inotifywait

r3j3ct

Of course. This is an excellent setup for real-time monitoring. I'll guide you through configuring `inotifywait` to act as a bridge between the filesystem and the Linux Malware Detect (LMD) `clamav` integration.

The goal is to have `inotifywait` watch for file changes (creates, closes) in key directories and then trigger an `lmd` scan on that specific file.

### Prerequisites (Verify First)

1.  **ClamAV is installed and the daemon (`clamav-daemon`) is running:**
    ```bash
    sudo systemctl status clamav-daemon
    # or
    sudo systemctl status clamav-freshclam
    ```

2.  **Linux Malware Detect (LMD) is installed and integrated with ClamAV:**
    This is usually done during LMD's configuration. Check that the `scan_clamscan` option is enabled in `/usr/local/maldetect/conf.maldet`.
    ```bash
    sudo grep scan_clamscan /usr/local/maldetect/conf.maldet
    ```
    It should return: `scan_clamscan="1"`.

### Step 1: Create the Monitoring Script

We'll create a script that uses `inotifywait` to monitor directories and call `maldet` to scan any new or modified files.

1.  Open a text editor with sudo privileges to create the script. A good place for system scripts is `/usr/local/sbin/`.
    ```bash
    sudo nano /usr/local/sbin/inotify-maldet.sh
    ```

2.  **Copy and paste the following script.** I'll explain the key parts below.

    ```bash
    #!/bin/bash

    # Directories to monitor. Add more with a space separator.
    # e.g., MONITOR_DIR="/home /www /var/www"
    MONITOR_DIR="/home /tmp /var/www"

    # ClamAV/LMD log file
    LOG_FILE="/var/log/inotify-maldet.log"

    # Inotifywait pattern. We watch for 'close_write' (file saved) and 'moved_to'
    INOTIFY_EVENTS="close_write,moved_to"

    # Maldet path
    MALDET_SCAN="/usr/local/maldetect/maldet"

    # Init log
    echo "$(date) - Starting inotifywait monitoring for LMD on: $MONITOR_DIR" >> "$LOG_FILE"

    # Start monitoring
    inotifywait -r -m -e "$INOTIFY_EVENTS" $MONITOR_DIR --format '%w%f' | while read FILE
    do
            # Check if the file exists (to avoid errors on moved/deleted files)
            if [ -f "$FILE" ]; then
                    # Avoid scanning files that are obviously not threats to reduce CPU load
                    # Example: skip .log, .tmp files. Add or remove extensions as needed.
                    case "$FILE" in
                        *.log|*.tmp)
                            # Skip these file types
                            continue
                            ;;
                    esac

                    # Run maldet on the specific file.
                    # The '--background' flag is CRUCIAL to avoid fork bombs.
                    # It tells maldet to run the scan as a background process.
                    echo "$(date) - Scanning file: $FILE" >> "$LOG_FILE"
                    $MALDET_SCAN --background -s "$FILE" >> "$LOG_FILE" 2>&1
            fi
    done
    ```

    **Script Explanation:**
    *   `MONITOR_DIR`: Define the directories you want to watch. **This is the most important setting.** Start with `/home` and `/tmp`. Add web directories like `/var/www` if you run a server.
    *   `LOG_FILE`: Where all output from the script and `maldet` will go. Essential for debugging.
    *   `INOTIFY_EVENTS`: `close_write,moved_to` is efficient. It triggers when a file is finished being written to or is moved into the directory.
    *   The `case` statement: This is a simple filter to skip scanning certain harmless file types, reducing unnecessary CPU usage.
    *   `--background`: **This is critical.** Without it, if a process creates many files quickly, each `maldet` scan would run in the foreground and could quickly consume all system resources, creating a fork bomb scenario. `--background` prevents this.

3.  **Make the script executable:**
    ```bash
    sudo chmod +x /usr/local/sbin/inotify-maldet.sh
    ```

### Step 2: Create a Systemd Service (Recommended)

The best way to manage a long-running script like this is with a systemd service. It ensures the script starts on boot and can be easily controlled.

1.  Create a service file:
    ```bash
    sudo nano /etc/systemd/system/inotify-maldet.service
    ```

2.  Paste the following configuration:
    ```ini
    [Unit]
    Description=Inotifywait monitoring with Linux Malware Detect
    After=network.target clamav-daemon.service maldet.service
    Wants=clamav-daemon.service maldet.service

    [Service]
    Type=simple
    ExecStart=/usr/local/sbin/inotify-maldet.sh
    Restart=on-failure
    RestartSec=5s

    [Install]
    WantedBy=multi-user.target
    ```
    *   `After=...`: Ensures this service starts *after* ClamAV and LMD are ready.
    *   `Restart=on-failure`: Automatically restarts the script if it crashes.

3.  Reload systemd to recognize the new service, then start and enable it:
    ```bash
    sudo systemctl daemon-reload
    sudo systemctl start inotify-maldet.service
    sudo systemctl enable inotify-maldet.service
    ```

### Step 3: Verify and Monitor

1.  **Check if the service is running:**
    ```bash
    sudo systemctl status inotify-maldet.service
    ```
    Look for `active (running)`.

2.  **Check the log file for initial messages:**
    ```bash
    sudo tail -f /var/log/inotify-maldet.log
    ```
    You should see the "Starting inotifywait..." message.

3.  **Test it!** Create a test file in one of your monitored directories (e.g., `/tmp`):
    ```bash
    touch /tmp/test_file.txt
    ```
    Immediately check the log again. You should see a new line indicating the file was scanned.
    ```bash
    sudo tail -f /var/log/inotify-maldet.log
    # Output should look like:
    # Sun Mar  2 12:00:00 UTC 2025 - Scanning file: /tmp/test_file.txt
    ```

### Important Considerations and Tips

*   **Performance:** Real-time scanning has a CPU and I/O cost. The `case` statement in the script helps. Monitor your system load after enabling this. Avoid monitoring very large, volatile directories (e.g., a database storage location).
*   **Testing EICAR:** To *really* test it, download the EICAR test virus file. The scan should detect it immediately.
    ```bash
    wget https://secure.eicar.org/eicar.com.txt -P /tmp/
    ```
*   **Updating Malware Definitions:** Remember, this real-time scanner is only as good as its definitions. Ensure the `maldet` and `clamav` update services are working:
    ```bash
    sudo systemctl status maldet.service
    sudo systemctl status clamav-freshclam.service
    ```
*   **Troubleshooting:** If it doesn't work, the log file (`/var/log/inotify-maldet.log`) is your first place to look for errors.

This configuration provides a robust, real-time shield that leverages the combined power of ClamAV's engine and LMD's specialized ruleset.