Configuring Symantec Protection Engine for Network Attached Storage. Compuverde vnas Cluster

Transcription

1 Configuring Symantec Protection Engine for Network Attached Storage Compuverde vnas Cluster

2 Contents Abstract... 2 About software component... 2 How does Compuverde antivirus protect data on Compuverde cluster... 2 Installing Symantec Protection Engine... 3 Configuring Symantec Protection Engine... 3 Configuring the ICAP-specific options... 3 About specifying which file types to scan on the protection engine... 4 Specifying which file types to scan... 5 About specifying container handling limits... 6 Scheduling LiveUpdate to update virus definitions automatically... 6 Configuring Rapid Release updates to occur automatically... 7 Configuring antivirus scanning for Compuverde Cluster... 8 NAS antivirus server specifications... 8 Adding an antivirus network... 8 Adding a NAS antivirus server... 9 Deleting an antivirus server Configuring antivirus scanning Antivirus policies Adding an antivirus policy Include and exclude files Viewing antivirus events Compuverde Alarm Event Codes Appendix Supported antivirus applications Page 1 of 16

3 Abstract This document explains how to configure Compuverde Cluster for antivirus scanning capabilities using Symantec Protection Engine. This document is meant for users who are using Compuverde Cluster NAS with Symantec Protection Engine version About software component Symantec Protection Engine for Network Attached Storage provides virus scanning and repair capabilities for Compuverde Cluster NAS devices. Configure the following components to add antivirus scanning to Compuverde Cluster NAS devices: Symantec Protection Engine for Network Attached Storage version Provides the virus scanning and repair services. Refer the Symantec Protection Engine for Network Attached Storage Implementation Guide for information on system requirements, installation, and configuration. Compuverde Cluster version or later How does Compuverde antivirus protect data on Compuverde cluster The Compuverde storage cluster connects to one or more Symantec Protection Engine servers (SPE) to have antivirus scanning performed on all or selected parts of your file system, both in the background and live during reads. The antivirus servers should be connected through a separate antivirus network, alternatively through the management or private network. Communication between the storage cluster and Symantec Protection Engine server requires API Antivirus scanning is controlled by antivirus policies defined on the file system, and it will be triggered when a file has been written to since the last scan or when the antivirus definition is more recent than the last completed scan. For NFS 4/4.1 and all versions of SMB, if a file is closed after writing, it will automatically be flagged for a new scan. The scan request will be sent from each node to one of the specified antivirus servers, either in the background or on the next read. If a file is found to be infected, the file is flagged and cannot be read or copied; only written, updated, deleted or moved. Optionally, the infected file can be deleted automatically. Alerts can be sent to the administrator as , SNMP traps or as messages to a syslog server. In case of a warning, a message can optionally be generated, not interrupting file operations. Should an object be wrongly marked as infected due to a false positive, there are two options to unlock it: Either the scan must be performed again with an updated definition file where the mistake has been corrected, or the file can be moved to a folder without antivirus policy so that reading is not prevented. Page 2 of 16

4 Installing Symantec Protection Engine The computer on which you plan to install Symantec Protection Engine must meet the system requirements that are listed in the Symantec Protection Engine for Network Attached Storage Implementation Guide. After you have installed Symantec Protection Engine, configure the virus scanning functionality on Compuverde Configuring Symantec Protection Engine You must configure several settings on each Symantec Protection Engine that is used to support scanning for Compuverde Note: If you use multiple protection engines to support scanning, the configuration settings on each protection engine must be identical. LiveUpdate must scheduled to occur at the same time on all protection engines so that virus definitions are consistent at all times. The protection engine must be configured to use ICAP as the communication protocol. ICAP is the default protocol at installation. After you have selected ICAP, you must configure the ICAP-specific options. Configuring the ICAP-specific options If you select ICAP, you must configure certain options specific to ICAP. You must also configure the ICAP client to work with Symantec Protection Engine. For more information, see the Symantec Protection Engine for Network Attached Storage Implementation Guide. Table 1 describes the protocol-specific options for ICAP. Table 1: Protocol-specific options for ICAP Option Bind address Description Symantec Protection Engine detects all the available IP addresses that are installed on the host. By default, Symantec Protection Engine accepts scanning requests on (binds to) all of the scanning IP addresses that it detects. You can configure up to 64 IP addresses as scanning IP addresses. You can specify whether you want Symantec Protection Engine to bind to all of the IP addresses that it detects, or you can restrict access to one or more interfaces. If you do not specify at least one IP address, Symantec Protection Engine binds to all of the scanning IP addresses that it detects. If Symantec Protection Engine fails to bind to any of the selected IP addresses, an event is written to the log as a critical error. Even if Symantec Protection Engine is unable to bind to any IP address, you can access the console. However, scanning functionality is unavailable. Note: You can use (the loopback interface) to let only the clients that are Page 3 of 16

5 running on the same computer connect to Symantec Protection Engine. Port number The port number must be exclusive to Symantec Protection Engine. For ICAP, the default port number is If you change the port number, use a number greater than 1024 that is not in use by any other program or service. To configure the ICAP-specific options: 1. On the Symantec Protection Engine administrative interface, in the left pane, click Configuration. 2. Under Views, click Protocol. 3. In the right pane, under Select Communication Protocol, click ICAP. The configuration settings are displayed for the selected protocol. If you change the protocol setting from RPC to ICAP through the Symantec Protection Engine administrative interface, you must manually stop and start the service. 4. Under ICAP Configuration, in the Bind address box, select the scanning IP addresses that you want to bind to Symantec Protection Engine. Check Select All to select every IP address in the Bind address table. By default, Symantec Protection Engine binds to all interfaces. 5. In the Port number box, type the TCP/IP port number that the NAS service uses to pass files to Symantec Protection Engine for scanning. The default setting for ICAP is port In the Scan policy list, select how you want Symantec Protection Engine to handle infected files. The default setting is Scan and repair or delete. 7. On the toolbar, select one of the following: Click Save to save your changes. You can continue to make changes in the administrative interface until you are ready to apply them. Click Apply to apply your changes. Your changes are not implemented until you apply them. About specifying which file types to scan on the protection engine The settings on Symantec Protection Engine must be configured to specify the types of files to be scanned for viruses. The scan policy on the protection engine determines which files it should scan from Compuverde The scanned files are those contained in archive or container file formats. You can control which embedded files are scanned by using an extension or type exclusion list, or you can scan all files regardless of extension and type. A prepopulated extension and type exclusion list exists that you can modify. Symantec Protection Engine is configured by default to scan all files. For more information, see the Symantec Protection Engine for Network Attached Storage Implementation Guide. Page 4 of 16

6 Specifying which file types to scan You can control which file types are scanned by specifying those extensions that you want to exclude from scanning, or you can scan all files regardless of extension. To scan all files except for those that are in the file extension exclusion list: 1. On the Symantec Protection Engine administrative interface, in the left pane, click Policies. 2. Under Views, click Scanning. 3. In the right pane, under Files to Scan, click Scan all files except those in the extension or type exclude lists. When you enable this option, both the file extension exclude list and the file type exclude list are activated automatically. 4. Type each file extension that you want to add to the list on a separate line. Use a period with each extension in the list. 5. To remove a file extension from the list, select it and delete it from the File extension exclude list. 6. To restore the default file extension exclude list, in the left pane, under Tasks, click Reset Default List. This option restores the default file-type exclude list and the file-extension exclude list. 7. On the toolbar, select one of the following: Click Save to save your changes. You can continue to make changes in the administrative interface until you are ready to apply them. Click Apply to apply your changes. Your changes are not implemented until you apply them. To scan all file types except those in the file type exclusion list: 1. On the Symantec Protection Engine administrative interface, in the left pane, click Policies. 2. Under Views, click Scanning. 3. In the right pane, under Files to Scan, click Scan all files except those in the extension or type exclude lists. When you enable this option, both the file type exclude list and the file extension exclude list are activated automatically. 4. Type each file type you want to add to the list on a separate line. To include all subtypes for a file type, use the wildcard character /*. For more information on how to write the file types, see the Symantec Protection Engine for Network Attached Storage Implementation Guide. 5. To remove a file type from the list, select it and delete it from the File type exclude list. 6. To restore the default file type exclude list, in the left pane, under Tasks, click Reset Default List. This option restores the default file-type exclude list and the file-extension exclude list. 7. On the toolbar, select one of the following: Page 5 of 16

7 Click Save to save your changes. You can continue to make changes in the administrative interface until you are ready to apply them. Click Apply to apply your changes. Your changes are not implemented until you apply them. About specifying container handling limits File attachments that consist of container files can overload the system and cause denial-of-service attacks. They can be overly large, contain large numbers of embedded, compressed files, or be designed to maliciously use resources and degrade performance. Symantec Protection Engine can be configured to impose limits on how container files are handled. This reduces the exposure of the network to denial-of-service attacks. You can specify the following limits for handling container files: The maximum amount of time, in seconds, that is spent decomposing a container file and its contents This setting does not apply to.hqx or.amg files. The maximum file size, in megabytes, for the individual files that are in a container file. The maximum number of nested levels to decompose for scanning. The maximum number of bytes that are read when determining whether a file is MIMEencoded. You can specify whether to allow or deny access to the file if any of these specified limits is met or exceeded. Symantec Protection Engine blocks container files based on their type, because only certain file types contain virus or malicious code. You can configure Symantec Protection Engine to block partial container files, malformed container files, and encrypted container files as well. For more information on container handling limits, see the Symantec Protection Engine for Network Attached Storage Implementation Guide. Scheduling LiveUpdate to update virus definitions automatically Scheduling LiveUpdate to occur automatically at a specified time interval ensures that Symantec Protection Engine always has the most current virus definitions. Schedule LiveUpdate to occur at the same time for each protection engine if you use multiple scanprotectionengines to support virus scanning. This scheduling ensures that all protection engines have the same version of virus definitions. Having the same version of virus definitions is necessary for proper functioning of virus scanning on the Compuverde device. You must schedule LiveUpdate on each Symantec Protection Engine. When LiveUpdate is scheduled, LiveUpdate runs at the specified time interval relative to the LiveUpdate base time. The default LiveUpdate base time is the time that the protection engine was installed. You can change the LiveUpdate base time. If you change the scheduled LiveUpdate interval, the interval adjusts based on the LiveUpdate base time. Page 6 of 16

8 To schedule LiveUpdate to update virus definitions automatically: 1. On the Symantec Protection Engine administrative interface, in the left pane, click System. 2. Under Views, click LiveUpdate Content. 3. In the right pane, under LiveUpdate Content, check Enable scheduled LiveUpdate. This option is enabled by default. 4. In the LiveUpdate interval list, choose an interval. You can select from 2, 4, 8, 10, 12, or 24- hour intervals. The default LiveUpdate interval is 2 hours. 1. On the toolbar, select one of the following: Click Save to save your changes. You can continue to make changes in the administrative interface until you are ready to apply them. Click Apply to apply your changes. Your changes are not implemented until you apply them. Configuring Rapid Release updates to occur automatically You can configure Symantec Protection Engine to obtain uncertified definition updates with Rapid Release. You can configure Symantec Protection Engine to retrieve Rapid Release definitions every 5 minutes to every 120 minutes. Rapid Release definitions are created when a new threat is discovered. Rapid Release definitions undergo basic quality assurance tests by Symantec Security Response. However, they do not undergo the intense testing that is required for a LiveUpdate release. Symantec updates Rapid Release definitions as needed to respond to high-level outbreaks. Warning: Rapid Release definitions do not undergo the same rigorous quality assurance tests as LiveUpdate and Intelligent Updater definitions. Symantec encourages users to rely on the full quality-assurance-tested definitions whenever possible. Ensure that you deploy Rapid Release definitions to a test environment before you install them on your network. If you use a proxy or firewall that blocks FTP communications, the Rapid Release feature does not function. Your environment must allow FTP traffic for the FTP session to succeed. You can schedule Rapid Release updates to occur automatically at a specified time interval to ensure that Symantec Protection Engine always has the most current definitions. Scheduled Rapid Release updates are disabled by default. 1. On the Symantec Protection Engine administrative interface, in the left pane, click System. 2. Under Views, click Rapid Release Content. 3. In the content area under Rapid Release Content, select the Enable scheduled Rapid Release check box to enable automatic downloads of Rapid Release definitions. This option is disabled by default. 4. In the Rapid Release interval box, to specify the interval between which you want Symantec Protection Engine to download Rapid Release definitions, do any of the following steps: Page 7 of 16

9 Type the interval. Click the up arrow or down arrow to select the interval. You can select any number between 5 minutes and 120 minutes. The default value is 30 minutes. 5. On the toolbar, select one of the following: Click Save to save your changes. You can continue to make changes in the administrative interface until you are ready to apply them. Click Apply to apply your changes. Your changes are not implemented until you apply them. Configuring antivirus scanning for Compuverde Cluster About configuring the virus scan functionality on Compuverde Cluster After you have installed and configured Symantec Protection Engine, configure the virus scanning functionality on Compuverde NAS antivirus server specifications The following requirements apply: You must have a system (Cluster) with Compuverde or later installed. The server hosting Symantec Protection Engine must be accessible by the antivirus network. The Compuverde antivirus feature is configured as described in the following chapter. For more information on system requirements for Symantec Protection Engine, see the Symantec Protection Engine for Network Attached Storage Implementation Guide. Adding an antivirus network For efficient communication between the storage nodes and external antivirus servers, a separate antivirus network should be used. Though not recommended, it is possible to enable the antivirus functionality without creating an Antivirus Network. In this case, one of the other logical networks will be used (depending on routing configuration), which may negatively impact the performance of the cluster. Page 8 of 16

10 To create a network for antivirus, go to Cluster > Config > Network > Networks tab and right-click the cluster icon as shown in the screenshot below. Select Add Antivirus Network. Choose a netmask for the antivirus network and, for each node in the cluster, a network interface and an IP address for the antivirus network. This must be on a subnet that is able to reach the antivirus server. It is recommended to use an optimal MTU size, determined by switches, equipment and configuration in the network. The interface, the netmask and the IP address of the antivirus network can be changed later at any time, on any node. You can have only one antivirus network per cluster. An antivirus network can be deleted later, at any time. Adding a NAS antivirus server Go to Cluster > Config > Gateway > Antivirus. Enable the antivirus protection and specify the location of one or more Symantec Protection Engine servers to be used for scanning. Page 9 of 16

11 To enable, check "Enable antivirus protection" and adjust the following: Timeout (sec) Timeout for background scanning Disallow opening of unscanned files Timeout interval for live antivirus scan (0-60 seconds). Note that for NFS, the timeout interval will be no more than 30 seconds. Typically, to avoid problematic files to stall file operations, this value should be low. Timeout interval for background scanning (0-60 seconds). Typically, this value should be higher than Timeout above. When enabled, the scan must be completed before the content can be read, either by an earlier scan, background scan or while being read. This means that, should live scan timeout occur, read access is denied. When disabled, if a timeout occurs, the file is still readable, the scan is not completed and the scan date is not adjusted. Click the Add button for each antivirus server IP address to be added to the list. If no port is specified, default port 1344 will be added. Click "Verify configuration" to test the configuration before you apply. This will verify that the servers are valid antivirus servers. Click Publish. Deleting an antivirus server To delete an antivirus server or alter the list of antivirus servers, go to Cluster > Config > Gateway > Antivirus. Select the antivirus server that you want to remove and click the Remove button. Click the Publish button to apply the changes. Configuring antivirus scanning Antivirus policies First make sure that antivirus protection is enabled. Antivirus policies are then used to specify how and when scanning will be performed. An antivirus policy is set on any folder or sub-folder and will then apply to that folder and all sub-folders below, until another antivirus policy is found further down; then that antivirus policy will be used from this point and below. Page 10 of 16

12 Adding an antivirus policy Go to the File system tab, right-click on your file system or any of the sub-folders, and select Add Antivirus Policy. The Antivirus Policy settings view appears to the right: The parameters decide which files are included in the scan, live at read or in the background (scheduled). Adjust and click Apply. Include files Exclude files Specifies files to be included in scans. Comma separated. If left blank, all files are included. See Include and Exclude files below. Specifies files to be excluded from scans, both live and background. Excluded files will have scan date adjusted. Leave blank to not exclude files. Page 11 of 16

13 See Include and Exclude files below. Maximum file size Only perform live read scan on files smaller than or equal to this limit (1-999 KiB/MiB/GiB). Only these files will have scan date adjusted upon a complete scan. Alerts Alert on warnings Automatically delete infected files Enable extended validation of files Background scanning Select to have virus alerts sent to and/or SNMP trap (live and background scans). Alerts will also be generated if no antivirus server can be reached. For configuration, see Alarm Configuration and appendix: Alarm Event Codes. Enable to include warnings, e.g. suspicious content (live and background scans) If enabled, files will be automatically deleted if found infected. Warning: By using this option, there is a risk of unintentional loss of data. When enabled, the antivirus policy will, in addition to the parameters here, adhere to the Symantec Protection Engine filtering parameters found under the Mail, Container Handling and Files tabs, any setting except the delete file option found in the File tab. Enable to have scanning performed in the background. Scans will be performed, on scan interval, on files that have been updated or written since the previous scan, or if the virus definition file has been updated. Set maximum file size for background scan. Set a scan interval: hourly, daily or weekly, and then specify the start time. Note that for SMB and NFS 4/4.1, files that are closed after write will be queued for scanning, independent of background setting or interval setting. Antivirus policies will be checked for any background scanning to be performed, once each hour. The first time after you have created or changed an antivirus policy, all affected files will be scanned according to the new policy to ensure that no files are overlooked due to actions of any previous policies. A background scan will finish before any next scheduled scan is allowed to start. Include and exclude files Include files and Exclude files are comma separated lists of file extensions to determine if a given file should be scanned for viruses or not, respectively. Extensions can include asterisk and wildcards. The maximum length for each list is 1020 characters. Files with extension listed in both the include and exclude lists, will not be scanned for virus. Files with extension listed in neither list, will not be scanned for virus. Files with extension listed in the Page 12 of 16

14 include list (or when the include list is blank) and the extension is not in the exclude list, will be included for scanning. The asterisk character * matches any string of characters, including an empty string. For example mp* would include mp3, mp4, mpeg etc. The wildcard character? represents any single character. For example mp? would include mp3, mp4, but not mp and not mpeg. Viewing antivirus events Antivirus events are logged in the Gateway logs. Antivirus Events can also trigger, if configured, an or an SNMP trap. Compuverde Alarm Event Codes The table below illustrates the Compuverde ID notations for uniquely identifying alarm events in the notification messages, as follows: 1. In the SNMP notifications (SNMP Traps version v2c), each event is uniquely identified by an OID, according to the SNMP standard. All events have a common OID part ( ), followed by a unique number (OID#). 2. In the notifications, the event codes follow the pattern BaseID{-arg1}{-arg2} {-argn}. The BaseID uniquely identifies the event, while arg1, arg2 argn are additional parameters, separated by dashes ( - ), which give more details about the respective event. ID Event Name OID# ID ID Example 52 Infected file detected Code: 52 Infected (#1234 Virus Name) file detected in /path/msg.bin 53 Antivirus warning Code: 53 Warning Virus Name (1234) in file /path/msg.bin 54 Antivirus No responding servers Code: 54 None of the configured antivirus server is responding Page 13 of 16

15 Appendix Supported antivirus applications Compuverde supports Symantec Protection Engine Page 14 of 16

16 Copyright 2018 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and Norton AntiVirus are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED AS IS AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 350, Ellis Street Mountain View, CA Page 15 of 16