User manual NOD32 ESET FILE SECURITY FOR LINUX/BSD/SOLARIS

[. . . ] ESET File Security Installation Manual and User Guide Linux, BSD and Solaris Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. 1 Main functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. 2 Key features of the system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2. Terminology and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3. Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4. [. . . ] See the following topics in this section for detailed information. Please note that this section is relevant only for Linux OS users and contains information regarding the operation, installation and configuration of the On-access scanner using the preload library ‘libesets_pa c. so’. 11 5. 3. 1 Operation principle The On-access scanner libesets_pa c. so (ESETS Preload library based file Access Controller) is a shared objects library which is activated at system start-up. This library is used for LIBC calls by file system servers such as FTP server, Samba server etc. Every file system object is scanned based on customizable file access event types. The following event types are supported by the current version: Open events This file access type is activated if the word ‘open’ is present in the ‘event_ma sk’ parameter in the esest. cfg file ( [pa c] section). Close events This file access type is activated if the word ‘close’ is present in the ‘event_ma sk’ parameter in the esets. cfg file ( [pa c] section). In this case, all file descriptor and FILE stream close functions of the LIBC are intercepted. Exec events This file access type is activated if the word ‘exec’ is present in the ‘event_ma sk’ parameter in the esets. cfg ( [pa c] section). In this case, all exec functions of the LIBC are intercepted. All opened, closed and executed files are scanned by the ESETS daemon for viruses. Based on the result of such scans, access to given files is denied or allowed. 5. 3. 2 Installation and configuration The libesets_pa c. so library module is installed using a standard installation mechanism of the preloaded libraries. One has just to define the environment variable ‘LD_PRELO A D’ with the absolute path to the libesets_pa c. so library. For more information, please refer to the ld. so(8 ) man page. NOTE: It is important that the ‘LD_PRELO A D‘ environment variable is defined only for the network server daemon processes (ftp, Samba, etc. ) that will be under control of the On-access scanner. Generally, preloading LIBC calls for all operating system processes is not recommended, as this can dramatically slow the performance of the system or even cause the system to hang. In this sense, the ‘/etc/ld. so. preload’ file should not be used, nor should the ‘LD_PRELOAD‘ environment variable be exported globally. Both would override all relevant LIBC calls, which could lead to system hang-up during initialization. To ensure that only relevant file access calls within a given file system are intercepted, executable statements can be overridden using the following line: LD_PRELOAD=/usr/lib/libesets_pac. so COMMAND COMMAND-ARGUMENTS where ‘COMMAND COMMAND-ARGUMENTS’ is the original executable statement. Review and edit the [g loba l] and [pa c] sections of the ESETS configuration file (esets. cfg). In order for the On-access scanner to function correctly, you must define the file system objects (i. e. directories and files) that are required to be under control of the preload library. This can be achieved by defining the parameters of the ‘ctl_incl’ and ‘ctl_excl’ options in the [pa c] section of the ESETS configuration file. [. . . ] The modules are created in the following directory: @BASEDIR@ This is the directory where the ESETS daemon loads modules from and thus can be redefined using the ‘ba se_dir’ option in the [g loba l] section of the ESETS configuration file. 7. 3 ESETS mirror http daemon ESETS mirror http daemon is installed automatically with ESET File Security. The http mirror daemon starts if the option ‘a v_mirror_httpd_ena bled’ in the [g loba l] section of the ESETS configuration file is set to ‘yes’ and the Mirror is enabled. Options ‘a v_mirror_httpd_port’ and ‘a v_mirror_httpd_a ddr’ define the port (default 2221) and address (default: all local tcp addresses) where the http server listens. The option ‘a v_mirror_httpd_a uth_mode’ allows access authentication (default: none) to be changed to basic. [. . . ]