Plugins: Feature request: optional clamav sources

Created on 16 Nov 2017 · 17Comments · Source: opnsense/plugins

If/when time allows please could you integrate the existing various clamav sources into the gui as options to use more fresh additional signatures to help the average gui-users fight malware? The mentioned signature sources can be found here: https://github.com/extremeshok/clamav-unofficial-sigs , which should be relatively easy to set up in cli - not with the linked script though as opnsense has no bash by default -, but it might make sense to raise attention to their existence and help console-rookies. :)

Cheers!

feature

Source

hippi-viking

Most helpful comment

@fichtner you can close this one too :)
@hippi-viking there will be some checkboxes for third party sigs with next release

mimugmail on 13 Feb 2019

🎉2

All 17 comments

@hippi-viking Would you call yourself a console rookie or can you adapt the script to FreeBSD?
I'm whether using unofficial sigs nor have any idea if they are up2date.
I had a look at the script but I'm not sure if this runs on BSD.

I'm discussing with a known commercial vendor to introduce support for current FreeBSD and I have a semi-commitment that there will be support in 2018. Then you would a possibility to double-scan traffic.

mimugmail on 17 Nov 2017

Hi @mimugmail, thanks for looking into this! :) Most of the script is actually unneded for us (some corner cases for different OS, different versions of ClamAV, etc), I can strip out the interesting parts for Opnsense. I haven't looked at how the GUI works though, could you be able to help integrate it if I convert the shell script?

The signatures are pretty much up to date, I use them on our mail server. We haven't got much (any?) ransomware-infected e-mails through since using those extra signatures - unlike with just the official ones. (That's why I thought this might be of use for others as well.)

That's great news! I believe the double-scanning could be dealt with pretty straightforwardly, especially if the extra signaures are not enabled by default, but be there as an option as I would like to integrate them.
Would this 'known commercial vendor' support FreeBSD with a paid-for subscription only? Or with delayed signatures for free as well perhaps? (I think that's where these extra signatures I propose would come in handy as most of them are free.)

I'm starting to strip out the interesting parts of this script then as time allows.

hippi-viking on 22 Nov 2017

If you have a working stripped down script I'll integrate it into the GUI, sure :)

Commercial vendor will only support paid license, that's ok since businesses using OPN would require a commercial scanner too.

mimugmail on 22 Nov 2017

Hi
Is there any progress with integrating clamav-unofficial-sigs?

I would like to encourage you to integrate this feature. The current database.clamav.net is constantly outdated.

Thanks Maik

edmunch on 30 Mar 2018

I was waiting for @hippi-viking to update the script. If you're willing to help there's no reason not to do it 👍

mimugmail on 30 Mar 2018

Hi,

i would love to help, but this is out of my league at the moment. i'm curious what is this: https://github.com/opnsense/ports/tree/master/security/clamav-unofficial-sigs ?

edmunch on 3 Apr 2018

That's the FreeBSD port which does the lifting for getting the rules into the machine for clamav. But I think we need a lighter approach where we can fetch and enable individual databases enclosed, a bit like intrusion detection works with its rulesets.

fichtner on 3 Apr 2018

@fichtner Had a short look at the script .. I think it would be easier to have the port as a pkg instead of doing things by hand like IPS plugins. The detection rate of ClamAV is really bad but I have no practical experience with this unofficial stuff.

mimugmail on 4 May 2018

Sorry for the extra-late answer gents! I have moved countries and started a new life since. As my time allows I still would like to adapt the unofficial-sigs script to Opnsense. As I remember quickly going through it we only really need the links for these optional files for Clamav, 95% of the script is not relevant to us.

hippi-viking on 20 Nov 2018

If you can put the last 5% into a file I'd be happy to help implementing it :)

mimugmail on 20 Nov 2018

👍1

@fichtner you can close this one too :)
@hippi-viking there will be some checkboxes for third party sigs with next release

mimugmail on 13 Feb 2019

🎉2

While #1162 now allows users to easily enable some specific hardcoded free signature sources, manually adding to /usr/local/etc/freshclam.conf is still the only way to add any other signature sources, especially commercially available sources that might protect from zero day exploits. The next configuration change made with opnsense will undo this manual modification of freshclam.conf so it must be repeated. This is not a valid solution for a security function.

The original request from @hippi-viking was about the integration of https://github.com/extremeshok/clamav-unofficial-sigs. For those sources that can be handled by freshclam it would be enough to add an "Advanced Freshclam Configuration" text field to the existing opnsense configuration fields (similar to the one of dnsmasq). The content of the text field would be added 1:1 to freshclam.conf. Then an advanced user can drop in any number of _DatabaseCustomURL_ definitions and even other freshclam options.

If there is another way to do this just let me know. I am willing to make the necessary changes if there is a good chance a merge request for this concept will be accepted. Because I have no previous experience with opnsense mods, please point me in the right direction regarding which projects files probably need modification.

jnsbyr on 9 May 2019

Just tell me the commercial feed links and I will have a look

mimugmail on 9 May 2019

Hi Michael, thanks for taking an interest. The freshclam configuration I could use looks like this:

The subscription code is a long alphanumeric string of more than 100 characters.

Some people might not want to use all of these signature sources. To hide this in a nice GUI with a lot of checkboxes with descriptions would be too much effort. That's why I suggested a simple text box.

And one other thing: I ordered this subscription to make my own comparison between a few commercial and non-commercial desktop and server scanners regarding a new critter a few weeks ago. Now I would like to use this subscription with opnsense so it does not go to waste. But I cannot say anything about the quality of these signatures in general.

jnsbyr on 10 May 2019

I can add this next week

mimugmail on 10 May 2019

🎉1

Thanks, again, I really appreciate your commitment. Let me know if you want me to do beta testing.

jnsbyr on 10 May 2019

Have updated my production system last week. Using the new config page for "unofficial" signatures needs no explanations. What I like best is the option to add a short comment for each URL.

Great work!

jnsbyr on 20 Jun 2019

Was this page helpful?

0 / 5 - 0 ratings