ESET FILE SECURITY - ANNEXE 22 User manual

ESET File Security
Installation Manual
and User Guide
we protect digital worlds

2ESET File Security
Table of contents
1. Introduction .........................................................................................3
2.Terminology and abbreviations..........................................................5
3. Installation............................................................................................. 9
4. Architecture Overview ......................................................................11
5. Integration with File System services.............................................15
5.1. On-demand scanner .................................................................................. 16
5.2. On-access scanner powered by Dazuko ............................................. 16
5.2.1. Operation principle................................................................................. 17
5.2.2. Installation and configuration ............................................................17
5.2.3. Tips ................................................................................................................ 17
5.3. On-access scanner using preload LIBC library...................................18
5.3.1. Operation principle................................................................................. 18
5.3.2. Installation and configuration ............................................................19
5.3.3. Tips ................................................................................................................ 19
6. Important ESET File Security mechanisms 21
6.1. Handle Object Policy.................................................................................. 22
6.2. User Specific Configuration..................................................................... 22
6.3. Samples Submission System................................................................... 23
6.4. World Wide Web Interface.........................................................................24
6.5. Remote Administration..............................................................................24
7. ESET Security system update...........................................................25
7.1. ESETS update utility.................................................................................... 26
7.2. ESETS update process description........................................................ 26
7.3. ESETS mirror http daemon........................................................................27
8. Let us know..........................................................................................29
Appendix A. PHP License .....................................................................31
ESET File Security
Copyright © 2009 ESET, spol. s r.o.
ESET File Security was developed by ESET, spol. s r.o. For more
information visit www.eset.com.
All rights reserved. No part of this documentation may be
reproduced, stored in a retrieval system or transmitted in any form
or by any means, electronic, mechanical, photocopying, recording,
scanning, or otherwise without permission in writing from the author.
ESET, spol. s r.o. reserves the right to change any of the described
application software without prior notice.
This product includes PHP software, freely available from http://www.
php.net/software/.
REV.20090224-007

Chapter 1:
Introduction

4ESET File Security
Dear user, you have acquired ESET File Security - the premier security system running under
the Linux/BSD/Solaris OS. As you will soon nd out, ESET's state-of-the-art scanning engine has
unsurpassed scanning speed and detection rates combined with a very small footprint that
makes it the ideal choice for any Linux/BSD/Solaris OS server.
Key features of the system:
•TheESETantivirusscanningenginealgorithmsprovidethehighestdetectionrateandthe
fastest scanning times.
•TheESETFileSecurityisdevelopedtorunonsingle-processoraswellasonmulti-processor
units.
•ItincludesuniqueadvancedheuristicsforWin32wormsandback-doors.
•Built-inarchiversunpackarchivedobjectswithouttheneedforanyexternalprograms.
•Toincreasethespeedandeciencyofthesystem,itsarchitectureisbasedontherunning
daemon (resident program) where all scanning requests are sent.
•Allexecutivedaemons(exceptesets_dac)runundernon-privilegeduseraccountto
enhance security.
•Thesystemsupportsselectivecongurationbasedontheuserorclient/server.
•Multiplelogginglevelscanbeconguredtogetinformationaboutsystemactivityand
inltrations.
•Conguration,administrationandlicensemanagementareoeredthroughanintuitiveand
user-friendly World Wide Web Interface.
•ThesystemsupportsESETRemoteAdministrationformanagementinlargecomputer
networks.
•TheESETFileSecurityinstallationdoesnotrequireexternallibrariesorprogramsexceptfor
LIBC.
•Thesystemcanbeconguredtonotifyspecicusersintheeventofadetectedinltration
or other important events.
Toruneciently,ESETFileSecurityrequiresjust16MBofhard-diskspaceand32MBofRAM.
It runs smoothly under the 2.2.x, 2.4.x and 2.6.x Linux OS kernel versions as well as under 5.x, 6.x
FreeBSD OS kernel versions.
Fromlower-powered,smalloceserverstoenterprise-class ISPserverswiththousands of
users, ESET File Security delivers the performance and scalability you expect from a UNIX based
solution, in addition to the unequaled security of ESET products.

Chapter 2:
Terminology
and abbreviations

6ESET File Security
In this section we will review the terms and abbreviations used in this document. Note that
a boldface font is reserved for product component names and also for newly defined terms and
abbreviations. Terms and abbreviations defined in this chapter are expanded upon later in this
document.
ESETS
ESET Security is a standard acronym for all security products developed by ESET, spol. s r.o. for
Linux, BSD and Solaris operating systems. It is also the name (or its part) of the software package
containing the products.
RSR
Abbreviation for ‘RedHat/Novell(SuSE) Ready’. Note that we also support RedHat Ready
and Novell(SuSE) Ready variations of the product. The RSRpackagediersfromthe“standard”
Linux version in that it meets the FHS (File-system Hierarchy Standard defined as a part of
Linux Standard Base) criteria required by the RedHat Ready and Novell(SuSE) Ready certificate.
This means that the RSR package is installed as an add-on application–the primary installation
directory is ’/opt/eset/esets’.
ESETS daemon
The main ESETS system control and scanning daemon: esets_daemon.
ESETS base directory
The directory where ESETS loadable modules containing the virus signature database
are stored. The abbreviation @BASEDIR@ will be used for future references to this
directory. The @BASEDIR@ value for the following Operating Systems is listed below:
Linux: /var/lib/esets
Linux RSR: /var/opt/eset/esets/lib
FreeBSD: /var/lib/esets
NetBSD: /var/lib/esets
Solaris: /var/opt/esets/lib
ESETS configuration directory
The directory where all files related to the ESET File Security configuration are stored. The
abbreviation @ETCDIR@ will be used for future references to this directory. The @ETCDIR@ value
for the following Operating Systems is listed below:
Linux: /etc/esets
Linux RSR: /etc/opt/eset/esets
FreeBSD: /usr/local/etc/esets
NetBSD: /usr/pkg/etc/esets
Solaris: /etc/opt/esets
ESETS configuration file
MainESETFileSecurityconfigurationfile.Theabsolutepathofthefileisasfollows:
@ETCDIR@/esets.cfg
ESETS binary files directory
The directory where the relevant ESET File Security binary files are stored. The abbreviation

7
@BINDIR@ will be used for future references to this directory. The @BINDIR@ value for the
following Operating Systems is listed below:
Linux: /usr/bin
Linux RSR: /opt/eset/esets/bin
FreeBSD: /usr/local/bin
NetBSD: /usr/pkg/bin
Solaris: /opt/esets/bin
ESETS system binary files directory
The directory where the relevant ESET File Security system binary files are stored. The
abbreviation @SBINDIR@ will be used for future references to this directory. The @SBINDIR@
value for the following Operating Systems is listed below:
Linux: /usr/sbin
Linux RSR: /opt/eset/esets/sbin
FreeBSD: /usr/local/sbin
NetBSD: /usr/pkg/sbin
Solaris: /opt/esets/sbin
ESETS object files directory
The directory where the relevant ESET File Security object files and libraries are stored. The
abbreviation @LIBDIR@ will be used for future references to this directory. The @LIBDIR@ value
for the following Operating Systems is listed below:
Linux: /usr/lib/esets
Linux RSR: /opt/eset/esets/lib
FreeBSD: /usr/local/lib/esets
NetBSD: /usr/pkg/lib/esets
Solaris: /opt/esets/lib
chapter 2 Terminology and abbreviations

Chapter 3:
Installation

10
After purchasing ESET File Security, you will receive your authorization data (username/
password and license key). This data is necessary for both identifying you as our customer and
allowing you to download updates for ESET File Security. The username/password data is also
required for downloading the initial installation package from our web site. ESET File Security is
distributed as a binary le:
esets.i386.ext.bin
Inthebinaryleshownabove,‘ext’isaLinux/BSD/SolarisOSdistributiondependentsux,
i.e., ‘deb’ for Debian, ‘rpm’ for RedHat and SuSE, ‘tgz’ for other Linux OS distributions, ‘fbs5.tgz’ for
FreeBSD 5.xx, ‘fbs6.tgz‘ for FreeBSD 6.xx, ‘nbs4.tgz‘ for NetBSD 4.xx and ‘sol10.pkg.gz‘ for Solaris
10.
Note that the Linux RSR binary le format is:
esets-rsr.i386.rpm.bin
To install or upgrade the product, use the following command:
sh ./esets.i386.ext.bin
For the Linux RSR variation of the product, use the command:
sh ./esets-rsr.i386.rpm.bin
to display the product’s User License Acceptance Agreement. Once you have conrmed the
Acceptance Agreement, the installation package is placed into the current working directory and
relevant information regarding the package’s installation, un-installation or upgrade is displayed
onscreen.
Once the package is installed, you can verify that the main ESETS service is running by using
the following command:
Linux OS:
ps -C esets_daemon
BSD OS:
ps -ax | grep esets_daemon
Solaris:
ps -A | grep esets_daemon
After pressing ENTER, you should see the following (or similar) message:
PID TTY TIME CMD
2226 ? 00:00:00 esets_daemon
2229 ? 00:00:00 esets_daemon
At least two ESETS daemon processes are running in the background. The rst PID represents
the process and threads manager of the system. The other represents the ESETS scanning
process.
ESET File Security

Chapter 4:
Architecture Overview

12 ESET File Security
Once ESET File Security is successfully installed, you should become familiar with its
architecture.
The structure of ESET File Security is shown in Figure 4-1. The system is comprised of the
following parts:
CORE
TheCoreofESETFileSecurityistheESETSdaemon(esets_daemon).ThedaemonusesESETS
APIlibrarylibesets.soandESETSloadingmodulesem00X_xx.dattoprovidebasesystemtasks
such as scanning, maintenance of the agent daemon processes, maintenance of the samples
submissionsystem,logging, notication, etc.Pleaserefertotheesets_daemon (8) man page
for details.
AGENTS
The purpose of ESETS agent modules is to integrate ESETS with the Linux/BSD/Solaris Server
environment.
UTILITIES
The utility modules provide simple and eective management of the system. They are
responsible for relevant system tasks such as license management, quarantine management,
system setup and update.
CONFIGURATION
Proper conguration is the most important aspect of a smooth-running security system–
the remainder of this chapter is dedicated to explaining all related components. A thorough
understanding of the esets.cfg le (page 6) is also highly recommended, as this le contains
information essential to the conguration of ESET File Security.
Figure 4-1. Structure of ESET File Security.
esets_scan
libesets_pac.so
esets_dac
AGENTS
esets_lic
UTILITIES
esets_quar
esets_setup
esets_update
scanning
engine
CORE
system
service
esets.cfg
license
scripts
WWW INTERFACE
CONFIGURATION

13
After the product is successfully installed, all its conguration components are stored in the
ESETS conguration directory. The directory consists of the following les:
@ETCDIR@/esets.cfg
This is the most important conguration le, as it controls all major aspects of the product‘s
functionality. The esets.cfg le is made up of several sections, each of which contains various
parameters.The le contains one global and several "agent“ sections, with all section names
enclosed in square brackets. Parameters in the global section are used to dene conguration
options for the ESETS daemon as well as default values for the ESETS scanning engine
conguration. Parameters in agent sections are used to dene conguration options of modules
used to intercept various data ow types in the computer and/or its neighborhood, and prepare
it for scanning. Note that in addition to the various parameters used for system conguration,
there are also rules governing the organization of the le. For detailed information on the most
eective way to organize this le, please refer to the esets.cfg(5) and esets_daemon(8) man
pages, as well as relevant agents‘ man pages.
@ETCDIR@/certs
This directory is used to store the certicates used by the ESETS Web Interface for
authentication.Pleaseseetheesets_wwwimanpage(8)fordetails.
@ETCDIR@/license
This directory is used to store the product(s) license key(s) you have acquired from your
vendor. Note that the ESETS daemon will check only this directory for a valid license key, unless
the‘license_dir‘parameterintheESETScongurationleisredened.
@ETCDIR@/scripts/license_warning_script
IfenabledbytheESETScongurationleparameter‘license_warn_enabled’,thisscriptwillbe
executed 30 days (once per day) before product license expiration, sending an email notication
about the expiration status to the system administrator.
@ETCDIR@/scripts/daemon_notication_script
IfenabledbytheESETScongurationleparameter‘exec_script‘,thisscriptisexecutedinthe
event of a detected inltration by the antivirus system. It is used to send email notication about
the event to the system administrator.
chapter 4 Product Roadmap

Chapter 5:
Integration with File System
services

16 ESET File Security
This chapter describes the On-demand and On-access scanner conguration which will
provide the most eective protection from virus and worm le system infections. ESET File
Security's scanning power is derived from the On-demand scanner command 'esets_scan' and
the On-access scanner command 'esets_dac'.TheLinuxversionofESETFileSecurityoersan
additional On-access scanner technique which uses the preloaded library module libesets_pac.
so. All of these commands are described in the following sections.
5.1. On-demand scanner
The On-demand scanner can be invoked by a privileged user (usually a system administrator)
through the command line interface or by the operating system's automatic scheduling tool
(e.g., cron). Thus, the term "On-demand" refers to le system objects which are scanned on user
or system demand.
The On-demand scanner does not require special conguration in order to run. After the
ESETS package has been properly installed and a valid license has been moved to the license
keys directory (@ETCDIR@/license), the On-demand scanner can be run immediately using the
command line interface or scheduler tool. To run the On-demand scanner from the command
line, use the following syntax:
@SBINDIR@/esets_scan [option(s)] FILES
where FILES is a list of directories and/or les to be scanned.
MultiplecommandlineoptionsareavailableusingESETSOn-demandscanner.Toseethefull
listofoptions,pleaseseetheesets_scan(8)manpage.
5.2. On-access scanner powered by Dazuko
The On-access scanner is invoked by user(s) access and/or operating system access to file
system objects. This also explains the term "On-access"; the scanner is triggered on any attempt
to access a selected le system object.
The technique used by ESETS On-access scanner is powered by the Dazuko (da-tzu-ko) kernel
module and is based on the interception of kernel calls. The Dazuko project is open source,
which means that its source code is freely distributed. This allows users to compile the kernel
module for their own custom kernels. Note that the Dazuko kernel module is not a part of any
ESETS product and must be compiled and installed into the kernel prior to using the On-access
command esets_dac. On the other hand the Dazuko technique makes On-access scanning
independent of the file system type used. It is also suitable for controlling file system objects via
Network File System (NFS), Nettalk and Samba.
IMPORTANT: Before we provide detailed information related to the On-access scanner's
configuration and operation, it should be noted that the scanner has been primarily developed
and tested to protect file systems mounted externally. If there are multiple le systems which are
not externally mounted, they will need to be excluded from file access control in order to prevent
system hang-up. An example of a typical directory to be excluded is the ‘/dev’ directory and any
directories used by ESETS.
5.2.1. Operation principle
TheOn-accessscanneresets_dac(ESETSDazuko-poweredleAccessController)isaresident

17
program which provides continuous monitoring and control over the le system. Every le
system object is scanned based on customizable le access event types. The following event
types are supported by the current version:
Open events
Thisleaccesstypeisactivatediftheword'open'ispresentinthe'event_mask‘parameterin
theeset.cfgle([dac]section).Inthiscase,theON_OPENbitofDazukoaccessmaskissettoon.
Close events
Thisleaccesstypeisactivatediftheword'close'ispresentinthe'event_mask‘parameterin
theeset.cfgle([dac]section).Inthiscase,theON_CLOSEbitandON_CLOSE_MODIFIEDbitof
Dazuko access mask is set to on.
NOTE:SomeOSkernelversionsdonotsupporttheinterceptionofON_CLOSEevents.Inthese
cases,closeeventswillnotbemonitoredbyesets_dac.
Exec events
Thisleaccesstypeisactivatediftheword'exec'ispresentinthe'event_mask'parameterin
theeset.cfgle([dac]section).InthiscasetheON_EXECbitofDazukoaccessmaskissettoon.
In summary, the On-access scanner ensures that all opened, closed and executed les are
scannedbytheesets_daemonforviruses.Basedontheresultofsuchscans,accesstogivenles
is denied or allowed.
5.2.2. Installation and configuration
As mentioned previously, the Dazuko kernel module must be compiled and installed within
the running kernel before esets_dac can be initialized. To compile and install Dazuko, please see:
http://www.dazuko.org/howto-install.shtml.
Once Dazuko is installed, review and edit the [global] and [dac] sections of the ESETS
configuration file (esets.cfg). Note that the proper functioning of the On-access scanner is
dependent upon configuration of the‘agent_enabled’ option within the [dac] section of this
le. Additionally, you must define the file system objects (i.e. directories and files) that are to be
monitored by the On-access scanner. This can be accomplished by defining the parameters of
the‘ctl_incl’and‘ctl_excl’options,whicharealsolocatedwithinthe[dac]section.Aftermaking
changes to the esets.cfg le, you can force the newly created configuration to be re-read by
reloading the ESETS daemon.
5.2.3. Tips
To ensure that the Dazuko module loads prior to initialization of the esets_dac daemon,
follow these steps:
Place a copy of the Dazuko module in either of the following directories, which are reserved
for kernel modules:
/lib/modules
or
/modules
Use the kernel utilities ‘depmod’ and ‘modprobe’ (For BSD OS, use ‘kldconfig’ and ‘kldload’) to
handle dependencies and successful initialization of the newly added Dazuko module.
In the esets_daemon initialization script ‘/etc/init.d/esets_daemon’, before the daemon
chapter 5 Integration with File System services

18 ESET File Security
initialization statement, insert the following line:
/sbin/modprobe dazuko
For BSD OS's the line
  /sbin/kldcongdazuko
mustbeinsertedintothe‘/usr/local/etc/rc.d/esets_daemon.sh’script.
Warning! It is extremely important that these steps are executed in the exact order given. If
the kernel module is not located within the kernel modules directory it will not properly load,
resulting in system hang-up.
5.3. On-access scanner using preload LIBC library
In previous sections we described the integration of the On-access scanner powered by
Dazuko with Linux/BSD file system services. In this section we would like to point out that the
technique using Dazuko may not be desired by system administrators who maintain critical
systems where:
The source code and/or configuration files related to the currently running kernel are noty
available
The kernel is more monolithic than modulary
The Dazuko module simply does not support the given OSy
In any of these cases, the On-access scanning technique based on the preload LIBC library
should be used. See section 5.3.1 below for detailed information. Please note that this section is
relevant only for Linux OS users and contains information regarding the operation, installation
and configuration of the On-access scanner using the preload library 'libesets_pac.so'.
5.3.1. Operation principle
The On-access scanner libesets_pac.so (ESETS Preload library based le Access Controller) is a
shared objects library which is activated at system start-up. This library is used for LIBC calls by
le system servers such as FTP server, Samba server etc. Every le system object is scanned based
on customizable le access event types. The following event types are supported by the current
version:
open events
Thisleaccesstypeisactivatediftheword'open'ispresentinthe'event_mask‘parameter
in the eset.cfg le ([pac] section).
close events
Thisleaccesstypeisactivatediftheword‘close‘ispresentinthe‘event_mask‘parameterin
the eset.cfg le ([pac] section). In this case, all le descriptor and FILE stream close functions of
the LIBC are intercepted.
exec events
Thisleaccesstypeisactivatediftheword‘exec‘ispresentinthe‘event_mask‘parameterin
the eset.cfg ([pac] section). In this case, all exec functions of the LIBC are intercepted.

19
All opened, closed and executed les are scanned by the ESETS daemon for viruses. Based on
the result of such scans, access to given les is denied or allowed.
5.3.2. Installation and configuration
The libesets_pac.so library module is installed using a standard installation mechanism of
thepreloadedlibraries.Onehasjusttodenetheenvironmentvariable‘LD_PRELOAD‘withthe
absolute path to the libesets_pac.so library. For more information, please refer to the ld.so(8)
man page.
NOTE: Itisimportantthatthe‘LD_PRELOAD‘environmentvariableisdenedonlyforthenetwork
server daemon processes (ftp, Samba, etc.) that will be under control of the On-access scanner.
Generally, preloading LIBC calls for all operating system processes is not recommended, as this
can dramatically slow the performance of the system or even cause the system to hang. In this
sense,the‘/etc/ld.so.preload‘leshouldnotbeused,norshouldthe‘LD_PRELOAD‘environment
variable be exported globally. Both would override all relevant LIBC calls, which could lead to
system hang-up during initialization.
To ensure that only relevant le access calls within a given le system are intercepted,
executable statements can be overridden using the following line:
LD_PRELOAD=/path/to/libesets_pac.so COMMAND COMMAND-ARGUMENTS
where‘COMMANDCOMMAND-ARGUMENTS‘istheoriginalexecutablestatement.
Review and edit the [global] and [pac] sections of the ESETS conguration le (esets.cfg). In
order for the On-access scanner to function correctly, you must dene the le system objects
(i.e. directories and les) that are required to be under control of the preload library. This can be
achievedbydeningtheparametersofthe‘ctl_incl‘and‘ctl_excl‘optionsinthe[pac]section
of the esets.cfg conguration le. After making changes to the esets.cfg le, you can force the
newly created configuration to be re-read by reloading the ESETS daemon.
5.3.3. Tips
In order to activate the On-access scanner immediately after le system start-up, the ‘LD_
PRELOAD‘ environment variable must be dened within the appropriate network le server
initialization script.
EXAMPLE:Let‘sassumewewanttohavetheOn-accessscannertomonitoralllesystemaccess
events immediately after starting the Samba server. Within the Samba daemon initialization
script (/etc/init.d/smb), we would replace the statement
daemon /usr/sbin/smbd $SMBDOPTIONS
with the following line:
LD_PRELOAD=/path/to/libesets_pac.so daemon /usr/sbin/smbd $SMBDOPTIONS
In this way, selected le system objects controlled by Samba will be scanned at system start-
up.
chapter 5 Integration with File System services