The guides above will cover the installation and customization of the Debian server environment. If you're interested in how to install the GNOME desktop environment on top of it, the following articles will help you with that:

Please follow the sub-sections below to learn how to install ClamAV on your Debian Linux operating system.

apt install -y --no-install-recommends clamav clamav-base clamav-freshclam clamav-daemon clamdscan

On the next screen, you will be asked to select the closest mirror from which the ClamAV will pull the updates. Please choose the one that is closest to your location:

Accepting the defaults for the rest of the questions the installer will ask is fine, so press Enter on your keyboard to do so.

Installation will set configuration files in the /etc/clamav directory, and database and signature updates will be downloaded in the /var/lib/clamav directory.

Usually, it's best only to scan the locations where most "user-created" files are located. That can be the home directory on your desktop or a folder where website(s) data is located on a public web server.

A list of locations (directories on the filesystem that need to be scanned) can be supplied to ClamAV by simply listing them in a simple text file. For example, if I want ClamAV to scan my home directory, I will open a new file /etc/clamav/clamav-paths.txt and paste in the following content:

/home

With paths to scan defined, a scan job can now be configured. You can create a small BASH script with all the required scan parameters for that. To do it, open a new file /usr/local/sbin/clamav-scan.sh and paste in the following content:

#!/usr/bin/env bash
set -euo pipefail

## Flush log
echo -n > /etc/clamav//clamav_scan_results.txt

## Scan files
/usr/bin/clamscan -r -z -i --file-list=/etc/clamav/clamav_paths.txt --log=/etc/clamav/clamav_scan_results.txt

Once you save and close the script, make it executable:

chmod 750 /usr/local/sbin/clamav-scan.sh

The last thing to do here is to set a corn job for the scan. To do so, you can open a new file /etc/cron.d/clamav-scan and paste in the following content:

# Execute virus scan on home folder
MAILTO=root
0 3 * * * root /usr/local/sbin/clamav-scan.sh

Save and close the file. With all this in place, ClamAV will scan the home folder every day at 3 o'clock in the morning and send an email message to the root user if something goes wrong.

In the following sub-sections, I will show you how to install and configure LMD on your Debian Linux system.

cd
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar xzf maldetect-current.tar.gz
rm -rf maldetect-current.tar.gz

The Maldetect package will be extracted into a folder whose name contains the latest version (at the moment of writing, the latest version was 1.6.5). To satisfy all, I will set a variable here that will help me to continue the installation regardless of the version number in the folder name:

MALDET_VERSION=$(ls | grep maldetect)

I will use that variable now to access the extracted folder containing Maldetect installation files and install the Maldedect on the system:

cd $MALDET_VERSION
./install.sh

The installation will install Maldetect in /usr/local/maldetect directory. It will set a main configuration file, executable binary, and daily cron job. It will also check the initial signatures and download new malware signatures if an update is required.

email_alert="1"
email_addr="root"
scan_clamscan="1"
scan_find_timeout="14400"
scan_export_filelist="1"
quarantine_hits="1"
quarantine_clean="1"
#default_monitor_mode="users"
default_monitor_mode="/usr/local/maldetect/monitor_paths"

Now, a file with a list of locations Maldetect will scan can be set. For example, I also want Maldetect to scan my home directory. To do so, open a new file /usr/local/maldetect/monitor_paths and paste in the following content:

/home

As a last step, a log rotation configuration for the event and inotify logs can be set so they don't grow indefinitely. To do so, open a new file /etc/logrotate.d/maldetect and paste in the following content:

/usr/local/maldetect/logs/event_log {
    missingok
    weekly
    compress
    notifempty
    size 1M
    rotate 4
    su root root
    create 0644 root root
}
/usr/local/maldetect/logs/inotify_log {
    missingok
    weekly
    compress
    create 0644 root root
    notifempty
    size 1M
    rotate 4
    su root root
    postrotate
        /bin/systemctl condrestart maldet.service > /dev/null 2>/dev/null || true
    endscript
}

Save and close the file and restart the Maldetect service to make this all work:

systemctl restart maldet.service

It's important to note that while LMD and ClamAV are valuable tools for enhancing the security of Linux servers, no single security solution can provide complete protection. Regular system updates, proper configuration, and a combination of security tools are typically recommended for a robust defense against malware and other security threats. Additionally, LMD and ClamAV are just single components of a comprehensive security strategy, and they should be used in conjunction with other security measures such as firewalls, intrusion detection systems, and regular security audits.

With that said, I will conclude this guide. Please share it if you like, and thank you very much for reading.