@@ -27,95 +27,92 @@ email_addr="you@domain.com"
2727email_ignore_clean=0
2828
2929# #
30- # [ QUARANTINE OPTIONS ]
31- # #
32- # The default quarantine action for malware hits
33- # [0 = alert only, 1 = move to quarantine & alert]
34- quarantine_hits=0
35-
36- # Try to clean string based malware injections
37- # [NOTE: quarantine_hits=1 required]
38- # [0 = disabled, 1 = clean]
39- quarantine_clean=1
40-
41- # The default suspend action for users wih hits
42- # Cpanel suspend or set shell /bin/false on non-Cpanel
43- # [NOTE: quarantine_hits=1 required]
44- # [0 = disabled, 1 = suspend account]
45- quarantine_suspend_user=0
46-
47- # The minimum userid value that can be suspended
48- # [ default = 500 ]
49- quarantine_suspend_user_minuid=500
50-
51- # #
52- # [ ADVANCED SCAN OPTIONS ]
30+ # [ SCAN OPTIONS ]
5331# #
5432
5533# The maximum directory depth that the scanner will search
5634# [ changing this may have an impact on scan performance ]
57- scan_find_max_depth =15
35+ scan_max_depth =15
5836
59- # The minimum in bytes for a file to be included in a scan
37+ # The minimum file size in bytes for a file to be included in
38+ # LMD scans. A value of less than 24b is highly discouraged.
6039# [ changing this may have an impact on scan performance ]
61- scan_find_min_filesize=32
40+ scan_min_filesize=24
6241
63- # The maximum file size for a file to be included in scan
64- # search results; use man find for accepted values
42+ # The maximum file size for a file to be included in scan LMD
43+ # scans. Accepted value formats are b, k, M.
6544# [ changing this may have an impact on scan performance ]
66- scan_find_max_filesize=" 768k"
45+ scan_max_filesize=" 768k"
46+
47+ # As a design and common use case, LMD typically only scans
48+ # user space paths and as such it makes sense to ignore files
49+ # that are root owned. It is recommended to leave this enabled.
50+ # [ 0 = disabled, 1 = enabled; enabled by default ]
51+ scan_ignore_root=" 1"
6752
6853# The maximum byte depth that the scanner will search into
69- # a files contents; default rules expect a 1024*60 depth
54+ # a files contents; default rules expect a 65536 depth size.
7055# [ changing this may have an impact on scan performance ]
71- scan_hexdepth=61440
72-
73- # Use named pipe (FIFO) for passing file contents hex data
74- # instead of stdin default; improved performance and greater
75- # scanning depth
76- # [ 0 = disabled, 1 = enabled; enabled by default ]
56+ scan_hexdepth=65536
57+
58+ # Use named pipe (FIFO) for passing file contents hex data instead
59+ # of stdin default; improved performance and greater scanning depth.
60+ # This is highly recommended and works on most systems. The hexfifo
61+ # will be disabled automatically if for any reason it can not be
62+ # successfully utilized.
63+ # [ 0 = disabled, 1 = enabled; enabled by default ]
7764scan_hexfifo=1
7865
79- # The maximum byte depth that the scanner will search into
80- # a files contents; default rules expect a 1024*60 depth
66+ # The maximum byte depth that the scanner will search into a files
67+ # contents when using named pipe (FIFO). Improved performance allows
68+ # for greater scan depth over default scan_hexdepth value.
8169# [ changing this may have an impact on scan performance ]
8270scan_hexfifo_depth=524288
8371
84- # If installed, use ClamAV clamscan binary as default scan
85- # engine which providers a higher degree of performance.
86- # This option only uses ClamAV as the scanner engine, LMD
87- # signatures are still the basis for detecting threats.
88- # [ 0 = disabled, 1 = enabled; enabled by default ]
72+ # If installed, use ClamAV clamscan binary as default scan engine which
73+ # provides improved scan performance on large file sets. The clamscan
74+ # engine is used in conjunction with native ClamAV signatures updated
75+ # through freshclam along with LMD signatures providing additional
76+ # detection capabilities.
77+ # [ 0 = disabled, 1 = enabled; enabled by default ]
8978scan_clamscan=1
9079
9180# Include the scanning of known temporary world-writable
9281# paths for -a|--al and -r|--recent scan types.
9382scan_tmpdir_paths=" /tmp /var/tmp /dev/shm"
9483
95- # Allow non-root users to perform malware scans. This must be
96- # enabled when using mod_security2 upload scanning or if you
97- # want to allow users to perform scans. When enabled, this will
98- # populate the /usr/local/maldetect/pub/ path with user owned
99- # quarantine, session and temporary paths to faciliate scans.
100- # These paths are populated through cron every 10min with the
101- # /etc/cron.d/maldet_pub cronjob.
102- # [ 0 = disabled, 1 = enabled, disabled by defaukt ]
84+ # Allows non-root users to perform scans. This must be enabled when
85+ # using mod_security2 upload scanning or if you want to allow users
86+ # to perform scans. When enabled, this will populate 'pub/' with user
87+ # owned quarantine, session and temporary paths to faciliate scans.
88+ # [ 0 = disabled, 1 = enabled, disabled by default ]
10389scan_user_access=0
10490
10591# Process CPU scheduling (nice) priority level for scan operations.
10692# [ -19 = high prio , 19 = low prio, default = 19 ]
10793scan_cpunice=" 19"
10894
10995# #
110- # [ STATISTICAL ANALYSIS ]
96+ # [ QUARANTINE OPTIONS ]
11197# #
112- # The string length test is used to identify threats based on the
113- # length of the longest uninterrupted string within a file. This is
114- # useful as obfuscated code is often stored using encoding methods
115- # that produce very long strings without spaces (e.g: base64)
116- # [ string length in characters, default = 150000 ]
117- string_length_scan=" 0" # [ 0 = disabled, 1 = enabled ]
118- string_length=" 150000" # [ max string length ]
98+ # The default quarantine action for malware hits
99+ # [0 = alert only, 1 = move to quarantine & alert]
100+ quarantine_hits=0
101+
102+ # Try to clean string based malware injections
103+ # [NOTE: quarantine_hits=1 required]
104+ # [0 = disabled, 1 = clean]
105+ quarantine_clean=1
106+
107+ # The default suspend action for users wih hits
108+ # Cpanel suspend or set shell /bin/false on non-Cpanel
109+ # [NOTE: quarantine_hits=1 required]
110+ # [0 = disabled, 1 = suspend account]
111+ quarantine_suspend_user=0
112+
113+ # The minimum userid value that can be suspended
114+ # [ default = 500 ]
115+ quarantine_suspend_user_minuid=500
119116
120117# #
121118# [ MONITORING OPTIONS ]
@@ -140,3 +137,17 @@ inotify_docroot=public_html
140137# Process CPU scheduling (nice) priority level for monitoring process.
141138# [ -19 = high prio , 19 = low prio, default = 15 ]
142139inotify_cpunice=15
140+
141+ # #
142+ # [ STATISTICAL ANALYSIS ]
143+ # This is a beta feature and as such should be used with caution.
144+ # Currently, this feature can have a substantially negative impact
145+ # on scan performance, especially with large file sets.
146+ # #
147+ # The string length test is used to identify threats based on the
148+ # length of the longest uninterrupted string within a file. This is
149+ # useful as obfuscated code is often stored using encoding methods
150+ # that produce very long strings without spaces (e.g: base64)
151+ # [ string length in characters, default = 150000 ]
152+ string_length_scan=" 0" # [ 0 = disabled, 1 = enabled ]
153+ string_length=" 150000" # [ max string length ]
0 commit comments