User manual F-SECURE INTERNET GATEKEEPER FOR LINUX 4.01 ADMINISTRATOR GUIDE

[. . . ] F-Secure Internet Gatekeeper for Linux A Comprehensive Internet and Anti-Virus Solution Version 4 20100125 Administrator's Guide F-Secure Internet Gatekeeper for Linux/Administrator's Guide About this Guide This guide describes the installation and uninstallation, usage, and settings for F-Secure Internet Gatekeeper for Linux. Please note that "F-Secure Internet Gatekeeper for Linux" is also referred to as "the product" and "Internet Gatekeeper" in this guide. Symbols Symbol Description Provides important information that you need to consider. Provides additional information that you should consider. Indicates that related information on the topic is available in a different chapter or another document. Fonts Arial bold Font (blue) Description Used to refer to menu names and commands, to buttons and other items in a dialog box. [. . . ] The maximum combined size of all conditions is 7000 characters. When you specify e-mail addresses, do not use forward or backward matching. If you use them, the e-mail address is not recognized correctly. This is because the From, To, and other headers contain additional characters before and after the e-mail address (example: "Xxx Yyy <aaa@example. com>"). If you use other language than English (for example, Japanese), the comparison is performed by using the UTF-8 codes. The Subject field and filename are converted to UTF-8 before being compared. The conversion is done for "encoded-word ("=?" charset "?" encoding "?" encoded-text "?=")" written in RFC-2047. To scan for character sets other than UTF-8 (such as Shift-JIS or Unicode), specify the codes as hexadecimal values. For example, specify the following to search for the text "" in Shift-JIS format: \x8a¥xae¥x91¥x53¥x96¥xb3¥x97¥xbf You can use utilities such as the following to perform the kanji code conversion. Linux: Use the iconv command as follows: # echo -n '<search character string>' | iconv -f <character set currently used in Linux> -t <character set into which to convert> | od -t x 1 Example: # echo -n '' | iconv -f EUC-JP -t SJIS | od -t x1 0000000 8a ae 91 53 96 b3 97 bf 0000010 * Insert "¥x" in front of each hexadecimal value. (Example: \x8a¥xae¥x91¥x53¥x96¥xb3¥x97¥xbf) Windows: Use a utility program such as the following: StrHex(http://www. pleasuresky. co. jp/strhex. php3) Comparison method Specifies how to compare text. Case sensitive Distinguish between upper and lower case characters when comparing. Prefix search Compare whether the leading characters of the specified field match the character string. 58 F-Secure Internet Gatekeeper for Linux/Administrator's Guide In the text body, this checks whether the character string matches the leading characters of each line. Prefix search cannot be used for the HTML body. Backward search Compare whether the trailing characters of the specified field match the character string. In the text body, this checks whether the character string matches the trailing characters of each line. Backward matching cannot be used for the HTML body. Not The rule is satisfied if there is no match with the specified character string. "AND" with previous rule The rule is satisfied if both the specified rule and the previous rule are satisfied. In this case, the previous rule is typically set to "no action". "AND" with previous rule in the same MIME part The rule is satisfied if both the specified rule and the previous rule are satisfied for the same MIME part. You can use this to specify a rule for both the Content-Type and file name of an attached file, for example. In this case, the previous rule is typically set to "no action". When you specify e-mail addresses, do not use forward or backward matching. If you use , the e-mail address is not recognized correctly. [. . . ] In addition, the process uses a single process for administration. Around 50 MB of memory cannot be shared per process. 163 F-Secure Internet Gatekeeper for Linux/Administrator's Guide 11. 14 Detection Names If F-Secure Internet Gatekeeper for Linux detects a virus, the virus name is recorded in a log. Detailed information on viruses can be found on the following web page: http://www. f-secure. com/v-descs/ If you specify certain conditions, the product can detect other information besides viruses. These detection names begin with "FSIGK/" and they are listed below: FSIGK/POLICY_FORMAT_MIME_BOUNDARY Invalid character in the boundary section of the mail header (Invalid character: '"', codes below 0x1f, codes above 0x7f) FSIGK/POLICY_FORMAT_MIME_FILENAME Invalid character in the file name section of the mail header (Invalid character: Codes below 0x1f (not including 0x1b)) FSIGK/POLICY_BLOCK_ENCRYPTED Encrypted file (if encrypted files are denied) FSIGK/POLICY_BLOCK_SCRIPT HTML file including scripts (if scripts are denied) FSIGK/POLICY_BLOCK_ACTIVEX HTML file including ActiveX (if ActiveX is denied) FSIGK/POLICY_BLOCK_PARTIAL_MESSAGE Partial message (if partial messages are denied) FSIGK/POLICY_BLOCK_MAXNESTED Archive file that contains more than the allowed nest levels (if the maximum nest level of archive files is denied in block_maxnested=yes) FSIGK/POLICY_BLOCK_SCANTIMEOUT Scan times out (if scans are denied if they reach the maximum allowed time which is set in block_scantimeout=yes) FSIGK/POLICY_BLOCK_MESSAGESIZE Mail size is greater than the maximum size allowed (if the mail size is set or if a mail is greater than 2 GB (block_messagesize_len=xxx)) FSIGK/POLICY_BLOCK_FILESIZE File size is greater than the maximum size allowed (If the file size limit is set in block_filesize=yes) FSIGK/SPAM_LIST/CUSTOM/(Condition number)/(Header field name) Spam detected by a specific condition. [. . . ]