Skip to content

Additional Databases

Additional Databases for ClamAV

Default ClamAV databases do not have great detection levels, but it can be enhanced with free or paid signature databases.

List of known free databases | As of April 2022

  • SecurityInfo - free ClamAV DBs for testing purposes, required registration after which you can use them from 1 IP
  • InterServer - free to use ClamAV DBs, but they do not fit well for email scanning

Enable SecuriteInfo databases

  1. Sign up for a free account at https://www.securiteinfo.com/clients/customers/signup
  2. You will receive an email to activate your account and then a follow-up email with your login name
  3. Login and navigate to your customer account: https://www.securiteinfo.com/clients/customers/account
  4. Click on the Setup tab
  5. You will need to get your_id from one of the download links, they are individual for every user
  6. Add to data/conf/clamav/freshclam.conf with replaced your_id part:

    DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.hdb
    DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.ign2
    DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/javascript.ndb
    DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/spam_marketing.ndb
    DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfohtml.hdb
    DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfoascii.hdb
    DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfopdf.hdb
    

  7. For free SecuriteInfo databases, download speed is limited to 300 kB/s. In data/conf/clamav/freshclam.conf, increase the default ReceiveTimeout 20 value to ReceiveTimeout 90 (time in seconds), otherwise some of the database downloads could fail because of their size.

  8. Adjust data/conf/clamav/clamd.conf to align with next settings:

    DetectPUA yes
    ExcludePUA PUA.Win.Packer
    ExcludePUA PUA.Win.Trojan.Packed
    ExcludePUA PUA.Win.Trojan.Molebox
    ExcludePUA PUA.Win.Packer.Upx
    ExcludePUA PUA.Doc.Packed
    MaxScanSize 150M
    MaxFileSize 100M
    MaxRecursion 40
    MaxEmbeddedPE 100M
    MaxHTMLNormalize 50M
    MaxScriptNormalize 50M
    MaxZipTypeRcg 50M
    

  9. Restart ClamAV container:
docker compose restart clamd-mailcow
docker-compose restart clamd-mailcow

Please note:

  • You can't use ExcludePUA and IncludePUA in clamd.conf simultaneously, so please comment any IncludePUA if you uncommented them before.
  • List of databases provided in this example fit most use-cases, but SecuriteInfo also provides other databases. Please check SecuriteInfo FAQ for additional information.
  • With the current DB set (including default DBs) ClamAV will consume about 1.3Gb of RAM on your server.
  • If you modified message_size_limit in Postfix you need to adapt MaxSize settings in ClamAV as well.

Enable InterServer databases

  1. Add to data/conf/clamav/freshclam.conf:
    DatabaseCustomURL http://sigs.interserver.net/interserver256.hdb
    DatabaseCustomURL http://sigs.interserver.net/interservertopline.db
    DatabaseCustomURL http://sigs.interserver.net/shell.ldb
    DatabaseCustomURL http://sigs.interserver.net/whitelist.fp
    
  2. Restart ClamAV container:
docker compose restart clamd-mailcow
docker-compose restart clamd-mailcow

Last update: 2022-12-15 15:31:09