KAPERSKY ANTI-VIRUS 5.7 - FOR LINUX FILE SERVER Service manual

KASPERSKY LAB
KasperskyAnti-Virus ® 5.7 for Linux File Server
ADMINISTRATOR'S GUIDE

K A S P E R S K Y A N T I - V I R U S ®5 . 7 F O R
L I N U X F I L E S E R V E R
Administrator's Guide
Kaspersky Lab Ltd.
http://www.kaspersky.com/
Revision date: September, 2008

Contents
CHAPTER 1. INTRODUCTION.................................................................................. 6
1.1. Computer viruses and malware........................................................................ 6
1.2. Purpose and major functionality of Kaspersky Anti-Virus .................................. 7
1.3. What's new in version 5.7? ............................................................................... 8
1.4. Licensing procedure ......................................................................................... 8
1.5. Hardware and software system requirements................................................... 8
1.6. Distribution kit ................................................................................................. 10
1.6.1. License Agreement .................................................................................. 10
1.6.2. Services for registered users.................................................................... 10
1.7. Conventions used in this document ................................................................ 11
CHAPTER 2. HOW IT WORKS................................................................................ 12
CHAPTER 3. INSTALLING KASPERSKY ANTI-VIRUS........................................... 14
3.1. Installing the application on a computer running Linux.................................... 14
3.2. Installation procedure...................................................................................... 14
3.3. Post-install configuration................................................................................. 15
3.4. Installing Network Agent ................................................................................. 16
3.5. Configuring Network Agent............................................................................. 16
3.6. Updating the application to version 5.7 ........................................................... 17
3.7. Locating the application files ........................................................................... 17
3.8. Completing the setup...................................................................................... 19
CHAPTER 4. USING KASPERSKY ANTI-VIRUS .................................................... 20
4.1. Updating the anti-virus database..................................................................... 20
4.1.1. Automatically updating the anti-virus database......................................... 21
4.1.2. On-demand updating of the anti-virus database....................................... 23
4.1.3. Creating a network directory to store the anti-virus database.................... 24
4.2. Anti-virus protection of file systems ................................................................. 25
4.2.1. Scan scope.............................................................................................. 26
4.2.2. Object scan and disinfection mode........................................................... 27
4.2.3. Actions to be performed on objects .......................................................... 28
4.2.4. On-demand scan of an individual directory............................................... 29
4.2.5. Scheduled scan ....................................................................................... 29

4 Kaspersky Anti-Virus 5.7 for Linux File Server
4.2.6. Additional capabilities: using script files .................................................... 30
4.2.6.1. Disinfection of infected objects in an archive...................................... 30
4.2.6.2. Sending notifications to the administrator........................................... 31
4.3. Real-time anti-virus protection......................................................................... 32
4.4. Managing license keys ................................................................................... 33
4.4.1. Viewing license key details....................................................................... 33
4.4.2. Renewing your license............................................................................. 35
CHAPTER 5. ADDITIONAL SETTINGS................................................................... 37
5.1. Configuration of product interaction with Webmin ........................................... 37
5.2. Optimization of Kaspersky Anti-Virus operation .............................................. 38
5.3. Moving objects into quarantine ....................................................................... 40
5.4. Backing up infected objects ............................................................................ 41
5.5. Localization of the date and time format.......................................................... 42
5.6. Kaspersky Anti-Virus report generation settings.............................................. 42
CHAPTER 6. ADMINISTERING THE PROGRAM WITH KASPERSKY
ADMINISTRATION KIT......................................................................................... 45
6.1. Administering the application .......................................................................... 47
6.1.1. Configuring application settings................................................................ 48
6.1.1.1. Settings tab, Real-time protection: general settings section................ 49
6.1.1.2. Settings tab, Real-time protection: protection scope section............... 50
6.2. Managing tasks .............................................................................................. 50
6.2.1. Creating tasks.......................................................................................... 50
6.2.1.1. Creating local tasks............................................................................ 52
6.2.1.2. Creating group tasks.......................................................................... 54
6.2.1.3. Creating global tasks ......................................................................... 54
6.2.2. Configuring specific task settings.............................................................. 54
6.2.2.1. On-demand scan task........................................................................ 55
6.2.2.2. Anti-virus database update task......................................................... 56
6.2.3. Starting and stopping tasks ...................................................................... 56
6.3. Managing policies........................................................................................... 57
6.3.1. Creating policies....................................................................................... 57
6.3.2. Viewing and editing policy settings........................................................... 59
6.3.2.1. Configuring the protection scope........................................................ 60
6.3.2.2. Specifying object types to be protected.............................................. 61
6.3.2.3. Configuring actions applied to objects................................................ 61

Contents 5
6.3.2.4. Specifying additional parameters....................................................... 61
CHAPTER 7. UNINSTALLING KASPERSKY ANTI-VIRUS...................................... 62
CHAPTER 8. VERIFYING THE ANTI-VIRUS OPERATION..................................... 63
APPENDIX A. ADDITIONAL INFORMATION ABOUT THE APPLICATION............. 65
A.1. Kaspersky Anti-Virus configuration file............................................................ 65
A.2. Command line parameters for component kavscanner .................................. 73
A.3. Return codes of the kavscanner component .................................................. 76
A.4. Command line parameters for component kavmonitor ................................... 77
A.5. Command line parameters for component licensemanager ........................... 78
A.6. Return codes of the licensemanager component............................................ 78
A.7. Command line parameters for component keepup2date................................ 80
A.8. Return codes of the keepup2date component................................................ 81
A.9. Command line parameters for component kavmidware.................................. 81
APPENDIX B. FREQUENTLY ASKED QUESTIONS............................................... 82
APPENDIX C. KASPERSKY LAB ............................................................................ 88
C.1. Other Kaspersky Lab Products ...................................................................... 89
C.2. Contact Us..................................................................................................... 99
APPENDIX D. LICENSE AGREEMENT................................................................. 100

CHAPTER 1. INTRODUCTION
The constant growth in both the number of computer users, and the volume of e-
mail and internet traffic, increases the threat of virus infections and data
corruption or theft by malicious computer programs (malware).
The most dangerous sources of malware are:
Internet
The global information network is the main conduit for all types of mal-
ware. As a rule, viruses and other malicious programs are located on
popular internet websites, disguised as useful software or freeware.
Malware can also be located within scripts that automatically run when a
website is loaded in the user‟s browser.
E-mail messages
E-mail messages delivered to the user‟s mailbox and stored in e-mail
databases may contain viruses. Malware can be located either in the
message body, or as a message attachment. Commonly, infected e-mail
messages contain viruses or mail worms. When you open an e-mail
message or save an attached file to your hard drive, you may infect data
stored in your computer.
Software vulnerabilities
In most cases hackers‟ attacks are attempted using "software holes".
Such vulnerabilities allow hackers to obtain remote access to your com-
puter and, therefore, to your data, your LAN resources and other
sources of information.
Viruses targeting Unix-based systems are far less common than those aimed at
the Windows Operating System, due to the peculiarities of the two platforms.
However, the threat to Unix users is not negligible. Provided below is a detailed
description of malware types.
1.1. Computer viruses and malware
In order to be aware of potential threats to your computer, it is helpful to know
about the types of malicious software (“malware”) and how they work. In general,
malicious programs fall into one of three categories:
Worms –malicious programs which spread themselves using network
resources. These programs are called "worms" due to their ability to tun-

Introduction 7
nel from one computer to another, using networks, e-mail and other
channels. This ability allows worms to proliferate extremely quickly.
Worms propagate by penetrating a computer, determining the IP ad-
dresses of other nearby computers, and send copies of themselves to
these computers. Apart from network addresses, worms often use data
contained in the address books of e-mail client applications installed on
the infected machine. Sometimes worms create work files on disks, but
they also can function without utilizing any resources of the infected
computer other than RAM.
Viruses –programs that infect other programs by adding their code to the
infected program's code, to gain control when the infected files are run.
This simple definition helps determine that the major action of a virus is
infecting computer programs. Viruses spread somewhat slower than
worms.
Trojan horses or Trojans –perform unauthorized actions on infected
computers. For instance, depending on the particular conditions, they can
erase information on hard drives, "freeze" the system, or steal confidential
information. In the strict sense, Trojan Horses are not viruses since they
do not infect programs or data; they are unable to sneak independently in-
to computers and are often distributed disguised as some "useful" soft-
ware. However, Trojans may inflict far greater damages than a regular vi-
rus attack.
Recently, worms and Trojans have become the most widespread type of
malware in the Unix-based systems.
Henceforth in the text of this Guide the term "virus" will be used to refer
to viruses, Trojan Horses and worms. A particular type of malware will
be mentioned only when it is required.
1.2. Purpose and major functionality
of Kaspersky Anti-Virus
Kaspersky Anti-virus®for Linux File Server (hereinafter referred to as
Kaspersky Anti-Virus, or the application)protects file servers running Linux
operating systems.
Kaspersky Anti-Virus for Linux allows the user to:
Ensure real-time protection of the file system against malicious code: in-
tercept and analyze attempts to access files, and disinfect or delete in-
fected objects.

8 Kaspersky Anti-Virus 5.7 for Linux File Server
Scan objects on demand: search infected and suspicious files (including
files within specified scan scopes); analyze files, and disinfect or delete
infected objects.
Quarantine suspicious and corrupted objects: save suspicious files in the
quarantine directory.
Create a copy of the infected object in the backup storage directory be-
fore attempting to disinfect or deleting the object, allowing a future resto-
ration of the object if it contains valuable information.
Update the anti-virus database; the database is updated from Kaspersky
Lab's updates servers. The user can also configure the application so that
the database is updated from a local directory.
Control and configure Kaspersky Anti-Virus using the application configu-
ration file, the web-based interface of Webmin or the Kaspersky Adminis-
tration Kit.
1.3. What's new in version 5.7?
The following features are new in Kaspersky Anti-Virus 5.7 for Linux File
Server as compared to version 5.5:
Support for Kaspersky Anti-Virus configuration and management using
Kaspersky Administration Kit has been implemented.
1.4. Licensing procedure
Kaspersky Anti-Virus licensing policy imposes restrictions on the use of the
application based on the usage period (as a rule, a one-year period since the
date when the application was purchased).
1.5. Hardware and software system
requirements
To run Kaspersky Anti-Virus, the system must comply with the following software
and hardware requirements:
Hardware requirements:
Processor Intel Pentium®133 MHz or higher.
64 MB RAM.

Introduction 9
100 MB free hard drive space for installation of the application
and storage of temporary files.
Software requirements:
One of the following operating systems for 32-bit platforms:
oRed Hat Enterprise Linux 5.2 server;
oFedora 9;
oSUSE Linux Enterprise Server 10 SP2;
oNovel Open Enterprise Server 2;
oopenSUSE Linux 11;
oDebian GNU/Linux 4 R4;
oMandriva Corporate Server 4;
oUbuntu 8.04.1 Server Edition;
One of the following operating systems for 64-bit platforms:
oRed Hat Enterprise Linux 5.2 server;
oFedora 9;
oSUSE Linux Enterprise Server 10 SP2;
oopenSUSE Linux 11.
Webmin program (www.webmin.com) –for remote administration of Kas-
persky Anti-Virus.
Perl interpreter - version 5.0 or higher (www.perl.org).
The which utility must be installed.
Software compilation packages must be installed (gcc, binutils, glibc-
devel, make, ld) and preinstalled operating system kernel source code for
compiling the kavmonitor component.
Please note that Kaspersky Anti-Virus does not support systems run-
ning SELinux. Use of SELinux may result in various warnings in the
system log file generated by the application.

10 Kaspersky Anti-Virus 5.7 for Linux File Server
1.6. Distribution kit
You can purchase Kaspersky Anti-Virus online (for example, visit
http://www.kaspersky.com and follow the E-Store link).
If you buy Kaspersky Anti-Virus online, you will download the application from
Kaspersky Lab's website; in this case, the distribution kit will include this Guide
along with the application. The license key will be e-mailed to you upon receipt of
your payment.
1.6.1. License Agreement
The License Agreement is a legal contract between you and Kaspersky Lab Ltd.,
which contains the terms and conditions under which you may use the anti-virus
product you have purchased.
Read the License Agreement carefully!
If you do not agree with the terms of the License Agreement, you can return
Kaspersky Anti-Virus to your dealer for a full refund.
1.6.2. Services for registered users
Kaspersky Lab Ltd. offers all legally registered users an extensive service
package that enables them to use Kaspersky Anti-Virus more efficiently.
After purchasing your license, you become a registered user and, during the
period of your subscription, you will receive the following services:
new versions of the purchased software product;
support on issues related to the installation, configuration and use of the
purchased software product. Services will be provided by phone or via e-
mail;
information about new Kaspersky Lab products and about new viruses
appearing worldwide (this service is provided to users who subscribe to
Kaspersky Lab's newsletter).
Support on issues related to the performance and the use of operating
systems or other technologies is not provided.