#!/bin/bash
#
# fetch-sanesecurity-sigs
# by Malcolm Scott, Retrosnub Internet Services
# <malcolm at retrosnub dot co dot uk>
#
# Revision: 352 $
# Date: 2009-01-23 00:50:08 +0000 (Fri, 23 Jan 2009) $
# $Cambridge: hermes/conf/clamav/sbin/sanerclam,v 1.22 2009/07/02 19:14:47 fanf2 Exp $
#
# -----------------------------------------------------------------------------
# Copyright (C) 2009 Malcolm Scott
#
# This program is free software; you can redistribute it and/or modify it under
# the terms of the GNU General Public License version 2 as published by the
# Free Software Foundation.
#
# This program is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along with
# this program; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA 02111-1307 USA
# -----------------------------------------------------------------------------
#
# INSTALLATION AND USAGE:
#
#  * Ensure that you have wget, gpg and rsync installed (in addition to a
#    standard set of UNIX tools).
#  * Configure this script by editing the configuration variables below.
#  * Set up cron to run this script periodically, at a randomly-selected time
#    (i.e. not just on the hour unless unavoidable), not more often than once
#    per hour.  The script should be run either as root or as the user clamd
#    runs as.  For example, add the following line to /etc/crontab or a file
#    in /etc/cron.d:
#         42 * * * *  root  /path/to/fetch-sanesecurity-sigs >/dev/null
#    (Redirection of the output to /dev/null is recommended when running from
#    cron as the script is verbose in normal operation.  This will not hide
#    errors, however.)
#
# Note that this script is tailored to the Sanesecurity setup (as of January
# 2009).  It should replace scripts using the pre-2009 setup (HTTP).  It is
# not intended to download non-Sanesecurity signatures; use another script
# for that purpose.


### Configuration ###

# ClamAV database location - reliable signatures blocked by Exim
clamd_dbdir="/spool/clamav/db"

# ClamAV database location - unreliable signatures scored by SpamAssassin
clamd_dbdir2="/spool/clamav/db2"

# ClamAV daemon process ID file
# (If this is commented out, the daemon will not be reloaded automatically)
#clamd_pidfile="/spool/clamav/clamd/pid"

# Directory in which this script will keep its cache
# (Any unexpected files in this directory will be deleted!)
cache_dir="/spool/clamav/sanesec"

# Mirror to use, in a form accepted by rsync
# (Leave set to the round robin address unless you know what you are doing:
# forcing the use of one particular mirror will cause excess load for that
# mirror)
mirror="rsync://rsync.sanesecurity.net/sanesecurity"

# Extra options for rsync
# (For example, if you have a slow link you may want to add -z here to
# enable compression)
rsync_extra_opts="-z"

# Location of GnuPG files
gpg_dir="/spool/clamav/gpg"

# Put temporary files in our working directory
export TMPDIR="/spool/clamav/tmp"

# Look in the right place for clamscan
PATH=/opt/clamav/bin:$PATH

### End of configuration ###


umask 0022

echo

# Check the configuration looks sane
if [ ! -d "$clamd_dbdir" ]
then
	echo "clamd_dbdir ($clamd_dbdir) does not exist; aborting" >&2
	echo "(check your configuration)" >&2
	exit 1
fi

if [ ! -d "$clamd_dbdir2" ]
then
	echo "clamd_dbdir2 ($clamd_dbdir2) does not exist; aborting" >&2
	echo "(check your configuration)" >&2
	exit 1
fi

# Set up GPG, if necessary
if [ ! -f "$gpg_dir/pubring.gpg" ]
then
	echo "No GnuPG public key ring found; initialising" >&2
	echo "(This should only occur once)" >&2
	if ! gpg --no-options --homedir="$gpg_dir" --import /opt/clamav/etc/sanesec.gpg
	then
		echo "ERROR: could not import GPG public key; aborting" >&2
		exit 4
	fi
fi

# Are we running noninteractively, i.e. without a tty on stdin?
if ! tty -s
then
	# $RANDOM is between 0 and 32767.
	# Use this to generate a time between 30 and 32767/200+30 = 193 seconds.
	sleep_time=$((RANDOM/200+30))
	echo "Sleeping for $sleep_time seconds."
	sleep $sleep_time
fi

if ! rsync --progress --delete -rt $rsync_extra_opts "$mirror/." "$cache_dir/"
then
	echo "rsync failed; aborting." >&2
	exit 3
fi
chmod 0644 "$cache_dir"/*.?db
echo

# Now just quit, and let fresherclam do the installation...

exit 0
