D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
proc
/
self
/
root
/
usr
/
local
/
maldetect.bk150566
/
Filename :
CHANGELOG
back
Copy
v1.6.6.1 | Feb 25 2025: [Fix] find_recentopts incorrectly escaping find options to the right of ( -mtime .. -ctime ); previously normalized by eval; issue #440, pr#442 [Fix] persist configuration value inotify_docroot between upgrades; issue #439 v1.6.6 | Feb 19 2025: [Fix] replaced eval usage in dynamic execution to improve security; thank you for responsible disclosure from barrebas [Fix] malware notification emails to ignore inactive siteworx users; pr #425 [New] add reporting support for telegram channel; pr #378 [New] add statistics collection and sending to ELK; pr #359 [Fix] prune ignore_paths with find -prune; pr #423, issue #433 [Fix] suppress excessive clamav temporary file inotify alerts by adding '/tmp/.*scantemp.*' to ignore_inotify; issue #431, #104 [Fix] consistent cron.daily file sourcing to allow configuration overrides; issue #401, #115 v1.6.5 | Mar 27 2023: [Fix] monitor mode white space detection; issue #354 [Change] event_log/clamscan_log now record year in timestamp; issue #352 [Change] -p|--purge will now trim the inotify_log; issue #350 [New] -E|--dump-report to dump reports to stdout; pr #362 [Fix] monitor mode will now fail to start if 'ed' is not installed; issue #350 inotify_log requires in-place inode pruning to prevent exponential growth [Fix] inotify kernel support on debian11 checking only System.map; pr #398 [Fix] human-readable path not displaying on -a|--scan-all default path scan (/home); #407 [Change] default scoped scan adjusted from /var/www/html to /var/www to make sure we scope all www content; #404 [Fix] compare md5 on ignore_sigs between monitor mode cycles and only regenerate signatures on file changes; #397 [New] add detect_control_panel function to files/internals/functions to determine installed control panel; pr #409 [New] add get_panel_contacts to files/internals/functions to discover contact emails; pr #409 [New] add configuration options for From, Subject, Reply-To headers on alert emails; pr #409 [New] add flag to enable these alerts (requires email_alert to be enabled as well); pr #409 [New] add internal configuration to set the user alert template location; pr #409 [New] add a base template that will be used to create emails to control panel contacts; pr #409 [Change] ambiguous restore error modified to include file name [Fix] adjusted ftp.rfxn.com checkout credentials; #390 [Fix] systemd unit file not copying properly; #371, #413 [Fix] monitor mode dependency failures on 'ed' not properly logging to be captured by unit file; #395 [Fix] newer versions of cpulimit explicitly enforce the usage of '--' to define where cpulimit options end; #395 v1.6.4 | Mar 18 2019: [New] add quarantine_on_error variable to control quarantine behavior when scanner engines such as ClamAV encounter an error [New] add support for slack alerts; pr #240 mostafahussein [New] add ability to disable cron via conf.maldet; issue #260 / pr #300 , #304 sporks5000 [New] add cleaner rule for php.malware.magentocore_ccskim and an alias of as php_malware_hexinject for associated yara rule [Change] update cron.daily for ispmanager5; pr #305 yogsottot [Change] normalize variable naming of pr #300 , #304 [Change] validate cron_daily_scan is set; otherwise default to 1 [Change] update importconf for cron_daily_scan block [Change] don't need "find" if given a file list; pr# 303 sporks5000 [Change] rename ambiguous internal variables related to user signatures [Change] removed clamscan_return code capture from piped logic of clam(d)scan execution; now always capture return code, even on good exits [Change] scan results now explicitly exclude any occurrences of files related to 'no reply from clamd' errors [Change] add backward compatibility for renamed internals.conf variables [Change] removed legacy $verbose tagging at the end of eout() calls [Change] modified cleaner rules to set their own PATH scoping [Change] file_stat() has been renamed get_filestat to match associated quar_get_filestat function naming [Change] get_file_stat() will now grab md5 hash of files to avoid superfluous md5sum calls [Change] added inotify elapsed run time to scan report output [Change] adjust '-e|--report' output for etime value and spacing [Change] force email_ignore_clean=1 to stop the most common email requested issue [Fix] hitname not logging to quarantine.hist on manual quarantine run against scanid; issue #319 [Fix] typo in PR #300; missing '; then' on elif [Fix] set default_monitor_mode to resolve issue #311 systemd service passing $default_monitor_mode as a literal string to the service [Fix] sad mail/sendmail validation logic, fix issue #316 [Fix] normalized scan start time output in scan reports when inotify monitoring is used [Fix] scan report list summary to always display an etime value, even if null [Fix] ad-hoc clean calls from clean_hitlist() was not executing sigignore and gensigs functions causing clean tasks to fail due to missing variables; issue #203 [Fix] adjust semantics of comma and spaced variables being passed to '-co|--config-option'; pr #298 sporks5000 [Fix] modified quarantine_hits to force disable if clamdscan explicitly encounters a 'no reply from clamd' fatal error [Fix] modified install.sh 'ps' execution to be BSD compliant [Fix] clean function was not properly stripping {CAV} and {YARA} prefixes from signature names when executing cleaner rules [Fix] clean function was not properly handling signature names with both underscores and periods [Fix] refactored clean_hitlist() & clean() functions to resolve pathing errors when cleaning previous session hits; issue #203 [Fix] ignore_inotify file exist/empty file negative match; issue #330 [Fix] operator issue cron.daily #331 [Fix] install.sh $ver required major numbering; renamed to ver_major so that session preservation semantics continue to work v1.6.3 | Sep 01 2018: [Fix] ensure clamscan_max_filesize is always set; pr #296 [Fix] remove escaping from inotifywait exclude regexp; pr #246 issue #205 [Fix] always set a value for monitor mode systemd unit; pr #257 [Fix] quar_get_filestat variable collisions during restore operations [Fix] quarantine files could be prematurely deleted, during 'cron.daily/maldet', on distributions where the 'mv' command preserves origin file mtime; call 'touch' on quarantined files to set current mtime post-move to quarantine path; issue #294 [Fix] update tlog inotify tracking file before trimming to prevent rescan loop; pr #292 [Fix] revert pruning empty lines from signature files to 1.6.1 behavior [Fix] usage semantics of cd'ing to a wildcard path on newer versions of Bash were causing version updates to fail; we now explicitly 'cd' to maldetect-${upstreamver} [Fix] spelling corrections; pr# 269 [Change] update importconf text to reflect monitor mode on systemd behavior [Change] on restore actions, reset restored files to original mtime value [Change] increase default remote_uri timeout from 10s to 30s [Change] increase default remote_uri tries from 3 to 4 [Change] added base_domain variable to internals.conf [Change] cleanup .tgz/.md5 files on version updates mid-flight to prevent potential 'cd: too many arguments' errors [Change] trim inotify log from beginning instead of end of file; pr #292 [Change] user mode scanning no longer scans system temporary paths; issue #283 [Change] improve regexp of scan start time values for '-e|--list' output [Change] added '--beta' flag to '-d|--update-ver' to support pulling down beta release of LMD [Change] stage v1.6.3 release; update version and date stamps [Kudos] Thank you to those that contributed pull requests and issues during this release cycle. PR contributions from: sporks5000 jsoref Joshua-Snapp mkubenka jkronza AnnopAlias v1.6.2 | Jul 13 2017: [Fix] signature updates using get_remote_file() would incorrect write temporary update files into /; issue #242 [Fix] added 'which curl' and 'which wget' for variable scoping of binary locations into internals.conf; issue #237 [New] added support to send email through 'sendmail' binary as alternative to 'mail'; pr #241 & issue #238 v1.6.1 | May 28 2017: [New] added conf.maldet option cron_prune_days to configure cron.daily pruning max age of quar/sess/tmp data; issue #197 [New] added curl support, as new default, into get_remote_file; wget support is preserved secondary to curl; issue #200 [New] added --force option on -u|--update-sigs [New] added --force option on -d|--update-ver [New] added empty lines cleaner for runtime signatures and sorting of hdb for better performance; pr #223 [Change] modified default prune interval of quarantine/sess/tmp data from older than 7d to 21d [Change] set email alerts to disabled when -z $mail / issue verbose warning on CLI; issue #220 [Change] scan_export_filelist feature had no real need to be limited to just cron runs; modified so when set, it will export find results for all '-r|--recent' scans [Change] updated help and README to reflect '--force' option on '-u|--update-sigs' and '-d|--update-ver' [Change] post-change to get_remote_file(); signature version file was truncating with tmp file for maldet-clean [Change] replaced all calls of wget with get_remote_file() [Change] refactored get_remote_file() to be more generic / not depend on wget [Change] increased default values for wget --timeout from 5 to 10 seconds [Change] replace egrep with posix 'grep -E'; direct invocation of egrep/fgrep is deprecated; pr #214 [Fix] modified sourcing of conf files and order of precedence in mald…et.sh init script to properly treat default_monitor_mode being defined in conf.maldet; issue #224 [Fix] escape quotes within eval md5sum command as fix for issues #230 and #216 [Fix] test condition for systemd was generating unary errors on older versions of bash; pr #36 [Fix] systemd based systems were skipping addition of sysconfig entry; pr #36 [Fix] install.sh find operation to prune old install backups was generating error when no previous installs existed [Fix] wgetopt was single quoted making the variables inside of it strings, set double quotes [Fix] potential out of memory issue while scanning a large set of files on native LMD scanner; pr #223 [Fix] -f option issue with relative path message; pr #223 [Fix] issue with checkout of relative file path for non root user; pr #223 v1.6 | Mar 17 2017: [New] added curated set of YARA webshell & malware signatures for use with ClamAV >= 0.99b [New] added cleaner rule 'VisitorTracker.Mob' [New] added cleaner rule 'js.inject.fakejquery02' [New] added support for 'froxlor' to cron.daily execution [New] added support for 'vestacp' to cron.daily execution [New] added support for 'ispconfig3' to cron.daily execution [New] added support for 'DTC' to cron.daily execution [New] added '$confpath', '$varlibpath' and '$libpath' for FHS separation [New] moved compatibility (legacy) variables out of internals.conf into compat.conf [New] added support to pull configuration variables for cron executions from 'sysconfig/maldet' [New] added Debian derivatives sysconfig and initd compatibility for function sourcing and subsys locking [New] added LSB tags to init script [New] added capability of moving public scan path with $userbasedir variable [New] manpage added and setup default with install.sh execution [New] added support for clamd running as an unprivileged user through clamdscan w/ --fdpass options [New] added --wget-proxy CLI option for http(s) proxy support [New] added clam(d)scan_extraopts variables to internals.conf for appending extra CLI options on clam(d)scan; these values can also be defined in sysconfig or cron/exec based config files and on CLI [New] sysconfig support through '/etc/sysconfig/maldet' or '/etc/default/maldet', system dependant, to allow easier configuration overrides; all conf.maldet and internals.conf variables supported [Change] file stat calls replaced with function file_stat [Change] stat calls are now (Free|Net)BSD compatible through file_stat function [Change] report listing, '-e|--report list', now displays scan run time [Change] scan reports and cli outputs once again display simplified path definitions instead of expanded paths [Change] unified all clamav selection logic for data paths, running clamd processes, clam(d)scan CLI options etc... into a single function, clamselector(); this will make clam behavior more predictable across all functions [Change] added subdomains path for ISPConfig to cron.daily [Change] corrected variable naming semantics for import_*_(md5|hex)_url parameters [Change] monitor mode now identifies inotifywait processes based on a string pattern unique to maldet to avoid conflicts with any other inotifywait processes [Change] added wget_proxy variable for us in sysconfig and conf.maldet options [Change] YARA-LMD curated signature set will now be included with signature updates [Change] differentiate signature hits for YARA with '{YARA}' signame prefix [Change] inotify_docroot now accepts comma or white spaced list of paths under user root to monitor [Change] removed absolute path usage from 'pidof' [Change] drop unneeded usage of shebang from sourced configuration files [Change] modified shebang usage with 'env' prefix for portability [Change] temporary path usage now consistently using $tmpdir value [Change] scan paths must now be absolute paths [Change] modified init script stop function for Debian derivatives [Change] improved history tracking with proper date stamps, more verbose quarantine history logging and storing into more explicitly named files '$sessdir/hits.hist' and '$sessdir/quarantine.hist' [Change] added scan_days value to cron.daily allowing customization of the date range scanned by daily cron [Change] replaced remaining absolute calls to sigdirs with '$sigdir' [Change] added Debian derivatives support for MONITOR_MODE checks [Change] updated cron.daily to provide for a custom execution file and modified custom config file into 'cron/conf.maldet.cron' and 'cron/custom.cron' [Change] install.sh cased variable on find execution [Change] symlink hookscan.sh to modsec.sh for pre-v1.5 compat [Change] added '^/tmp/clamav-.*' to ignored paths where ownership matches clamd process [Change] preserve custom cron configuration files on upgrade [Change] hookscan.sh was calling LMD using legacy, deprecated, '--config-option' options [Change] normalize installation path variable between LMD proper and installation scripts [Change] reduced redundant path definitions [Change] added test for main.cvd and main.cld in determining clamav signature paths [Change] README changes to reflect new cron customization setup [Change] added attempting passive ftp when active fails for malware checkout uploads [Change] .ca.def configuration template renamed importconf and now copied over during installation to 'internals/importconf' [Change] new versions of 'chown' don't support use of . (dot) to separate user and group [Change] find option regextype is now dropped on FreeBSD for compatibility [Change] scan.tpl reporting template handles column spacing on filenames with spaces better [Change] CLI usage semantics of --include-regex and --exclude-regex now consistently passing to 'find' command [Change] moved all internal field separator line break modifications to lbreakifs() [Change] quarantine .info file is now field separated with colon symbol (:) [Change] quarantine .info file value ordering has been modified # owner:group:mode:size(b):md5:atime(epoch):mtime(epoch):ctime(epoch):file(path) [Change] record_hits() now writes file mode and file times (a|m|c) into hits history file [Change] 'eval' is now used as a prefix on the 'find' command to better handle the complex set of options passed to 'find' and avoid globbing, splitting and other bash'esque semantic issues [Change] modified mkpubpaths cronjob to execute every 5 minutes instead of 10 [Change] public mode scanning errors are now more verbose [Change] updated README to reflect required modsec >=2.9 variable 'SecTmpSaveUploadedFiles' for upload scanning [Change] hookscan.sh (modsec.sh) now checks for variable override file at conf.maldet.hookscan [Change] added use of sed flag -E for FreeBSD compatibility with GNU sed usage [Change] clamscan will now respect scan_max_filesize value instead of hardcoded 5M [Change] default scan_max_filesize increased from 768k to 2048k [Change] clamscan max-scansize for archive depth set as scan_max_filesize*2 [Fix] improved special character argument escaping for -a|-r options that could have caused arbitrary command executions in environments where LMD was allowed to be called by non-root users and/or set-uid/gid wrappers [Fix] FreeBSD calls to 'md5 -q' were being incorrectly escaped causing file names to never pass and return valid md5 hash string; corrected by preprending 'eval' to the md5 command callouts. [Fix] corrected typo with import_* variables causing configuration imports to fail [Fix] suppress eout() output for certain import_*() and get_remote_file() calls; this was causing false-positive hits for modsec integration [Fix] install.sh may not have preserved certain variables on upgrade [Fix] clamdscan was running as a non-root user, would generate lstat errors for all file find results leading to potential false positive hit/quarantine [Fix] the permissions of the $tmpdir path can cause clamd when running as a non-root user to fail on startup due as a result of lstat errors on the custom user signature files stored under $tmpdir [Fix] clamd.conf configurations containing Follow(File|Directory)Symlinks set to false results in the rfxn.*/lmd.user.* links causing clamd startup failures [Fix] suppress error output to cli for customer user signature files when they do not exist [Fix] uninstall.sh now cleans up signature files from clamav data paths [Fix] corrected invalid matching against clamdscan binary when clamd was running as non-root user [Fix] inotifywait on Ubuntu12 doesn't support the '-o' and '-d' option; modified to send stdout to logfile for better compatibility [Fix] conditionally test for vz container and disable use of ionice which is not support in vz containers [Fix] '-k|--kill-monitor' would under certain circumstances leave zombie processes [Fix] monitor_cycle() could lead to memory depletion due to infinite loop cycle calls [Fix] uninstall.sh was not shutting off monitor mode on uninstall [Fix] legacy variable suppress_cleanhit references updated to email_ignore_clean [Fix] email alerting broke during an iterative update due to order of precedence change of how configuration files were loaded and compatibility (legacy) variables being set before main conf.maldet was loaded; caused by FHS refactoring [Fix] installation upgrade configuration importer was not properly executing after FHS refactoring during an iterative update [Fix] issue #167 certain variables not being preserved on importconf execution, updated 'compat.conf' [Fix] custom signature runtime files could grow exponentially in monitor mode [Fix] make '--mkpubpaths' option cross-platform compatible (debian, rh, bsd) [Fix] replaced usage of 'awk' on file name sensitive variables with 'cut' and/or better scoped field separator for awk [Fix] double quote wrapped file name variables properly on restore*() functions [Fix] quarantine .info files were not properly recording source file atime,mtime,ctime values manual quarantine calls [Fix] user supplied paths to CLI are now better handled if they contain special characters [Fix] multiple user supplied paths to CLI would generate an error if the first path contained a space and subsequent paths did not [Fix] commit c8a1279 introduced bug where clamav could be fed zero sized signature files resulting in fatal exit [Fix] public mode scanning will now properly error if mkpubpaths paths do not exist [Fix] hookscan.sh (modsec.sh) will now default to not using clamav if clamd is not running [Fix] though functional, public mode scanning would result in permission errors on console due to pathing issues with history tracking files [Fix] clam(d)scan was not respecting values in 'ignore_sigs' file, this has been corrected for both CLI and monitor mode [Fix] addition of prefixing eval to find command required certain values to be escaped differently for proper function of '-r|--recent' [Fix] util-linux 2.23 supports 'column' command with '-o' but earlier versions do not, resulting in scan reports generating empty hit lists [Fix] importconf was setting invalid vars for custom signature imports; correct variables are import_custsigs_md5_url and import_custsigs_hex_url [Fix] multiplying maldet monitor processes due to 'ps' command expansion under parent bash process on CentOS6 [Fix] added default installation path to ignore_inotify to prevent monitor looping when '/' is scoped into monitoring mode; results in notify log filling disk space [Fix] importconf was not importing the value for import_config_url v1.5 | Sep 19 2015: [New] added -f|--file-list CLI option to allow user supplied run-time file list for scanning [New] added -i|--include-regex CLI option for run-time path/file inclusion based on posix-egrep regular expressions [New] added -x|--exclude-regex CLI option for run-time path/file exclusion based on posix-egrep regular expressions [New] added support for custom md5/hex signatures with preservation across signature and version updates, files located at: sigs/custom.md5.dat sigs/custom.hex.dat [New] custom signatures perform run-time conversion into clamscan compatible format on systems that use clamscan engine [New] new md5 signature format (md5v2) now includes file size that an md5 hash was derived from in format of: hash:filesize:signame [New] added support for custom cleaner rules to be executed on clean events, file name format of "clean/custom.signame"; rules are preserved across signature and version updates [New] added support for clam(d) engine when running in inotify monitoring mode [New] added URL import feature for global configuration overrides using import_config_url variable in conf.maldet [New] added URL import feature for user custom signatures using import_custsigs_md5_url & import_custsigs_hex_url variables in conf.maldet [New] added set of defined exit codes for errored exits(1), successful runs with hits(2), successful runs with no hits(0) [New] added uninstall.sh script to maldetect installation path [New] added md5 hash verification of signature and version update downloads [New] added scan_cpunice option to control CPU priority value of all scan operations such as find, clamscan etc.. (default 19) [New] added scan_ionice option to control IO priority value of all scan operations such as find, clamscan etc.. (default 6) [New] added autoupdate_signatures/autoupdate_version options to control daily cron based signature/version updates [New] added autoupdate_version_hashed option to control validating hash of maldet executable against upstream version [New] added support for virtualmin to cron.daily scans [New] added support for ispmanager to cron.daily scans [New] added support/detection of clamdscan to leverage memory preloaded signatures and multi-threaded scanning [New] added scan_find_timeout option which controls the maximum execution time, in seconds, for the find command to generate a file list [New] added scan_ignore_root option to exclude root owned files from scans [New] added scan_ignore_user and scan_ignore_group options which allow for the exclusion of specified user and group names from scans [New] added scan_export_filelist option allowing for daily scan of recent added/modified files to be exported to a static path [New] added sourcing of of conf.maldet.cron into the cron.daily task which allows for cron specific configurations [New] added inotify_reloadtime which controls the time at which inotify watcher will reload LMD configuration data [New] added support for comma space (,) path list on CLI [New] added reload option for monitor mode to invoke forced configuration reload (-m|--monitor reload) [New] added maldet init script for monitor mode with $default_monitor_mode conf.maldet variable [New] added usage of /etc/sysconfig/maldet for configuration of monitor mode init/systemd options, overrides conf.maldet [New] added support for 'cpulimit' usage, when installed, through scan_cpulimit and inotify_cpulimit configuration variables [Change] increased randomness of quarantine temporary file names [Change] added atime,mtime,ctime since epoch values into quarantine info files [Change] monitor mode now supports all existing ignore options as well as enforcing minimum/maximum file sizes [Change] monitor mode now supports hot configuration reloads by touching reload_monitor under installation path (e.g: touch /usr/local/maldetect/monitor_reload) [Change] modsec.sh has been renamed to hookscan.sh and more generic hook based scanning conventions set [Change] hookscan.sh will now autodetect if clamdscan is running and perform scans through clamd when appropriate [Change] hookscan.sh will now provide more verbose output on malware hit events [Change] hookscan.sh now explicitly disables scanning of temporary paths, ensuring only requested file/paths are scanned [Change] install.sh now gracefully handles upgrades when monitoring mode is enabled by restarting monitor mode [Change] improved handling of single file scans which should now behave as expected [Change] explicitly removed the inclusion of tmpdir paths during single file scans [Change] automagically remove empty lines from ignore files [Change] reordered configuration file, expanded on variable descriptions, overall attempt to simplify/streamline conf.maldet [Change] installer symlinks LMD signatures into known/existing ClamAV paths to ensure signatures are loaded into memory by clamd [Change] installer issues SIGUSR2 to any running clamd processes to force reload of signature databases [Change] cron.daily signature updates issue SIGUSR2 to any running clamd processes to force reload of signature databases [Change] cron.daily signature/version updates sleep random interval 1-999 secs before contacting upstream rfxn.com servers to reduce cdn load [Change] modified clamscan database path checks to support cPanel >=11.40 RPM clamAV connector RPM's [Change] modified location of statistical data files from tmpdir to sessdir making tmpdir a stateless path that can be purged at anytime [Change] when clamscan engine is enabled scan_max_filesize value is now set dynamically based on the largest known file in the md5v2 signature set [Change] modified e-mail based alerts to source from an e-mail template file at .email.template [Change] clamscan execution command logged to logs/clamscan_log to make debugging clamscan errors easier [Change] clamscan stderr/stdout output now pipes to logs/clamscan_log and if clamscan returns an error code (2), flag with an appropriate error message to check the clamscan_log file for more details [Change] ambiguous variables renamed for better consistency and more logical naming conventions, documented in CHANGELOG.VARIABLES [Change] modified sessionid values to derive from YYMMDD instead of MMDDYY and adjusted human readable report START/END date to include year value [Change] modified view_report output to sort output on unix time of scan start times [Change] signature updates now download as a single file tgz to reduce bandwidth usage and request load on upstream cdn [Change] modified signature update function for additional error checking and better handling of zero sized signature downloads [Change] modified version update function for additional error checking and better handling of zero sized file downloads [Change] modified '-e|--report list' output include total files scanned, hits and cleaned results, reversed output order and consistent column spacing (column -t) [Change] moved tlog executable out of inotify/ path, changed inotify_log path to logs/, removed inotify directory [Change] created logs/ path, moved event_log path to logs/ [Change] modified previous wget timeout values of 3s timeout & 3 retries to 5s timeout & 3 retries [Change] wget timeout and retry attempts are now configurable through internals.conf wget_timeout & wget_retries variables [Change] removed file type check on native LMD stage2 hex scanner which was part of legacy code and no longer needed [Change] removed verbose progressive scan output for native LMD scanner as performance penalty was unreasonable [Change] replaced usage of tmpwatch with find in cron.daily for temporary path pruning [Change] removed internals.conf from version check hashing for installation version updates (-d|--update-ver) [Change] cron.daily now tests for directadmin and scans appropriate user domain paths [Change] directory checkout uploads limited to maximum of 50 files [Change] added tmpdir_paths option to explicitly scan known temporary (world-write) paths on all scan types [Change] updated example ModSecurity rule in README file for compatibility with ModSec 2.7 which now requires every rule, even hooks, to have a rule ID [Change] -r|--recent scan now uses mtime and ctime, instead of just mtime, to find recently changed/modified files [Change] LMD v1.4.2+ will now use the new md5 v2 signature format and make direct requests on signature updates to the appropriate upstream file (md5v2.dat); old format, md5 v1, preserved in signature releases for compatibility of pre-1.4.2 releases [Change] modified hexfifo.pl & hexstring.pl to accept user supplied value for path to hex signature file [Change] install.sh now deletes LMD backup installation copies older than 30days [Change] references to www.rfxn.com for remote signature and version updates now query cdn.rfxn.com [Change] cleaner rules are now executable scripts in which infected files are passed as an argument ($1) allowing for a diverse set of cleaner rule options apart from the previous sed only setup [Change] converted current cleaner rules to new executable scripts format [Change] checkout uploads now store malware in the filename format of (hostid is an anonymous md5 identifier): $hostid.$RANDOM.$filename.[ascii|bin] [Change] inotifywait from inotify-tools is no longer packaged with LMD, it should be downloaded in binary or source form from: https://github.com/rvoicilas/inotify-tools/wiki/ binary versions are also available from dag repo at: http://pkgs.repoforge.org/inotify-tools/ [Change] internals.conf will now attempt to detect the path to inotifywait from $PATH [Change] inotify max_user_watches was static set to 128, now configurable with inotify_user_watches [Change] inotify values for max_user_instances|watches will first be checked and only modified if the existing values are lower than what maldet requires [Change] modified error output for missing inotifywait to display URL to inotify-tools github page [Change] modified default scan_hexdepth value to 65k as a result of improved scan efficiency in native scanner engine [Change] added backwards compatibility for all pre-v1.5 configuration options however they should be considered deprecated and will be removed in the future [Change] expanded on EICAR test signature support for native LMD scanner engine to better facilitate testing of functional installed signature set [Change] added scan/find elapsed execution time values to scan report and cli output [Change] relocated internal files into $inspath/internals/ [Change] created generic clean_exit() function to handle file cleanups on all fatal exist and replaced many random rm -f calls with it [Change] moved all pre/post actions into a prerun() and postrun() functions [Change] moved statistical logging to record_hits() function [Change] quarantine() function borrows stat file data from record_hits to reduce calls to stat [Change] more extensible cleaner rules with additional input arguments: $1 file path, $2 signame, $3 owner.group, $4 file_chmod, $5 file_size, $6 file_md5 [Change] added additional fields file_size and file_md5 to quarantine info file [Change] added caching support for import_config_url with import_config_expire to control expiry interval [Change] stricter handling of variable definitions which contain dynamic variable values [Change] modified daily cron recent range from 2 to 1 as mtime/ctime values are n*24h, as such value of 1 is equal to two days [Change] modified daily cron to use comma spaced path lists instead of multiple maldet executions [Change] changed quarantine malware cleaning default value to 0 [Change] use of clamav engine output statement now more verbose [Change] previously LMD only linked clamav signatures into clamav data paths on install, this is now done after each signature update [Change] maldet.sh init script exites code 1 on status check when maldet monitor mode is not found running [Change] monitor mode now invokes every 15 seconds, legacy installations will preserve 30 second cycle timing [Change] modified shebang to use env bash for portability [Fix] when clamdscan was running as a non-root user, would generate lstat errors for all file find results leading to potential false positive hits/quarantines [Fix] the permissions of the $tmpdir path can cause clamd when running as a non-root user to fail on startup due as a result of lstat errors on the custom user signature files stored under $tmpdir [Fix] clamd.conf configurations containing FollowDirectorySymlinks/FollowFileSymlinks set to false results in the rfxn.* and lmd.user.* links causing clamd startup failures; corrected by updating clamav_linksigs() to copy signatures into clamav data paths instead of linking them [Fix] inotify monitor execution now properly passes ionice configuration value [Fix] monitor_paths was not being preserved on version updates [Fix] record_hit() was not being invoked outside of clamscan based events [Fix] monitor.pid file would potentially have an incorrect pid written to it on each execution of monitor_check() [Fix] quote syntax error in scan.etpl [Fix] help output for -k|--kill-monitor incorrectly referred to --kill instead of --kill-monitor [Fix] inotify_user_instances was defined in internals.conf incorrectly as inotify_user_watches [Fix] tlog executable was not being set +x during installation [Fix] install.sh was attempt to create default event_log while the parent directory did not yet exist [Fix] invalid find expression was causing find to return directory paths on recent scans [Fix] OSTYPE env checking was not properly matching on all FreeBSD versions [Fix] renamed alert() to genalert() to avoid builtin function conflict on Ubuntu [Fix] corrected -r|--recent scan mode trap on SIGINT (CTRL+C) not calling trap_exit() for cleanup actions [Fix] modified native LMD scanner to better leverage bash internal field separator for handling of paths with spaces [Fix] modified all calls to system executables to use paths derived from $PATH [Fix] suppressed ignore signature count being displayed when calling with --modsec [Fix] set modsec.sh to use /bin/bash as interpreter instead of /bin/sh for compatibility [Fix] removed MAILTO & SHELL variables from crons which were causing crond 'bad minute' errors on some systems [Fix] quoted extension values from ignore_file_ext input to provide consistent behavior [Fix] added trailing slash '/' to all cron.daily scan (find) paths to properly handle symlinked paths [Fix] install.sh now links LMD clamav signatures into all clamav data paths it finds instead of just the first [Fix] clean() function was improperly exiting after first file hit clean attempt and ignoring all other hits [Fix] set interpreter in uninstall.sh to /bin/bash instead of /bin/sh for better compatibility [Fix] modified psa scan paths to pull in top level and sub domain content [Fix] corrected invalid matching against clamdscan binary when clamd was not available v1.4.2 | Feb 25th 2013: [New] detection and alerting of libkeyutils root compromised libraries [Change] cron.daily now tests for directadmin and scans appropriate user domain paths [Change] removed temporary paths /var/tmp, /tmp, and /dev/shm from cron.daily which are now added explicitly to all scanning paths / modes v1.4.1 | Nov 20th 2011: [Change] rfxn.com ftp server moved and anonymous FTP checkout uploads changed [Change] modsec.sh force sets clamav_scan=0 as native LMD scanner engine is faster on single / small file sets [Fix] correct plesk if statement added to to daily scan cronjob [New] added -U|--user to force execution under defined user, ideal for restoring user quarantined data or viewing user reports e.g: maldet --user nobody --report e.g: maldet --user nobody --restore 050910-1534.21135 [New] added public_scan variable to conf.maldet to control enabling of public mode scanning, disabled by default [New] added cron.d/maldet_pub cronjob to populate public user paths when public mode scanning is enabled; does nothing when disabled [Change] README file updated, had fallen behind on CLI usage help details [New] added -co|--config-option for defining conf.maldet options on the CLI [Fix] README, COPYING.GPL and CHANGELOG are now properly copied into the installation path [Fix] version header in config import template was incorrect [Fix] value of email_ignore_clean is now properly preserved on version upgrades [New] added modsec.sh to allow for easy calls from mod_security2 inspectFile hook [Change] autodetect executing uid and define public mode scanning variables [New] added public mode scanning which redefines tmpdir, sessdir, quardir to pub/username/ directory tree for user initiated (non-root) scans [Change] installation permissions changed to 644/755 for public mode support [Change] revised (gz)base64 rules to be more specific thus reducing false positives [Fix] tlog was set to use /bin/sh which breaks usage on systems with default shells other than bash v1.4.0 | Apr 17th 2011: [Change] default editor now inherited from $EDITOR [New] clamav signatures update through sigup(), -u|--update [New] cleaner rules update through sigup(), -u|--update [Change] added error checking for missing or corrupted signature files [Fix] monitor_cycle() now properly trims inotify_log [Fix] version dates in CHANGELOG for 1.3.8 -> current had 2010 instead of 2012 [New] added -b|--background flag to execute scans in background [Change] cron.daily now uses the -b flag for background scanning [Change] wget calls now use the --referer option to broadcast local LMD version [Fix] replaced stray references of absolute install path with the install path variable [New] stage2 (HEX) scanner now supports use of named pipe (FIFO) for passing file hex contents, enabled by default, provides better performance with larger depth analysis of files [New] added hex_fifo_scan & hex_fifo_depth variables to conf.maldet for fifo hex scanning [Change] -c|--checkout now supports directory paths [Change] -r|--scan-recent and -a|--scan-all now supports single file scans [Fix] replaced absolute path to nice on inotifywait exec to which located variable value [Change] added error checking for all internally required binaries e.g: wget, find, od etc... [New] detection of ClamAV clamscan binary and usage as default scanner engine; when detected, clamscan is executed on scan file lists using rfxn.com LMD clamav-compat sigs [Change] added OSTYPE check for differentiating md5 sum binaries on linux and FreeBSD [Change] added OSTYPE check on monitor mode to disable on FreeBSD, pending kqueue alternative to inotifywait [Fix] revised od flags for FreeBSD support [Fix] ignore_inotify now properly interprets extended posix regexp as ignore parameters [Change] added sample ignore values into ignore_inotify along with sane defaults to ignore common noisy files [New] added statistical analysis for string length to identify threats based on the longest uninterrupted string within files, common of obfuscated code (e.g: base64, gzip etc...) [New] added string_length_scan & string_length variables to conf.maldet for strlength scanning [Fix] ignore_file_ext has been readded and now correctly ignores files based on extension [Fix] replaced absolute path to mail with which located variable value [Fix] lmdup() now properly errors out when rfxn.com web server is offline [New] added clamav_scan variable to conf.maldet to toggle clamscan detection [New] Full compatibility under the following distros has been verified :) - FreeBSD 9.0-CURRENT - RHEL/CentOS 5.6 - RHEL 6 - Fedora Core 14 - OpenSuse 11.4 - Suse Linux Enterprise Server 11 SP1 - Ubuntu Desktop/Server 10.10 - Debian 6.0.1a [Change] updated README file for new features & vars, sample ignore usage, revised features and updated cymru hash statistics [Fix] relaxed grep for inotify sysfunctions to just inotify_ on System.map file [New] can now pass list to -e|--report to view all available scan reports e.g: maldet --report list [New] can now pass an e-mail address to -e|--report to email a specific report e.g: maldet --report SCANID user@domain.com [New] added email_ignore_clean variable to suppress alerts where all hits are cleaned v1.3.9 | Mar 16th 2011: [Fix] ignore files are now properly imported on version updates [Change] cron.daily now checks for version updates [Fix] hexdepth greater than 65Kb caused an 'argument list too long' error with hexstring.pl which would fail-clean any malware on hex checks [Change] default hex depth increased to 61440 as there was an increasing margin of error on missing threats due to them falling outside the default hexdepth; will add offset option to signatures in the near future [Change] updated cymru hash statistics in README file v1.3.8 | Jan 30th 2011: [Fix] revised inotify tracking log file to properly rotate instead of growing indefinitely v1.3.7 | Nov 27th 2010: [Fix] package ownership at some point got set to uid 501 instead of root [Fix] daily cronjob now checks ps output for inotifywait proc instead of pidof [Fix] monitor mode users would exit prematurely if a user home path did not exist [Fix] a file hijacking race condition existed with quarantine mode restore function [Fix] inotify max_user_instances value was being set to a value that would cause inotifywait to fail v1.3.6 | May 21st 2010: [Fix] restore option will now handle session based restores for quarantines that were manually invoked with -q|--quar SCANID [Fix] session data gets recreated if it disappears during scan v1.3.5 | May 18th 2010: [Fix] tlog now handles data that logged between 0bytes and first wake cycle [Fix] monitor_check now properly handles CREATE,ISDIR events [Change] --alert-daily|weekly alerts have been changed similar to manual alerts [Fix] cleaner was not properly running on monitor_check calls to scan files [Fix] quar_suspend was not properly running on monitor_check calls to quar() [Change] monitor tracker files now pass through trim_log to avoid oversizing [Fix] monitor_check now properly handles path names with spaces [Fix] monitor_check was throwing nx file/directory error for monitor.pid [Fix] older bash versions were having trouble with the [[ =~ ]] regexp search [Change] set all script files from shebang/bin/sh to shebang/bin/bash [Change] --alert-daily|weekly will now only send alerts if hits were found [New] -d|--update-ver now compares file hashes to determine update status [Fix] suspend events were not properly being added to monitor alerts [Change] all alerts have had spacing changes to make them more readable [Fix] signature names now properly list for daily|weekly alerts hit list [Fix] monitor_check will now recursive monitor newly created directories [New] monitor daily|weekly alerts now save as a pseudo scan report with SCANID [Fix] monitor reports now generate properly when quar_hits=0 v1.3.4 | May 16th 2010: [Fix] cleaner function was not properly executing under certain conditions [Change] additional error checking/output added to the cleaner function [Change] default status output of scans changed for better performance [New] added ignore_inotify for ignoring paths from the monitor service [Change] updated ignore section of README [Fix] backreference errors kicking from scan_stage1 function [New] -d|--update-ver option added to update installed version from rfxn.com [Change] updated short and long usage output for update-ver usage [Fix] -k|--kill-monitor now properly kills only the inotifywait/monitor pid's [Fix] monitor_cycle function now correctly stores its pid in the pidfile [Fix] files with multiple events in the same waking cycle are only scanned once [Change] install.sh now symlinks maldet executable to /usr/local/sbin/lmd v1.3.3 | May 15th 2010: [Fix] quarantined files were not properly dropping owner [New] signature based, rule driven, cleaner component added [New] base64.inject cleaner rule [New] gzbase64.inject cleaner rule [New] -n|--clean SCANID option added to batch clean scan all files from a scan [Fix] made default install file/path permissions more strict (750/640) [New] install.sh now preserves conf.maldet settings [New] install.sh now links backups of old installation to INSTALL_PATH.last [Fix] install.sh now properly imports session data from previous install [New] -s|--restore can now take a SCANID to batch restore all files from a scan [Change] improved the layout of conf.maldet; more scan options and commenting [New] added quar_susp_minuid option for suspend user minimum user id [Fix] inotify monitor now properly acts on MODIFY,MOVE_TO,MOVE_FROM states [Change] inotify monitor now can take a list of paths or file for path input [Change] inotify monitor now has no default use, must specify USER|FILE|PATHS [Change] revised short and long usage output for new options/usage changes [Change] inotify monitor now spawns only one process for all monitored paths [Change] inotify monitor sets max_user_instances to processors*2 [Change] inotify monitor sets max_user_watches to inotify_base_watches*users [Change] migrated all inotify options from internals.conf to conf.maldet [New] added inotify_base_watches to conf.maldet for max file watches multiplier [New] added inotify_nice to conf.maldet for run-time prio of inotifywait [New] added inotify_webdir to conf.maldet for html/web root only monitoring [Change] extensive format change to README [Change] rewrote inotify section of README to reflect the many changes [New] added cleaner section to README [Change] -q|--quarantine now calls cleaner if quar_clean=1 [Change] -n|--clean can now do in place cleaning without quarantine [Fix] cleaner function was not properly executing under certain conditions v1.3.2 | May 13th 2010: [New] added ignore files: ignore_paths , ignore_sigs [Change] ignore_sigs is processed as a pre-scan component before all scans [Change] revised README file to include details on new ignore options [Change] signature counts now displayed pre-scan and post-update [Change] install.sh now runs --update after installation [Fix] -p|--purge now properly clears session state data [New] added [ SIGNATURE UPDATES ] section to README file [Fix] some functions were referencing full paths instead of the variable equivs v1.3.1 | May 12th 2010: [Fix] typo in report command eout() [Fix] cron.daily tmpwatch on invalid path [Change] redirect stdout to /dev/null on tmpwatch calls in cron.daily [Change] better commented cron.daily actions [Change] cron.daily scans will now hit /home*/*/public_html on non-ensim systems [Change] inotify monitor now properly handles any user homedir paths [Fix] sigup will now download full signature set when no sigs are found local [Fix] rewrote 17 signatures that would never match due to hexdepth restrictions [Fix] removed some HEX signatures derived from ClamAV that would never hit [Change] files must now be >32bytes to be included in search results [Change] search results default to a max directory depth of 15 [New] added vars for minfilesize and maxdepth scan options [Change] updated inotifywait to v1.3.6, statically linked binary [Info] signature RSS and XML data sources added, see: http://www.rfxn.com/signature-updates-rss-feed/ [Info] LMD now has a homepage on rfxn.com: http://www.rfxn.com/projects/linux-malware-detect/ [New] adopted new versioning scheme [MAJOR].[MINOR].[REV] 1 3 1 v1.3 | May 11th 2010: - First public release v1.1 - v1.2 | Mar. 2010 - May 2010: - Internal releases v0.5 - v1.0 | Nov. 2009 - Feb. 2010: - Closed beta v0.4< | Oct. 2009: - Internal releases