The good news for busy admins is that you don't have to do anything to keep either of these programs updated. Both of them run with a cron job that gets created automatically and that does the updates for us. To prove that ClamAV is getting updated, we can look in the system log file:
Dec 8 20:02:09 localhost freshclam[22326]: ClamAV update process started at Fri Dec 8 20:02:09 2017
Dec 8 20:02:29 localhost freshclam[22326]: Can't query current.cvd.clamav.net
Dec 8 20:02:29 localhost freshclam[22326]: Invalid DNS reply. Falling back to HTTP mode.
Dec 8 20:02:29 localhost freshclam[22326]: Reading CVD header (main.cvd):
Dec 8 20:02:35 localhost freshclam[22326]: OK
Dec 8 20:02:47 localhost freshclam[22326]: Downloading main-58.cdiff [100%]
Dec 8 20:03:19 localhost freshclam[22326]: main.cld updated (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
. . .
. . .
Dec 8 20:04:45 localhost freshclam[22326]: Downloading daily.cvd [100%]
Dec 8 20:04:53 localhost freshclam[22326]: daily.cvd updated (version: 24111, sigs: 1799769, f-level: 63, builder: neo)
Dec 8 20:04:53 localhost freshclam[22326]: Reading CVD header (bytecode.cvd):
Dec 8 20:04:54 localhost freshclam[22326]: OK
Dec 8 20:04:54 localhost freshclam[22326]: Downloading bytecode-279.cdiff [100%]
Dec 8 20:04:55 localhost freshclam[22326]: Downloading bytecode-280.cdiff [100%]
Dec 8 20:04:55 localhost freshclam[22326]: Downloading bytecode-281.cdiff [100%]
Dec 8 20:04:56 localhost freshclam[22326]: Downloading bytecode-282.cdiff [100%]
. . .
. . .
You'll see these same entries in either the Ubuntu logs or the CentOS logs. However, there is a difference between how the updates get run automatically.
In the /etc/clamav/freshclam.conf file of your Ubuntu machine, you'll see the following lines at the end:
# Check for new database 24 times a day
Checks 24
DatabaseMirror db.local.clamav.net
DatabaseMirror database.clamav.net
So essentially, this means that on Ubuntu, ClamAV will be checking for updates every hour.
On your CentOS machine, you'll see a clamav-update cron job in the /etc/cron.d directory that looks like this:
## Adjust this line...
MAILTO=root
## It is ok to execute it as root; freshclam drops privileges and becomes
## user 'clamupdate' as soon as possible
0 */3 * * * root /usr/share/clamav/freshclam-sleep
The */3 in the second column from the left indicates that ClamAV will check for updates every 3 hours. You can change that if you like, but you'll also need to change the setting in the /etc/sysconfig/freshclam file. Let's say that you want for CentOS to also check for ClamAV updates every hour. In the cron job file, change the */3 to *. (You don't need to do */1 because the asterisk by itself in that position already indicates that the job will run every hour.) Then, in the /etc/sysconfig/freshclam file, look for this line:
# FRESHCLAM_MOD=
Uncomment that line and add the number of minutes that you want between updates. To set it to 1 hour, in order to match the cron job, it will look like this:
FRESHCLAM_MOD=60
To prove that maldet is getting updated, you can look in its own log files in the /usr/local/maldetect/logs/ directory. In the event_log file, you'll see the following code:
Dec 06 22:06:14 localhost maldet(3728): {sigup} performing signature update check...
Dec 06 22:06:14 localhost maldet(3728): {sigup} local signature set is version 2017070716978
Dec 06 22:07:13 localhost maldet(3728): {sigup} downloaded https://cdn.rfxn.com/downloads/maldet.sigs.ver
Dec 06 22:07:13 localhost maldet(3728): {sigup} new signature set (201708255569) available
Dec 06 22:07:13 localhost maldet(3728): {sigup} downloading https://cdn.rfxn.com/downloads/maldet-sigpack.tgz
. . .
. . .
Dec 06 22:07:43 localhost maldet(3728): {sigup} unpacked and installed maldet-clean.tgz
Dec 06 22:07:43 localhost maldet(3728): {sigup} signature set update completed
Dec 06 22:07:43 localhost maldet(3728): {sigup} 15218 signatures (12485 MD5 | 1954 HEX | 779 YARA | 0 USER)
Dec 06 22:14:55 localhost maldet(4070): {scan} signatures loaded: 15218 (12485 MD5 | 1954 HEX | 779 YARA | 0 USER)
In the /usr/local/maldetect/conf.maldet file, you'll see these two lines, but with some comments in between them:
autoupdate_signatures="1"
autoupdate_version="1"
Not only will LMD automatically update its malware signatures, it will also ensure that you have the latest version of LMD itself.