Skip to content

Instantly share code, notes, and snippets.

@henryk
Created July 27, 2018 12:22
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save henryk/b8a7392613ea2dee6559c995ed48258d to your computer and use it in GitHub Desktop.
Save henryk/b8a7392613ea2dee6559c995ed48258d to your computer and use it in GitHub Desktop.
Disable and delete YARA rules from clamav-unofficial-sigs
---
- name: Nuke clamav YARA
hosts: all
gather_facts: false
tasks:
- name: Disable yararulesproject
lineinfile:
dest: /etc/clamav-unofficial-sigs/master.conf
regexp: '^\s*#?\s*yararulesproject_enabled\s*='
line: 'yararulesproject_enabled="no"'
notify:
- Restart clamav-daemon
- name: Disable yararules
lineinfile:
dest: /etc/clamav-unofficial-sigs/master.conf
regexp: '^\s*#?\s*enable_yararules\s*='
line: 'enable_yararules="no"'
notify:
- Restart clamav-daemon
- name: Find YARA files
find:
paths: /var/lib/clamav/
patterns:
- "*.yar"
- "*.yara"
register: yara_files
- name: Delete YARA files
file:
path: "{{item.path}}"
state: absent
with_items: "{{yara_files.files}}"
notify:
- Restart clamav-daemon
handlers:
- name: Restart clamav-daemon
service: name=clamav-daemon state=restarted
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment