Antivirus and Content Shield Protect your SharePoint Farm Using the AvePoint Antivirus and Content Shield Solution

Transcription

1 Quick Start Guide Antivirus and Content Shield Protect your SharePoint Farm Using the AvePoint Antivirus and Content Shield Solution This document is intended for anyone wishing to familiarize themselves with the user interface and basic functionality of the Antivirus and Content Shield, including real-time and scan-based farm protection from malicious viruses and sensitive information. Page 1

2 Table of Contents Table of Contents... 2 Basic Overview... 4 Requirements... 4 Supported Platforms... 4 Installation... 4 Installation steps... 4 Front-end Settings... 5 License Management... 5 Patch Management... 5 Setup Basics... 6 Database Configuration... 6 Creating a new database... 6 Connecting to an existing database... 6 Scan Engine... 7 General Settings... 7 Quarantine Settings... 7 Log Settings Profile Settings... 8 Editing the template... 8 Scan Engines Settings... 9 Scheduled Scan Profile... 9 Filter Engines Filter Dictionaries Filter Profile Antivirus Real-Time Scan Antivirus Settings (Real-Time Scan Settings) Real-time Scan Actions Real-time Filter Rule Scheduled Scan Reporting Content Shield Page 2

3 Real-Time Content Shield Scheduled Filter Content Filter Reports Supported Type Page 3

4 Before You Begin Basic Overview The Antivirus and Content Shield contains two separate products that are essential to the health and compliance of your SharePoint environment. The SharePoint Antivirus is used to scan both live uploaded content and already existing content in your SharePoint environment for viruses. The Content Shield will also be able to perform real-time scans of uploaded SharePoint content and of data stored in SharePoint content databases based on pre-defined keyword dictionaries and filters. It is fully integrated in SharePoint s Central Admin, where you can deploy and manage the filters on your SharePoint Front-End Web (FEW) servers easily. Only the SharePoint farm administrator has the authority to use this tool. *Note: The AvePoint Antivirus leverages the Symantec Scan Engine TM, which must be installed prior to the deployment of this product. Requirements The requirements and supported platforms for both products are below. Supported Platforms The Antivirus and Content Shield contains two components running in a manager/agent configuration. This requires the software to be installed in the SharePoint Central Admin and deployed to all user-facing SharePoint FEWs to provide full protection for your farm. The SharePoint FEW and SharePoint Central Admin should be running: Microsoft Office SharePoint Server (MOSS) 2007 Windows SharePoint Services (WSS) v3 Windows Server 2003 or 2008 SQL Server 2005 or 2008.NET Framework v2 or higher Symantec Scan Engine version 5 Installation The Installation Wizard is there to guide you through this installation process. By following the steps below, you should have the Antivirus and Content Shield up-and-running on your environment very quickly. Installation steps Make sure you run the Installation Wizard on the SharePoint Central Admin server first, as you will be able to deploy the FEW agents for this software easily from this location. Page 4

5 1. Download the Antivirus and Content Shield ZIP file, either by requesting a demo version from: or by contacting an AvePoint representative for links to this package. 2. Unzip the package on your SharePoint FEW. 3. Run the setup.exe file found in the unzipped directory. 4. Follow the simple steps on screen for configuring this tool. You will be asked for your name, company information, and for a location to install this software. 5. After installing the tool, it will prompt you to restart IIS to complete the installation. You can choose to reset IIS later by selecting No. *Note: The IIS reset performed does not restart the IIS service, but performs a no-force reset of IIS processes. Any processes currently running will be allowed to finish before this reset takes place. If you choose to reset IIS at a later time, the installation will not complete until it is performed. Congratulations! The SharePoint Antivirus and Content Shield is now installed on your environment. Front-end Settings In order to protect your SharePoint environment, you need to configure the Antivirus and Content Shield on your SharePoint FEW. The FEW will control both the database scan and real-time filter of your environment. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Front-End Settings and it lists the available front-end servers in the Front-end Server list. 2. Click the front-end server name you want to deploy, and select Deploy Now option. License Management In order to use the Antivirus and Content Shield, you need to apply the license for the Font-end server. You can obtain this license from your AvePoint sales representative. To assign the license to the Front-end server, please follow the steps below. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Front-End Settings. 2. Click the Browse button and select the license you want to apply under the License Management section. 3. Click the Apply button, and the detailed information will be listed above. 4. Select the Front-end server you want to assign the license to in the Front-end Server List by clicking the Front-end server name, and click the Assign license. 5. After assigning the license for the Front-end server, the license status of the server will be Assigned. Patch Management Antivirus and Content Shield Patch Management allows you to update the current version of Antivirus and Content Shield from within the GUI. Page 5

6 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Front-End Settings. 2. Click the Browse button and select the patch you want to load under the Patch Management section. 3. Click the Load button, the detailed information for this patch will be listed underneath. Setup Basics Database Configuration The Antivirus and Content Shield installation requires an application database to store all settings and configurations. You can deploy this application database to any SQL Server instance connected to your network. Creating a new database To create a new database for the Antivirus and Content Shield, follow the steps below. 1. Navigate to the Central Administration -> Operations tab and you will see the AvePoint Tools and Services field. Click the Antivirus and Content Shield option to enter the setup. 2. If you do not specify a database for the application, there will be an interface to prompt you. 3. Select the Create a new database option from the Application Database Type category. 4. Enter the database server name into the Database Server text box, and then the database name for the new database you want to apply for the Antivirus and Content Shield. 5. Select an authentication by checking the corresponding check-box. If you select the SQL Server Authentication option, you need to enter the necessary information in the SQL Username and password fields. 6. Click the Create button to create the new database for the application. Connecting to an existing database To connect an existing database to use as the Antivirus and Content Shield application database, please follow the steps below. 1. Navigate to the Central Administration -> Operations tab and you will see the AvePoint Tools and Services field. Click the Antivirus and Content Shield option to enter the setup. 2. If you do not specify a database for the application, there will be an interface to prompt you. 3. Select the Connect to an existing database option from the Application Database Type. 4. Enter the database server name into the Database Server text box, and then the database name you want to apply for the Antivirus and Content Shield. Page 6

7 5. Select an authentication by checking the corresponding check-box. If you select the SQL Server Authentication option, you need to enter the necessary information in the SQL Username and password fields. 6. Click the Connect button; it will connect to the database for the application. Scan Engine After applying the database settings successfully, you need to register the Antivirus portion of this product with the Symantec Scan Engine. If you are only using the Content Shield half of this product, you can skip this section. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Antivirus > Register Scan Engine. 2. Enter the IP address or the machine name of the server where the Symantec Scan Engine is installed into the provided field. 3. Specify a TCP/IP port for the Scan Engine. By default, the port number is You can enter a description for this setting in the field provided. 5. Click the Next button to list the Scan Engine details in the next page. 6. You can also change the priority for the scan engine or select to disable it. 7. Click the Register button to complete the registration. The scan engine will now be listed in the Scan Engine Management. 8. You can click the Register Scan Engine to register another engine, or click the Show under the List column to modify or delete the engine. *Note: Please make sure you can connect to the machine which already installs the Symantec scan engine from the Central Admin Server. General Settings This section details the simple steps required to setup several important settings for use with the Antivirus and Content Shield. Quarantine Settings The Antivirus and Content Shield application gives you the option of either deleting data or storing offending data in a quarantined location in your environment, preventing access directly from SharePoint. Access to this location should be restricted as the contents may be infected or harmful. Using these settings, you can specify the location, maximum space, time period to keep the files, and the notification using this setting. 1. Naviagate to Central Administration > Operations > Antivirus and Content Shield > Quarantine Settings, and you can configure the quarantine settings. 2. Enter a location for the quarantine into the Quarantine Path area. If the path you specify is a network path, you need to specify the user account. Page 7

8 3. Setup the maxmum space for the quarantine, and then specify the time period to keep the files in the quarantine. 4. Checking the Warning Notification option, it will send a notification once the capacity is less than 10% of the available quarantine space. 5. Click the Save button to save the configration. You can go to View Quarantine to view the files in the quarantine. Log Settings You can cinfigure the log level for each features and specify the maximum storage time for the report. After configuring the settings, you can click the Save button to save the settings or the Reset button to clear the configuration. *Note: Before contacting technical support for this product, we recommend setting all log-levels to Debug. Profile In this section, you can create various profiles containing different mailing lists. To setup an notification profile, please follow the steps below. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Profile, and then you can view the profiles in the left-hand column. 2. Click the New button to create a new profile, and then enter a profile name into the provided field. 3. Enter your Microsoft Exchange Outgoing Mail Server (SMTP) and specify the corresponding port for it. By default, the port is You need to select the Server Authentication option if you setup this option in your E- mail Account Configuration. 5. Under the Sender field, enter the address you would like the notifications to come from. 6. Enter the recipients under the Recipients field. Multiple recipients can be added to the recipient text box in separated line. 7. You can click the Test button to test the configuration. If test successful, the recipient(s) you specified will receive the test mail. 8. Click the Save button to save the configuration, and it will be listed on the left. Settings In this section you can specify the profile by selecting the profile from the drop-down box for each module, you can also edit the mail template for each module. Editing the template 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Settings. 2. Click the Edit Mail Template for the module you want to edit, it will go to the edit template page. Page 8

9 3. Select the keywords you want to add to subject from the first Value Keywords drop-down box, and then click the Add button, the keywords will be added into the subject. 4. Select the keywords you want to add to the message body from the second Value Keywords drop-down box, and then click the Add button, the keywords will be added into the main body. 5. You can also enter the content you want to view in the Click the OK button to save the configuration for specific feature; or the Cancel button to cancel the settings. Scan Engines Settings This section will teach you a few simple steps to quickly setup a basic rule for the scan engine. There are several options for scan rule: Latest Virus Definitions: this section lists the version of the Symantec scan engine you installed. You can click the Refresh button to load the latest information of this tool. Scan Engine Auto-Check: it will check the scan engine version automatically once you select this option. Enter a number into the provided field to specify the auto-check interval. The unit for this option is by the minute. Take the Scan Engine offline if its virus definition is not up-to-date: After you select the Scan Engine Auto-Check option, this option will be enabled. You can bring the scan engine offline after a specific time if its virus definition is out-of-date beyond an acceptable measure. Enable notification if the virus definition of Scan Engine is not up-to-date: it will send you a notification once the virus definition is considered out-of-date. Select Mode: you can select a mode for the online scan engines to specify how to use the scan engines; there are three modes for the scan engine. Select One Mode: you need to specify a scan engine from the drop-down box, and it will only use this selected scan engine while running the scan job. Cycle Mode: it will use the scan engine according to the registered order. Priority Cycle Mode: it will select the scan engine according to the priority setting defined. After setting up the options, click the Save button to apply the scan engines rule. Scheduled Scan Profile In this section, you can setup some basic setting for the scheduled scan job. There are several options you can setup for the scheduled scan profile: Profile Name: enter the profile name for the scheduled scan profile into the provided field. Number of Threads: this will start several threads while scanning for a virus. The scans will be more efficient if you specify a higher thread number, but it will require more resources. Scan File Version: it will scan all versions of the files in SharePoint if you select this option, since each SharePoint version is a unique object, it is recommended that all versions are scanned. Page 9

10 File Extension Policy: you can enter the file extensions into the provided field, the files will be excluded from the scheduled scan job. Multiple policies can be added to the text box in a separate line. Virus Scan Action: in this area, you can setup the operation on the infected files for different file rules during a scheduled scan job. Basic Virus Rule: The operation you specified in this field is used for the files with the common virus. There are four actions you can select: Clean, Quarantine, Delete, and Report only. Unrepairable Virus Rule: The operation you specified in this field is used for the files with the unrepaired virus. There are three actions you can select: Delete File, Quarantine, Delete, and Report only. Encrypted File Rule: The operation you specified in this field is used for the files which are encrypted. There are three actions you can select: Delete File, Delete File and Quarantine, Delete, and Report only. Click the Save button to save the configuration, and then the profile will be listed on the left column. Filter Engines Before running a filter job, you need to setup several filter engine with different dictionary to get different filter result. To setup a filter engine, please follow the steps below. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Filter Engines, and you can view all the filter engines in the list. 2. Click the Add New Filter Engine, and the setting interface will appear. 3. Enter an engine name for the filter rule into the provided field. 4. You can also enter a description in the field provided to help distinguish this engine. 5. Select the dictionary for the filter engine by checking the corresponding check-box; you can select the Select All option to select all dictionaries. 6. Click the Save button to save the settings, it will be listed in the filter engine list. Filter Dictionaries You can setup or update a dictionary for the filter rule. To setup the dictionary, please follow the steps below. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Filter Dictionaries, and you can view all the filter dictionaries in the list. 2. Click the Add New Dictionary, and the setting interface will appear. 3. Enter a dictionary name for the filter dictionary into the provided field. 4. Specify the category for the dictionary. 5. Enter the keywords into the box for the specific dictionary. Multiple keywords can be added to the text box in separated line. Page 10

11 6. Click the Save button to save it, it will be listed in the Filter Dictionaries list. Filter Profile In this section, you can setup some basic setting for the filter profile. To setup a filter profile, please follow the steps below. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Filter Profile. 2. Enter a profile name into the provided field. 3. Enter the number of threads to use for scanning. The scans will be more efficient if you specify a higher thread number, but it will require more resources 4. You can select the extension policy by clicking the corresponding radio box, and then enter the file extensions into the provided field. Multiple policies can be added to the text box in separated line. 5. Select an action for the content filter. Report only: all offending content will be permitted to enter SharePoint, but it will list the items in the filter job report. Delete/Block(Real-Time Filter): for the schedule filter, it will delete the offending items from SharePoint. For the real-time filter, it will block the new items entering SharePoint or move the items into the quarantine. *Note: if you select this option, the filtered items will be deleted directly while running a content filter job. Set content type to: all offending contents will be set in SharePoint the content type you want to display. Set column value to: this will use metadata to tag the new item when it enters SharePoint. Enter the column name, the value in the column, and select a type for the column. 6. Click the Save button to save the filter profile, and then it will be listed in the column on the left. You can define multiple profiles, but only one can be applied to the engine. Antivirus After setting up the basic settings, you can setup some settings to scan the files in SharePoint. Antivirus and Content Shield allows you setup some rules for the scan engine, and it will scan the content in SharePoint accordingly. Real-Time Scan You should configure the settings for the real-time scan, the actions while finding the virus, and the options for the content filter in this section. Page 11

12 Antivirus Settings (Real-Time Scan Settings) Antivirus Settings is used to configure the scan rule for the several operations and some basic settings. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Real-Time Scan Settings. 2. Click the Edit Settings to edit the antivirus settings. 3. There are four actions for scanning the documents: Scan documents on upload Scan documents on download Allow users to download infected documents Attempt to clean infected documents By default, the options Scan documents on upload, Scan documents on download, and Attempt to clean infected documents are selected. 4. Enter a number into the Time out duration box. If the time waiting for the server response is longer than the time you specify, it will be considered as time out. 5. Enter a number into the text box; it will start several threads while scanning the virus. It will make it more efficiency if you specify a suitable threads number. 6. Click the OK button to save the configuration. 7. You can select the Scan Engine Bypass, and it will bypass the scanning if the all scan engines are offline or disabled. Real-time Scan Actions In this area, you can setup the operation on the infected files for different file rules during a real-time scan job. Real-time Filter Rule You can filter the documents while scanning job by enable the filter rule. You should specify the action for the documents and select a filter engine for this filter rule. For more information about the filter engine, please refer to the Filter Engines section. Scheduled Scan Scheduled Scan allows you setup a scan plan to scan the content in specific site at a specified time. To setup a scan plan, please follow the steps below. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Scheduled Scan. 2. Enter a plan name into the provided field. 3. Clicking on the name of the farm will expand the tree further to display the list. 4. Select the content you want to scan by checking the corresponding check-box. Page 12

13 Reporting 5. You can set the scan job to run on a schedule by checking the Enable Full Schedule or Enable Incremental Schedule check-box. 6. Using the calendar icon next to the Start Time field, select a date for the scan job to run, and then select the time from the corresponding drop-down box. 7. Set an interval for recurring rules based on Only Once, by Minute, by Hour, by Day, by Week, or by Month. 8. There are two scan types: Full and Incremental. Full: This will scan all content in the specific location. Incremental: This option scans only the changes from the previous scan job in the specific location (including creating / updating the items). *Note: If no full filter has been performed previously, the incremental option will perform a full scan job by default. Although incremental scans improve performance, a full scan is recommended whenever your Symantec Scan Engine receives a new virus definition update. 9. You may enter a Description in the field provided to help distinguish this job in the report. 10. To create a second schedule, select the Schedule B tab. 11. Select a schedule scan profile from the drop-down box. It is a mandatory option. 12. Select an profile from the drop-down box; it contains a list of profiles that have an associated account. For more information on adding or editing new reporting profiles, please refer to the Section Profile of this Manual. Please note that this feature is optional. 13. You can filter the documents while scanning job by enable the filter rule. You should select a filter engine and a filter profile for this filter rule. For more information about the filter engine, please refer to the Filter Engine section. After scanning the content, it will generate the report for the job. There are two kinds of reports: Real-Time Reports and Reports for the scheduled scanning jobs. For the Real-Time Reports, all the infected files will be listed in the report list. You can view the detailed information of the infected files in the list. For the reports, all the scheduled scanning jobs will be listed in it. You can view the detailed information and the job status for the scanning plan. Content Shield Filtering the specific metadata or content of the item is a very quick and simple process using the Content Shield. Page 13

14 *Note: For the file type you want to filter, please make sure you have install the corresponding read plus-in in the machine installed the SharePoint environment. For example, if you want to filter the.doc files, it will need you install the Office in the OS. Real-Time Content Shield In order to run a real-time content shield, you need to apply the feature to the content you want to run the filter. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Real-Time Filter. 2. Select the content filter policy and content filter engine you want to apply from the corresponding drop-down box. 3. Click the Save button to save the setting. 4. Click the farm name to expand the data tree on the right. 5. Select the content you want to scan by checking the corresponding check-box. 6. Click the Apply Handler to apply the filter rule on the specific content; it will filter the content while uploading/editing the content. If you do not want to run a filter on the specific location, you should click the Remove Handler button to remove it. Scheduled Filter Scheduled Filter allows you setup a filter plan to filter the content in specific site at a specified time. To setup a filter plan, please follow the steps below. 1. Navigate to Central Administration > Operations > Antivirus and Content Shield > Scheduled Filter. 2. Enter a plan name into the provided field. 3. Clicking on the name of the farm will expand the tree further to display the list. 4. Select the content you want to filter by checking the corresponding check-box. 5. You can set the filter job to run on a schedule by checking the Enable Full Schedule or Enable Incremental Schedule check-box. 6. Using the calendar icon next to the Start Time field, select a date for the filter job to run, and then select the time from the corresponding drop-down box. 7. Set an interval for recurring rules based on Only Once, by Minute, by Hour, by Day, by Week, or by Month. 8. There are two filter types: Full and Incremental. Full: This will filter all content in the specific location. Incremental: This option only filters the changes from the previous filter job in the specific location (including creating / updating the items). *Note: If no full filter has been performed previously, the incremental option will perform a full filter job by default. It is recommended that you run a full scan whenever your filter profile or dictionaries are updated. Page 14

15 9. You may enter a Description in the field provided to help distinguish this filter job. 10. To create a second schedule, select the Schedule B tab. 11. Select a schedule filter profile and the content filter engine from the drop-down box. These two options are mandatory. 12. Select an profile from the drop-down box; it contains a list of profiles that have an associated account. For more information on adding or editing new reporting profiles, please refer to the Section Profile of this Manual. Please note that this feature is optional. 13. Click the Save Plan to save this filter plan, and then it will be listed underneath. Content Filter Reports After filtering the content, it will generate the report for the filtering job. There are two kinds reports: Real- Time Content Filter Reports and Content Filter Reports. For the Real-Time Content Filter Reports, all filtered files will be listed in the report list. You can view the detailed information of the infected files in the list. For the Content Filter Reports, all the scheduled filter jobs will be listed in it. You can view the detailed information and the job status for the filter plan. Supported Type The file types you can filter are asp, gif, hhc htm, html, htt, htw, htx, ico, jfjf, jpe, jpeg, jpg, odc, stm, xbm, doc, dot, obd, obt, pot, pps, ppt, xlb, xlc, xls, xlt, docm, docx, pptm, pptx, xlsm, xlsx, xml, xsl, asm, asx, bat, c, cmd, cpp, cxx, def, dic, h, hpp, hxx, ibq, idl idq, inf ini, inx, js, log, m3u, pl, rc, reg, rtf, txt, url, vbs, and wtx. Page 15

16 Copyright 2009 AvePoint, Inc. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written consent of AvePoint, 3 Second Street, Jersey City, NJ 07311, USA Trademarks AvePoint DocAve, AvePoint logo, and AvePoint, Inc. are trademarks of AvePoint, Inc. Microsoft, MS-DOS, Internet Explorer, Microsoft Office SharePoint Servers 2007, SharePoint Portal Server 2003, Windows SharePoint Services, Windows SQL server, and Windows are either registered trademarks or trademarks of Microsoft Corporation. Adobe Acrobat and Acrobat Reader are trademarks of Adobe Systems, Inc. All other trademarks are property of their respective owners. Changes The material in this document is for information only and is subject to change without notice. While reasonable efforts have been made in the preparation of this document to assure its accuracy, AvePoint makes no representation or warranty, expressed or implied, as to its completeness, accuracy, or suitability, and assumes no liability resulting from errors or omissions in this document or from the use of the information contained herein. AvePoint reserves the right to make changes in the product design without reservation and without notification to its users. AvePoint 3 Second Street Jersey City, NJ USA Page 16