2013-12-04 17:03:06 -05:00
.TH "freshclam" "1" "December 4, 2013" "ClamAV @VERSION@" "Clam AntiVirus"
2004-09-26 01:28:55 +00:00
.SH "NAME"
2019-06-05 11:38:01 -04:00
.LP
2004-09-26 01:28:55 +00:00
freshclam \- update virus databases
.SH "SYNOPSIS"
2019-06-05 11:38:01 -04:00
.LP
2004-09-26 01:28:55 +00:00
freshclam [options]
.SH "DESCRIPTION"
2019-06-05 11:38:01 -04:00
.LP
2007-02-12 18:38:32 +00:00
freshclam is a virus database update tool for ClamAV.
2004-09-26 01:28:55 +00:00
.SH "OPTIONS"
2019-06-05 11:38:01 -04:00
.LP
2021-03-20 21:25:18 -07:00
FreshClam reads its configuration from freshclam.conf. The settings can be overwritten with command line options.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
\fB \- h, \- \- help\fR
Output help information and exit.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
\fB \- V, \- \- version\fR
Print version number and exit.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
\fB \- v, \- \- verbose\fR
2008-04-29 14:04:58 +00:00
Be verbose. This option causes freshclam to print much additional information.
2019-06-05 11:38:01 -04:00
.TP
2013-12-04 17:03:06 -05:00
\fB \- \- debug\fR
Enable debug messages from LibClamAV.
.TP
2004-09-26 01:28:55 +00:00
\fB \- \- quiet\fR
Be quiet \- output only error messages.
2019-06-05 11:38:01 -04:00
.TP
2008-01-23 12:12:25 +00:00
\fB \- \- no\- warnings\fR
Don't print and log warnings.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
\fB \- \- stdout\fR
2007-02-12 18:38:32 +00:00
Write all messages to stdout.
2019-06-05 11:38:01 -04:00
.TP
2018-02-06 16:23:07 -05:00
\fB \- \- show\- progress\fR
Show download progress percentage.
2019-06-05 11:38:01 -04:00
.TP
2013-12-04 17:03:06 -05:00
\fB \- \- config\- file=FILE
Read configuration from FILE.
.TP
2004-09-26 01:28:55 +00:00
\fB \- l FILE, \- \- log=FILE\fR
2013-12-04 17:03:06 -05:00
Log report to FILE.
.TP
2004-09-26 01:28:55 +00:00
\fB \- d, \- \- daemon\fR
2013-12-04 17:03:06 -05:00
Run in a daemon mode. Defaults to 12 checks per day unless otherwise specified by \- \- checks or freshclam.conf.
.TP
2004-09-26 01:28:55 +00:00
\fB \- p FILE, \- \- pid=FILE\fR
2023-05-31 17:38:00 -07:00
Write the daemon's pid to FILE.
2019-06-05 11:38:01 -04:00
.TP
2019-07-05 11:53:43 -07:00
\fB \- F, \- \- foreground\fR
Don't fork into background (for use in daemon mode).
.TP
2013-12-04 17:03:06 -05:00
\fB \- u USER, \- \- user USER\fR
2021-07-28 14:52:39 -07:00
Run as USER. By default (when started by root) freshclam drops privileges and operates as the '@CLAMAV_USER@' user.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
\fB \- \- no\- dns\fR
This option forces old non\- DNS verification method (without a TTL delay).
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
\fB \- c #n, \- \- checks=#n\fR
Check #n times per day for a new database. #n must be between 1 and 50.
2013-12-04 17:03:06 -05:00
.TP
\fB \- \- datadir=DIRECTORY\fR
2024-03-06 14:13:06 -08:00
Install new database in DIRECTORY. The directory must be writable for the '@CLAMAV_USER@' user or unprivileged user running freshclam, already exist, and be an absolute path.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
\fB \- \- daemon\- notify=/path/to/clamd.conf\fR
2007-02-12 18:38:32 +00:00
Notify the daemon about the new database. By default it reads a hardcoded config file but you can use a different one. Both local and TCP sockets are supported.
2019-06-05 11:38:01 -04:00
.TP
2005-05-11 00:54:14 +00:00
\fB \- a IP, \- \- local\- address=IP\fR
Use (local) IP for HTTP downloads. Useful for multi\- homed systems. If binding fails for whatever reason, a warning is issued and freshclam behaves like without this flag.
2013-12-04 17:03:06 -05:00
.TP
\fB \- \- on\- update\- execute=COMMAND\fR
Execute COMMAND after successful update.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
\fB \- \- on\- error\- execute=COMMAND\fR
2005-06-18 23:00:56 +00:00
Execute COMMAND if error occurred. Remember, that virus database freshness is the most important thing in anti\- virus system. With this option freshclam can alert you (eg. send SMS) when something is going wrong.
2019-06-05 11:38:01 -04:00
.TP
2005-08-03 02:59:29 +00:00
\fB \- \- on\- outdated\- execute=COMMAND\fR
2005-08-03 14:21:55 +00:00
Execute COMMAND when freshclam reports outdated version. In the command string %v will be replaced by the new version number.
2008-10-28 09:25:55 +00:00
.TP
2011-08-08 11:32:51 +02:00
\fB \- \- update\- db=DBNAME\fR
2018-02-21 15:00:59 -05:00
With this option you can limit updates to a subset of database files. The DBNAME should be "main", "daily", "bytecode", "safebrowsing" or one of the 3rd party database names. This option can be used multiple times and only works with the official and 3rd party databases distributed through the ClamAV mirrors, your custom databases (specified with DatabaseCustomURL in freshclam.conf) will not be ignored.
2021-08-17 09:52:46 -07:00
.SH "ENVIRONMENT VARIABLES"
.LP
freshclam uses the following environment variables:
.TP
2023-08-02 15:51:04 -07:00
\fB CURL_CA_BUNDLE\fR
(Linux/Unix only, excluding macOS) May be set to the path of a file (bundle) containing one or more CA certificates. This will override the default openssl certificate path.
.TP
\fB FRESHCLAM_CLIENT_CERT\fR
May be set to the path of a file (PEM) containing the client certificate. This may be used for client authentication.
.TP
\fB FRESHCLAM_CLIENT_KEY\fR
May be set to the path of a file (PEM) containing the client private key. This is required if FRESHCLAM_CLIENT_CERT is set.
.TP
\fB FRESHCLAM_CLIENT_KEY_PASSWD\fR
May be set to a password for the client key PEM file. This is required if FRESHCLAM_CLIENT_KEY is set and the PEM file is password protected.
FIPS-compliant CVD signing and verification
Add X509 certificate chain based signing with PKCS7-PEM external
signatures distributed alongside CVD's in a custom .cvd.sign format.
This new signing and verification mechanism is primarily in support
of FIPS compliance.
Fixes: https://github.com/Cisco-Talos/clamav/issues/564
Add a Rust implementation for parsing, verifying, and unpacking CVD
files.
Now installs a 'certs' directory in the app config directory
(e.g. <prefix>/etc/certs). The install location is configurable.
The CMake option to configure the CVD certs directory is:
`-D CVD_CERTS_DIRECTORY=PATH`
New options to set an alternative CVD certs directory:
- Commandline for freshclam, clamd, clamscan, and sigtool is:
`--cvdcertsdir PATH`
- Env variable for freshclam, clamd, clamscan, and sigtool is:
`CVD_CERTS_DIR`
- Config option for freshclam and clamd is:
`CVDCertsDirectory PATH`
Sigtool:
- Add sign/verify commands.
- Also verify CDIFF external digital signatures when applying CDIFFs.
- Place commonly used commands at the top of --help string.
- Fix up manpage.
Freshclam:
- Will try to download .sign files to verify CVDs and CDIFFs.
- Fix an issue where making a CLD would only include the CFG file for
daily and not if patching any other database.
libclamav.so:
- Bump version to 13:0:1 (aka 12.1.0).
- Also remove libclamav.map versioning.
Resolves: https://github.com/Cisco-Talos/clamav/issues/1304
- Add two new API's to the public clamav.h header:
```c
extern cl_error_t cl_cvdverify_ex(const char *file,
const char *certs_directory);
extern cl_error_t cl_cvdunpack_ex(const char *file,
const char *dir,
bool dont_verify,
const char *certs_directory);
```
The original `cl_cvdverify` and `cl_cvdunpack` are deprecated.
- Add `cl_engine_field` enum option `CL_ENGINE_CVDCERTSDIR`.
You may set this option with `cl_engine_set_str` and get it
with `cl_engine_get_str`, to override the compiled in default
CVD certs directory.
libfreshclam.so: Bump version to 4:0:0 (aka 4.0.0).
Add sigtool sign/verify tests and test certs.
Make it so downloadFile doesn't throw a warning if the server
doesn't have the .sign file.
Replace use of md5-based FP signatures in the unit tests with
sha256-based FP signatures because the md5 implementation used
by Python may be disabled in FIPS mode.
Fixes: https://github.com/Cisco-Talos/clamav/issues/1411
CMake: Add logic to enable the Rust openssl-sys / openssl-rs crates
to build against the same OpenSSL library as is used for the C build.
The Rust unit test application must also link directly with libcrypto
and libssl.
Fix some log messages with missing new lines.
Fix missing environment variable notes in --help messages and manpages.
Deconflict CONFDIR/DATADIR/CERTSDIR variable names that are defined in
clamav-config.h.in for libclamav from variable that had the same name
for use in clamav applications that use the optparser.
The 'clamav-test' certs for the unit tests will live for 10 years.
The 'clamav-beta.crt' public cert will only live for 120 days and will
be replaced before the stable release with a production 'clamav.crt'.
2024-11-21 14:01:09 -05:00
.TP
\fB CVD_CERTS_DIR\fR
Specify a directory containing the root CA cert needed to verify detached CVD digital signatures. If not provided, then freshclam will look in the default directory.
2021-08-17 09:52:46 -07:00
2023-08-02 15:51:04 -07:00
.TP
2021-08-17 09:52:46 -07:00
Note that the CURL_CA_BUNDLE environment variable is also used by the curl command line tool for the same purpose.
2004-09-26 01:28:55 +00:00
.SH "EXAMPLES"
2019-06-05 11:38:01 -04:00
.LP
.TP
2004-09-26 01:28:55 +00:00
(0) Download database to default directory:
\fB freshclam\fR
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
(1) Download database to current directory:
\fB freshclam \- \- datadir=.\fR
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
(2) Run as a daemon and check 2 times per day for new database:
\fB freshclam \- d \- c 2\fR
2021-08-17 09:52:46 -07:00
2004-09-26 01:28:55 +00:00
.SH "RETURN CODES"
2009-03-13 15:36:30 +00:00
Some return codes of freshclam can be overwritten with a built-in command EXIT_n which can be passed to \- \- on\- *\- execute, eg. \- \- on\- update\- execute=EXIT_1 will force freshclam to always return 1 after successful database update.
2008-12-03 09:23:18 +00:00
.TP
2009-09-14 19:56:56 +02:00
0 : Database is up\- to\- date or successfully updated.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
40: Unknown option passed.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
50: Can't change directory.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
51: Can't check MD5 sum.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
52: Connection (network) problem.
2019-06-05 11:38:01 -04:00
.TP
2005-05-11 00:54:14 +00:00
53: Can't unlink file.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
54: MD5 or digital signature verification error.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
55: Error reading file.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
56: Config file error.
2019-06-05 11:38:01 -04:00
.TP
2005-05-11 00:54:14 +00:00
57: Can't create new file.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
58: Can't read database from remote server.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
59: Mirrors are not fully synchronized (try again later).
2019-06-05 11:38:01 -04:00
.TP
2021-07-28 14:52:39 -07:00
60: Can't get information about '@CLAMAV_USER@' user from /etc/passwd.
2019-06-05 11:38:01 -04:00
.TP
2004-09-26 01:28:55 +00:00
61: Can't drop privileges.
2019-06-05 11:38:01 -04:00
.TP
2005-06-18 23:00:56 +00:00
62: Can't initialize logger.
2004-09-26 01:28:55 +00:00
.SH "FILES"
2019-06-05 11:38:01 -04:00
.LP
2021-07-28 14:52:39 -07:00
@CONFDIR@/freshclam.conf
2004-09-26 01:28:55 +00:00
.SH "CREDITS"
Please check the full documentation for credits.
.SH "AUTHOR"
2019-06-05 11:38:01 -04:00
.LP
2013-12-04 17:03:06 -05:00
Tomasz Kojm <tkojm@clamav.net>, Kevin Lin <klin@sourcefire.com>
2004-09-26 01:28:55 +00:00
.SH "SEE ALSO"
2019-06-05 11:38:01 -04:00
.LP
2010-05-06 17:02:53 +02:00
freshclam.conf(5), clamd(8), clamd.conf(5), clamscan(1)
