KAPERSKY ANTI-VIRUS 5.5 - FOR LINUX-FREEBSD MAIL... Use and care manual

KASPERSKY LAB
Kaspersky Anti-Virus®5.5
for Samba Servers
ADMINISTRATOR'S
MANUAL

KASPERSKY ANTI-VIRUS®5.5 FOR SAMBA SERVERS
Administrator's manual
©Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: November 2006

Contents
CHAPTER 1. INTRODUCTION ...................................................................................... 5
1.1. Computer viruses and malware ............................................................................ 5
1.2. The purpose and main features of Kaspersky Anti-Virus .................................... 6
1.3. Hardware and software system requirements ..................................................... 8
1.4. Distribution kit ........................................................................................................ 9
1.5. Help desk for registered users ............................................................................ 10
1.6. Adopted conventions........................................................................................... 10
CHAPTER 2. INTERNAL ARCHITECTURE OF KASPERSKY ANTI-VIRUS FOR
SAMBA SERVERS .................................................................................................... 12
2.1. Component structure........................................................................................... 12
2.2. Algorithm of operation ......................................................................................... 12
CHAPTER 3. INSTALLATION OF KASPERSKY ANTI-VIRUS .................................. 14
3.1. Software installation to a server running Linux................................................... 14
3.2. Software installation to a server running FreeBSD ............................................ 14
3.3. Installation process.............................................................................................. 15
3.4. Configuring the application.................................................................................. 15
3.5. Locations of product files..................................................................................... 16
3.6. Upgrading your Samba server............................................................................ 19
3.7. Uninstalling Kaspersky Anti-Virus....................................................................... 19
CHAPTER 4. POST-INSTALL CONFIGURATION...................................................... 21
4.1. Default product settings....................................................................................... 21
4.2. Installing the anti-virus databases....................................................................... 22
4.3. Setting the product up for work with Webmin..................................................... 22
4.4. Recommended operation modes ....................................................................... 23
4.4.1. Optimal operation mode ............................................................................... 23
4.4.2. Top performance mode................................................................................ 24
4.4.3. Top reliability mode....................................................................................... 25
4.4.4. Scanning mode for frequently modified files................................................ 26

Contents 3
CHAPTER 5. USING KASPERSKY ANTI-VIRUS FOR SAMBA SERVERS............. 28
5.1. Anti-Virus Database Updating............................................................................. 28
5.1.1. Automatic updating of the anti-virus databases........................................... 30
5.1.2. On-demand update of the anti-virus databases .......................................... 31
5.1.3. Creation of a network directory for storage and downloading of anti-
virus databases............................................................................................. 32
5.2. Real-time anti-virus protection of Samba servers .............................................. 33
5.2.1. Setup of user's notifications.......................................................................... 34
5.2.1.1. Monitoring with notifications through smbclient .................................... 34
5.2.1.2. Monitoring with e-mail notifications........................................................ 35
5.3. Anti-Virus protection of file systems.................................................................... 35
5.3.1. On-demand scanning of files ....................................................................... 36
5.3.2. Scheduled scanning of a directory (cron) .................................................... 37
5.3.3. Additional opportunities: using scripts.......................................................... 37
5.3.3.1. E-mail notification of administrator ........................................................ 37
CHAPTER 6. ADDITIONAL SETUP ............................................................................. 39
6.1. Tuning real-time anti-virus protection.................................................................. 39
6.1.1. Scope of monitoring...................................................................................... 39
6.1.2. File scanning and disinfection mode............................................................ 40
6.1.3. File operations .............................................................................................. 41
6.1.4. Quarantine for infected objects .................................................................... 41
6.1.5. Backup copying of objects............................................................................ 42
6.2. Setup of anti-virus protection for server file systems.......................................... 43
6.2.1. Scanning area............................................................................................... 43
6.2.2. File scanning and disinfection mode............................................................ 44
6.2.3. File operations .............................................................................................. 45
6.2.4. Backup mode settings .................................................................................. 45
6.3. Optimizing Kaspersky Anti-Virus for Samba Servers......................................... 46
6.4. Restarting Kaspersky Anti-Virus for Samba Servers ......................................... 48
6.5. Localization of displayed date and time format .................................................. 49
6.6. Reporting parameters in Kaspersky Anti-Virus .................................................. 50
CHAPTER 7. LICENSE KEYS MANAGEMENT.......................................................... 52
7.1.1. Viewing license key information ................................................................... 52
7.1.2. License extension ......................................................................................... 53

4 Introduction
7.1.3. License key removal..................................................................................... 54
CHAPTER 8. CHECKING CORRECT OPERATION OF THE ANTI-VIRUS ............. 56
CHAPTER 9. FREQUENTLY ASKED QUESTIONS................................................... 58
APPENDIX A. ADDITIONAL INFORMATION ABOUT THE APPLICATION ............. 63
A.1. Kaspersky Anti-Virus configuration file............................................................... 63
A.2. Command line options for the kavsamba component....................................... 71
A.3. Kavsamba return codes...................................................................................... 71
A.4. Command line options for the kavscanner component ..................................... 72
A.5. Kavscanner return codes.................................................................................... 75
A.6. Command line options for the licensemanager component.............................. 76
A.7. Licensemanager return codes............................................................................ 76
A.8. Command line options for the keepup2date component .................................. 77
A.9. keepup2date return codes.................................................................................. 78
APPENDIX B. KASPERSKY LAB................................................................................. 79
B.1. Other Kaspersky Lab Products .......................................................................... 80
B.2. Contact Us........................................................................................................... 86
APPENDIX C. LICENSE AGREEMENT ...................................................................... 87

CHAPTER 1. INTRODUCTION
The constant growth in the number of computer users and new the possibilities
of data exchange between them via e-mail or internet result in the increased
threat of virus infections and data corruption or theft by malicious computer
programs.
Among the sources of malware penetrating users’ computers the most
dangerous are:
Internet
Global information network is the main source of distribution of all types of
malware. As a rule, viruses and other malicious programs are be located
on popular internet websites disguising themselves as useful software or
freeware. Malware can be located within numerous scripts that automati-
cally run when a website is loaded in the user’s browser.
E-mail messages
E-mail messages delivered to the user’s mailbox and stored in the e-mail
databases may contain viruses. Malware can be located either in the at-
tachments to messages or in the body of a message. As a rule, infected
e-mail messages contain viruses or mail worms. When you open an e-
mail message or save an attached file to your hard drive, you may infect
data stored in your computer.
Software vulnerabilities
In most cases hackers’ attacks are attempted using "software holes".
Such vulnerabilities allow hackers to obtain remote access to your com-
puter and, therefore, to your data, your LAN resources and other sources
of information.
In the Unix-based systems viruses are far less common compared, for example,
to the Windows Operating System due to the peculiarities of the two platforms.
However, this does not mean that Unix users encounter no threat. Provided
below is a detailed description of malware types.
1.1. Computer viruses and malware
In order to be aware of the potential threats to your computer, it is helpful to know
what the types of malicious software (“malware”) are and how they work. In
general, malicious programs fall into one of the following three categories:
Worms – malicious programs that belong to this category use network
resources for distribution. These programs were called "worms" due to
their ability to tunnel from one computer to another, using networks, email

6 Introduction
and other channels. Due to this ability, worms can proliferate extremely
fast.
Worms penetrate a computer, determine IP addresses of other com-
puters, and send copies of themselves to these computers. Apart from the
network addresses, worms often use data contained in the address books
of e-mail client applications installed on the infected machine. Sometimes
worms create work files on disks, but they also can function without utiliz-
ing any resources of the infected computer except RAM.
Viruses –programs that infect other programs by adding their code to the
infected program's code in order to gain control when infected files are
run. This simple definition helps determine that the major action a virus
performs is infecting computer programs. Viruses spread somewhat
slower than worms.
Trojan horses or Trojans – perform unauthorized actions on infected
computers, for instance, depending on the particular conditions, they can
erase information on hard drives, "freeze" the system, steal confidential
information, etc. In the strict sense, Trojan Horses are not viruses as they
do not infect programs or data; they are unable to sneak independently
into computers and therefore are distributed by impostors disguised as
some "useful" software. However, Trojans may inflict far greater damages
compared to a regular virus attack.
Recently, worms and Trojans have become the most widespread type of
malware in the Unix-based systems.
Henceforth in the text of this Guide the term "virus" will be used to refer
to viruses, Trojan Horses and worms. A particular type of malware will
be mentioned only when it is required.
1.2. The purpose and main features
of Kaspersky Anti-Virus
Kaspersky Anti-Virus®5.5 for Samba Servers software application (hereinafter
also called Kaspersky Anti-Virus) performs anti-virus scanning of objects for
Samba servers running Linux or FreeBSD operating systems.
The application accomplishes two-level scanning of server file systems both in
real-time and in the on-demand scanning mode. If malicious code is detected
Kaspersky Anti-Virus can cure or block the infected objects efficiently in order to
prevent further spreading of epidemics providing timely notifications to system
administrators about such accidents.

Introduction 7
The application also employs iChecker™ – an intellectual technology,
which allows considerable increase of file scanning speed.
Kaspersky Anti-Virus for Samba Servers is a package of anti-virus components
performing the following functions:
•Real-time protection of Samba file server from malicious code (On-
Access Scanner).
•On-demand searching and neutralization of malicious code in the
server file system (On-Demand Scanner).
•Notifications to the administrator about detection of infected or sus-
picious objects.
•Maintaining the current status of the anti-virus databases
(keepup2date).
•Local and remote administration using a web administration module
(Webmin).
Besides, Kaspersky Anti-Virus offers the following additional functionality to its
users:
•An opportunity to run user-defined scripts in cases, when events of
the “an infected file was detected” type occur.
•An opportunity to move infected (or suspicious) objects to a special
storage location (quarantine).
•Preserving the original infected object prior to its disinfection
(Backup) with an opportunity to restore it in a non-standard situa-
tion.
•Saving information about already scanned files in an operational
cache, which allows a considerable increase of file scanning speed
during subsequent access to such files (the cache preserves the in-
formation until application restart).
•An opportunity to restrict the maximum number of files for simulta-
neous real-time scanning while adding the rest of the requested
files to a scanning queue.
•An opportunity to suspend automatically the anti-virus background
file scanning, when the server load exceeds the user-defined level –
and resume operation, when the server load reaches an acceptable
level.
•An opportunity to define any combination of “scanning on access”
and “scanning on saving” modes for each public directory.
•An opportunity to define selectively individual anti-virus protection
settings for each public directory.

8 Introduction
•The least loaded updates’ server of Kaspersky Lab is detected dur-
ing the updating of the anti-virus databases. Besides, in cases of
line disconnection the updating process after reconnection resumes
its work from the place where it left off.
•An opportunity to roll back both the updates to anti-virus databases
and application updates.
1.3. Hardware and software system
requirements
Operation of Kaspersky Anti-Virus for Samba Servers requires:
•Intel Pentium®133 MHz CPU or better.
•64 МB RAM.
•100 MB of disk space for application installation and storage of temporary
files.
•Software requirements:
•One of the following operating systems for a 32-bit platform:
oRedHat Linux 9.0.
oRedHat Enterprise Linux Advanced Server 4 UPD3.
oSUSE Linux Enterprise Server 9.0 SP3.
oSUSE Linux Professional 10.1.
oDebian GNU/Linux 3.1 R2.
oMandriva 2006.
oFreeBSD 4.11.
oFreeBSD 5.4.
oFreeBSD 6.1.
•One of the following operating systems for a 64-bit platform:
oRedHat Enterprise Linux Advanced Server 4 UPD3.
oRedHat Fedora Core 5.
oSUSE Linux Professional 10.1.
oSUSE LES 9 SP3.
•The Webmin program (www.webmin.com) for remote admini-
stration of Kaspersky Anti-Virus.

Introduction 9
•Perl language interpreter, version 5.0 or newer (www.perl.org).
•Installed Samba server 2.2.7 and newer or 3.0.0-3.0.23c.
1.4. Distribution kit
You can purchase Kaspersky Anti-Virus either from our distributors (retail box) or
in our Internet-shop (www.kaspersky.com, Buy online section).
When purchasing a retail box you will receive the following distribution kit:
•A sealed envelope with an installation CD (or a set of floppy disks) con-
taining software product files.
•Administrator’s guide.
•Register card (with the serial number)
•License key.
•License agreement.
Before you unseal the envelope containing the CD (or floppy disks), be
sure to thoroughly review the license agreement.
When purchasing Kaspersky Anti-Virus in the Web-shop you download the
product from Kaspersky Lab’s website. The distribution file contains the product
and the license key.
The License Agreement (LA) is a legal agreement between you (either an
individual or a single entity) and the manufacturer (Kaspersky Lab Ltd.)
describing the terms on which you may employ the anti-virus product, which you
have purchased.
Make sure to read the terms of the LA!
If you do not agree to the terms of this LA, Kaspersky Lab is not willing to license
the software product to you and you should return the unused product to your
Kaspersky Anti-Virus dealer for a full refund, making sure the envelope with CD
(or diskettes) is sealed.
Please note that Kaspersky Anti-Virus does not support systems run-
ning SE Linux. Use of SE Linux may result in various warnings in the
system log file generated by the application.
Besides, if your server uses protection based on File System Access
Control Lists (ACLs), you will have to configure Samba server to sup-
port that functionality.