From b1833cf1d8dca37a839672bc0c569a48cd99d494 Mon Sep 17 00:00:00 2001 From: Brandon Peters <196836+cisox@users.noreply.github.com> Date: Fri, 30 Oct 2026 10:56:39 -0400 Subject: [PATCH 1/3] Add ClamAV LXC scripts Debian 13 container running clamd on TCP 3310 with freshclam signature updates, installed from Debian's packages. TCP is preseeded via debconf and opened through a clamav-daemon.socket drop-in, since Debian's clamd is socket-activated and otherwise only listens on its unix socket. Co-Authored-By: Claude Opus 5.5 --- ct/clamav.sh | 51 +++++++++++++++++++++++++++++++++++++++ install/clamav-install.sh | 40 ++++++++++++++++++++++++++++++ json/clamav.json | 45 ++++++++++++++++++++++++++++++++++ 3 files changed, 136 insertions(+) create mode 100644 ct/clamav.sh create mode 100644 install/clamav-install.sh create mode 100644 json/clamav.json diff --git a/ct/clamav.sh b/ct/clamav.sh new file mode 100644 index 0000000000..4ae20f47fa --- /dev/null +++ b/ct/clamav.sh @@ -0,0 +1,51 @@ +#!/usr/bin/env bash +_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/DevScripts/main" +_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func" +source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func") + +# Copyright (c) 2021-2026 community-scripts ORG +# Author: cisox +# License: MIT | https://github.com/community-scripts/DevScripts/raw/main/LICENSE +# Source: https://www.clamav.net/ + +APP="ClamAV" +var_tags="${var_tags:-antivirus;security}" +var_cpu="${var_cpu:-2}" +var_ram="${var_ram:-3072}" +var_disk="${var_disk:-8}" +var_os="${var_os:-debian}" +var_version="${var_version:-13}" +var_unprivileged="${var_unprivileged:-1}" +#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified + +header_info "$APP" +variables +color +catch_errors + +function update_script() { + header_info + check_container_storage + check_container_resources + + if [[ ! -f /etc/clamav/clamd.conf ]]; then + msg_error "No ${APP} Installation Found!" + exit + fi + + msg_info "Updating ClamAV" + apt_update_safe + upgrade_packages_with_retry clamav clamav-daemon clamav-freshclam + msg_ok "Updated ClamAV" + msg_ok "Updated successfully!" + exit +} + +start +build_container +description + +msg_ok "Completed Successfully!\n" +echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}" +echo -e "${INFO}${YW}clamd is listening for scan requests on TCP port 3310:${CL}" +echo -e "${GATEWAY}${BGN}${IP}:3310${CL}" diff --git a/install/clamav-install.sh b/install/clamav-install.sh new file mode 100644 index 0000000000..8244babf67 --- /dev/null +++ b/install/clamav-install.sh @@ -0,0 +1,40 @@ +#!/usr/bin/env bash + +# Copyright (c) 2021-2026 community-scripts ORG +# Author: cisox +# License: MIT | https://github.com/community-scripts/DevScripts/raw/main/LICENSE +# Source: https://www.clamav.net/ + +source /dev/stdin <<<"$FUNCTIONS_FILE_PATH" +color +verb_ip6 +catch_errors +setting_up_container +network_check +update_os + +msg_info "Installing ClamAV" +echo "clamav-daemon clamav-daemon/TcpOrLocal select TCP" | debconf-set-selections +echo "clamav-daemon clamav-daemon/TCPSocket string 3310" | debconf-set-selections +echo "clamav-daemon clamav-daemon/TCPAddr string 0.0.0.0" | debconf-set-selections +# clamd is socket-activated on Debian and only listens where clamav-daemon.socket tells it to +mkdir -p /etc/systemd/system/clamav-daemon.socket.d +cat </etc/systemd/system/clamav-daemon.socket.d/tcp.conf +[Socket] +ListenStream=3310 +EOF +$STD apt install -y \ + clamav \ + clamav-daemon \ + clamav-freshclam +msg_ok "Installed ClamAV" + +msg_info "Downloading ClamAV Signatures" +systemctl stop clamav-freshclam +$STD freshclam +systemctl enable -q --now clamav-freshclam clamav-daemon +msg_ok "Downloaded ClamAV Signatures" + +motd_ssh +customize +cleanup_lxc diff --git a/json/clamav.json b/json/clamav.json new file mode 100644 index 0000000000..3857ce5a14 --- /dev/null +++ b/json/clamav.json @@ -0,0 +1,45 @@ +{ + "name": "ClamAV", + "slug": "clamav", + "categories": [ + 6 + ], + "date_created": "2026-10-30", + "type": "ct", + "updateable": true, + "privileged": false, + "interface_port": null, + "documentation": "https://docs.clamav.net/", + "website": "https://www.clamav.net/", + "repository": "https://github.com/Cisco-Talos/clamav", + "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/clamav.webp", + "description": "ClamAV is an open-source antivirus engine for detecting trojans, viruses, malware and other threats. The clamd daemon serves scan requests over the network, so mail servers, Nextcloud, Paperless-ngx and other apps can use it as their virus scanner, while freshclam keeps the signatures up to date.", + "install_methods": [ + { + "type": "default", + "script": "ct/clamav.sh", + "config_path": "/etc/clamav/clamd.conf", + "resources": { + "cpu": 2, + "ram": 3072, + "hdd": 8, + "os": "Debian", + "version": "13" + } + } + ], + "default_credentials": { + "username": null, + "password": null + }, + "notes": [ + { + "text": "clamd accepts unauthenticated connections on TCP port 3310. Only expose it to trusted networks.", + "type": "warning" + }, + { + "text": "To scan host storage, bind-mount it into the container and run `clamdscan --multiscan --fdpass /path`.", + "type": "info" + } + ] +} From 06125e01bb9dcc1458375b61afe93816e048196d Mon Sep 17 00:00:00 2001 From: Brandon Peters Date: Sat, 31 Oct 2026 07:43:45 -0400 Subject: [PATCH 2/3] Update install/clamav-install.sh Co-authored-by: Sam Heinz --- install/clamav-install.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/install/clamav-install.sh b/install/clamav-install.sh index 8244babf67..10499e65e5 100644 --- a/install/clamav-install.sh +++ b/install/clamav-install.sh @@ -17,7 +17,6 @@ msg_info "Installing ClamAV" echo "clamav-daemon clamav-daemon/TcpOrLocal select TCP" | debconf-set-selections echo "clamav-daemon clamav-daemon/TCPSocket string 3310" | debconf-set-selections echo "clamav-daemon clamav-daemon/TCPAddr string 0.0.0.0" | debconf-set-selections -# clamd is socket-activated on Debian and only listens where clamav-daemon.socket tells it to mkdir -p /etc/systemd/system/clamav-daemon.socket.d cat </etc/systemd/system/clamav-daemon.socket.d/tcp.conf [Socket] From d91f0ae52436102c9c862e33b9da88a27f0c47ec Mon Sep 17 00:00:00 2001 From: Brandon Peters Date: Sat, 31 Oct 2026 07:44:04 -0400 Subject: [PATCH 3/3] Update json/clamav.json Co-authored-by: Sam Heinz --- json/clamav.json | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/json/clamav.json b/json/clamav.json index 3857ce5a14..c004b45c5b 100644 --- a/json/clamav.json +++ b/json/clamav.json @@ -32,14 +32,5 @@ "username": null, "password": null }, - "notes": [ - { - "text": "clamd accepts unauthenticated connections on TCP port 3310. Only expose it to trusted networks.", - "type": "warning" - }, - { - "text": "To scan host storage, bind-mount it into the container and run `clamdscan --multiscan --fdpass /path`.", - "type": "info" - } - ] + "notes": [] }