[clamav-users] Not able to use curl to download the cvd files successfully

[Joel Esler (jesler)]

On Mar 8, 2021, at 9:36 AM, Todd Aiken <todd.aiken at ubishops.ca<mailto:todd.aiken at ubishops.ca>> wrote:

> From: clamav-users <clamav-users-bounces at lists.clamav.net<mailto:clamav-users-bounces at lists.clamav.net>> on behalf of Lo Nelson via clamav-users <clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>>
> Reply-To: ClamAV users ML <clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>>
> Date: Monday, March 8, 2021 at 8:49 AM
> To: "clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>" <clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>>
> Cc: Lo Nelson <nelo_1990 at hotmail.com<mailto:nelo_1990 at hotmail.com>>
> Subject: [EXTERNAL] [clamav-users] Not able to use curl to download the cvd files successfully
>
> Dear Clamav support,
>
> May I know why I am not able to use curl to download the cvd files successfully? The cvd files show error code 1020. Thank you.

This is Cloudfare "protecting" the ClamAV website.  You can bypass it by sending a fake user agent string, like this:

curl -A "Mozilla/5.0" http://database.clamav.net/daily.cvd --output daily.cvd

or using wget:

wget --user-agent "Mozilla/5.0" http://database.clamav.net/daily.cvd''


No!  Don’t “bypass” it.

And “protecting” does not need to be in quotes, it’s quite literally what we are doing.  And people doing the above are the problem.

As I said in countless other emails, either use Freshclam or https://github.com/micahsnyder/cvdupdate.  The more people that do the above will force us to take drastic measures.

--
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com | https://www.snort.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20210308/111acc34/attachment.htm>