Applies to: SECURE WEB Version 1.3 and above

Size: px

Start display at page:

Download "Applies to: SECURE WEB Version 1.3 and above"

Coleen McCormick
6 years ago
Views:

1 Apr. 4, 2008 Applies to: SECURE WEB Version 1.3 and above

3 This document provides step by step instructions on how to install, activate and configure anti virus scanning in CYAN SECURE WEB using the ClamAV anti virus engine. Overview 1. Install ClamAV support package 2. Set up access rights 3. Restart the services 4. Enable virus scanning in SECURE WEB 5. Test virus scanning Note: the various steps need to be performed with proper user permissions. The user is specified with each step as Proceed as. Depending on the Linux distribution used, the way to impersonate the proper account differes. Debian On Debian systems you either login as root, or login as a user and you change identity to root by executing: su Ubuntu On Ubuntu systems typically no root login is permitted. All system administration level tasks are executed by a user having the permission to do so, using the sudo command: sudo apt get update Redhat Enterprise Linux 5 On RHEL 5 systems you either login as root, or login as a user and change identity to root by executing: su 2008 CYAN Networks Software GmbH 1

4 1. Install ClamAV support package Proceed as: root Install on Debian To install the support package for ClamAV, start by making sure that the CYAN repository is configured in your Debian system: Test for the repository: proxy:~# grep cyan /etc/apt/sources.list deb networks.com/ debian/etch stable proxy:~# In case the repository is not configured yet execute the following command: echo "deb networks.com/ debian/etch stable" >> /etc/apt/sources.list To update the software index execute apt get update Finally install the ClamAV support package for CYAN SECURE WEB apt get install cyan sweb 1.3 vscan clamav Install on Ubuntu To install the support package for ClamAV, start by making sure that the CYAN repository is configured in your Ubuntu system: Test for the repository: proxy:~# grep cyan /etc/apt/sources.list deb networks.com/ ubuntu/feisty stable proxy:~# 2008 CYAN Networks Software GmbH 2

5 In case the repository is not configured yet execute the following command: echo "deb networks.com/ ubuntu/feisty stable" >> /etc/apt/sources.list To update the software index execute: sudo apt get update Finally install the Kaspersky support package for CYAN SECURE WEB: sudo apt get install cyan sweb 1.3 vscan clamav Install on Redhat Enterprise Linux 5 To install the support package for ClamAV, start by making sure that the CYAN repository is configured in your Redhat system: Test for the repository: proxy:~# ls l /etc/yum.repos.d/cyan.repo rw r r 1 root root 118 *date* *time* /etc/yum.repos.d/cyan.repo proxy:~# In case the repository is not configured yet, execute the following command: echo '[cyan yum] name=cyan Networks Secure Web baseurl= networks.com/redhat5/stable/ enabled=1 gpgcheck=0' > /etc/yum.repos.d/cyan.repo To update the software index execute: yum update Finally install the ClamAV support package for CYAN SECURE WEB 2008 CYAN Networks Software GmbH 3

6 yum install cyan sweb 1.3 vscan clamav Install on any Linux system using the generic installer For SUSE linux enterprise, Debian, Ubuntu and Redhat enterprise: The ClamAV antivirus should be installed by the generic installation of CYAN SECURE WEB CYAN Networks Software GmbH 4

7 2. Set up access rights Proceed as: root To operate CYAN SECURE WEB with the ClamAV anti virus engine, you need to set up access rights for the user sweb. To do so, open the file group under /etc/group with an editor and add following line:. sweb:x:1001:clamav clamav:x:106:sweb. Instead of 1001 use the user ID of the user sweb and also instead of the 106 use the user ID of the user clamav. You can display your group ID if you open a terminal and enter: root~# id g sweb root~# id g clamav With id g user you can see the group ( g) of a specific user. 3. Restart the services Proceed as: root To restart the clamav daemon, open a terminal and enter: root~# /etc/init.d/clamav daemon restart root~# /etc/init.d/sweb stop root~# /etc/init.d/sweb start 2008 CYAN Networks Software GmbH 5

In the menu SERVER / VIRUS SCAN / SETUP verify that virus scanning is enabled: Work path: defines the path in which the download and scanning will be processed.

8 4. Enable virus scanning in CYAN SECURE WEB To enable virus scanning in SECURE WEB you need to open the web administration interface. Use a web browser to connect to the URL proxy server>:9992/ Replace <your proxy server> by either the host name or the IP address of your proxy installation. In the menu SERVER / VIRUS SCAN / SETUP verify that virus scanning is enabled: Work path: defines the path in which the download and scanning will be processed. Quarantine path: infected files are moved into this directory for later investigation by the system administrator. All files within this directory may contain harmful viruses. Note: paths in CYAN SECURE WEB can be specified in two ways, as a path relative to the installation directory in this case the path begins with any letter or other character that may start a directory name or as an absolute path, in which case the name must start with the character '/'. Next, in the menu SERVER / VIRUS SCAN / ENGINE, select the option External scanner as the virus engine: Executable: Full path and the name of the external scanner executable. The placeholder FILE in the command line string will be replaced with the file to scan at runtime. The placeholder MUST be present, otherwise scanning will not work CYAN Networks Software GmbH 6

9 Return code for virus found : Comma separated (',') list of numeric return values from the scanner process, which will be interpreted as "Virus found". Return code for file clean : Comma separated (',') list of numeric return values from the scanner process, which will be interpreted as "No virus found, file clean". Now you should be able to scan files and web pages for viruses CYAN Networks Software GmbH 7

10 5. Test virus scanning To test your virus scan engine open for example: and download the file: eicar_com.zip. If virus scanning is active and working properly, you should see a page indicating, that the file download was denied: 2008 CYAN Networks Software GmbH 8

Purpose. Target Audience. Install SNMP On The Remote Linux Machine. Nagios XI. Monitoring Linux Using SNMP

Purpose. Target Audience. Install SNMP On The Remote Linux Machine. Nagios XI. Monitoring Linux Using SNMP Purpose This document describes how to monitor Linux machines with using SNMP. SNMP is an agentless method of monitoring network devices and servers, and is often preferable to installing dedicated agents