fangfrisch 1.9.0.dev1__tar.gz → 1.9.0.dev2__tar.gz

{fangfrisch-1.9.0.dev1/fangfrisch.egg-info → fangfrisch-1.9.0.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: fangfrisch
-Version: 1.9.0.dev1
+Version: 1.9.0.dev2
 Summary: Update and verify unofficial Clam Anti-Virus signatures
 Home-page: https://github.com/rseichter/fangfrisch
 Author: Ralph Seichter

{fangfrisch-1.9.0.dev1 → fangfrisch-1.9.0.dev2}/docs/combined.conf

@@ -10,6 +10,21 @@ local_directory = /var/lib/clamav
 on_update_exec = clamdscan --reload
 on_update_timeout = 42
 
+[interserver]
+interval = 1h
+integrity_check = disabled
+max_size = 5MB
+prefix = http://sigs.interserver.net/
+!url_shell_hdb = ${prefix}shell.hdb
+!url_shellb_db = ${prefix}shellb.db
+url_interserver256 = ${prefix}interserver256.hdb
+url_shell_ldb = ${prefix}shell.ldb
+filename_shell_ldb = interservershell.ldb
+url_topline = ${prefix}interservertopline.db
+url_whitelist_fp = ${prefix}whitelist.fp
+filename_whitelist_fp = interserverwhitelist.fp
+enabled = yes
+
 [malwarepatrol]
 interval = 1d
 integrity_check = disabled
@@ -78,7 +93,8 @@ prefix = https://www.securiteinfo.com/get/signatures/${customer_id}/
 !url_0hour = ${prefix}securiteinfo0hour.hdb
 !url_old = ${prefix}securiteinfoold.hdb
 !url_securiteinfo_mdb = ${prefix}securiteinfo.mdb
-!url_spam_marketing = ${prefix}spam_marketing.ndb
+!url_securiteinfo_pdb = ${prefix}securiteinfo.pdb
+!url_securiteinfo_yara = ${prefix}securiteinfo.yara
 url_android = ${prefix}securiteinfoandroid.hdb
 url_ascii = ${prefix}securiteinfoascii.hdb
 url_html = ${prefix}securiteinfohtml.hdb
@@ -86,6 +102,7 @@ url_javascript = ${prefix}javascript.ndb
 url_pdf = ${prefix}securiteinfopdf.hdb
 url_securiteinfo = ${prefix}securiteinfo.hdb
 url_securiteinfo_ign2 = ${prefix}securiteinfo.ign2
+url_spam_marketing = ${prefix}spam_marketing.ndb
 enabled = yes
 
 [urlhaus]

{fangfrisch-1.9.0.dev1 → fangfrisch-1.9.0.dev2}/docs/example.conf

@@ -11,6 +11,9 @@ max_size = 5MB
 on_update_exec = clamdscan --reload
 on_update_timeout = 42
 
+[interserver]
+enabled = yes
+
 [malwarepatrol]
 enabled = yes
 # Replace with your personal Malwarepatrol receipt

{fangfrisch-1.9.0.dev1 → fangfrisch-1.9.0.dev2}/docs/fangfrisch.adoc

@@ -1,6 +1,6 @@
 # Fangfrisch
 Ralph Seichter <fangfrisch@seichter.de>
-v1.9.0.dev1, {docdate}
+v1.9.0.dev2, {docdate}
 :copyright: © 2020-2024 Ralph Seichter
 :encoding: UTF-8
 :hyphens: en
@@ -166,15 +166,19 @@ See https://docs.python.org/3.7/library/configparser.html[here] for details abou
 
 === Default providers
 
-Fangfrisch contains internal defaults for the following providers (in alphabetical order):
+Fangfrisch contains internal defaults for the following providers, listed in alphabetical order:
 
+* http://sigs.interserver.net/[InterServer]
 * https://www.malwarepatrol.net[Malwarepatrol]
 * https://sanesecurity.com[Sanesecurity]
 * https://www.securiteinfo.com/services/anti-spam-anti-virus/improve-detection-rate-of-zero-day-malwares-for-clamav.shtml[SecuriteInfo]
 * https://urlhaus.abuse.ch[URLhaus]
 
-The internal default values for providers can be used by specifiying `enabled = yes` in the desired sections.
-Some providers require additional configuration as shown in the following example.
+Providers can be enabled by specifiying `enabled = yes` in the desired configuration file sections.
+
+IMPORTANT: Please make sure to examine the respective settings for yourself before enabling providers.
+
+The defaults may not suit your personal preferences, and some providers require additional configuration, e.g. an access token.
 
 ----
 include::example.conf[]
@@ -271,7 +275,7 @@ An example crontab looks like this:
 HOME=/var/lib/fangfrisch
 LOG_LEVEL=INFO
 # minute hour day-of-month month day-of-week user command
-*/10 * * * * clamav venv/bin/fangfrisch --conf /etc/fangfrisch.conf refresh
+*/10 * * * * clamav sleep $((RANDOM \% 42)); venv/bin/fangfrisch --conf /etc/fangfrisch.conf refresh
 ----
 
 == Support
@@ -330,8 +334,10 @@ See Heather McNamee's blog https://about.gitlab.com/blog/2016/03/03/start-with-a
 == Default configuration
 
 Fangfrisch contains the following internal configuration settings as defaults.
-All sections are disabled, and entries with the `!url_` prefix are included for reference only.
-These represent data sources which either have a high risk of false positives or are not free to use.
+As a safety measure, all sections are disabled by default.
+Entries with the `!url_` prefix are included for reference only.
+These represent data sources which are not recommended for general use.
+Possible reasons: Some sources have an elevated risk of false positives, are not free to use, or contain legacy data.
 Enabling a section will not enable these specially prefixed entries.
 
 ----
@@ -354,7 +360,6 @@ include::combined.conf[]
 
 While users can technically access the Fangfrisch backend database directly, its structure and content are considered *private*.
 They may change at any time, without notice.
-Related complaints will be filed under https://en.wikipedia.org/wiki/Somebody_else%27s_problem[SEP].
 
 === Accessing mappings