Closed lirigithub closed 3 years ago
Hi @lirigithub I will try to answer your questions inline:
1. We thought to bring only the daily.cvd every day (after the main.cvd is there, of course). Is this ok?
It would be best to check if there are updates to each of main
, daily
, and bytecode
before copying them. 99% of the time, only daily
will need to be updated, When main
is updated, it means that good signatures have been migrated from daily
to main
, so there will be a loss in efficacy unless you update both. The bytecode
database is also infrequently updated because those signatures are handcrafted from C-like code. Other than a loss in efficacy if main
and bytecode
are updated, there would be no adverse effects from just updating daily
as far as I'm aware.
2. In order to know what the current version of the signatures on the server side, we wanted to use ‘sigtool --info daily.cvd’ and take the version attribute from there. a. Is this is the correct way to achieve it?
For your offline server, sigtool --info daily.cvd
will work great.
b. Is there another type of signatures version beside the version of the main.cvd and the daily.cvd?
The Version:
field is what you want. Some signatures have a set minimum or maximum functionality level that will enable or disable those signatures for certain versions of ClamAV. Don't worry about that though. For your needs, just make sure your local database version matches the latest version available from our servers.
3. For regular environment on which we use mirror (using cvd update), we would like to have a way to check if the if our signatures on the mirror are most updated. For that, we would like to have a way to get the signatures version on the remote location (the one the mirror downloads from). Is there a way to achieve it?
Both cvd update
and freshclam
use DNS queries to check what version is available for download. Please do not try to disable the DNS query for this check. So long as DNS is used for the version check, the check will only use a small amount of data for you and won't cost us anything. To make sure it's up to date, just run cvd update
. The output should look something like this:
2021-04-28 09:22:54 cvdupdate-1.0.2 INFO main.cvd is up-to-date. Version: 59
2021-04-28 09:22:54 cvdupdate-1.0.2 INFO daily.cvd is up-to-date. Version: 26154
2021-04-28 09:22:54 cvdupdate-1.0.2 INFO bytecode.cvd is up-to-date. Version: 333
In addition to sigtool --info <database>
you can also run cvd config show
. The JSON output from that command will include the local version
for each CVD database.
Does this help?
Yes. Thanks a lot.
I wanted also to ask, what is the best way to programmatically get the signatures version in offline mode if we don't have the sigtool or cvd on this environment? I see that the version is written in the head of the cvd file. Can we count on it?
Yes, the CVD header information is what sigtool uses. It's not pretty to read, but if you need, you could do something like:
❯ head -c 100 ~/.cvdupdate/database/daily.cvd
ClamAV-VDB:29 Apr 2021 07-08 -0400:26155:3974911:63:4324d544f045ea0a3c99ee6721366288:s1yadu2drxP92CF⏎
^---- version
You may want to write a script to collect just that version field.
Hi,
We want to support the an environment in which clients download signatures from one server. This server will be in offline mode – meaning that the signatures will be put there by an administrator manually. I have some questions regarding it:
Thanks a lot for your help.