -n .
         sleep 1
      done
      echo
   else
      sleep $sleep_forced
   fi
fi

# Process http://urls
for source_url in $http_source_urls ; do
   source_file=`basename $source_url | awk -F, '{print $1}'`
   source_args=`basename $source_url | sed "s/^\$source_file//;s/^,//"`
   target_file=`echo $source_file | sed 's/\.gz$//'`

   # If the source and target filenames are equal the source is not gzipped
   # (this will have to be expanded upon if/when additional forms of source
   # compression are to be supported).
   source_not_gzipped=
   if [ $source_file = $target_file ] ; then
      source_not_gzipped=1
   fi

   # Remove any non-word characters from the source filename.
   # We need this since it's used in various file operations
   source_file=`echo $source_file | sed 's/[^[:alnum:]\.-]/_/g'`

   # Produce the source header
   show_source_header

   # Check for an existing database file. If it exists then run an
   # update check. Otherwise, just download and extract the database file.
   if [ ! -s $target_file ] ; then
      # Redirect stderr to stdout while downloading the file.
      ( curl -L -R -o $tmp_dir/$source_file $source_url 2>&1 )

      # If the source isn't gzipped, compress it if $keep_sources_gzipped
      # is non-empty
      if [ -n "$keep_sources_gzipped" -a -n "$source_not_gzipped" ] ; then
         test -s $tmp_dir/$source_file && \
            gzip -9f $tmp_dir/$source_file && \
            source_file=${source_file}.gz
      fi

      # Validate the source file through a series of tests.
      # If all tests succeed install the source and database files
      # in the ClamAV database directory ($clamd_dbdir).
      test -s $tmp_dir/$source_file && \
         gunzip -cdf $tmp_dir/$source_file > $tmp_dir/$target_file && \
         clamscan --quiet -d $tmp_dir/$target_file - < /dev/null && \
         mv -f $tmp_dir/$target_file $tmp_dir/$source_file . && \
         do_clamd_reload=$(($do_clamd_reload + 1))
   else
      # Select which file to use as a timestamp reference.
      source_timeref=$source_file
      if [ -n "$keep_sources_gzipped" -a -f ${source_file}.gz ] || \
         [ ! -f $source_file -a -f ${source_file}.gz ] ; then
         source_timeref=${source_file}.gz
      fi

      # Redirect stderr to stdout while downloading the source file, tell curl
      # to use $source_timeref as a timestamp reference
      ( curl -L -R -z $source_timeref -o $tmp_dir/$source_file $source_url 2>&1 )

      # If the source isn't gzipped...
      if [ -n "$keep_sources_gzipped" -a -n "$source_not_gzipped" ] ; then
         test -s $tmp_dir/$source_file && \
            gzip -9f $tmp_dir/$source_file && \
            source_file=${source_file}.gz
      fi

      # Validate the source file...
      test -s $tmp_dir/$source_file && \
         gunzip -cdf $tmp_dir/$source_file > $tmp_dir/$target_file && \
         clamscan --quiet -d $tmp_dir/$target_file - < /dev/null && \
         cp -f -p $target_file $backup_dir && \
         mv -f $tmp_dir/$target_file $tmp_dir/$source_file . && \
         do_clamd_reload=$(($do_clamd_reload + 1))
   fi
done

# Process rsync://urls
for source_url in $rsync_source_urls ; do
   source_file=`basename $source_url | awk -F, '{print $1}'`
   source_args=`basename $source_url | sed "s/^\$source_file//;s/^,//"`
   target_file=$source_file

   # Produce the source header
   show_source_header

   # Check for an existing database file. If it exists then run an
   # update check. Otherwise, just download and extract the database file.
   if [ ! -s $target_file ] ; then
      # Redirect stderr to stdout while downloading the file.
      ( rsync -t --stats $source_url $rsync_dir/$target_file 2>&1 )

      # Validate the source file through a series of tests.
      # If all tests succeed install the source and database files
      # in the ClamAV database directory ($clamd_dbdir).
      cp -p $rsync_dir/$target_file $tmp_dir && \
      test -s $tmp_dir/$target_file && \
         clamscan --quiet -d $tmp_dir/$target_file - < /dev/null && \
         mv -f $tmp_dir/$target_file . && \
         do_clamd_reload=$(($do_clamd_reload + 1))
   else
      # Download the source file...
      ( rsync -tu --stats $source_url $rsync_dir/$target_file 2>&1 )

      # Validate the source file...
      test $rsync_dir/$target_file -nt $target_file && \
         cp -p $rsync_dir/$target_file $tmp_dir && \
         test -s $tmp_dir/$target_file && \
            clamscan --quiet -d $tmp_dir/$target_file - < /dev/null && \
            cp -f -p $target_file $backup_dir && \
            mv -f $tmp_dir/$target_file . && \
            do_clamd_reload=$(($do_clamd_reload + 1))
   fi
done

# Set appropriate file access permissions
chown -R $clamd_user:$clamd_group $clamd_dbdir

# Remove any leftover files in the $tmp_dir working directory
# (should only happen when a corrupted database is detected)
rm -f $tmp_dir/*

# Reload the clamd database if $clamd_pidfile and $do_clamd_reload
# are both non-empty
if [ -n "$clamd_pidfile" -a -n "$do_clamd_reload" ] ; then
   echo
   echo ====================================================
   echo Reloading the ClamAV databases \($do_clamd_reload updated\)
   echo ====================================================
   kill -USR2 `cat $clamd_pidfile`
fi

echo
echo "Script ended: "`date`

exit $?