F-SECURE ANTI-VIRUS LINUX CLIENT SECURITY - Service manual

F-Secure Anti-Virus
Linux Server Security
Administrator’s Guide

"F-Secure" and the triangle symbol are registered trademarks of F-Secure Corporation and F-Secure
product names and symbols/logos are either trademarks or registered trademarks of F-Secure
Corporation. All product names referenced herein are trademarks or registered trademarks of their
respective companies. F-Secure Corporation disclaims proprietary interest in the marks and names of
others. Although F-Secure Corporation makes every effort to ensure that this information is accurate,
F-Secure Corporation will not be liable for any errors or omission of facts contained herein. F-Secure
Corporation reserves the right to modify specifications cited in this document without prior notice.
Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of
this document may be reproduced or transmitted in any form or by any means, electronic or
mechanical, for any purpose, without the express written permission of F-Secure Corporation.
This product may be covered by one or more F-Secure patents, including the following:
Copyright © 2007 F-Secure Corporation. All rights reserved. 12000074-07B27
GB2353372 GB2366691 GB2366692 GB2366693 GB2367933 GB2368233
GB2374260

1
Contents
Chapter 1 Introduction 5
1.1 Welcome......................................................................................................................6
1.2 How the Product Works ...............................................................................................6
1.3 Key Features and Benefits...........................................................................................9
1.4 F-Secure Anti-Virus Server and Gateway Products...................................................11
Chapter 2 Deployment 13
2.1 Deployment on Multiple Stand-alone Linux Workstations..........................................14
2.2 Deployment on Multiple Centrally Managed Linux Workstations...............................14
2.3 Central Deployment Using Image Files......................................................................15
Chapter 3 Installation 16
3.1 System Requirements................................................................................................17
3.2 Installation Instructions...............................................................................................18
3.2.1 Stand-alone Installation..................................................................................19
3.2.2 Centrally Managed Installation.......................................................................21
3.3 Upgrading from a Previous Product Version..............................................................24
3.4 Upgrading the Evaluation Version..............................................................................25
3.5 Replicating Software Using Image Files ....................................................................26
3.6 Preparing for Custom Installation...............................................................................26
3.7 Unattended Installation ..............................................................................................27
3.8 Installing Command Line Scanner Only.....................................................................28
3.9 Creating a Backup......................................................................................................29

3.10 Uninstallation..............................................................................................................30
Chapter 4 Getting Started 31
4.1 Accessing the Web User Interface.............................................................................32
4.2 Basics of Using F-Secure Policy Manager.................................................................32
4.3 Testing the Antivirus Protection .................................................................................33
Chapter 5 User Interface - Basic Mode 34
5.1 Summary ...................................................................................................................35
5.2 Common Tasks..........................................................................................................36
Chapter 6 User Interface - Advanced Mode 37
6.1 Alerts..........................................................................................................................38
6.2 Virus Protection..........................................................................................................40
6.2.1 Real-Time Scanning.......................................................................................40
6.2.2 Scheduled Scanning.......................................................................................45
6.2.3 Manual Scanning............................................................................................46
6.3 Firewall Protection......................................................................................................51
6.3.1 General Settings.............................................................................................53
6.3.2 Firewall Rules.................................................................................................54
6.3.3 Network Services............................................................................................56
6.4 Integrity Checking ......................................................................................................59
6.4.1 Known Files....................................................................................................59
6.4.2 Verify Baseline................................................................................................63
6.4.3 Generate Baseline..........................................................................................63
6.4.4 Rootkit Prevention..........................................................................................65
6.5 General Settings ........................................................................................................66
6.5.1 Communications.............................................................................................66
6.5.2 Automatic Updates.........................................................................................68
6.5.3 About..............................................................................................................71
Chapter 7 Command Line Tools 72
7.1 Overview....................................................................................................................73
7.2 Virus Protection..........................................................................................................73
7.2.1 fsav.................................................................................................................73

3
7.2.2 dbupdate.........................................................................................................74
7.3 Firewall Protection......................................................................................................74
7.3.1 fsfwc ...............................................................................................................75
7.4 Integrity Checking ......................................................................................................75
7.4.1 fsic..................................................................................................................75
7.4.2 fsims...............................................................................................................76
7.5 General Command Line Tools...................................................................................76
7.5.1 fssetlanguage.................................................................................................76
7.5.2 fsma................................................................................................................77
7.5.3 fsav-config......................................................................................................78
AppendixA Installation Prerequisites 79
A.1 All 64-bit Distributions ............................................................................................... 80
A.2 Red Hat Enterprise Linux 4........................................................................................80
A.3 Debian 3.1 and Ubuntu 5.04, 5.10, 6.06 ....................................................................81
A.4 SuSE..........................................................................................................................82
A.5 Turbolinux 10 .............................................................................................................82
AppendixB Installing Required Kernel Modules Manually 83
B.1 Introduction ............................................................................................................... 84
B.2 Before Installing Required Kernel Modules................................................................84
B.3 Installation Instructions...............................................................................................84
AppendixC Riskware Types 86
C.1 Riskware Categories and Platforms.......................................................................... 87
AppendixD List of Used System Resources 90
D.1 Overview................................................................................................................... 91
D.2 Installed Files.............................................................................................................91
D.3 Network Resources....................................................................................................91
D.4 Memory......................................................................................................................92
D.5 CPU............................................................................................................................92

AppendixE Troubleshooting 93
E.1 User Interface............................................................................................................ 94
E.2 F-Secure Policy Manager...........................................................................................95
E.3 Integrity Checking ......................................................................................................95
E.4 Firewall.......................................................................................................................97
E.5 Virus Protection..........................................................................................................99
E.6 Generic Issues...........................................................................................................99
AppendixF Man Pages 102
AppendixG Config Files 171
G.1 fsaua_config............................................................................................................ 172
G.2 fssp.conf...................................................................................................................177
Technical Support 201
Introduction ...................................................................................................................... 202
F-Secure Online Support Resources ...............................................................................202
Web Club .........................................................................................................................203
Virus Descriptions on the Web .........................................................................................203

5
1INTRODUCTION
Welcome....................................................................................... 6
How the Product Works................................................................ 6
Key Features and Benefits........................................................... 9
F-Secure Anti-Virus Server and Gateway Products................... 11

6
1.1 Welcome
Welcome to F-Secure Anti-Virus Linux Server Security.
Computer viruses are one of the most harmful threats to the security of
data on computers. Viruses have increased in number from just a handful
a few years ago to many thousands today. While some viruses are
harmless pranks, other viruses can destroy data and pose a real threat.
The product provides an integrated, out-of-the-box ready security solution
with a strong real-time antivirus and riskware protection and a host
intrusion prevention (HIPS) functionality that provides protection against
unauthorized connection attempts from network, unauthorized system
modifications, userspace and kernel rootkits. The solution can be easily
deployed and managed either using the local graphical user interface or
F-Secure Policy Manager.
F-Secure Policy Manager provides a tightly integrated infrastructure for
defining and distributing security policies and monitoring the security of
different applications from one central location.
1.2 How the Product Works
The product detects and prevents intrusions and protects against
malware. With the default settings, workstations and servers are
protected right after the installation without any time spent configuring the
product.
Protection Against Malware
The product protects the system against viruses and potentially malicious
files.
When user downloads a file from the Internet, for example by clicking a
link in an e-mail message, the file is scanned when the user tries to open
it. If the file is infected, the product protects the system against the
malware.

CHAPTER1 7
Introduction
Real-time Scanning
Real-time scanning gives you continuous protection against viruses and
riskware items as files are opened, copied, and downloaded from the
Web. Real-time scanning functions transparently in the background,
looking for viruses whenever you access files on the hard disk, diskettes,
or network drives. If you try to access an infected file, the real-time
protection automatically stops the virus from executing.
Manual Scanning And Scheduled Scanning
When the real-time scanning has been configured to scan a limited set of
files, the manual scanning can be used to scan the full system or you can
use the scheduled scanning to scan the full system at regular intervals.
Automatic Updates
Automatic Updates keep the virus definitions always up-to-date. The virus
definition databases are updated automatically after the product has been
installed. The virus definitions updates are signed by the F-Secure
Anti-Virus Research Team.
Host Intrusion Prevention System
The Host Intrusion Prevention System (HIPS) detects any malicious
activity on the host, protecting the system on many levels.
Integrity Checking
Integrity Checking protects the system against unauthorized
modifications. It is based on the concept of a known good configuration -
the product should be installed before the server or workstation is
connected to the network to guarantee that the system is in a known good
configuration.
You can create a baseline of the system files you want to protect and
block modification attempts of protected files for all users.

8
Firewall
The firewall component is a stateful packet filtering firewall which is based
on Netfilter and Iptables. It protects computers against unauthorized
connection attempts. You can use predefined security profiles which are
tailored for common use cases to select the traffic you want to allow and
deny.
Protection Against Unauthorized System Modifications
If an attacker gains a shell access to the system and tries to add a user
account to login to the system later, Host Intrusion Prevention System
(HIPS) detects modified system files and alerts the administrator.
Protection Against Userspace Rootkits
If an attacker has gained an access to the system and tries to install a
userspace rootkit by replacing various system utilities, HIPS detects
modified system files and alerts the administrator.
Protection Against Kernel Rootkits
If an attacker has gained an access to the system and tries to install a
kernel rootkit by loading a kernel module for example through /sbin/
insmod or /sbin/modprobe, HIPS detects the attempt, prevents the
unknown kernel module from loading and alerts the administrator.
If an attacker has gained an access to the system and tries to install a
kernel rootkit by modifying the running kernel directly via /dev/kmem,
HIPS detects the attempt, prevents write attempts and alerts the
administrator.

CHAPTER1 9
Introduction
1.3 Key Features and Benefits
Superior Protection
against Viruses and
Worms
›The product scans files on any Linux-supported file system. This
is the optimum solution for computers that run several different
operating systems with a multi-boot utility.
›Superior detection rate with multiple scanning engines.
›A heuristic scanning engine can detect suspicious, potentially
malicious files.
›The product can detect and categorize riskware items.
›The product can be configured so that the users cannot bypass
the protection.
›Files are scanned for viruses when they are opened and before
they are executed.
›You can specify what files to scan, how to scan them, what action
to take when malicious content is found and how to alert about
the infections.
›Recursive scanning of archive files.
›Virus definition database updates are signed for security.
›Integrated firewall component with predefined security levels.
Each security level comprises a set of rules that allow or deny
network traffic based on the protocols used.
Transparent to
End-users ›The product has an easy-to-use user interface.
›The product works totally transparently to the end users.
›Virus definition databases are updated automatically without any
need for end-user intervention.

10
Protection of Critical
System Files ›Critical information of system files is stored and automatically
checked before access is allowed.
›The administrator can protect files against changes so that it is
not possible to install, for example, a trojan version.
›The administrator can define that all Linux kernel modules are
verified before the modules are allowed to be loaded.
›An alert is sent to the administrator when a modified system file is
found.
Easy to Deploy and
Administer ›The default settings apply in most systems and the product can
be taken into use without any additional configuration.
›Security policies can be configured and distributed from one
central location.
Extensive Alerting
Options ›The product has extensive monitoring and alerting functions that
can be used to notify any administrator in the company network
about any infected content that has been found.
›Alerts can be forwarded to F-Secure Policy Manager Console,
e-mail and syslog.

CHAPTER1 11
Introduction
1.4 F-Secure Anti-Virus Server and Gateway
Products
The F-Secure Anti-Virus product line consists of workstation, file server,
mail server and gateway products.
›F-Secure Messaging Security Gateway delivers the industry's
most complete and effective security for e-mail. It combines a
robust, enterprise-class messaging platform with perimeter
security, antispam, antivirus, secure messaging and outbound
content security capabilities in an easy-to-deploy, hardened
appliance.
›F-Secure Internet Gatekeeper for Linux is a high performance,
totally automated web (HTTP and FTP) and e-mail (SMTP and
POP) virus scanning solution for the gateway level. F-Secure
Internet Gatekeeper works independently of firewall and e-mail
server solutions, and does not affect their performance.
›F-Secure Internet Gatekeeper (for Windows) is a high
performance, totally automated web (HTTP and FTP-over-HTTP)
and e-mail (SMTP) virus scanning solution for the gateway level.
F-Secure Internet Gatekeeper works independently of firewall
and e-mail server solutions, and does not affect their
performance.
›F-Secure Anti-Virus for Microsoft Exchange protects your
Microsoft Exchange users from malicious code contained within
files they receive in mail messages and documents they open
from shared databases. Malicious code is also stopped in
outbound messages and in notes being posted on Public Folders.
The product operates transparently and scans files in the
Exchange Server Information Store in real-time. Manual and
scheduled scanning of user mailboxes and Public Folders is also
supported.

12
›F-Secure Anti-Virus for MIMEsweeper provides a powerful
anti-virus scanning solution that tightly integrates with Clearswift
MAILsweeper and WEBsweeper products. F-Secure provides
top-class anti-virus software with fast and simple integration to
Clearswift MIMEsweeper for SMTP and MIMEsweeper for Web,
giving the corporation the powerful combination of complete
content security.
›F-Secure Anti-Virus for Citrix Servers ensures business
continuity without disruptions caused by viruses and other
malicious content. Citrix solutions enable businesses to improve
their productivity by providing easy access to information and
applications regardless of time, place and access device.

13
2DEPLOYMENT
Deployment on Multiple Stand-alone Linux Workstations.......... 14
Deployment on Multiple Centrally Managed Linux Workstations 14
Central Deployment Using Image Files...................................... 15

14
2.1 Deployment on Multiple Stand-alone Linux
Workstations
When the company has multiple Linux workstations deployed, but they
are not managed centrally, the workstation users can install the software
themselves.
›In organizations with few Linux machines, the graphical user
interface can be used to manage Linux workstations instead of
F-Secure Policy Manager. For more information on stand-alone
installation without F-Secure Policy Manager, see “Stand-alone
Installation”, 19.
›Centrally Managed installation with F-Secure Policy Manager
installed on a separate computer is recommended. In this mode,
F-Secure Policy Manager is used to manage Linux workstations.
For more information on Centrally Managed installation, see
“Centrally Managed Installation”, 21.
The recommended deployment method is to delegate the
installation responsibility to each workstation user and then
monitor the installation progress via F-Secure Policy Manager
Console. After the installation on a host has completed, the host
sends an autoregistration request to F-Secure Policy Manager.
You can monitor with F-Secure Policy Manager Console which of
the hosts have sent an autoregistration request.
2.2 Deployment on Multiple Centrally Managed Linux
Workstations
When the company has multiple Linux workstations deployed and they
are managed through Red Hat network, Ximian Red Carpet, or similar,
the software can be pushed to workstations using the existing
management framework.

CHAPTER2 15
Deployment
2.3 Central Deployment Using Image Files
When the company has a centralized IT department that install and
maintains computers, the software can be installed centrally to all
workstations.
The recommended way to deploy the products is to create an image of a
Linux workstation with the product preinstalled. For instructions on how to
do this, see “Replicating Software Using Image Files”, 26.

16
3INSTALLATION
System Requirements................................................................ 17
Installation Instructions............................................................... 18
Upgrading from a Previous Product Version.............................. 24
Upgrading the Evaluation Version.............................................. 25
Replicating Software Using Image Files..................................... 26
Preparing for Custom Installation............................................... 26
Creating a Backup...................................................................... 29
Uninstallation.............................................................................. 30

CHAPTER3 17
Installation
3.1 System Requirements
Operating system: ›Novell Linux Desktop 9
›SUSE Linux 9.0, 9.1, 9.2, 9.3, 10, 10.1,
10.2
›Ubuntu 5.10 (Breezy), 6.06 (Dapper
Drake)
›SUSE Linux Enterprise Server 8, 9, 10
›SUSE Linux Enterprise Desktop 10
›Red Hat Enterprise Linux 4, 3, 2.1 AS
›Miracle Linux 2.1
›Miracle Linux 3.0
›Asianux 2.0
›Turbolinux 10
›Debian 3.1
The following 64-bit (AMD64/EM64T)
distributions are supported with 32-bit
compatibility packages:
›SUSE Linux Enterprise Server 9, 10
›SUSE Linux Enterprise Desktop 10
›Red Hat Enterprise Linux 4
›Asianux 2.0
›Turbolinux 10
Kernel version: Linux kernel 2.4 or later (for 64-bit support, Linux
kernel 2.6 or later)
Glibc version Glibc 2.2.4 or later
Processor: Intel x86
Memory: 256 MB RAM or more
Disk space: 200 MB

18
Note About Dazuko Version
The product needs the Dazuko kernel module for the real-time virus
protection, integrity checking and rootkit protection. Dazuko is an
open-source kernel module that provides an interface for the file access
control. More information is at http://www.dazuko.org.
The product installs the Dazuko driver during the product installation.
The product has been tested extensively with the Dazuko version that is
included with the product. Operation with other Dazuko versions or Linux
distribution provided Dazuko versions is not supported or recommended.
3.2 Installation Instructions
The following installation modes are available:
›Stand-alone installation.
This installation mode is meant for evaluation use and for
environments with few Linux workstations or servers where
central administration with F-Secure Policy Manager is not
necessary.
When you install the product in stand-alone mode you configure
and manage the product with the web user interface that can be
opened from the system tray, or with the http://localhost:28080/
(local) or https://<host.domain>:28082/ (remote) address.
In addition to the user interface, the stand-alone installation
creates the F-Icon and a program entry under the applications
menu, and enables you to use the “right-mouse click” function.
For installation instructions, see “Stand-alone Installation”, 19.
›Centrally Managed installation.
The product is installed locally, and it is managed with F-Secure
Policy Manager that is installed on a separate computer.
Konqueror is not a supported browser with the local user interface.
It is recommended to use Mozilla or Firefox browsers.