ESET FILE SECURITY User manual

ESET File Security
Installation Manual
and User Guide
we protect digital worlds

2ESET File Security
Table of contents
1. Introduction .........................................................................................3
2.Terminology and abbreviations..........................................................5
3. Installation............................................................................................. 9
4. Architecture Overview ......................................................................11
5. Integration with File System services.............................................15
5.1. On-demand scanner .................................................................................. 16
5.2. On-access scanner powered by Dazuko ............................................. 16
5.2.1. Operation principle................................................................................. 17
5.2.2. Installation and configuration ............................................................17
5.2.3. Tips ................................................................................................................ 17
5.3. On-access scanner using preload LIBC library...................................18
5.3.1. Operation principle................................................................................. 18
5.3.2. Installation and configuration ............................................................19
5.3.3. Tips ................................................................................................................ 19
6. Important ESET File Security mechanisms 21
6.1. Handle Object Policy.................................................................................. 22
6.2. User Specific Configuration..................................................................... 22
6.3. Samples Submission System................................................................... 23
6.4. World Wide Web Interface.........................................................................24
6.5. Remote Administration..............................................................................24
7. ESET Security system update...........................................................25
7.1. ESETS update utility.................................................................................... 26
7.2. ESETS update process description........................................................ 26
8. Let us know..........................................................................................27
Appendix A. PHP License .....................................................................29
ESET File Security
Copyright © 2008 ESET, spol. s r.o.
ESET File Security was developed by ESET, spol. s r.o. For more
information visit www.eset.com.
All rights reserved. No part of this documentation may be
reproduced, stored in a retrieval system or transmitted in any form
or by any means, electronic, mechanical, photocopying, recording,
scanning, or otherwise without permission in writing from the author.
ESET, spol. s r.o. reserves the right to change any of the described
application software without prior notice.
This product includes PHP software, freely available from http://www.
php.net/software/.
REV.20080701-005

Chapter 1:
Introduction

4ESET File Security
Dear user, you have acquired ESET File Security - arguably the most advanced security system
running under the Linux/BSD/Solaris OS. As you will soon find, ESET's state-of-the-art scanning
engine has unsurpassed scanning speed and detection rates, combined with a very small
footprint that makes it the ideal choice for any Linux/BSD/Solaris OS server.
Key features of the system:
• TheESETantivirusscanningenginealgorithmsprovidethehighestdetectionrateand
the fastest scanning times.
• ESETFileSecurityisdevelopedtorunonsingle-processoraswellas
multi-processor units.
• ItincludesuniqueadvancedheuristicsforWin32wormsandback-doors.
• Inbuiltarchiversunpackarchivedobjectswithouttheneedforanyexternalprograms.
• Toincreasethespeedandefficiencyofthesystem,itsarchitectureisbasedonthe
running daemon (resident program) where all scanning requests are sent.
• Allexecutivedaemons(exceptesets_dac)rununderanon-privilegeduseraccountto
enhance security.
• Thesystemsupportsselectiveconfigurationbasedontheuserorclient/server.
• Sixlogginglevelscanbeconfiguredtoretrieveinformationaboutsystemactivityand
infiltrations.
• Conguration,administrationandlicensemanagementareoeredthroughanintuitive
and user-friendly World Wide Web Interface.
• ThesystemsupportsESETRemoteAdministrationformanagementinlargecomputer
networks.
• TheESETFileSecurityinstallationdoesnotrequireexternallibrariesorprogramsexcept
for LIBC.
• Thesystemcanbeconfiguredtonotifyanyuserintheeventofadetectedinfiltration.
To run efficiently, ESET File Security requires just 16MB of hard disk space and 32MB of RAM.
It runs smoothly under the 2.2.x, 2.4.x and 2.6.x Linux OS kernel versions and the 5.x, 6.x FreeBSD
OS kernel versions.
From lower-powered, small office servers to enterprise-class ISP servers with thousands of
users, the system delivers the performance and scalability you expect from a Unix-based solution,
in addition to the unequaled security of ESET products.

Chapter 2:
Terminology
and abbreviations

6ESET File Security
In this section we will review the terms and abbreviations used in this document. Note that
a boldface font is reserved for product component names and also for newly defined terms and
abbreviations. Terms and abbreviations defined in this chapter are expanded upon later in this
document.
ESETS
ESET Security is a standard acronym for all security products developed by ESET, spol. s r.o. for
Linux, BSD and Solaris operating systems. It is also the name (or its part) of the software package
containing the products.
RSR
Abbreviation for ‘RedHat/Novell(SuSE) Ready’. Note that we also support RedHat Ready
and Novell(SuSE) Ready variations of the product. The RSRpackagediersfromthe“standard”
Linux version in that it meets the FHS (File-system Hierarchy Standard defined as a part of
Linux Standard Base) criteria required by the RedHat Ready and Novell(SuSE) Ready certificate.
This means that the RSR package is installed as an add-on application–the primary installation
directory is ’/opt/eset/esets’.
ESETS daemon
The main ESETS system control and scanning daemon: esets_daemon.
ESETS base directory
The directory where ESETS loadable modules containing the virus signature database
are stored. The abbreviation @BASEDIR@ will be used for future references to this
directory. The @BASEDIR@ value for the following Operating Systems is listed below:
Linux: /var/lib/esets
Linux RSR: /var/opt/eset/esets/lib
FreeBSD: /var/lib/esets
NetBSD: /var/lib/esets
Solaris: /var/opt/esets/lib
ESETS configuration directory
The directory where all files related to the ESET File Security configuration are stored. The
abbreviation @ETCDIR@ will be used for future references to this directory. The @ETCDIR@ value
for the following Operating Systems is listed below:
Linux: /etc/esets
Linux RSR: /etc/opt/eset/esets
FreeBSD: /usr/local/etc/esets
NetBSD: /usr/pkg/etc/esets
Solaris: /etc/opt/esets
ESETS configuration file
Main ESET File Security configuration file. The absolute path of the file is as follows:
@ETCDIR@/esets.cfg
ESETS binary files directory
The directory where the relevant ESET File Security binary files are stored. The abbreviation

7
@BINDIR@ will be used for future references to this directory. The @BINDIR@ value for the
following Operating Systems is listed below:
Linux: /usr/bin
Linux RSR: /opt/eset/esets/bin
FreeBSD: /usr/local/bin
NetBSD: /usr/pkg/bin
Solaris: /opt/esets/bin
ESETS system binary files directory
The directory where the relevant ESET File Security system binary files are stored. The
abbreviation @SBINDIR@ will be used for future references to this directory. The @SBINDIR@
value for the following Operating Systems is listed below:
Linux: /usr/sbin
Linux RSR: /opt/eset/esets/sbin
FreeBSD: /usr/local/sbin
NetBSD: /usr/pkg/sbin
Solaris: /opt/esets/sbin
ESETS object files directory
The directory where the relevant ESET File Security object files and libraries are stored. The
abbreviation @LIBDIR@ will be used for future references to this directory. The @LIBDIR@ value
for the following Operating Systems is listed below:
Linux: /usr/lib/esets
Linux RSR: /opt/eset/esets/lib
FreeBSD: /usr/local/lib/esets
NetBSD: /usr/pkg/lib/esets
Solaris: /opt/esets/lib
chapter 2 Terminology and abbreviations

Chapter 3:
Installation

10
After a purchase of the ESET Gateway Security, you will get your authorization data (Username/
password and a license key). The data are needed to identify you as our customer, who has right
to download updates for ESET Gateway Security. The Username/password data are required for
downloading installation package from our website. The ESET File Security product is distributed
as a binary file:
esets.i386.ext.bin
where ‘ext’ is a Linux/BSD/Solaris OS distribution dependent suffix. ‘deb’ is used for Debian,
‘rpm’ for RedHat and SuSE, ‘tgz’ for other Linux OS distributions, ‘fbs5.tgz’ for FreeBSD 5.xx, ‘fbs6.
tgz’ for FreeBSD 6.xx, ‘nbs4.tgz‘ for NetBSD 4.xx and ‘sol10.pkg.gz‘ for Solaris 10.
Note that the Linux RSR binary file format is:
esets-rsr.i386.rpm.bin
In order to install or upgrade the product, use the following command:
sh ./esets.i386.ext.bin
For Linux RSR variations of the product, use the command:
sh ./esets-rsr.i386.rpm.bin
to display the product’s User License Acceptance Agreement. Once you have confirmed the
Acceptance Agreement, the installation package is placed in the current working directory and
relevant information regarding the package’s installation, un-installation or upgrade is displayed
onscreen.
Once the package is installed, you can verify that the main ESETS service is running by using
the following command:
Linux OS:
ps -C esets_daemon
BSD OS:
ps -ax | grep esets_daemon
Solaris:
ps -A | grep esets_daemon
After pressing ENTER, you should see the following (or similar) message:
PID TTY TIME CMD
2226 ? 00:00:00 esets_daemon
2229 ? 00:00:00 esets_daemon
where at least two ESETS daemon processes are running in the background.The rst PID
represents the process and threads manager of the system. The second PID represents the ESETS
scanning process.
ESET File Security

Chapter 4:
Architecture Overview

12 ESET File Security
Once ESET File Security is successfully installed, you should become familiar with its
conguration.
The structure of ESET File Security is shown in Figure 4-1. The system is comprised of the
following parts:
CORE
The core  of  ESET  File  Security is the daemon esets_daemon.The daemon uses ESETS
APIlibrarylibesets.soandESETSloadingmodulesem00X_xx.dattoprovidebasesystemtasks
such as scanning, maintenance of the agent daemon processes, maintenance of the Samples
SubmissionSystem,logging,notication,etc.Pleaserefertotheesets_daemon(8)manpagefor
details.
AGENTS
The purpose of ESETS agent modules is to integrate ESETS with the Linux/BSD/Solaris Server
environment.
UTILITIES
Theutilitymodulesprovidesimpleandeectivemanagementofthesystem.Theyareresponsible
for system tasks such as license management, quarantine management, system setup and update.
CONFIGURATION
Proper congurationis the most important aspect of  a smooth-running security system–
the remainder of this chapter is dedicated to explaining all related components. A thorough
understanding of the esets.cfg le (page 6) is also highly recommended, as this le contains
informationessentialtothecongurationofESETFileSecurity.
Aftertheproductissuccessfullyinstalled,allofitscongurationcomponentsarestoredin
Figure 4-1. Structure of ESET File Security.
esets_scan
libesets_pac.so
esets_dac
AGENTS
esets_lic
UTILITIES
esets_quar
esets_setup
esets_update
scanning
engine
CORE
system
service
esets.cfg
license
scripts
WWW INTERFACE
CONFIGURATION

13
theESETScongurationdirectory.Thisdirectoryconsistsofthefollowingles:
@ETCDIR@/esets.cfg
Thisisthemostimportantcongurationle,asitcontrolsallmajoraspectsoftheproduct's
functionality.Theesets.cfgleismadeupofseveralsections,eachsectioncontainingvarious
parameters.The le contains one global and several "agent" sections, with all section names
enclosedinsquarebrackets.Parametersintheglobalsectionareusedtodeneconguration
options for the ESETS daemon as well as default values for the ESETS scanning engine
conguration.Parametersintheagentsectionsareusedtodenecongurationoptionsforall
ESET File Security agents and modules. These agents are used to intercept various data types
received by the computer and prepare this data for scanning. Note that in addition to the various
parametersusedforthesystemconguration,therearealsorulesgoverningtheorganizationof
thele.Fordetailedinformationonthemosteectivewaytoorganizethisle,pleaserefertothe
esets.cfg(5)andesets_daemon(8)manualpages(manpages).
@ETCDIR@/certs
ThisdirectoryisusedtostorethecerticatesusedbyESETSWWWInterfaceforauthentication
Seeesets_wwwionpageXfordetails.
@ETCDIR@/license
This directory is used to store the product(s) license key(s) you have acquired from your
vendor. Note that the ESETS daemon will check only this directory to evaluate license key
validityunlessthe‘license_dir’parameterintheESETScongurationleisredened.
@ETCDIR@/scripts/license_warning_script
IfenabledbytheESETScongurationleparameter‘license_warn_enabled’,thisscriptwillbe
executed30days(onceperday)beforeproductlicenseexpiration,sendinganemailnotication
about the expiration status to the system administrator.
@ETCDIR@/scripts/daemon_notication_script
IfenabledbytheESETScongurationleparameter‘exec_script‘,thisscriptisexecutedinthe
eventofadetectedinltrationbytheantivirussystem.Itisusedtosendemailnoticationabout
the event to the system administrator.
chapter 4 Product Roadmap

Chapter 5:
Integration with File System
services

16 ESET File Security
This chapter describes the On-demand and On-access scanner conguration which will
provide the most eective protection from virus and worm le system infections. ESET File
Security's scanning power is derived from the On-demand scanner command 'esets_scan' and
the On-access scanner command 'esets_dac'.TheLinuxversionofESETFileSecurityoersan
additional On-access scanner technique which uses the preloaded library module libesets_pac.
so. All of these commands are described in the following sections.
5.1. On-demand scanner
The On-demand scanner can be invoked by a privileged user (usually a system administrator)
through the command line interface or by the operating system's automatic scheduling tool
(e.g.,cron).Thus,theterm"On-demand"referstolesystemobjectswhicharescannedonuser
or system demand.
The On-demand scanner does not require special conguration in order to run. After the
ESETS package has been properly installed and a valid license has been moved to the license
keys directory (@ETCDIR@/license), the On-demand scanner can be run immediately using the
command line interface or scheduler tool. To run the On-demand scanner from the command
line, use the following syntax:
@SBINDIR@/esets_scan [option(s)] FILES
whereFILESisalistofdirectoriesand/orlestobescanned.
Multiple command line options are available using ESETS On-demand scanner. To see the full
listofoptions,seepageXesets_scan(8).
5.2. On-access scanner powered by Dazuko
The On-access scanner is invoked by user(s) access and/or operating system access to file
systemobjects.Thisalsoexplainstheterm"On-access";thescannerisinitializedonanyattempt
to access a selected file system object.
The technique used by ESETS On-access scanner is powered by the Dazuko (da-tzu-ko) kernel
module and is based on the interception of kernel calls. The Dazuko project is open source,
which means that its source code is freely distributed. This allows users to compile the kernel
module for their own custom kernels. Note that the Dazuko kernel module is not a part of any
ESETS product and must be compiled and installed into the kernel prior to using the On-access
command esets_dac. On the other hand the Dazuko technique makes On-access scanning
independent of the file system type used. It is also suitable for controlling file system objects via
Network File System (NFS), Nettalk and Samba.
IMPORTANT: Before we provide detailed information related to the On-access scanner's
configuration and operation, it should be noted that the scanner has been primarily developed
andtestedtoprotectfilesystemsmountedexternally.Iftherearemultiplelesystemswhichare
not externally mounted, they will need to be excluded from file access control in order to prevent
system hang-up. An example of a typical directory to be excluded is the ‘/dev’ directory and any
directories used by ESETS.
5.2.1. Operation principle
TheOn-accessscanneresets_dac(ESETSDazuko-poweredleAccessController)isaresident

17
program which provides continuous monitoring and control over the le system. Every le
systemobject is scanned based on customizable le access eventtypes.The followingevent
types are supported by the current version:
Open events
Thisleaccesstypeisactivatediftheword'open'ispresentinthe'event_mask‘parameterin
theeset.cfgle([dac]section).Inthiscase,theON_OPENbitofDazukoaccessmaskissettoon.
Close events
Thisleaccesstypeisactivatediftheword'close'ispresentinthe'event_mask‘parameterin
theeset.cfgle([dac]section).Inthiscase,theON_CLOSEbitandON_CLOSE_MODIFIEDbitof
Dazuko access mask is set to on.
NOTE:SomeOSkernelversionsdonotsupporttheinterceptionofON_CLOSEevents.Inthese
cases,closeeventswillnotbemonitoredbyesets_dac.
Exec events
Thisleaccesstypeisactivatediftheword'exec'ispresentinthe'event_mask'parameterin
theeset.cfgle([dac]section).InthiscasetheON_EXECbitofDazukoaccessmaskissettoon.
In summary,the On-accessscannerensuresthatallopened,closedandexecutedlesare
scannedbytheesets_daemonforviruses.Basedontheresultofsuchscans,accesstogivenles
is denied or allowed.
5.2.2. Installation and configuration
As mentioned previously, the Dazuko kernel module must be compiled and installed within
the running kernel before esets_dac can be initialized. To compile and install Dazuko, please see:
http://www.dazuko.org/howto-install.shtml.
Once Dazuko is installed, review and edit the [global] and [dac] sections of the ESETS
configuration file (esets.cfg). Note that the proper functioning of the On-access scanner is
dependent upon configuration of the‘agent_enabled’ option within the [dac] section of this
le.Additionally,youmustdefinethefilesystemobjects(i.e.directoriesandfiles)thataretobe
monitored by the On-access scanner. This can be accomplished by defining the parameters of
the‘ctl_incl’and‘ctl_excl’options,whicharealsolocatedwithinthe[dac]section.Aftermaking
changes to the esets.cfg le, you can force the newly created configuration to be re-read by
reloading the ESETS daemon.
5.2.3. Tips
To ensure that the Dazuko module loads prior to initialization of the esets_dac daemon,
follow these steps:
Place a copy of the Dazuko module in either of the following directories, which are reserved
for kernel modules:
/lib/modules
or
/modules
Use the kernel utilities ‘depmod’ and ‘modprobe’ (For BSD OS, use ‘kldconfig’ and ‘kldload’) to
handle dependencies and successful initialization of the newly added Dazuko module.
In the esets_daemon initialization script ‘/etc/init.d/esets_daemon’, before the daemon
chapter 5 Integration with File System services

18 ESET File Security
initialization statement, insert the following line:
/sbin/modprobe dazuko
For BSD OS's the line
  /sbin/kldcongdazuko
mustbeinsertedintothe‘/usr/local/etc/rc.d/esets_daemon.sh’script.
Warning! It is extremely important that these steps be executed in the exact order given. If the
kernel module is not located within the kernel modules directory ‘modprobe’ (resp. ‘kldload’ in
BSD OS) the module will not properly load, resulting in system hang-up.
5.3. On-access scanner using preload LIBC library
In previous sections we described the integration of the On-access scanner powered by
Dazuko with Linux/BSD file system services. In this section we would like to point out that the
technique using Dazuko may not be desired by system administrators who maintain critical
systems where:
The source code and/or configuration files related to the currently running kernel are noty
available
The kernel is more monolithic than modulary
The Dazuko module simply does not support the given OSy
In any of these cases, the On-access scanning technique based on the preload LIBC library
should be used. See section 5.3.1 below for detailed information. Please note that this section is
relevant only for Linux OS users and contains information regarding the operation, installation
and configuration of the On-access scanner using the preload library 'libesets_pac.so'.
5.3.1. Operation principle
The On-access scanner libesets_pac.so(ESETSPreloadlibrary-basedleAccessController)isa
shared objects preloaded library which is activated at system start-up. This library is used by
lesystemserversforLIBCcallstootherdevicessuchasFTPserver,Sambaserveretc.Everyle
systemobject is scanned based on customizable le access eventtypes.The followingevent
types are supported by the current version:
open events
Thisleaccesstypeisactivatediftheword'open'ispresentinthe'event_mask‘parameter
intheeset.cfgle([pac]section).
close events
Thisleaccesstypeisactivatediftheword‘close‘ispresentinthe‘event_mask‘parameterin
theeset.cfgle([pac]section).Inthiscase,allledescriptorandFILEstreamclosefunctionsof
the LIBC are intercepted.
exec events
Thisleaccesstypeisactivatediftheword‘exec‘ispresentinthe‘event_mask‘parameterin
theeset.cfg([pac]section).Inthiscase,allexecfunctionsoftheLIBCareintercepted.Allopened,

19
closedandexecutedlesarescannedbytheESETSdaemonforviruses.Basedontheresultof
suchscans,accesstogivenlesisdeniedorallowed.
5.3.2. Installation and configuration
The libesets_pac.so library module is installed using a standard installation mechanism of
thepreloadedlibraries.Onehasjusttodenetheenvironmentvariable‘LD_PRELOAD‘withthe
absolute path to the libesets_pac.so library. For more information, please refer to the ld.so(8)
man page.
NOTE: Itisimportantthatthe‘LD_PRELOAD‘environmentvariableisdenedonlyforthenetwork
server daemon processes (ftp, Samba, etc.) that will be under control of the On-access scanner.
Generally, preloading LIBC calls for all operating system processes is not recommended, as this
can dramatically slow the performance of the system or even cause the system to hang. In this
sense,the‘/etc/ld.so.preload‘leshouldnotbeused,norshouldthe‘LD_PRELOAD‘environment
variable be exported globally. Both would override all relevant LIBC calls, which could lead to
system hang-up during initialization.
To ensure that only relevant le access calls within a given le system are intercepted,
executable statements can be overridden using the following line:
LD_PRELOAD=/path/to/libesets_pac.so COMMAND COMMAND-ARGUMENTS
where ‘COMMAND COMMAND-ARGUMENTS‘ is the original executable statement.
Reviewandeditthe[global]and[pac]sectionsoftheESETScongurationle(esets.cfg).In
orderfortheOn-accessscannertofunctioncorrectly,youmustdenethelesystemobjects
(i.e.directoriesandles)thatarerequiredtobeundercontrolofthepreloadlibrary.Thiscanbe
achievedbydeningtheparametersofthe‘ctl_incl‘and‘ctl_excl‘optionsinthe[pac]section
oftheesets.cfgcongurationle.Aftermakingchangestotheesets.cfgle,youcanforcethe
newly created configuration to be re-read by reloading the ESETS daemon.
5.3.3. Tips
In order to activate the On-access scanner immediately after le system start-up, the ‘LD_
PRELOAD‘ environment variable must be dened within the appropriate network le server
initialization script.
EXAMPLE:Let‘sassumewewanttohavetheOn-accessscannertomonitoralllesystemaccess
events immediately after starting the Samba server. Within the Samba daemon initialization
script (/etc/init.d/smb), we would replace the statement
daemon /usr/sbin/smbd $SMBDOPTIONS
with the following line, which is responsible for initialization of the smbd daemon:
LD_PRELOAD=/path/to/libesets_pac.so daemon /usr/sbin/smbd $SMBDOPTIONS
Inthisway,selectedlesystemobjectscontrolledbySambawillbescannedatsystemstart-
up.
chapter 5 Integration with File System services