ClamAV Antivirus Engine

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

ClamAV is the open source, GPL-2.0 licensed antivirus engine: a scanning daemon (clamd) that holds a signature set in memory and returns verdicts, on-demand command-line scanners (clamscan and clamdscan), and a signature updater (freshclam). It is a long-standing answer to file-scanning and compliance requirements such as PCI-DSS 5.x. This AMI delivers ClamAV fully installed and running as a ready-to-use scanning appliance - SSH in and the daemon is already loaded and detecting.

## What This Appliance Is

ClamAV is a scanning engine, not a turnkey endpoint-protection suite. There is no web interface and it does not automatically protect other machines. What it does out of the box, and what the guide documents in detail:

• Scan this instance's own storage - on demand with clamscan, or on a schedule with clamdscan
• Scan mounted storage - mount an EFS/NFS share or an EBS data volume and let the shipped systemd timer sweep it; the most useful single-node pattern
• Run as a scanning service - other workloads hand files to clamd for a verdict over its local socket, with a documented VPC-scoped TCP opt-in
• Integration substrate - an application on this instance calls clamdscan or libclamav locally

## Signatures Fetched Per-Instance, Never Baked

No virus signature database is shipped inside the image. On the first boot of every instance, freshclam fetches the current signature databases directly from the upstream provider, so your scanner starts with fresh signatures rather than a stale set frozen at build time, and clamav-freshclam keeps them current thereafter.

## Secure By Default

The clamd daemon binds a local UNIX socket only - it never listens on TCP by default, because clamd has no authentication of its own. The shipped security group opens only the SSH port, and a preflight guard refuses to start clamd if a TCP listener is ever configured without following the deliberate, VPC-scoped opt-in in the guide. A brief, fail-closed design means the daemon will not run at all unless a valid signature database is present.

## Fail-Closed By Design

clamd physically cannot start without a signature database, and none ships, so the very first boot cannot silently come up blind. Two independent levers - a systemd dependency on the first-boot signature fetch, and a preflight check re-run on every start - ensure the scanner is either fully armed or not running.

## Getting Started

1. Launch the AMI on your preferred EC2 instance type (at least 4 GB RAM is recommended; clamd loads the full signature set into memory)

2. Connect over SSH using your key pair

3. Confirm the daemon is loaded and detecting with a scan of the standard EICAR test file

4. Point the scheduled sweep at a path by setting SCAN_PATHS in /etc/cloudimg/clamav-scan.conf

## cloudimg Support

24/7 technical support by email and live chat covers on-demand and scheduled scanning, the clamd socket and the scanning-service opt-in, freshclam signature updates, tuning for memory and throughput, and integrating ClamAV with your own applications and storage. Critical issues receive a one-hour average response.

## Use Cases

• Scanning uploaded or transferred files for malware before they are trusted
• Sweeping mounted storage (an EFS share or EBS data volume) on a schedule
• Providing a local malware-scanning service to other workloads over the clamd socket
• Satisfying compliance controls that require antivirus scanning, such as PCI-DSS 5.x

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.