ESET MAIL SECURITY - ANNEXE 209 User manual

ESET Mail Security
Installation Manual
and User Guide
we protect digital worlds

2ESET Mail Security
Table of contents
1. Introduction .........................................................................................3
2.Terminology and abbreviations..........................................................5
3. Installation............................................................................................. 9
4. Architecture Overview ......................................................................11
5. Integration with Email Messaging System.....................................15
5.1. Bi-directional email messages scanning in MTA...............................17
5.2. Scanning of inbound email messages................................................. 17
5.3. Scanning of outbound email messages...............................................18
5.4. Scanning of email messages being downloaded from POP3/
IMAP server.............................................................................................................18
5.5. Alternative methods of content ltering.............................................19
5.5.1. Scanning email messages in CommuniGate Pro
using esets_cgp....................................................................................................19
5.5.2. Scanning email messages using AMaViS.........................................20
6. Important ESET Mail Security mechanisms...................................23
6.1. Handle Object Policy.................................................................................. 24
6.2. User Specic Conguration..................................................................... 25
6.3. Blacklist and Whitelist.................................................................................26
6.4. Anti-Spam Control ...................................................................................... 26
6.5. Samples Submission System................................................................... 27
6.6. Web Interface.................................................................................................27
6.7. Remote Administration..............................................................................28
7. ESET Mail Security update................................................................29
7.1. ESETS update utility.................................................................................... 30
7.2. ESETS update process description........................................................ 30
7.3. ESETS mirror http daemon........................................................................31
8. Let us know..........................................................................................33
A. ESETS setup and configuration........................................................35
A.1. Setting ESETS for MTA Postx..................................................................36
A.2. Setting ESETS for MTA Sendmail ................... ........................................37
A.3. Setting ESETS for MTA Qmail...................................................................38
A.4. Setting ESETS for MTA Exim version 3..................................................39
A.5. Setting ESETS for MTA Exim version 4..................................................40
A.6. Setting ESETS for MTA ZMailer................................................................41
A.7. Setting ESETS for outbound email messages scanning.................41
A.8. Setting ESETS for scanning of POP3 communication.....................42
A.9. Setting ESETS for scanning of IMAP communication.....................43
B. PHP License ........................................................................................45
ESET Mail Security
Copyright © 2009 ESET, spol. s r.o.
ESET Mail Security was developed by
ESET, spol. s r.o. For more information
visit www.eset.com.
All rights reserved. No part of this
documentation may be reproduced,
stored in a retrieval system or
transmitted in any form or by any
means, electronic, mechanical,
photocopying, recording, scanning,
or otherwise without a permission in
writing from the author.ESET, spol. s
r.o. reserves the right to change any
of the described application software
without prior notice.This product
includes PHP software, freely available
from http://www.php.net/software/.
ESET Mail Security was developed in
co-operation with ProWeb Consulting.
For more information visit www.
pwc.sk.
REV.20090224-012

Chapter 1:
Introduction

4ESET Mail Security
Dear user, you have acquired ESET Mail Security - the premier security system running under
the Linux/BSD/Solaris OS. As you will soon nd out, ESET‘s state-of-the-art scanning engine has
unsurpassed scanning speed and detection rates combined with a very small footprint that
makes it the ideal choice for any Linux/BSD/Solaris OS server.
Key features of the system:
•TheESETantivirusscanningenginealgorithmsprovidethehighestdetectionrateandthe
fastest scanning times.
•TheESETMailSecurityisdevelopedtorunonsingle-processoraswellasonmulti-processor
units.
•ItincludesuniqueadvancedheuristicsforWin32wormsandback-doors.
•Built-inarchiversunpackarchivedobjectswithouttheneedforanyexternalprograms.
•Toincreasethespeedandeciencyofthesystem,itsarchitectureisbasedontherunning
daemon (resident program) where all scanning requests are sent.
•Allexecutivedaemons(exceptesets_dac)runundernon-privilegeduseraccountto
enhance security.
•Thesystemsupportsselectivecongurationbasedontheuserorclient/server.
•Multiplelogginglevelscanbeconguredtogetinformationaboutsystemactivityand
inltrations.
•Conguration,administrationandlicensemanagementareoeredthroughanintuitiveand
user-friendly World Wide Web Interface.
•ThesystemsupportsESETRemoteAdministrationformanagementinlargecomputer
networks.
•TheESETMailSecurityinstallationdoesnotrequireexternallibrariesorprogramsexceptfor
LIBC.
•Thesystemcanbeconguredtonotifyspecicusersintheeventofadetectedinltration
or other important events.
Toruneciently,ESETMailSecurityrequiresjust16MBofhard-diskspaceand32MBofRAM.
It runs smoothly under the 2.2.x, 2.4.x and 2.6.x Linux OS kernel versions as well as under 5.x, 6.x
FreeBSD OS kernel versions.
Fromlower-powered,small oceserverstoenterprise-classISPserverswiththousandsof
users, ESET Mail Security delivers the performance and scalability you expect from a UNIX based
solution, in addition to the unequaled security of ESET products.

Chapter 2:
Terminology
and abbreviations

6ESET Mail Security
In this section we will review the terms and abbreviations used in this document. Note that
a boldface font is reserved for product component names and also for newly defined terms and
abbreviations. Terms and abbreviations defined in this chapter are expanded upon later in this
document.
ESETS
ESET Security is a standard acronym for all security products developed by ESET, spol. s r.o. for
Linux, BSD and Solaris operating systems. It is also the name (or its part) of the software package
containing the products.
RSR
Abbreviation for ‘RedHat/Novell(SuSE) Ready’. Note that we also support RedHat Ready
and Novell(SuSE) Ready variations of the product. The RSRpackagediersfromthe“standard”
Linux version in that it meets the FHS (File-system Hierarchy Standard defined as a part of
Linux Standard Base) criteria required by the RedHat Ready and Novell(SuSE) Ready certificate.
This means that the RSR package is installed as an add-on application–the primary installation
directory is ’/opt/eset/esets’.
ESETS daemon
The main ESETS system control and scanning daemon: esets_daemon.
ESETS base directory
The directory where ESETS loadable modules containing the virus signature database
are stored. The abbreviation @BASEDIR@ will be used for future references to this
directory. The @BASEDIR@ value for the following Operating Systems is listed below:
Linux: /var/lib/esets
Linux RSR: /var/opt/eset/esets/lib
FreeBSD: /var/lib/esets
NetBSD: /var/lib/esets
Solaris: /var/opt/esets/lib
ESETS configuration directory
The directory where all files related to the ESET Mail Security configuration are stored. The
abbreviation @ETCDIR@ will be used for future references to this directory. The @ETCDIR@ value
for the following Operating Systems is listed below:
Linux: /etc/esets
Linux RSR: /etc/opt/eset/esets
FreeBSD: /usr/local/etc/esets
NetBSD: /usr/pkg/etc/esets
Solaris: /etc/opt/esets
ESETS configuration file
Main ESET Mail Security configuration file. The absolute path of the file is as follows:
@ETCDIR@/esets.cfg
ESETS binary files directory
The directory where the relevant ESET Mail Security binary files are stored. The abbreviation

7
@BINDIR@ will be used for future references to this directory. The @BINDIR@ value for the
following Operating Systems is listed below:
Linux: /usr/bin
Linux RSR: /opt/eset/esets/bin
FreeBSD: /usr/local/bin
NetBSD: /usr/pkg/bin
Solaris: /opt/esets/bin
ESETS system binary files directory
The directory where the relevant ESET Mail Security system binary files are stored. The
abbreviation @SBINDIR@ will be used for future references to this directory. The @SBINDIR@
value for the following Operating Systems is listed below:
Linux: /usr/sbin
Linux RSR: /opt/eset/esets/sbin
FreeBSD: /usr/local/sbin
NetBSD: /usr/pkg/sbin
Solaris: /opt/esets/sbin
ESETS object files directory
The directory where the relevant ESET Mail Security object files and libraries are stored. The
abbreviation @LIBDIR@ will be used for future references to this directory. The @LIBDIR@ value
for the following Operating Systems is listed below:
Linux: /usr/lib/esets
Linux RSR: /opt/eset/esets/lib
FreeBSD: /usr/local/lib/esets
NetBSD: /usr/pkg/lib/esets
Solaris: /opt/esets/lib
chapter 2 Terminology and abbreviations

Chapter 3:
Installation

10
After purchasing ESET Mail Security, you will receive your authorization data (username/
password and license key). This data is necessary for both identifying you as our customer and
allowing you to download updates for ESET Mail Security. The username/password data is also
required for downloading the initial installation package from our web site. ESET Mail Security is
distributed as a binary le:
esets.i386.ext.bin
Inthebinaryleshownabove,‘ext’isaLinux/BSD/SolarisOSdistributiondependentsux,
i.e., ‘deb’ for Debian, ‘rpm’ for RedHat and SuSE, ‘tgz’ for other Linux OS distributions, ‘fbs5.tgz’ for
FreeBSD 5.xx, ‘fbs6.tgz‘ for FreeBSD 6.xx, ‘nbs4.tgz‘ for NetBSD 4.xx and ‘sol10.pkg.gz‘ for Solaris
10.
Note that the Linux RSR binary le format is:
esets-rsr.i386.rpm.bin
To install or upgrade the product, use the following command:
sh ./esets.i386.ext.bin
For the Linux RSR variation of the product, use the command:
sh ./esets-rsr.i386.rpm.bin
to display the product’s User License Acceptance Agreement. Once you have conrmed the
Acceptance Agreement, the installation package is placed into the current working directory and
relevant information regarding the package’s installation, un-installation or upgrade is displayed
onscreen.
Once the package is installed, you can verify that the main ESETS service is running by using
the following command:
Linux OS:
ps -C esets_daemon
BSD OS:
ps -ax | grep esets_daemon
Solaris:
ps -A | grep esets_daemon
After pressing ENTER, you should see the following (or similar) message:
PID TTY TIME CMD
2226 ? 00:00:00 esets_daemon
2229 ? 00:00:00 esets_daemon
At least two ESETS daemon processes are running in the background. The rst PID represents
the process and threads manager of the system. The other represents the ESETS scanning
process.
ESET Mail Security

Chapter 4:
Architecture Overview

12 ESET Mail Security
Once ESET Mail Security is successfully installed, you should become familiar with its
architecture.
The structure of ESET Mail Security is shown in Figure 4-1. The system is comprised of the
following parts:
CORE
The Core of ESET Mail Security is the ESETS daemon (esets_daemon). The daemon uses ESETS
API library libesets.so and ESETS loading modules em00X_xx.dat to provide base system tasks
such as scanning, maintenance of the agent daemon processes, maintenance of the samples
submission system, logging, notication, etc. Please refer to the esets_daemon (8) man page
for details.
AGENTS
The purpose of ESETS agent modules is to integrate ESETS with the Linux/BSD/Solaris Server
environment.
UTILITIES
The utility modules provide simple and eective management of the system. They are
responsible for relevant system tasks such as license management, quarantine management,
system setup and update.
CONFIGURATION
Proper conguration is the most important aspect of a smooth-running security system–
the remainder of this chapter is dedicated to explaining all related components. A thorough
understanding of the esets.cfg le (page 6) is also highly recommended, as this le contains
information essential to the conguration of ESET Mail Security.
After the product is successfully installed, all its conguration components are stored in the
ESETS conguration directory. The directory consists of the following les:
Figure 4-1. Structure of ESET Mail Security.
esets_mda
esets_imap
esets_cli
AGENTS
esets_pipe
esets_pop3
esets_smfi
esets_smtp
esets_lic
UTILITIES
esets_quar
esets_setup
esets_update
scanning
engine
CORE
system
service
esets.cfg
license
scripts
WWW INTERFACE
CONFIGURATION

13
@ETCDIR@/esets.cfg
This is the most important conguration le, as it controls all major aspects of the product‘s
functionality. The esets.cfg le is made up of several sections, each of which contains various
parameters.The le contains one global and several„agent“ sections, with all section names
enclosed in square brackets. Parameters in the global section are used to dene conguration
options for the ESETS daemon as well as default values for the ESETS scanning engine
conguration. Parameters in agent sections are used to dene conguration options of modules
used to intercept various data ow types in the computer and/or its neighborhood, and prepare
it for scanning. Note that in addition to the various parameters used for system conguration,
there are also rules governing the organization of the le. For detailed information on the most
eective way to organize this le, please refer to the esets.cfg(5) and esets_daemon(8) man
pages, as well as relevant agents‘ man pages.
@ETCDIR@/certs
This directory is used to store the certicates used by the ESETS Web Interface for
authentication. Please see the esets_wwwi man page (8) for details.
@ETCDIR@/license
This directory is used to store the product(s) license key(s) you have acquired from your
vendor. Note that the ESETS daemon will check only this directory for a valid license key, unless
the ‘license_dir‘ parameter in the ESETS conguration le is redened.
@ETCDIR@/scripts/license_warning_script
If enabled by the ESETS conguration le parameter‘license_warn_enabled’, this script will be
executed 30 days (once per day) before product license expiration, sending an email notication
about the expiration status to the system administrator.
@ETCDIR@/scripts/daemon_notication_script
If enabled by the ESETS conguration le parameter‘exec_script‘, this script is executed in the
event of a detected inltration by the antivirus system. It is used to send email notication about
the event to the system administrator.
@ETCDIR@/anti-spam
This directory contains the conguration le used to ne tune the anti-spam engine
operation.
chapter 4 Product’s Roadmap

Chapter 5:
Integration with Email
Messaging System

16 ESET Mail Security
This chapter describes the integration of ESET Mail Security with a variety of known email
messaging systems. It is extremely important to understand the basic principles of an email
messaging system (see gure 5-1) and how ESET Mail Security integrates with it.
Figure 5-1. Scheme of UNIX OS email messaging system.
MTA - Mail Transport Agent
A program (e.g., sendmail, postx, qmail, exim, etc.) that enables the transfer of email
messages between local and remote domains.
MDA - Mail Delivery Agent
A program (e.g., maildrop, procmail, deliver, local.mail, etc.) that enables the delivery of locally
addressed email messages into particular mailboxes.
MUA - Mail User Agent
A program (e.g., Microsoft Outlook, Mozilla Mail, Eudora, etc.) that provides access to and
management of email messages, such as reading, composing, printing, etc.
MAILBOX
A le or le structure on a disk serving as the storage space for email messages.
The email server receives data communication using SMTP (Simple Mail Transfer Protocol)
communication. The received message is transferred by MTA either to another remote email
messaging system or is delivered using local MDA into a particular MAILBOX. In most cases, each
local network user owns a MAILBOX located on the server. Note that it is the responsibility of the
user’s local MUA to provide the function of downloading and correctly interpreting the message
at the user’s computer. When retrieving data from MAILBOX, the MUA typically uses POP3 (Post
OceProtocol)orIMAP(InternetMessageAccessProtocol)tocommunicatewiththeMTA.The
SMTP protocol is used to send data to the Internet.
The ESETS operating principle is based on data communication interception and scanning at
the various phases of its transfer. The interception locations are marked in gure 5-1 by symbols
Client
User Agent User Agent
INTERNET
Client
Email Server
Local Network
Client
smtp smtp
pipe
file
pop3/imap
smtp
S1 S2
S3
S4
MAILBOX
MDA
MTA
User Agent

17
S1, S2, S3 and S4.
S1 - Bi-directional email message scanning, i.e. content ltering in MTA.
S2 - Scanning of inbound email messages, i.e. messages with a target address which is located
inside the local domain.
S3 - Scanning of outbound email messages, i.e. messages bound to a remote Internet
domain.
S4 - Scanning of email messages being downloaded from POP3/IMAP server.
The remainder of this chapter reviews methods for integrating ESETS with a variety of
supported messaging systems.
5.1. Bi-directional email message scanning in MTA
Bi-directional email message scanning mode allows the user to scan inbound email messages
as well as outbound, using the same implementation algorithm. The bi-directional content lter
method is MTA dependent. ESET Mail Security comes with ve content lters that are built for the
most common MTA programs, such as MTA Sendmail, Postx, Exim, QMail and ZMailer.
Check that your MTA is properly congured and running. Then, congure ESET Mail Security
for bi-directional email message scanning by running the following script:
/usr/sbin/esets_setup
Select MTA and content lter install options. The ESETS module being used is also displayed.
Note that the installer backs up all modied conguration les and can display every
command that it will execute after your approval. It can also be used for uninstalling. Detailed
steps for all possible scenarios are described in appendix A of this documentation.
5.2. Scanning of inbound email messages
Inbound email message scanning is performed during message transfer between MTA and
MDA. Incoming emails are intercepted by the esets_mda module, scanned by the ESETS daemon
and delivered to MAILBOX using the original MDA. As shown in gure 5-1, virus scanning can
be enabled by setting the proper conguration of MTA and the esets_mda module. ESET Mail
Security supports most common MTA programs, such as MTA Sendmail, Postx, Exim, QMail
and ZMailer. ESETS supports any MDA. In particular, the following MDAs were tested: procmail,
maildrop, deliver and local.mail.
Check that your MTA is properly congured using the original MDA and that the MTA is
running. Then congure ESET Mail Security for inbound email message scanning by running the
following script:
/usr/sbin/esets_setup
Select MDA and inbound install options. The ESETS module used is also displayed.
chapter 5 Integration with Email messaging system

18 ESET Mail Security
Note that the installer backs up all modied conguration les and can display every
command that it will execute after your approval. Also use it for uninstall. Detailed steps for all
possible scenarios are described in the appendix A of this documentation.
5.3. Scanning of outbound email messages
Outbound email message scanning is performed during transfer of email messages between
the local MUA and the MTA.
Congure ESET Mail Security for outbound email message scanning by running the following
script:
/usr/sbin/esets_setup
Select the SMTP install option. This will set the esets_smtp module to listen on a predened
port and redirect applicable IP packets. Check the newly added rewall rule to see if any changes
are necessary.
Note that the installer backs up all modied conguration les and can display every
command that it will execute after your approval. It can also be used for uninstalling. Detailed
steps for all possible scenarios are described in appendix A of this documentation.
5.4. Scanning of email messages downloaded from POP3/IMAP server
POP3/IMAP messages scanning is performed during message transfer between MAILBOX and
MUA. All emails requested by POP3/IMAP clients are intercepted by the esets_pop3 (resp. esets_
imap) agent module and scanned by the ESETS daemon for inltrations. ESET Mail Security
supports most common MUA programs, such as MS Outlook, Evolution, Mozilla Thunderbird and
others. Note that there is restriction in ESET Mail Security functionality when emails downloaded
by Mozilla Thunderbird using IMAP communication protocol. An email in this case is requested
and downloaded part by part and built directly by Mozilla Thunderbird. For this reason it is not
possible to write proper information about the inltrations found into the header and body of
the email and thus the functionality is deactivated for this MUA.
To congure ESET Mail Security for scanning of email messages downloaded from POP3 or
IMAP server, run this script:
/usr/sbin/esets_setup
Select the POP3 or IMAP install option. This will set the given ESETS module to listen on a
predened port and redirect applicable IP packets. Check the newly added rewall rule to see if
any changes are necessary.
Note that the installer backs up all modied conguration les and can display every
command that it will execute after your approval. It can also be used for uninstalling. Detailed
steps for all possible scenarios are described in appendix A of this documentation.

19
5.5. Alternative methods of content ltering
5.5.1. Scanning email messages in CommuniGate Pro using esets_cgp
CommuniGate Pro is the powerful and reliable Unied Communications server and esets_
cgp is used for content ltering (anti-virus and anti-spam ltering).
Esets_cgp only allows scanning of incoming email messages. Esets_cgp does not allow
modication of scanned email messages and denies ESETS access to clean or delete infected
email attachments. As a result, the ESETS footnote with log and status dependent header elds
will not be written into the email message. Also, esets_cgp does not provide mail sender/
recipient information. Thus, user specic congurations are unavailable and advanced mail
handling features (accept, defer, discard, reject) are limited.
5.5.1.1. Integrating the antivirus Plugin with CommuniGate Pro.
Please see the VirusScan section of the CommuniGate Pro manual.
Open the General page in the Settings section of the WebAdmin Interface and click the
Helpers link. In panel Content Filtering create new lter with followed values:
Figure 5-2. Setting of Content Filtering.
Next, open the Mail page in the Settings section of the WebAdmin Interface, click the Rules
link and add a new rule as follows:
Figure 5-3. Rule Settings.

20 ESET Mail Security
5.5.1.2. Testing the antivirus Plugin.
On Unix and MacOS X System:
Launch the esets_cgp application from its directory:
/usr/bin/esets_cgp
It will report the Plugin name.
Type the following command (replace lename with name of existing le):
1 FILE lename
the Plugin should indicate if a virus is found.
Quit esets_cgp by pressing CTRL + D.
5.5.2. Scanning email messages using AMaViS
AMaViS (A Mail Virus Scanner) is a tool that interfaces your MTA with several antivirus scanners.
It supports various MTAs and comes in three branches: amavis, amavisd and amavisd-new.
AMaViS cooperates with ESET Mail Security by using esets_cli. Before explaining the AMaViS
congurations, the impact of the ESET Mail Security functionality method is described.
AMaViS does not allow modication of scanned email messages and denies ESETS access to
clean or delete infected email attachments. As a result, the ESETS footnote with log and status
dependent header elds will not be written into the email message. Also, AMaViS does not
provide mail sender/recipient information. Thus, user specic congurations are unavailable and
advanced mail handling features (accept, defer, discard, reject) are limited for esets_cli. Lastly,
AMaViS only scans les, it cannot use the ESETS anti-spam engine.