KAPERSKY ANTI-VIRUS - FOR FREEBSD-OPENBSD-BSDI MAIL... User manual

KASPERSKY LAB
Kaspersky Anti-Virus
for FreeBSD, OpenBSD and BSDi
Mail Server
USER GUIDE

KASPERSKY ANTI-VIRUS FOR FREEBSD,
OPENBSD AND BSDI MAIL SERVER
User Guide
Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: June 2002
1

Contents
1. KASPERSKYTM ANTI-VIRUS FOR FREEBSD, OPENBSD AND
BSDI MAIL SERVER..........................................................................11
1.1. Introduction...............................................................................11
1.2. Distribution kit............................................................................14
1.2.1. What is in the distribution kit...............................................14
1.2.2. License agreement.............................................................14
1.2.3. Registration card.................................................................15
1.3. Help desk for registered users.................................................15
1.4. Information in the book.............................................................16
1.5. Conventions..............................................................................16
2. INSTALLING ANTI-VIRUS.................................................................18
2.1. Software and hardware requirements.....................................18
2.2. Backing up your installation diskettes......................................19
2.3. Step-By-Step Installation..........................................................19
2.3.1. Installation of Anti-Virus for FreeBSD................................19
2.3.2. Installation of Anti-Virus for OpenBSD and BSDi Mail Server
.............................................................................................21
2.4. Preparing to run........................................................................22
2.4.1. Editing the .ini file................................................................22
2.4.2. Editing the path to temporary files......................................24
2.4.3. Customizing software for several users.............................24
3. RUNNING ANTI-VIRUS......................................................................25
3.1. Changing scanning settings.....................................................25
2

CONTENTS
3.2. Starting to check.......................................................................26
3.3. Starting to update virus-definition databases..........................28
4. ANTI-VIRUS SCANNER: SCANNING AND DISINFECTING.........29
4.1. Starting Scanner.......................................................................29
4.2. Searching for viruses and deleting them.................................31
4.2.1. Loading anti-virus scanner.................................................31
4.2.2. Handling infected objects ...................................................32
4.2.3. Handling corrupted objects.................................................35
4.2.4. Handling suspicious objects...............................................36
4.3. Reviewing performance statistics............................................36
5. ANTI-VIRUS SCANNER AND DAEMON PROCESS: USING
SWITCHES AND PROFILES.............................................................38
5.1. Scanning settings.....................................................................38
5.2. How to change settings............................................................39
5.3. Settings for a separate location to be checked.......................40
5.3.1. Defining the location(s) to be checked...............................40
5.3.2. Defining objects to be checked..........................................42
5.3.2.1. Object types.................................................................... 42
5.3.2.2. Sectors............................................................................. 43
5.3.2.3. Files.................................................................................. 43
5.3.2.4. Packed executables...................................................... 45
5.3.2.5. Archives........................................................................... 46
5.3.2.6. Mail databases and plain mail files............................ 47
5.3.2.7. Embedded OLE objects............................................... 49
5.3.3. Defining anti-virus actions ..................................................49
5.3.4. Defining the advanced scanning tools to be used ............51
5.4. Settings for the cumulative location to be checked ................54
3

CONTENTS
5.4.1. Cumulative settings.............................................................54
5.4.2. Defining scanning and performance settings: Scanner and
Daemon...............................................................................55
5.4.3. Defining actions on infected and suspicious objects.........59
5.4.4. Defining the reporting parameters .....................................61
6. DAEMON PROCESS: INTEGRATING ANTI-VIRUS PROTECTION
IN CLIENTS.........................................................................................65
6.1. Features of the Daemon program...........................................65
6.2. Launching the daemon process..............................................66
6.3. Calling up the process from a client program .........................69
7. KEEPER: SCANNING SMTP TRAFFIC IN MAIL SYSTEMS:
SENDMAIL, QMAIL, POSTFIX AND EXIM......................................72
7.1. Features of the Keeper program.............................................72
7.2. Integrating Anti-Virus with sendmail........................................74
7.3. Integrating Anti-Virus with Qmail .............................................76
7.4. Integrating Anti-Virus with Postfix............................................78
7.5. Integrating Anti-Virus with Exim...............................................80
7.6. Customizing Keeper.................................................................82
7.6.1. General concept..................................................................82
7.6.2. Processing infected messages for an address group.......84
7.6.2.1. General concept............................................................ 84
7.6.2.2. The address group and the To/From addresses.... 86
7.6.2.3. To check or not to check… ......................................... 87
7.6.2.4. Defining after-check processing of a message....... 88
7.6.2.5. Filtering mail by the files attached.............................. 93
7.6.2.6. Delivering infected messages to the administrator 94
7.6.2.7. Notifying the sender...................................................... 95
4

CONTENTS
7.6.3. Defining attributes of the notification..................................96
7.6.4. Log.......................................................................................97
7.6.5. Communication between Keeper and the daemon process
.............................................................................................97
7.7. Launching Keeper....................................................................97
8. ANTI-VIRUS MONITOR: MONITORING THE SYSTEM FOR
VIRUSES .............................................................................................99
8.1. Features and functions.............................................................99
8.2. Assembling and Configuring..................................................100
8.2.1. The File-Monitoring Technology ......................................100
8.2.2. Configuring Monitor...........................................................101
8.3. Launching Monitor..................................................................105
8.4. Reviewing the performance results.......................................106
8.5. Troubleshooting......................................................................106
9. SLOGAN: PROCESSING AND SUMMARIZING THE
PERFORMANCE REPORTS...........................................................109
9.1. Features and functions...........................................................109
9.2. Launching Slogan...................................................................110
9.3. Slogan in the real-time monitoring mode..............................112
10. TUNER: CUSTOMIZING SCANNER AND DAEMON...................115
10.1. Features and functions...........................................................115
10.2. Launching Tuner.....................................................................116
10.3. Interface..................................................................................117
10.4. Creating, editing and saving a profile....................................119
10.5. The Location page..................................................................121
10.5.1. Defining the location to be scanned for viruses...............121
10.5.2. Defining scanning settings for a separate directory........123
5

CONTENTS
10.5.2.1. The directory Property window: Selecting the
required directory......................................................... 123
10.5.2.2. The directory Property window: Objects to be
checked......................................................................... 124
10.5.2.3. The directory Property window: Defining anti-virus
actions............................................................................ 127
10.5.2.4. The directory Property window: Defining the
advanced scanning tools used. The Options page128
10.6. The Options page...................................................................130
10.7. The Report page.....................................................................132
10.8. The ActionWith page..............................................................135
10.9. The Customize page..............................................................137
11. WEBTUNER: REMOTE ADMINISTRATION PROGRAM ............139
11.1. Functions and features...........................................................139
11.2. General concept of the program performance......................140
11.3. Installing WebTuner. Access rights.......................................142
11.3.1. The WebTuner components............................................142
11.3.2. Setting up the web server and WebTuner.......................143
11.3.3. Rights on the web server..................................................147
11.3.3.1. Rights to run the web server..................................... 147
11.3.3.2. Rights to run the WebTuner copy............................ 148
11.4. Launching WebTuner.............................................................148
11.5. Interface..................................................................................150
11.6. Defining the Configuration of WebTuner...............................152
11.6.1. WebTuner settings............................................................152
11.6.2. The main page: WebTuner performance settings..........154
11.6.3. The modules page: remote administration settings........155
11.7. WebTuner: Administering Daemon.......................................159
6

CONTENTS
11.7.1. Daemon settings...............................................................159
11.7.2. Remote configuration of the Daemon program...............161
11.7.2.1. The Profile tuning window......................................... 161
11.7.2.2. The objects page: location to be scanned............. 162
11.7.2.3. The options page: scanning settings ...................... 165
11.7.2.4. The actions page: object-handling settings........... 165
11.7.2.5. The report page: reporting settings......................... 166
11.7.2.6. The customs page: advanced scanning settings. 167
11.7.3. Launching Daemon from a remote location....................167
11.7.4. Reviewing the log file........................................................172
11.8. WebTuner: administering Scanner........................................174
11.8.1. Scanner settings...............................................................174
11.8.2. Remote configuration of the Scanner program...............176
11.8.3. Launching Scanner from a Remote Location..................177
11.8.4. Reviewing the log file........................................................179
11.9. WebTuner: administering Updater ........................................179
11.10. WebTuner: administering Keeper..........................................183
11.10.1. Keeper settings.................................................................183
11.10.2. The main page: identification settings and communication
with Daemon.....................................................................185
11.10.3. Defining processing rules for a separate group ..............188
11.10.3.1. The groups page: defining the group...................... 188
11.10.3.2. The Group: window masks page: defining group
recipients and senders............................................... 191
11.10.3.3. The Group: window filters page: defining the filter193
11.10.3.4. The Group: window administrator page: notifications
for the administrator. Isolating infected objects..... 195
7

CONTENTS
11.10.3.5. The Group: window sender page: notifications for the
sender............................................................................ 198
11.10.3.6. The Group: window recipient page: messages to
group recipients........................................................... 200
11.10.4. The users page: the list of legal users............................203
11.10.5. The log page: data to be logged......................................205
11.10.6. The report page: defining the notification contents........206
11.10.6.1. The list of to be notified.............................................. 206
11.10.6.2. Notifications for administrators................................. 208
11.10.6.3. Notifications for senders............................................. 210
11.10.6.4. Notifications for recipients.......................................... 210
11.10.7. The restricts page: restrictions for the Keeper.................210
12. UPDATER: UPDATING VIRUS-DEFINITION DATABASES .......213
12.1. Function and features.............................................................213
12.2. Starting the Updater...............................................................214
12.3. How to update virus-definition databases.............................215
12.3.1. Updating via the Internet ..................................................215
12.3.2. Updating from a network directory...................................216
12.3.3. Updating from an archive.................................................217
12.4. Saving the report to a file .......................................................217
13. INSPECTOR: MONITORING FILESYSTEM INTEGRITY.............219
13.1. Function and Features...........................................................219
13.2. Running Inspector..................................................................220
13.2.1. The Program Command Line ..........................................220
13.2.2. Defining the location to be checked.................................222
13.2.3. Handling modified and new files......................................224
13.2.4. Saving the performance report.........................................226
8

CONTENTS
14. CONTROL CENTRE: SCHEDULING THE ANTI-VIRUS
PERFORMANCE..............................................................................227
14.1. Function and Features...........................................................227
14.2. Running Control Centre.........................................................227
14.3. Scheduling performance of package component-based tasks
.................................................................................................228
14.4. Saving the performance report..............................................233
15. APPENDIX A. PRINCIPAL FILES..................................................234
16. APPENDIX B. SUPPLEMENTARY DETAILS OF ANTI-VIRUS..236
16.1. Files with the program settings..............................................236
16.2. Scanner and Daemon: The initialization file (AvpUnix.ini)....236
16.3. Scanner and Daemon: the profile (defUnix.prf)....................238
16.4. Scanner and Daemon: command line switches...................249
16.5. Scanner and Daemon: report messages..............................256
16.6. Scanner and Daemon: exit codes.........................................257
16.7. Slogan: report templates........................................................259
16.8. Inspector: command line switches ........................................262
16.9. Control Centre: command line switches................................266
16.10. Monitor: configuration file (monitor.conf)...............................270
16.11. Updater: command line switches...........................................273
16.12. Installer: command line switches...........................................276
16.13. Keeper for sendmail: configuration file (kaspersky-av.mc) .277
16.14. Keeper for Postfix: configuration file (master.cf)...................278
16.15. WebTuner: the configuration file (loader.cfg)........................280
17. APPENDIX C. CLASSIFYING COMPUTER VIRUSES.................284
18. APPENDIX D. KASPERSKY LAB LTD.........................................288
18.1. About Kaspersky Lab.............................................................288
9