fangfrisch 1.9.0.dev1__tar.gz → 1.9.0.dev3__tar.gz

{fangfrisch-1.9.0.dev1/fangfrisch.egg-info → fangfrisch-1.9.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: fangfrisch
-Version: 1.9.0.dev1
+Version: 1.9.0.dev3
 Summary: Update and verify unofficial Clam Anti-Virus signatures
 Home-page: https://github.com/rseichter/fangfrisch
 Author: Ralph Seichter

{fangfrisch-1.9.0.dev1 → fangfrisch-1.9.0.dev3}/docs/combined.conf

@@ -10,6 +10,31 @@ local_directory = /var/lib/clamav
 on_update_exec = clamdscan --reload
 on_update_timeout = 42
 
+[fangfrischnews]
+interval = 12h
+local_directory = /tmp
+max_size = 50KB
+script = /path/to/script/fangfrisch-has-news.sh
+on_update_exec = sh -c "[ ! -r ${script} ] || ${script} ${local_directory}"
+prefix = http://mirror.sentries.org/fangfrisch/
+url_alerts = ${prefix}fangfrisch_alerts.txt
+url_news = ${prefix}fangfrisch_news.txt
+
+[interserver]
+interval = 1h
+integrity_check = disabled
+max_size = 5MB
+prefix = http://sigs.interserver.net/
+!url_shell_hdb = ${prefix}shell.hdb
+!url_shellb_db = ${prefix}shellb.db
+url_interserver256 = ${prefix}interserver256.hdb
+url_shell_ldb = ${prefix}shell.ldb
+filename_shell_ldb = interservershell.ldb
+url_topline = ${prefix}interservertopline.db
+url_whitelist_fp = ${prefix}whitelist.fp
+filename_whitelist_fp = interserverwhitelist.fp
+enabled = yes
+
 [malwarepatrol]
 interval = 1d
 integrity_check = disabled
@@ -78,7 +103,8 @@ prefix = https://www.securiteinfo.com/get/signatures/${customer_id}/
 !url_0hour = ${prefix}securiteinfo0hour.hdb
 !url_old = ${prefix}securiteinfoold.hdb
 !url_securiteinfo_mdb = ${prefix}securiteinfo.mdb
-!url_spam_marketing = ${prefix}spam_marketing.ndb
+!url_securiteinfo_pdb = ${prefix}securiteinfo.pdb
+!url_securiteinfo_yara = ${prefix}securiteinfo.yara
 url_android = ${prefix}securiteinfoandroid.hdb
 url_ascii = ${prefix}securiteinfoascii.hdb
 url_html = ${prefix}securiteinfohtml.hdb
@@ -86,6 +112,7 @@ url_javascript = ${prefix}javascript.ndb
 url_pdf = ${prefix}securiteinfopdf.hdb
 url_securiteinfo = ${prefix}securiteinfo.hdb
 url_securiteinfo_ign2 = ${prefix}securiteinfo.ign2
+url_spam_marketing = ${prefix}spam_marketing.ndb
 enabled = yes
 
 [urlhaus]

{fangfrisch-1.9.0.dev1 → fangfrisch-1.9.0.dev3}/docs/example.conf

@@ -11,6 +11,9 @@ max_size = 5MB
 on_update_exec = clamdscan --reload
 on_update_timeout = 42
 
+[interserver]
+enabled = yes
+
 [malwarepatrol]
 enabled = yes
 # Replace with your personal Malwarepatrol receipt

{fangfrisch-1.9.0.dev1 → fangfrisch-1.9.0.dev3}/docs/fangfrisch.adoc

@@ -1,6 +1,6 @@
 # Fangfrisch
 Ralph Seichter <fangfrisch@seichter.de>
-v1.9.0.dev1, {docdate}
+v1.9.0.dev3, {docdate}
 :copyright: © 2020-2024 Ralph Seichter
 :encoding: UTF-8
 :hyphens: en
@@ -17,6 +17,7 @@ v1.9.0.dev1, {docdate}
 Fangfrisch (German for "freshly caught") is a sibling of the https://www.clamav.net[Clam Anti-Virus] freshclam utility.
 It allows downloading virus definition files that are not official ClamAV canon, e.g. from https://sanesecurity.com[Sanesecurity] and https://urlhaus.abuse.ch[URLhaus].
 Fangfrisch was designed with security in mind, to be run by an unprivileged user only.
+For those curious about the development history, a https://github.com/rseichter/fangfrisch/blob/master/CHANGELOG.rst[changelog] is available online.
 
 == License
 
@@ -158,23 +159,30 @@ If providers don't respond with content length information, Fangfrisch will log
 * *on_update_exec*: If any files were downloaded during a pass, a command can be executed in after the pass finishes.
 No default.
 A typical value is `clamdscan --reload`.
+Starting with Fangfrisch 1.9.0, this option may be overridden in individual sections, permitting per-provider actions.
 * *on_update_timeout*: Timeout for the `on_update_exec` command, in seconds.
 Default: 30.
+This option may also be overridden in individual sections.
 
 See https://docs.python.org/3.7/library/configparser.html[here] for details about the configuration parser and extended interpolation.
 <<Semantics>> provides additional information on how configuration options are interpreted.
 
 === Default providers
 
-Fangfrisch contains internal defaults for the following providers (in alphabetical order):
+Fangfrisch contains internal defaults for the following providers, listed in alphabetical order:
 
+* http://sigs.interserver.net/[InterServer]
 * https://www.malwarepatrol.net[Malwarepatrol]
 * https://sanesecurity.com[Sanesecurity]
 * https://www.securiteinfo.com/services/anti-spam-anti-virus/improve-detection-rate-of-zero-day-malwares-for-clamav.shtml[SecuriteInfo]
 * https://urlhaus.abuse.ch[URLhaus]
 
-The internal default values for providers can be used by specifiying `enabled = yes` in the desired sections.
-Some providers require additional configuration as shown in the following example.
+I have also included "Fangfrisch News" (see <<ffnews>>).
+Providers can be enabled by specifiying `enabled = yes` in the desired configuration file sections.
+
+IMPORTANT: Please make sure to examine the respective settings for yourself before enabling providers.
+
+The defaults may not suit your personal preferences, and some providers require additional configuration, e.g. an access token.
 
 ----
 include::example.conf[]
@@ -271,7 +279,7 @@ An example crontab looks like this:
 HOME=/var/lib/fangfrisch
 LOG_LEVEL=INFO
 # minute hour day-of-month month day-of-week user command
-*/10 * * * * clamav venv/bin/fangfrisch --conf /etc/fangfrisch.conf refresh
+*/10 * * * * clamav sleep $((RANDOM \% 42)); venv/bin/fangfrisch --conf /etc/fangfrisch.conf refresh
 ----
 
 == Support
@@ -330,8 +338,10 @@ See Heather McNamee's blog https://about.gitlab.com/blog/2016/03/03/start-with-a
 == Default configuration
 
 Fangfrisch contains the following internal configuration settings as defaults.
-All sections are disabled, and entries with the `!url_` prefix are included for reference only.
-These represent data sources which either have a high risk of false positives or are not free to use.
+As a safety measure, all sections are disabled by default.
+Entries with the `!url_` prefix are included for reference only.
+These represent data sources which are not recommended for general use.
+Possible reasons: Some sources have an elevated risk of false positives, are not free to use, or contain legacy data.
 Enabling a section will not enable these specially prefixed entries.
 
 ----
@@ -348,13 +358,36 @@ The following effective configuration is the result of combining internal defaul
 include::combined.conf[]
 ----
 
+[[ffnews]]
+[appendix]
+== Fangfrisch News
+
+This pseudo provider does not offer antivirus signature files.
+It is only meant for me to pass news about Fangfrisch to you, the user, in lieu of a mailing list.
+Don't expect this to happen on a regular basis.
+I am only thinking about release notifications at this point in time.
+Still, I kindly ask you to please enable this service as you would enable any other provider, by adding the following to your configuration file:
+----
+[fangfrischnews]
+enabled = yes
+# Uncomment/adapt the following to trigger a script in case of news.
+# script = /path/to/script/fangfrisch-has-news.sh
+----
+This will only enable Fangfrisch to occasionally download small text files, nothing more.
+You will not need to read the content, nor will anything else happen, unless you modify the `script` option.
+Here is an example script which you could use to have downloaded news items mailed to you.
+It needs to be readable for the user account running Fangfrisch, and the sender/recipient addresses obviously have to be adapted.
+For your convenience, the latest version of the script can be downloaded https://github.com/rseichter/fangfrisch/blob/master/contrib/process-news.sh[here].
+----
+include::../contrib/process-news.sh[]
+----
+
 [[dbstructure]]
 [appendix]
 == Database structure
 
 While users can technically access the Fangfrisch backend database directly, its structure and content are considered *private*.
 They may change at any time, without notice.
-Related complaints will be filed under https://en.wikipedia.org/wiki/Somebody_else%27s_problem[SEP].
 
 === Accessing mappings