Fangfrisch

https://rseichter.github.io/fangfrisch/
Admin
Fangfrisch is a security-focused utility designed to download and update unofficial virus definition...
Tokens:8,797
Snippets:42
Trust Score:9.7
Update:1 month ago
Show doc for...
Tokens:
Raw
### Print all recorded mappings for the [example] provider section

Source: https://rseichter.github.io/fangfrisch

Use the dumpmappings action with the --provider option to print all recorded mappings for the [example] provider section. The provider option is interpreted as a regular expression, so anchoring (e.g., ^example$) is needed to match only the exact provider. Ensure proper shell quoting.

```bash
# Print all recorded mappings for the [example] provider section.
fangfrisch --conf /etc/fangfrisch.conf --provider '^example$' dumpmappings
```

--------------------------------

### Minimal Fangfrisch configuration example

Source: https://rseichter.github.io/fangfrisch

A minimal configuration file for testing. It requires a db_url entry and enables the urlhaus provider. The local_directory is set to /var/lib/clamav.

```ini
# Minimal example configuration, meant for testing.

[DEFAULT]
db_url = sqlite:////var/lib/fangfrisch/db.sqlite
local_directory = /var/lib/clamav

[urlhaus]
enabled = yes
```

--------------------------------

### Install Fangfrisch via pip

Source: https://rseichter.github.io/fangfrisch

Installs Fangfrisch from PyPI, which also creates the executable launcher script venv/bin/fangfrisch.

```bash
pip install fangfrisch
```

--------------------------------

### Example configuration for default providers

Source: https://rseichter.github.io/fangfrisch

Shows a complete Fangfrisch configuration file with DEFAULT settings and enabled default providers. Includes optional settings like local_directory, max_size, on_update_exec, and provider-specific options such as receipt, prefix, and customer_id. Note that some providers require additional configuration like access tokens.

```ini
# Example configuration

[DEFAULT]
db_url = sqlite:////var/lib/fangfrisch/db.sqlite

# The following settings are optional. Other sections inherit
# values from DEFAULT and may also overwrite values.

local_directory = /var/lib/clamav
max_size = 5MB
on_update_exec = clamdscan --reload
on_update_timeout = 42

[interserver]
enabled = yes

[malwarepatrol]
enabled = yes
# Replace with your personal Malwarepatrol receipt
receipt = abcd1234

[sanesecurity]
enabled = yes
# Use a non-default mirror
prefix = http://mirror.example.com/sanesecurity/

[securiteinfo]
enabled = yes
# Replace with your personal SecuriteInfo customer ID
customer_id = abcdef123456

[urlhaus]
enabled = yes
max_size = 2MB
```

--------------------------------

### User-defined provider configuration example

Source: https://rseichter.github.io/fangfrisch

Defines a fictional provider with custom settings: integrity_check, interval, prefix, URL definitions, filename override, and an on_update command. Shows how to reference values from other sections using ${section:option} syntax.

```ini
[fictionalprovider]
enabled = yes
integrity_check = md5
interval = 90m
prefix = http://fictional-provider.tld/clamav-unofficial/

# Reference the defined prefix in URL definitions. Values in
# other sections can be referenced using ${section:option}.
url_eggs = ${prefix}eggs.ndb
url_spam = ${prefix}spam.hdb

# Override local file name for url_spam
filename_spam = spam_spam_spam_lovely_spam.db

# Execute command after each fresh download from url_eggs
on_update_eggs = echo Fresh eggs in {path}
```

--------------------------------

### Effective configuration for Fangfrisch (INI)

Source: https://rseichter.github.io/fangfrisch

Effective configuration combining internal defaults with the example settings from Section 5. It defines the [DEFAULT] section and per-source sections for fangfrischnews, interserver, malwarepatrol, sanesecurity, securiteinfo, and urlhaus. Lines prefixed with '!' disable the corresponding URL, and ${prefix} variables are expanded from the section's prefix value.

```ini
[DEFAULT]
cleanup = automatic
enabled = no
integrity_check = sha256
log_level = WARNING
log_method = console
max_size = 5MB
db_url = sqlite:////var/lib/fangfrisch/db.sqlite
local_directory = /var/lib/clamav
on_update_exec = clamdscan --reload
on_update_timeout = 42

[fangfrischnews]
interval = 12h
local_directory = /tmp
max_size = 100KB
script = /path/to/fangfrisch-has-news.sh
on_update_exec = [ ! -x ${script} ] || ${script} ${local_directory}
prefix = https://www.seichter.de/fangfrisch/
url_alerts = ${prefix}fangfrisch_alerts.txt
url_news = ${prefix}fangfrisch_news.txt

[interserver]
interval = 1h
integrity_check = disabled
max_size = 5MB
prefix = http://sigs.interserver.net/
!url_shell_hdb = ${prefix}shell.hdb
!url_shellb_db = ${prefix}shellb.db
url_interserver256 = ${prefix}interserver256.hdb
url_shell_ldb = ${prefix}shell.ldb
filename_shell_ldb = interservershell.ldb
url_topline = ${prefix}interservertopline.db
url_whitelist_fp = ${prefix}whitelist.fp
filename_whitelist_fp = interserverwhitelist.fp
enabled = yes

[malwarepatrol]
interval = 1d
integrity_check = disabled
product = 8
receipt = abcd1234
prefix = https://lists.malwarepatrol.net/cgi/getfile?product=${product}&receipt=${receipt}&list=
url_clamav_basic = ${prefix}clamav_basic
filename_clamav_basic = malwarepatrol.db
enabled = yes

[sanesecurity]
interval = 1h
prefix = http://mirror.example.com/sanesecurity/
!url_foxhole_all_cdb = ${prefix}foxhole_all.cdb
!url_foxhole_all_ndb = ${prefix}foxhole_all.ndb
!url_foxhole_links = ${prefix}foxhole_links.ldb
!url_foxhole_mail = ${prefix}foxhole_mail.cdb
!url_winnow_phish_complete = ${prefix}winnow_phish_complete.ndb
url_badmacro = ${prefix}badmacro.ndb
url_blurl = ${prefix}blurl.ndb
url_bofhland_cracked_url = ${prefix}bofhland_cracked_URL.ndb
url_bofhland_malware_attach = ${prefix}bofhland_malware_attach.hdb
url_bofhland_malware_url = ${prefix}bofhland_malware_URL.ndb
url_bofhland_phishing_url = ${prefix}bofhland_phishing_URL.ndb
url_foxhole_filename = ${prefix}foxhole_filename.cdb
url_foxhole_generic = ${prefix}foxhole_generic.cdb
url_foxhole_js_cdb = ${prefix}foxhole_js.cdb
url_foxhole_js_ndb = ${prefix}foxhole_js.ndb
url_hackingteam = ${prefix}hackingteam.hsb
url_junk = ${prefix}junk.ndb
url_jurlbl = ${prefix}jurlbl.ndb
url_jurlbla = ${prefix}jurlbla.ndb
url_lott = ${prefix}lott.ndb
url_malwareexpert_fp = ${prefix}malware.expert.fp
url_malwareexpert_hdb = ${prefix}malware.expert.hdb
url_malwareexpert_ldb = ${prefix}malware.expert.ldb
url_malwareexpert_ndb = ${prefix}malware.expert.ndb
url_malwarehash = ${prefix}malwarehash.hsb
url_phish = ${prefix}phish.ndb
url_phishtank = ${prefix}phishtank.ndb
url_porcupine = ${prefix}porcupine.ndb
url_rogue = ${prefix}rogue.hdb
url_scam = ${prefix}scam.ndb
url_shelter = ${prefix}shelter.ldb
url_sigwhitelist = ${prefix}sigwhitelist.ign2
url_spamattach = ${prefix}spamattach.hdb
url_spamimg = ${prefix}spamimg.hdb
url_spear = ${prefix}spear.ndb
url_spearl = ${prefix}spearl.ndb
url_ssftm = ${prefix}sanesecurity.ftm
url_winnow_attachments = ${prefix}winnow.attachments.hdb
url_winnow_bad_cw = ${prefix}winnow_bad_cw.hdb
url_winnow_extended_malware = ${prefix}winnow_extended_malware.hdb
url_winnow_extended_malware_links = ${prefix}winnow_extended_malware_links.ndb
url_winnow_malware = ${prefix}winnow_malware.hdb
url_winnow_malware_links = ${prefix}winnow_malware_links.ndb
url_winnow_phish_complete_url = ${prefix}winnow_phish_complete_url.ndb
url_winnow_spam_complete = ${prefix}winnow_spam_complete.ndb
enabled = yes

[securiteinfo]
customer_id = abcdef123456
interval = 1h
max_size = 20MB
prefix = https://www.securiteinfo.com/get/signatures/${customer_id}/
!url_0hour = ${prefix}securiteinfo0hour.hdb
!url_old = ${prefix}securiteinfoold.hdb
!url_securiteinfo_mdb = ${prefix}securiteinfo.mdb
!url_securiteinfo_pdb = ${prefix}securiteinfo.pdb
!url_securiteinfo_yara = ${prefix}securiteinfo.yara
url_android = ${prefix}securiteinfoandroid.hdb
url_ascii = ${prefix}securiteinfoascii.hdb
url_html = ${prefix}securiteinfohtml.hdb
url_javascript = ${prefix}javascript.ndb
url_pdf = ${prefix}securiteinfopdf.hdb
url_securiteinfo = ${prefix}securiteinfo.hdb
url_securiteinfo_ign2 = ${prefix}securiteinfo.ign2
url_spam_marketing = ${prefix}spam_marketing.ndb
enabled = yes

[urlhaus]
interval = 10m
url_urlhaus = https://urlhaus.abuse.ch/downloads/urlhaus.ndb
enabled = yes
max_size = 2MB
```

--------------------------------

### Crontab entry for fangfrisch refresh

Source: https://rseichter.github.io/fangfrisch

Example crontab entry for running Fangfrisch refresh every 10 minutes as user clamav. Sets HOME and LOG_LEVEL environment variables and uses a random sleep to spread load.

```cron
HOME=/var/lib/fangfrisch
LOG_LEVEL=INFO
# minute hour day-of-month month day-of-week user command
*/10 * * * * clamav sleep $((RANDOM \% 42)); venv/bin/fangfrisch --conf /etc/fangfrisch.conf refresh
```

--------------------------------

### Process Fangfrisch News with mail script

Source: https://rseichter.github.io/fangfrisch

Example script to process downloaded Fangfrisch News items, typically by mailing them. It must be readable by the user account running Fangfrisch, and the sender/recipient addresses need adaptation. Choose one of the three mail application options (mutt, sendmail, or swaks) by uncommenting the corresponding declare statements; until that is done, the script fails with an error message.

```bash
#!/usr/bin/env bash
# vim: ts=4 sw=4 noet ft=sh
#
# Example script to process Fangfrisch News.

declare -r MAILFROM="noreply"
declare -r MAILTO="alice@example.com"
declare -r SUBJECT="Fangfrisch News are available"

# Choose one of the options below and uncomment the 'declare'
# statements. Until this is done, the script will fail with
# an error message.

# Option 1: Mutt
#declare -r MAILAPP="mutt"
#declare -r MAILAPP_OPT=( "-s" "$SUBJECT" "$MAILTO" )

# Option 2: sendmail
#declare -r MAILAPP="sendmail"
#declare -r MAILAPP_OPT=( "-t" )
#export PATH="$PATH:/usr/sbin"

# Option 3: swaks
#declare -r MAILAPP="swaks"
#declare -r MAILAPP_OPT=( "-d" "-" "-f" "$MAILFROM" "-t" "$MAILTO" )

### No changes required below this line ###

set -euo pipefail

die() {
	echo >&2 "$@"
	exit 1
}

usage() {
	die "Usage: $(basename "$0") {directory}"
}

gen_header() {
	cat <<EOT
Auto-Submitted: auto-generated
From: Fangfrisch News <$MAILFROM>
To: $MAILTO
Subject: $SUBJECT

EOT
	# Mail header must end with an empty line!
}

declare -a NEWSITEMS=()

report_news() {
	local dir=$1 ni
	[ -d "$dir" ] || die "$dir is not a directory"
	while IFS= read -r -d '' ni; do
		if [ ${#NEWSITEMS[*]} -eq 0 ] && [ "$MAILAPP" != mutt ]; then
			# Mutt does not need the header, others do.
			gen_header
		fi
		NEWSITEMS+=("$ni")
		echo -e "\n### $(basename "$ni"):\n"
		cat "$ni"
	done < <(find "$dir" -maxdepth 1 -type f -name "fangfrisch*.txt" -print0)
}

main() {
	local t
	[ -n "$MAILAPP" ] || die "MAILAPP is undefined, exiting."
	if tty -s; then
		# Running in a terminal session
		t=$(mktemp)
		# shellcheck disable=SC2064
		trap "rm $t" EXIT
		report_news "$@" | tee "$t" || exit 1
		[ ! -s "$t" ] || "$MAILAPP" "${MAILAPP_OPT[@]}" >/dev/null <"$t"
	else
		report_news "$@" 2>&1 | "$MAILAPP" "${MAILAPP_OPT[@]}" >/dev/null
		[ ${#NEWSITEMS[*]} -eq 0 ] || rm -v "${NEWSITEMS[@]}"
	fi
}

[ $# -ge 1 ] || usage
main "$@"

```

--------------------------------

### Initialize database with fangfrisch initdb

Source: https://rseichter.github.io/fangfrisch

Run as root to create the database structure. Use --force initdb to drop existing tables; for SQLite, deleting the database file is an alternative.

```bash
sudo -u clamav -- fangfrisch --conf /etc/fangfrisch.conf initdb
```

--------------------------------

### Enable Fangfrisch News in configuration

Source: https://rseichter.github.io/fangfrisch

Enable the Fangfrisch News pseudo provider by adding this section to the configuration file. The script option is commented out by default; uncomment and adapt it to trigger a script when news is available.

```ini
[fangfrischnews]
enabled = yes
# Uncomment/adapt the following to trigger a script in case of news.
# script = /path/to/script/fangfrisch-has-news.sh

```

--------------------------------

### Fangfrisch command-line usage

Source: https://rseichter.github.io/fangfrisch

Command-line help output for Fangfrisch 1.9.2. Lists actions (dumpconf, dumpmappings, initdb, refresh) and options -c/--conf, -f/--force, -p/--provider.

```text
usage: fangfrisch [-h] [-c CONF] [-f] [-p PROVIDER]
                  {dumpconf,dumpmappings,initdb,refresh}

Update and verify unofficial ClamAV signatures.

positional arguments:
  {dumpconf,dumpmappings,initdb,refresh}

options:
  -h, --help            show this help message and exit
  -c, --conf CONF       configuration file
  -f, --force           force action (default: False)
  -p, --provider PROVIDER
                        provider name filter (regular expression)

Fangfrisch version 1.9.2. Copyright © 2020-2025 Ralph Seichter.
```

--------------------------------

### Prepare and activate venv

Source: https://rseichter.github.io/fangfrisch

Prepares and activates a virtual Python environment for Fangfrisch in the home directory.

```bash
cd /var/lib/fangfrisch
python3 -m venv venv
source venv/bin/activate
```

--------------------------------

### Create Fangfrisch home directory

Source: https://rseichter.github.io/fangfrisch

Creates the Fangfrisch home directory with group write access and assigns it to the clamav group, granting group members the necessary write access to create the database.

```bash
mkdir -m 0770 -p /var/lib/fangfrisch
chgrp clamav /var/lib/fangfrisch
```

--------------------------------

### Fangfrisch default configuration (INI format)

Source: https://rseichter.github.io/fangfrisch

Default configuration for Fangfrisch with all sections disabled by default. Entries prefixed with !url_ are for reference only and not recommended for general use. Includes settings for cleanup, integrity checks, log methods, and various data sources.

```ini
[DEFAULT]
cleanup = automatic
enabled = no
integrity_check = sha256
log_level = WARNING
log_method = console
max_size = 10MB

[fangfrischnews]
interval = 12h
local_directory = /tmp
max_size = 100KB
script = /path/to/fangfrisch-has-news.sh
on_update_exec = [ ! -x ${script} ] || ${script} ${local_directory}
prefix = https://www.seichter.de/fangfrisch/
url_alerts = ${prefix}fangfrisch_alerts.txt
url_news = ${prefix}fangfrisch_news.txt

[interserver]
interval = 1h
integrity_check = disabled
max_size = 5MB
prefix = http://sigs.interserver.net/
!url_shell_hdb = ${prefix}shell.hdb
!url_shellb_db = ${prefix}shellb.db
url_interserver256 = ${prefix}interserver256.hdb
url_shell_ldb = ${prefix}shell.ldb
filename_shell_ldb = interservershell.ldb
url_topline = ${prefix}interservertopline.db
url_whitelist_fp = ${prefix}whitelist.fp
filename_whitelist_fp = interserverwhitelist.fp

[malwarepatrol]
interval = 1d
integrity_check = disabled
product = 8
receipt = you_forgot_to_configure_receipt
prefix = https://lists.malwarepatrol.net/cgi/getfile?product=${product}&receipt=${receipt}&list=
url_clamav_basic = ${prefix}clamav_basic
filename_clamav_basic = malwarepatrol.db

[sanesecurity]
interval = 1h
prefix = http://mirror.seichter.de/sanesecurity/
!url_foxhole_all_cdb = ${prefix}foxhole_all.cdb
!url_foxhole_all_ndb = ${prefix}foxhole_all.ndb
!url_foxhole_links = ${prefix}foxhole_links.ldb
!url_foxhole_mail = ${prefix}foxhole_mail.cdb
!url_winnow_phish_complete = ${prefix}winnow_phish_complete.ndb
url_badmacro = ${prefix}badmacro.ndb
url_blurl = ${prefix}blurl.ndb
url_bofhland_cracked_url = ${prefix}bofhland_cracked_URL.ndb
url_bofhland_malware_attach = ${prefix}bofhland_malware_attach.hdb
url_bofhland_malware_url = ${prefix}bofhland_malware_URL.ndb
url_bofhland_phishing_url = ${prefix}bofhland_phishing_URL.ndb
url_foxhole_filename = ${prefix}foxhole_filename.cdb
url_foxhole_generic = ${prefix}foxhole_generic.cdb
url_foxhole_js_cdb = ${prefix}foxhole_js.cdb
url_foxhole_js_ndb = ${prefix}foxhole_js.ndb
url_hackingteam = ${prefix}hackingteam.hsb
url_junk = ${prefix}junk.ndb
url_jurlbl = ${prefix}jurlbl.ndb
url_jurlbla = ${prefix}jurlbla.ndb
url_lott = ${prefix}lott.ndb
url_malwareexpert_fp = ${prefix}malware.expert.fp
url_malwareexpert_hdb = ${prefix}malware.expert.hdb
url_malwareexpert_ldb = ${prefix}malware.expert.ldb
url_malwareexpert_ndb = ${prefix}malware.expert.ndb
url_malwarehash = ${prefix}malwarehash.hsb
url_phish = ${prefix}phish.ndb
url_phishtank = ${prefix}phishtank.ndb
url_porcupine = ${prefix}porcupine.ndb
url_rogue = ${prefix}rogue.hdb
url_scam = ${prefix}scam.ndb
url_shelter = ${prefix}shelter.ldb
url_sigwhitelist = ${prefix}sigwhitelist.ign2
url_spamattach = ${prefix}spamattach.hdb
url_spamimg = ${prefix}spamimg.hdb
url_spear = ${prefix}spear.ndb
url_spearl = ${prefix}spearl.ndb
url_ssftm = ${prefix}sanesecurity.ftm
url_winnow_attachments = ${prefix}winnow.attachments.hdb
url_winnow_bad_cw = ${prefix}winnow_bad_cw.hdb
url_winnow_extended_malware = ${prefix}winnow_extended_malware.hdb
url_winnow_extended_malware_links = ${prefix}winnow_extended_malware_links.ndb
url_winnow_malware = ${prefix}winnow_malware.hdb
url_winnow_malware_links = ${prefix}winnow_malware_links.ndb
url_winnow_phish_complete_url = ${prefix}winnow_phish_complete_url.ndb
url_winnow_spam_complete = ${prefix}winnow_spam_complete.ndb

[securiteinfo]
customer_id = you_forgot_to_configure_customer_id
interval = 1h
max_size = 20MB
prefix = https://www.securiteinfo.com/get/signatures/${customer_id}/
!url_0hour = ${prefix}securiteinfo0hour.hdb
!url_old = ${prefix}securiteinfoold.hdb
!url_securiteinfo_mdb = ${prefix}securiteinfo.mdb
!url_securiteinfo_pdb = ${prefix}securiteinfo.pdb
!url_securiteinfo_yara = ${prefix}securiteinfo.yara
url_android = ${prefix}securiteinfoandroid.hdb
url_ascii = ${prefix}securiteinfoascii.hdb
url_html = ${prefix}securiteinfohtml.hdb
url_javascript = ${prefix}javascript.ndb
url_pdf = ${prefix}securiteinfopdf.hdb
url_securiteinfo = ${prefix}securiteinfo.hdb
url_securiteinfo_ign2 = ${prefix}securiteinfo.ign2
url_spam_marketing = ${prefix}spam_marketing.ndb

[urlhaus]
interval = 10m
url_urlhaus = https://urlhaus.abuse.ch/downloads/urlhaus.ndb
```

--------------------------------

### Delete all files downloaded by Fangfrisch

Source: https://rseichter.github.io/fangfrisch

Deletes all files that were downloaded by Fangfrisch by piping the dumpmappings output to awk and xargs. Warning: do not execute this unless you really mean it.

```bash
# Delete all files that were downloaded by Fangfrisch.
# DON'T EXECUTE THIS UNLESS YOU REALLY MEAN IT!
fangfrisch --conf /etc/fangfrisch.conf dumpmappings | awk '{print $3}' | xargs /bin/rm
```
Tokens:
Raw