F-SECURE INTERNET GATEKEEPER FOR LINUX 4.01 - Service manual

F-Secure Internet Gatekeeper
for Linux
―A Comprehensive Internet and Anti-Virus Solution ―
Version 4
Ｒｅｖ． 20100125
Administrator’s Guide

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
2
About this Guide
This guide describes the installation and uninstallation, usage, and settings for F-Secure Internet
Gatekeeper for Linux.
Please note that “F-Secure Internet Gatekeeper for Linux” is also referred to as “the product” and
“Internet Gatekeeper" in this guide.
Symbols
Symbol Description
Provides important information that you need to consider.
Provides additional information that you should consider.
Indicates that related information on the topic is available in a different chapter or another
document.
Fonts
Font Description
Arial bold (blue) Used to refer to menu names and commands, to buttons and other items in a
dialog box.
Arial italics (blue) Used to refer to chapters in the manual, and to book titles of other manuals.
Arial italics (black) Used for file and folder names, for figure and table captions, and for directory
names.
Courier New Used for messages on your computer screen.
Courier New bold Used for information that you must type.
SMALL CAPS (BLACK) Used for a key or key combination on your keyboard.
Arial underlined (blue) Used for user interface links.
Arial italics Used for windows and dialog names.

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
3
Contents
1. Introduction.............................................................................................. 6
2. Features .................................................................................................. 8
2.1 Overview .................................................................................................................................... 8
2.2 List of Features .......................................................................................................................... 8
3. System Requirements ........................................................................... 11
3.1 Hardware Requirements .......................................................................................................... 11
3.2 Software Requirements............................................................................................................ 12
4. Installing F-Secure Internet Gatekeeper for Linux................................. 13
4.1 Installing an rpm Package........................................................................................................ 13
4.2 Installing a deb Package .......................................................................................................... 14
4.3 Installing a tar.gz Package....................................................................................................... 15
4.4 Using the Installation Command .............................................................................................. 15
4.5 Uninstalling F-Secure Internet Gatekeeper for Linux............................................................... 16
4.6 Backup and Restore................................................................................................................. 16
5. Typical Configurations........................................................................... 17
5.1 Configuration Overview............................................................................................................ 17
5.1.1 HTTP Connection ...................................................................................................... 17
5.1.2 SMTP Connection...................................................................................................... 18
5.1.3 POP Connection ........................................................................................................ 19
5.1.4 FTP Connection......................................................................................................... 20
5.2 Network Configuration Examples............................................................................................. 21
5.3 Internet Gatekeeper Server Settings ....................................................................................... 22
5.3.1 Web Console ............................................................................................................. 22
5.3.1.1 Accessing the Web Console ...................................................................... 22
5.3.1.2 Web Console Layout .................................................................................. 23
5.3.2 Typical Settings.......................................................................................................... 24
5.4 Client Settings .......................................................................................................................... 25
6. Checking the Proxy Setup..................................................................... 26
6.1 Checking the HTTP Proxy........................................................................................................ 26
6.2 Checking the SMTP Proxy ....................................................................................................... 26
6.3 Checking the POP Proxy ......................................................................................................... 27
6.4 Checking the FTP Proxy .......................................................................................................... 27
7. Advanced Settings ................................................................................ 28

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
4
7.1 Web Console Settings.............................................................................................................. 28
7.1.1 Proxy Settings............................................................................................................ 28
7.1.1.1 HTTP Proxy ................................................................................................ 28
7.1.1.2 SMTP Proxy ............................................................................................... 35
7.1.1.3 POP Proxy.................................................................................................. 45
7.1.1.4 FTP Proxy................................................................................................... 52
7.1.1.5 Common Settings ....................................................................................... 56
7.1.2 Virus Definition Database .......................................................................................... 62
7.1.3 Logs ........................................................................................................................... 63
7.1.4 Top Menu................................................................................................................... 64
7.2 Access Control ......................................................................................................................... 65
7.3 Detection Notification Templates ............................................................................................. 67
7.4 Expert Options ......................................................................................................................... 69
8. Command-line Tools ............................................................................. 70
8.1 Auto-Start ................................................................................................................................. 70
8.2 Proxy Execution ....................................................................................................................... 71
8.3 Virus Definition Updates........................................................................................................... 72
8.4 Restarting All Services ............................................................................................................. 73
8.5 Creating Diagnostic Information............................................................................................... 74
9. Logs....................................................................................................... 75
9.1 Log Files................................................................................................................................... 75
9.1.1 Access Logs............................................................................................................... 75
9.1.2 Virus and Spam Detection Logs ................................................................................ 78
9.1.3 Error Logs .................................................................................................................. 79
9.1.4 Information Logs ........................................................................................................ 89
9.2 Splitting/Rotating Log Files ...................................................................................................... 94
9.3 Time Display Conversion Tool ................................................................................................. 95
9.4 Log Analysis Tools ................................................................................................................... 96
9.5 External Output of Logs ........................................................................................................... 97
10. Other Settings ..................................................................................... 98
10.1 Access Authentication............................................................................................................ 98
10.1.1 Host Authentication.................................................................................................. 98
10.1.2 Authentication using Virtual Networks ................................................................... 100
10.1.3 Proxy Authentication using Internet Gatekeeper................................................... 102
10.1.4 Authentication by Mail Servers .............................................................................. 104
10.1.5 Authentication using POP-before-SMTP ............................................................... 105
10.2 Transparent Proxy................................................................................................................ 107
10.2.1 Transparent Proxy Details ..................................................................................... 108
10.2.2 Transparent Proxy – Router Mode ........................................................................ 109
10.2.3 Transparent Proxy – Bridge Mode......................................................................... 113
10.3 Coexisting with mail servers................................................................................................. 117
10.3.1 Changing the Port Number of Internet Gatekeeper............................................... 117
10.3.2 Changing the Port Number of the Mail Server....................................................... 118

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
5
10.3.3 Changing the IP Address....................................................................................... 121
10.3.4 Changing IP Addresses with iptables .................................................................... 123
10.4 Scanning Viruses Before Saving Mail to the Mail Server .................................................... 125
10.5 Reverse Proxy Settings........................................................................................................ 128
10.5.1 Reverse Proxy – Typical Settings.......................................................................... 128
10.5.2 Coexisting with Web Servers................................................................................. 129
10.5.3 Implementing a HTTPS (SSL) Server ................................................................... 130
11. Product Specifications........................................................................132
11.1 Product Specifications.......................................................................................................... 132
11.2 HTTP Proxy Process............................................................................................................ 134
11.3 SMTP Proxy Process ........................................................................................................... 136
11.4 POP Proxy Process ............................................................................................................. 138
11.5 FTP Proxy Process .............................................................................................................. 140
11.6 HTTP Error Responses........................................................................................................ 144
11.7 HTTP Request and Response Headers .............................................................................. 146
11.8 SMTP Command Responses............................................................................................... 148
11.9 SMTP Commands – Operations .......................................................................................... 151
11.10 POP Commands – Operations .......................................................................................... 155
11.11 FTP Commands – Operations ........................................................................................... 157
11.12 Connection Error Messages............................................................................................... 160
11.13 Service Process List........................................................................................................... 162
11.14 Detection Names................................................................................................................ 164
11.15 Riskware............................................................................................................................. 166
12. Copyright Information .........................................................................168

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
6
1. Introduction
F-Secure Internet Gatekeeper for Linux is an Internet Gatekeeper solution designed to protect
corporate networks, Internet Service Provider networks, and home networks against malware.
Computer viruses are one of the most harmful threats to the security of data on computers. Viruses
have become even more widespread due to the trend in standardizing platforms and the continuous
spread of the Internet. In addition to corrupting or falsifying data, viruses can also cause damage by
using the Internet to leak confidential company data or personal information. Even if the leaked
information is not important in itself, viruses can use the computer to spread their infection more,
resulting in harm to others.
With F-Secure Internet Gatekeeper for Linux, you can scan for viruses centrally. You can monitor web
site connections, and the sending and receiving of e-mails from all computers in a LAN (Local Area
Network).
The product can scan communication that is based on HTTP, FTP, SMTP, and POP.
The ability to use the POP protocol means that you do not need to make any changes to the mail
server to check e-mail for viruses. You can simply pass all inbound and outbound e-mail through
F-Secure Internet Gatekeeper for Linux.
The product is very fast, being optimized for performance. This makes it suitable for large-scale
networks, and for networks that support high-speed broadband. It also means that performance is
adequate even when the product is run on less powerful computers.
The product also supports a transparent proxy, various authentication functions, and spam blocking.
The product is available also in Japanese.

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
7
Internet
Mail Server
PC PC PC PC
Mail Server
Web Serve
r
F-Secure Internet Gatekeeper

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
8
2. Features
2.1 Overview
F-Secure Internet Gatekeeper for Linux:
•Protects a range of different networks against viruses:
－Internal company networks
－ISP networks
－Home networks
•Uses a single computer to monitor the network access by all computers on the company, ISP, or
home network.
•Does not use any resources from other computers on the network.
•Is easy to install and administer on an existing network.
•Can be used both on large and small networks. Adequate performance can be obtained also on
less powerful computers.
2.2 List of Features
Monitor Web Browsing and E-mail Traffic
•HTTP
•FTP
•SMTP
•POP
High-Speed Virus Scanning Proxy
•Best performance when compared to any Internet Gatekeeper product (based on research by
F-Secure)
* Pentium III 1GHz Dual, MEM: 1GB, NETWORK: Performance measured on a 1000BaseTX
network
－HTTP : 120Mbps, 640 sessions/sec (Average 23 KB/session)
－SMTP: 110Mbps, 130 sessions/sec (Average 80 KB/session)
－1000 or more simultaneous connections
→Adequate performance can be obtained on less powerful computers
→Operation on a single computer is practical even on large networks

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
9
Simple Installation
•Runs in almost all Linux environments
•Combines all functions in a single computer
•Can be installed as an rpm or deb package. The rpm package complies with Linux Standard Base,
which is used in Red Hat Linux and some other distributions.
•Can be installed as a .tar.gz package (for any Linux distribution)
Simple Configuration
•No configuration changes are required on your mail server
•No changes are required to your network configuration
•Minimal configuration changes for individual users
•All settings can be configured in the web console
•The language of the web console can be changed while using it
Authentication Functions
•Supports POP-before-SMTP authentication
•Supports proxy authentication for various protocols
(HTTP proxy authentication, SMTP authentication, POP/FTP user restrictions)
→Proxy authentication operates via PAMs (Pluggable Authentication Modules) and can integrate
with other authentication methods such as UNIX accounts, LDAP, NIS, and Radius.
•Access restrictions can be set for all protocols based on the IP address, host name, or domain
name
•The SMTP receive domain can be restricted to prevent relaying through a third party
•Existing SMTP authentication function on a mail server can be used
•Existing APOP function on a mail server can be used
Virus Detection Notifications
•The notification text can be edited and customized freely
•UTF-8 characters (for example, Japanese) can be used in messages
•An e-mail can be sent to the administrator when a virus is detected
•The header and body of the notification e-mail are customizable
Flexible Configuration
•Can use a transparent proxy (HTTP, SMTP, POP, and FTP)
•Individual users can select POP servers independently
•Scans files that are sent by using the HTTP protocol for viruses. Supports POST and PUT
methods.
•Supports sending and receiving from dedicated FTP clients
•Supports multi-level connections using parent proxy settings
•Can monitor all connections to designated web servers by using parent proxy settings (reverse
proxy)
•Can connect to any mail server
•Can use any mail server running on the same computer
•SMTP reception and SMTP transmission can be configured independently

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
10
Anti-Virus
•Uses the award-winning and proven F-Secure engine
•Can handle practically all existing viruses
•Can handle viruses for Windows, DOS, Microsoft Office, VBS, Linux, and other environments
•Combined use of multiple engines (FS-Engine (Hydra) and Aquarius) allows for a quick response
to new types of virus
•Low level of misdetection and false alarms
•Supports various file archive formats (ZIP, ARJ, LZH, CAB, RAR, TAR, GZIP, BZIP2 up to six
levels of nesting)
•Virus definition files can be updated automatically
Spam Blocking
•Supports spam detection for both SMTP and POP
•Uses a prioritized black list and white list to scan designated headers and the e-mail body to detect
spam by using customized conditions
•Uses the Spam detection engine
•Can use a RBL (Realtime Black List) to detect spam from the sender’s e-mail address
•Can use a SURBL (SPAM URL Realtime Black List) to detect spam that contains spam domain
URLs in the e-mail body
•Adds a spam identification header (“X-Spam-Status: Yes”) to spam e-mail to allow easy sorting
•Adds predefined text (such as "[[SPAM]]") to the e-mail subject to allow easy sorting
Other Features
•Can specify whether to block or allow files based on conditions such as the file extension,
User-Agent, and file size
•Can block ActiveX and script (JavaScript or VBScript) content
•Can generate access statistics in a Squid compatible log
•Can output to external logs such as syslog
•Includes an HTTPS (encrypted HTTP) proxy function. However, because communication is
encrypted, HTTPS (SSL) is not scannded for viruses.
•A virus identification header (X-Virus-Status: infected) can be added to virus detection notification
e-mails to allow easy sorting

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
11
3. System Requirements
F-Secure Internet Gatekeeper for Linux has the following system requirements.
3.1 Hardware Requirements
Minimum Hardware Requirements
CPU Intel Pentium compatible CPU
MEMORY 512 MB RAM or more
DISK 5 GB or more free space (adequate space for temporary file storage)
NETWORK TCP/IP connection
Recommended Hardware
CPU Intel Pentium compatible CPU 2GHz or faster
MEMORY 1 GB or more
DISK 20 GB or more free space
NETWORK 100BaseT or better

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
12
3.2 Software Requirements
Required Components
•Linux kernel 2.4/2.6
•glibc 2.3.2 or later
•perl 5.8 or later
Supported Distributions
32-bit:
•Asianux Server 3
•Asianux 2.0 (MIRACLE LINUX 4.0)
•Asianux 1.0 (MIRACLE LINUX 3.0)
•CentOS 4/5
•Debian GNU/Linux 5.0
•Red Hat Enterprise Linux 3/4/5
•SuSE Linux Enterprise Server 9/10/11
•Turbolinux 10 Server/11 Server
•Ubuntu 8.04
64-bit(x86_64):
•Asianux Server 3
•Asianux 2.0 (MIRACLE LINUX 4.0)
•CentOS 5
•Debian GNU/Linux 5.0
•Red Hat Enterprise Linux 4/5
•SuSE Linux Enterprise Server 9/10/11
•Turbolinux 10 Server/11 Server
•Ubuntu 8.04
* On x86_64 platforms, the product requires 32-bit libraries to be installed, and it runs in 32-bit mode.

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
13
4. Installing F-Secure Internet
Gatekeeper for Linux
Use either the rpm package, deb package or tar.gz package to install F-Secure Internet Gatekeeper
for Linux.
￭ Use the rpm package for installation if possible.
￭ You can install updates by following the same steps. The existing configuration settings are not
changed.
4.1 Installing an rpm Package
This section explains how to install F-Secure Internet Gatekeeper for Linux on a server, which runs
one of the Red Hat family of Linux distributions.
In a Red Hat distribution, you can easily install the software by using the rpm package. The Red Hat
family of distributions include the following:
￭ Red Hat
￭ Turbolinux
￭ SUSE Linux
￭ MIRACLE LINUX / Asianux
* Please refer to the related installation guides for instructions on how to install each distribution.
You can install the package by double clicking the rpm package, or executing the following command
with root privileges:
# rpm -Uvh fsigk-XXX.i386.rpm
This installs the whole product and makes the web console available for use.
Next, see “Typical Configurations”, 15.

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
14
4.2 Installing a deb Package
This section explains how to install F-Secure Internet Gatekeeper for Linux on a server, which runs
one of the Debian or Ubuntu based Linux distributions.
In a Debian or Ubuntu distribution, you can easily install the software by using the deb package.
You can install the package by double clicking the deb package, or executing the following command
with root privileges:
# dpkg –i fsigk-xxx_all.deb
This installs the whole product and makes the web console available for use.
Next, see “Typical Configurations”, 15.

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
15
4.3 Installing a tar.gz Package
If you cannot use the rpm or deb package to install F-Secure Internet Gatekeeper for Linux, you can
install it by using a tar.gz package.
Execute the following command with root privileges:
# tar -zxvf fsigk-XXX.tar.gz
# cd fsigk-XXX/
# make install
This installs the whole product and makes the web console available for use. To specify the
installation options, see “Using the Installation Command”, 13.
Next, see “Typical Configurations”, 15.
4.4 Using the Installation Command
When you use the tar.gz package to install the software, you can specify installation options during
the installation. Run the installation command as described below. You can omit the options if needed.
make [options]... target
Although you can specify the installation options, we recommend that you use the "make
install" command for installation.
Target
install Install. We recommend that you specify this target.
In addition to installing the files, this also installs the startup script and PAM
setup files and starts the web console service.
Options
prefix=[dir] Specifies the installation directory. We recommend that you install the product
in the default installation directory (/opt/f-secure/fsigk).
suffix=[name] Specifies a suffix. Use this option if you install multiple copies of the software
on the same server.
Adds a suffix to the executable file and other command names (fsigk) to
distinguish between each copy. The suffix must be less than two characters.
adminport=[num] Specifies a port number other than the default port (9012) for the F-Secure
Internet Gatekeeper for Linux web console. Use this option when you install
multiple copies of the software on the same server.
lang=[ja|en] Specifies the language of the product. The available languages are "ja"
(Japanese) and "en" (English). If no language is specified, the language is
selected automatically. Automatic selection selects Japanese if the time zone
is JST or the LANG environment variable starts with "ja". Otherwise, English
is selected. This setting determines the default language for the web console
and the default templates for virus detection messages.

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
16
Command examples
To install the whole product, use this command:
# make install
To install multiple copies of the software, use this command:
# make prefix=/opt/f-secure/fsigk2 suffix=2 adminport=10012 install
4.5 Uninstalling F-Secure Internet Gatekeeper for Linux
Follow the steps below to uninstall the software. This removes the files installed on the system,
deletes the configuration settings, and shuts down the service.
Execute the following command with root privileges:
#cd /opt/f-secure/fsigk
#make uninstall
#rm -rf /opt/f-secure/fsigk
If you use the rpm package, execute the following command:
#rpm -e fsigk
If you use the deb package, execute the following command:
#dpkg –r fsigk
4.6 Backup and Restore
Follow these steps to back up and restore F-Secure Internet Gatekeeper for Linux.
To back up the product, save the contents of the following directories as needed:
/opt/f-secure/fsigk : Entire system state
/opt/f-secure/fsigk/conf : Configuration files
/opt/f-secure/fsigk/log : Log files
(Note that the settings for definition file updates are saved separately by using crontab.)
To restore the software to its previous state, restore the files and then (forcibly) reinstall the package.
For rpm package:
# rpm -Uvh --force fsigk-xxx-0.i386.rpm
For deb package:
# dpkg –r fsigk
# dpkg –i fsigk-xxx_all.deb

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
17
5. Typical Configurations
Once the installation has completed, locate the appropriate Internet Gatekeeper server and modify the
settings as required. The next step is to configure client computers.
5.1 Configuration Overview
The following section describes how HTTP, SMTP, POP, and FTP connections operate in these
cases:
•virus scanning is not used
•Internet Gatekeeper performs virus scanning
5.1.1 HTTP Connection
•Without virus scanning
The web browser connects to the web server directly and fetches the page.
•With virus scanning
When virus scanning is used, Internet Gatekeeper stands between the web server and client and
operates as a proxy server for the web browser. The web browser connects to the web server
through Internet Gatekeeper. The web browser retrieves pages after they have been scanned for
viruses. Internet Gatekeeper connects to the appropriate web server based on the URL that has
been requested from the web browser.
HTTP Connection example
WEB server (www2)WEB server (www1)
Client
URL:http://www1/ URL:http://www2/
Proxy setting: http://fsigk:9080/
Anti-Virus Gateway
(virusgw)
WEB server (www2)
WEB server (www1)
Client
URL:http://www1/ URL: http://www2/
Without virus scanning With virus scanning

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
18
5.1.2 SMTP Connection
•Without virus scanning
The e-mail client sends e-mail to mail servers on the Internet through an SMTP server for
outbound e-mail.
•With virus scanning
When virus scanning is used, Internet Gatekeeper stands between the client and mail server and
operates as the SMTP server for the e-mail client. The client connects to the SMTP server through
Internet Gatekeeper. The client sends outbound e-mail to mail servers on the Internet. Internet
Gatekeeper forwards the mail through the outbound mail server.
SMTP Connection example
Mail server (mail3)Mail server (mail2)
Client
To: foo@mail2 To: foo@mail3
SMTP server settings: fsigk
Internet Gatekeepe
r
(fsigk)
Parent server: mail1
Mail server (mail3)
Mail server (mail2)
To: foo@mail2 To: foo@mail3
Without virus scanning With virus scanning
SMTP server settings: mail1
Mail server (mail1) Mail server (mail1)
Client

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
19
5.1.3 POP Connection
•Without virus scanning
To retrieve e-mail, the e-mail client connects to the mail server directly by using the POP protocol.
•With virus scanning
When virus scanning is used, Internet Gatekeeper stands between the client and mail server and
operates as the POP server for the e-mail client. The client connects to the mail server through
Internet Gatekeeper. The client retrieves e-mail that has been scanned for viruses. Although
Internet Gatekeeper usually connects to the designated parent server, you can specify that the
connection is created to any POP server. To do this, specify the POP user name in the format
"<POP server user name>@<POP server name>".
POP Connection example
Mail server (mail3)Mail server (mail2)
POP user: user2
POP server: fsigk
POP user: user3@mail3
POP server: fsigk
Internet Gatekeepe
r
(fsigk)
Parent server: mail2
Mail server (mail3)Mail server (mail2)
POP user: user2
POP server: mail2
POP user: user3
POP server: mail3
Without virus scanning With virus scanning
Client Client

F-Secure Internet Gatekeeper for Linux/Administrator’s Guide
20
5.1.4 FTP Connection
•Without virus scanning
To send and receive files, the FTP client connects to an FTP server directly by using the FTP
protocol.
•With virus scanning
When virus scanning is used, Internet Gatekeeper stands between the client and server and
operates as a proxy server for the FTP client. The client connects to the FTP server through
Internet Gatekeeper. The client sends and receives files that have been scanned for viruses. If the
FTP client does not support a proxy server, Internet Gatekeeper usually connects to the
designated parent server. However, you can specify that the connection is created to any FTP
server. To do this, specify the FTP user name in the format "<FTP server user name>@<FTP
server name>".
FTP Connection example
FTP server (ftp2)FTP server (ftp1)
FTP user: user1
FTP server: fsigk FTP user: user2@ftp2
FTP server: fsigk
Internet Gatekeepe
r
(fsigk)
Parent server: ftp1
FTP server (ftp2)
FTP server(ftp1)
FTP user: user1
FTP server: ftp1 FTP user: user2
FTP server: ftp2
Without virus scanning With virus scanning
Client Client