KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Use and care manual

KASPERSKY LAB
Kaspersky Anti-Virus®5.0
for Samba Servers
ADMINISTRATOR'S MANUAL

KASPERSKY ANTI-VIRUS®5.0 FOR SAMBA SERVERS
Administrator's manual
©Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: October 2004

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUS®FOR SAMBA SERVERS.......................... 6
1.1. Hardware and software system requirements ..................................................... 7
1.2. Distribution kit ........................................................................................................ 8
1.3. Help desk for registered users .............................................................................. 9
1.4. Adopted conventions............................................................................................. 9
CHAPTER 2. INTERNAL ARCHITECTURE OF KASPERSKY ANTI-VIRUS®
FOR SAMBA SERVERS ........................................................................................... 11
2.1. Component structure........................................................................................... 11
2.2. Algorithm of operation ......................................................................................... 11
CHAPTER 3. INSTALLATION OF KASPERSKY ANTI-VIRUS®FOR SAMBA
SERVERS................................................................................................................... 13
3.1. Software installation to a server running under Linux ........................................ 13
3.2. Software installation to a server running under FreeBSD or OpenBSD ........... 14
3.3. Installation process.............................................................................................. 14
3.4. Configuring the application.................................................................................. 15
3.5. Distribution of files within directories ................................................................... 16
3.6. Uninstalling Kaspersky Anti-Virus®for Samba Servers ..................................... 17
CHAPTER 4. POST-INSTALL SETUP......................................................................... 19
4.1. Default product settings....................................................................................... 19
4.2. Installing/updating anti-virus databases.............................................................. 20
4.3. Setting the product up for work with Webmin..................................................... 20
4.4. Recommended operation modes ....................................................................... 21
4.4.1. Optimal operation mode ............................................................................... 21
4.4.2. Top performance mode................................................................................ 22
4.4.3. Top reliability mode....................................................................................... 23
4.4.4. Scanning mode for frequently modified files................................................ 24
CHAPTER 5. USING KASPERSKY ANTI-VIRUS®FOR SAMBA SERVERS........... 26
5.1. Anti-Virus Database Updating............................................................................. 26

4 Kaspersky Anti-Virus®for Samba Servers
5.1.1. Scheduling updates of anti-virus databases using cron.............................. 27
5.1.2. One-time update of the anti-virus databases............................................... 28
5.1.3. Creation of a network directory for storage and downloading of anti-
virus databases ............................................................................................. 29
5.2. Real-time anti-virus protection of Samba servers .............................................. 29
5.2.1. Setup of user's notifications.......................................................................... 30
5.2.1.1. Monitoring with notifications through smbclient .................................... 30
5.2.1.2. Monitoring with e-mail notifications........................................................ 31
5.3. Anti-Virus protection of file systems.................................................................... 31
5.3.1. On-demand scanning of files ....................................................................... 32
5.3.2. Daily scheduled scanning of a directory (cron)............................................ 33
5.3.3. Additional opportunities: using scripts.......................................................... 33
5.3.3.1. Disinfection of archived objects ............................................................. 33
5.3.3.2. E-Mail notification of administrator ........................................................ 34
CHAPTER 6. ADDITIONAL SETUP ............................................................................. 36
6.1. Tuning real-time anti-virus protection.................................................................. 36
6.1.1. Scope of monitoring...................................................................................... 36
6.1.2. File scanning and disinfection mode............................................................ 37
6.1.3. File operations .............................................................................................. 38
6.1.4. Quarantine for infected objects .................................................................... 38
6.1.5. Objects backup settings ............................................................................... 39
6.2. Setup of anti-virus protection for server file systems.......................................... 39
6.2.1. Scanning area............................................................................................... 40
6.2.2. File scanning and cure mode ....................................................................... 41
6.2.3. File operations .............................................................................................. 41
6.2.4. Backup mode settings .................................................................................. 42
6.3. Optimizing Kaspersky Anti-Virus®for Samba Servers....................................... 43
6.4. Restarting Kaspersky Anti-Virus®for Samba Servers ....................................... 44
6.5. Localization of displayed date and time format .................................................. 46
6.6. Reporting parameters in Kaspersky Anti-Virus®................................................ 47
6.6.1. Format of scanning messages..................................................................... 48
6.6.2. Format of console messages ....................................................................... 50
CHAPTER 7. USING LICENSES.................................................................................. 52
7.1. License keys management ................................................................................. 52

Contents 5
7.1.1. Viewing license key information ................................................................... 52
7.1.2. License extension ......................................................................................... 54
7.1.3. License key removal..................................................................................... 55
CHAPTER 8. CHECKING CORRECT OPERATION OF THE ANTI-VIRUS ............. 56
CHAPTER 9. LIKELY QUESTIONS PERTAINING TO PRODUCT USE................... 58
APPENDIX A. MALWARE IN UNIX ENVIRONMENT ................................................. 63
A.1. Viruses................................................................................................................. 63
A.2. Trojan software.................................................................................................... 64
A.3. Network worms ................................................................................................... 65
APPENDIX B. KASPERSKY LAB................................................................................. 68
B.1. Other Kaspersky Lab Products .......................................................................... 69
B.2. Our contact information....................................................................................... 73
APPENDIX C. LICENSE AGREEMENT ...................................................................... 74

CHAPTER 1. KASPERSKY ANTI-
VIRUS®FOR SAMBA
SERVERS
Kaspersky Anti-Virus®for Samba Servers software application (hereinafter
also called Kaspersky Anti-Virus®) is designed to perform anti-virus scanning of
objects for Samba servers running Linux, FreeBSD or OpenBSD operating
systems.
The application accomplishes two-level scanning of server file systems both in
real-time and in the on-demand scanning mode. If malicious code is detected
Kaspersky Anti-Virus®can cure or block the infected objects efficiently in order to
prevent further spreading of epidemics providing timely notifications to system
administrators about such accidents.
The application also employs iChecker™ – an intellectual technology,
which allows considerable increase of file scanning speed.
Kaspersky Anti-Virus®for Samba Servers is a package of anti-virus components
performing the following functions:
• Real-time protection of Samba file server from malicious code (On-
Access Scanner).
• On-demand searching and neutralization of malicious code in the server
file system (On-Demand Scanner).
• Notifications to the administrator about detection of infected or suspicious
objects.
• Maintaining the current status of the anti-virus databases (keepup2date).
• Local and remote administration using a web administration module
(Webmin).
Besides, Kaspersky Anti-Virus®offers the following additional functionality to its
users:
• An opportunity to run user-defined scripts in cases, when events of the
“an infected file was detected” type occur.
• An opportunity to move infected (or suspicious) objects to a special stor-
age location (quarantine).

Kaspersky Anti-Virus®for Samba Servers 7
• Preserving the original infected object prior to its disinfection (Backup)
with an opportunity to restore it if an off-normal situation happens.
• Saving information about already scanned files in an operational cache,
which allows a considerable increase of file scanning speed during sub-
sequent access to such files (the cache preserves the information until
application restart).
• An opportunity to restrict the maximum number of files for simultaneous
real-time scanning while adding the rest of the requested files to a scan-
ning queue.
• An opportunity to suspend automatically the anti-virus background file
scanning, when the server load exceeds the user-defined level – and re-
sume operation, when the server load reaches an acceptable level.
• An opportunity to define any combination of “scanning on access” and
“scanning on saving” modes for each public directory.
• An opportunity to define selectively individual anti-virus protection settings
for each public directory.
• The least loaded updates’ server of Kaspersky Lab is detected during the
updating of the anti-virus databases. Besides, in cases of line disconnec-
tion the updating process after reconnection resumes its work from the
place where it left off.
• An opportunity to roll-back both the updates to anti-virus databases and
application updates.
1.1. Hardware and software system
requirements
Operation of Kaspersky Anti-Virus®for Samba Servers requires:
• Hardware requirements:
• Pentium class CPU.
• At least 32 Мb of free RAM.
• At least 100 Mb of available disk space.
• Software requirements:
• One of the following operating systems:
o Linux RedHat (versions 7.3, 8.0 or 9.0), Linux SuSE (ver-
sions 8.1 or 8.2) or Linux Debian (version 3.0)

8 Kaspersky Anti-Virus®for Samba Servers
o FreeBSD, versions 4.7 or 5.0
o OpenBSD, version 3.3
• Installed Samba server 2.2.6 or newer.
• Installed Perl, version 5.0 or newer.
1.2. Distribution kit
You can purchase Kaspersky Anti-Virus®either from our distributors (retail box)
or in our Internet-shop (www.kaspersky.com, Buy online section).
When purchasing a retail box you will receive the following distribution kit:
• A sealed envelope with an installation CD (or a set of floppy disks)
containing software product files.
• Administrator’s guide.
• License key.
• License agreement.
Before you unseal the envelope containing the CD (or floppy disks), be sure to
thoroughly review the license agreement.
When purchasing Kaspersky Anti-Virus®in the Web-shop you download the
product from Kaspersky Lab’s website. The distribution file contains the product
and the license key.
The License Agreement (LA) is a legal agreement between you (either an
individual or a single entity) and the manufacturer (Kaspersky Lab Ltd.)
describing the terms on which you may employ the anti-virus product, which you
have purchased.
Make sure to read the terms of the LA!
If you do not agree to the terms of this LA, Kaspersky Lab is not willing to license
the software product to you and you should return the unused product to your
Kaspersky Anti-Virus®dealer for a full refund, making sure the envelope with CD
(or diskettes) is sealed.
If you unsealed the envelope, you have agreed to all the terms of the LA.

Kaspersky Anti-Virus®for Samba Servers 9
1.3. Help desk for registered users
Kaspersky Lab offers a large service package enabling legal users to efficiently
employ Kaspersky Anti-Virus®.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:
• daily virus-definition database updates via e-mail;
• product upgrades;
• phone and e-mail advice on matters related to your software installation,
configuration and performance;
• information about new Kaspersky Lab products and new computer vi-
ruses (for those who subscribe to our newsletter).
Kaspersky Lab does not give advice on the performance and use of
your operating system or various other technologies.
1.4. Adopted conventions
The text in this document uses various styles depending upon its purpose. The
table below lists adopted conventions used in the text.
Style Purpose
Bold type Menu titles, menu items, window titles,
parts of dialog boxes, etc.
Note.
Additional information, notes.
Attention!
Information that should be paid special
attention.
In order to perform the
action,
1. Step 1.
2. …
Procedure description for user's steps
and possible actions.

10 Kaspersky Anti-Virus®for Samba Servers
Style Purpose
Task, example
Statement of problem, example for
using the software features.
Solution
Solution to a defined problem.
[key] – key purpose. Command line keys.
Text of information mes-
sages and the command line Text of configuration files, information
messages and the command line.

CHAPTER 2. INTERNAL
ARCHITECTURE OF
KASPERSKY ANTI-VIRUS®
FOR SAMBA SERVERS
Before we describe the features of Kaspersky Anti-Virus®for Samba Servers let
us discuss its internal architecture in detail. That will allow better understanding
of the Anti-Virus operation algorithm.
2.1. Component structure
Kaspersky Anti-Virus®for Samba Servers consists of the following components:
• kavsamba (or an On-Access Scanner);
• kavscanner (or an On-Demand Scanner);
• keepup2date.
The kavsamba component, in its turn, includes the kavsamba.so and kavsamba
modules. The kavsamba.so is implemented in the form of a dynamic library
integrated into Samba server and intercepting attempts to access files through
that Samba server. The kavsamba module is a daemon process analyzing the
files provided by the kavsamba.so files and processing them in accordance with
the current settings. Data exchange between the module and the daemon
process is accomplished through a local socket (Unix Domain sockets).
The kavscanner component is designed for anti-virus protection of file systems.
Server file systems or individual directories are scanned according to the
administrator’s demand or the schedule (depending upon selected settings).
The keepup2date component updates the anti-virus databases used during
scanning and disinfection and also downloads patches to the package programs.
2.2. Algorithm of operation
Here we shall review internal architecture of the product in terms of real-time
anti-virus protection since the on-demand scanning process is fairly simple and
does not require any special coverage.

12 Kaspersky Anti-Virus®for Samba Servers
So the used algorithm of operation is as follows:
1. If a user attempts to access a file through Samba server the request
is intercepted by the server itself and transferred to the
kavsamba.so module.
2. The kavsamba.so module sends the data pertaining to the request
(file name, its full path, ID of the user who requested the file,
computer domain name) to the kavsamba component through IPC
using binary protocol.
3. The kavsamba module scans the requested object for viruses and
processes it in accordance with the settings in the configuration file
(including the use of anti-virus databases, if that option is enabled).
4. Upon completion of file scanning and processing kavsamba.so
receives from kavsamba the access code (granted/denied), which
determines the file status.
5. In accordance with the object status kavsamba.so transfers to the
Samba server a permit to access the object or blocks the latter.
File access is blocked if it is infected (Infected, CureFailed). In all other cases
access to the file is granted.

CHAPTER 3. INSTALLATION OF
KASPERSKY ANTI-VIRUS®
FOR SAMBA SERVERS
Prior to beginning the installation of Kaspersky Anti-Virus®for Samba Servers we
recommend the following preparations for your system:
• Make sure that your system conforms to the hardware and software re-
quirements for installation of the Kaspersky Anti-Virus®(please see sec-
tion 1.1 on p. 6).
• Enter the system as superuser (root).
3.1. Software installation to a server
running under Linux
Kaspersky Anti-Virus®for Samba Servers is distributed in three variants of
installation packages depending upon distribution type.
In order to start the installation of Kaspersky Anti-Virus®from an .rpm
package enter the following in the command line:
rpm –i <package_file_name>
In order to start the installation of Kaspersky Anti-Virus®from a .deb
package enter the following in the command line:
dpkg –i <package_file_name>
You may also use the standard installation method, which is identical for all Linux
distributions. It can be used in cases, when a respective Linux distribution does
not support .rpm or .deb formats (like SlackWare, for example) or when the
administrator does not use the built – in package manager.
Universal installation package of Kaspersky Anti-Virus®for Samba Servers is
supplied as an archive. The archive contains the tree of directories with the
package files and the install.sh script, which performs the installation.

14 Kaspersky Anti-Virus®for Samba Servers
In order to start installation of Kaspersky Anti-Virus®to a server perform
the following procedure:
1. Copy the archived installation package to a directory in the server file
system and unpack it.
2. Launch the installation script: install.sh.
3.2. Software installation to a server
running under FreeBSD or
OpenBSD
The installation package of Kaspersky Anti-Virus®is supplied in a .pkg package
for servers running FreeBSD or OpenBSD operating systems.
In order to start the installation of Kaspersky Anti-Virus®from a .pkg
package enter the following in the command line:
pkg_add <package_name>
3.3. Installation process
For several reasons the process of installation may terminate with an
error code. In such cases make sure that your computer conforms to
the hardware and software requirements (please see section 1.1 on
p. 7) and that you have logged into the system with root privileges.
The application is installed to a server in several stages:
1. Copying the installation package files to a server.
2. Configuration of the keepup2date component.
3. Installation (updating) of the anti-virus databases.
Ensure that the anti-virus databases are installed before you begin
using the product. The procedure of anti-virus scanning and disin-
fection depends upon the records in the anti-virus databases con-
taining descriptions of all currently known viruses and cure meth-
ods for infected objects. Scanning and processing of files cannot
be performed without anti-virus databases!

Installation of Kaspersky Anti-Virus®for Samba Servers 15
Please note also that automatic configuration of the application will
not be performed if the anti-virus databases are not installed.
4. License key installation.
If a license key is not installed configuration will not be performed
and it will be impossible to use the application. However, if the key
is missing temporarily (for example, the product has been pur-
chased via the Internet and the license key hasn’t been received by
e-mail yet) you can install it after installation, before beginning to
actually use the product. Please see details in section 7.1 on p.52.
5. Installation of a Webmin module.
Remote control module for the Webmin package will be installed
only if Webmin has a standard path. After module installation you
will receive respective recommendations for its setup to work with
the Application.
3.4. Configuring the application
System configuration is performed immediately upon copying the installation
package files to server. Depending upon the package manager the configuration
stage will either start automatically or (if the package manager does not allow
using interactive packages like .rpm, for example) require some additional
actions on the user’s part. A respective message will appear on-screen in that
case.
The process of configuring the application consists of the following stages:
• Search for an installed Samba server and checking its version for confor-
mity with the software requirements.
• Search and modification of the Samba server configuration file.
• Checking the Samba server configuration file for presence of VFS ob-
jects. If the Samba server configuration file contains lines indicating VFS
objects in use, a respective message will appear on-screen with an offer
to comment such lines. If the offer is rejected, the process of configuration
will terminate.
If the system configuration requires some additional information (e.g., the path to
the Samba server configuration file) the respective questions will be output to
server console. Entry of incorrect responses will abort the configuration process.
If the above configuration stages complete successfully, the application will be
ready for work, no additional notifications will be produced. The configuration file
supplied with the product package contains all settings necessary to start
working.

16 Kaspersky Anti-Virus®for Samba Servers
Please keep in mind that you have to restart the Samba server before
you can proceed to further work.
3.5. Distribution of files within
directories
After Kaspersky Anti-Virus®installation the files from its installation package will
have the following locations provided that all default paths are accepted during
the installation procedure:
/etc/kav/5.0/kavsamba is a directory containing the configuration file of Kasper-
sky Anti-Virus®and other configuration files:
kav4sambaservers.conf – configuration file.
/var/db/kav/5.0/kavsamba/bases and /var/db/kav/5.0/kavsamba/license are direc-
tories containing the anti-virus databases and a list of servers distributing
updates for the bases.
/var/db/kav/5.0/kavsamba/patches is a directory containing downloaded applica-
tion patches.
If you have Linux OS installed:
/opt/kav/5.0/kavsamba – the main Anti-Virus directory including:
/bin/ – the directory with the executable files for all the components of
Kaspersky Anti-Virus®for Samba Servers:
kavscanner – is the executable file of the kavscanner component per-
forming anti-virus protection of file servers (On-Demand Scanner);
kavsamba – is the executable file of the kavsamba component perform-
ing real-time anti-virus protection (On-Access Scanner);
keepup2date – is the executable file of the keepup2date component
updating the anti-virus databases.
/man/ – directory with man files.
/setup/ – directory for storage of service scripts and Webmin module.
If you have FreeBSD or OpenBSD OS installed:
/usr/local/share/kav/5.0/kavsamba – the main Anti-Virus directory including:
/bin/ – the directory with the executable files for all the components of
Kaspersky Anti-Virus®for Samba Servers:
kavscanner – is the executable file of the kavscanner component per-
forming anti-virus protection of file servers (On-Demand Scanner);
kavsamba – is the executable file of the kavsamba component perform-
ing real-time anti-virus protection (On-Access Scanner);

Installation of Kaspersky Anti-Virus®for Samba Servers 17
keepup2date– is the executable file of the keepup2date component up-
dating the anti-virus databases.
/man/ – directory with man files.
/setup/ – directory for storage of service scripts and Webmin module.
3.6. Uninstalling Kaspersky Anti-
Virus®for Samba Servers
The procedure of uninstalling Kaspersky Anti-Virus®for Samba Servers requires
the following:
• Superuser privileges (root or another user with UID=0). If you have no
such privileges at the moment of uninstall procedure you’ll have to enter
the system as root.
• Stopped Samba server.
The uninstaller routine does not stop the Samba server on its
own!
The administrator may have to terminate the operation of the application
manually. That can be accomplished using, for example, the following command:
/etc/init.d/kavsamba stop
As soon as the above actions are performed you may proceed to the actual
uninstall procedure, which will be performed automatically. The uninstall
procedure is performed using different methods depending upon used packages
manager. Let us review those variants in detail.
If you installed Kaspersky Anti-Virus®for Samba Servers using its .rpm
package enter the following in the command line to begin uninstalling:
rpm -e <name.rpm>
If you installed Kaspersky Anti-Virus®for Samba Servers using its .deb
package enter the following in the command line to begin uninstalling:
dpkg -r <name.deb>

18 Kaspersky Anti-Virus®for Samba Servers
If you installed Kaspersky Anti-Virus®for Samba Servers using its
.tar.gz package enter the following in the command line to begin unin-
stalling:
install.pl uninstall
If you installed Kaspersky Anti-Virus®for Samba Servers using its .pkg
package enter the following in the command line to begin uninstalling:
pkg-delete <name.pkg>
No additional notifications are output if the uninstall procedure completes
successfully.

CHAPTER 4. POST-INSTALL
SETUP
The installation routine performs analysis of the system, where Kaspersky Anti-
Virus®is being installed to and defines some parameters of its configuration
automatically. Several parameters of the product configuration file are defined by
default as most convenient for work with the Anti-Virus (please see section 4.1
on p. 19).
Prior to beginning work with the product we recommend installing or
updating its anti-virus databases if you haven’t done so during installa-
tion, with subsequent scanning of all server file systems!
We suggest that you begin the product use with updating its anti-virus databases
and setting it up for work with the Webmin package.
This chapter is devoted to discussing the default settings of Kaspersky Anti-
Virus®and detailed review of the configuration necessary for product operation.
4.1. Default product settings
All parameters pertaining to the operation of Kaspersky Anti-Virus®are recorded
in the default configuration file.
You can create your own configuration files and use them both for cur-
rent tasks and as the default configuration.
Let us review closely the default parameters defined in that file. Based on the
information in this section you can determine whether Kaspersky Anti-Virus®
needs additional tuning (please see Chapter 6 on p. 36) for its more efficient
integration in your corporate environment.
The default configuration of Kaspersky Anti-Virus®suggests that the real-time
protection component (kavsamba) begins working at the start of the operating
system. Starting the on-demand scanning component (kavscanner) without
additional command line keys forces anti-virus scanning of server directories and
file systems beginning with the current one.
If infected, suspicious or corrupted files are discovered respective notifications
are output to console and appended to the report file.

20 Kaspersky Anti-Virus®for Samba Servers
Please note that discovered infected files ARE NOT CURED
BY DEFAULT!
4.2. Installing/updating anti-virus
databases
We recommend installing/updating anti-virus databases immediately after
installation of the product to a server.
In order to accomplish that you have to start the keepup2date component. Enter
the following in the command line:
/path/to/keepup2date
The anti-virus databases will be copied from the Kaspersky Lab updates’ servers
to a special directory defined in the configuration file.
We recommend DAILY updates of anti-virus databases since new vi-
ruses emerge every day in the world and the product status must re-
main up-to-date. Please see details on variants of updates’ organization
in section 5.2.1-5.3.3 on p. 30-33.
Please pay also special attention to the fact that during the process of
updating the anti-virus databases Kaspersky Anti-Virus®for Samba
Servers uses a new version of the keepup2date component. Anti-virus
databases of a special (extended) format have been designed for that
component. Therefore an extended database collection has to be used
if an administrator performs updating manually!
4.3. Setting the product up for work
with Webmin
If you plan to configure Kaspersky Anti-Virus®remotely we recommend that you
set it up for work with the Webmin package.
For example, Webmin may be used for restriction of access to the program
through a system of user passwords (please see details on Webmin tuning in the
respective documentation for that product).
All Anti-Virus settings modified remotely through Webmin are saved to the
default configuration file of the application.