© 2011 "Doctor Web"

Dr.Web, SpIDer Mail, SpIDer Guard, CureIt!, CureNet!, AV-desk,
Dr.WEB
Doctor Web

Doctor Web

Dr.Web® Antivirus for UNIX File Servers
6.0.0
Administrator Manual
18.10.2011
2-12A, 3rd str. Yamskogo polya
Moscow, Russia
125124www.drweb.com+7 (495) 789-45-87

Doctor Web
Dr.WebR

Dr.WebDr.Web

1992

4

7
7
8
9
10

14
Distribution Package for UNIXsystems

14

Dr.Web Samba VFS
SpIDer17

Distribution Package for UNIX
Systems

18

Distribution Package for UNIX Systems

19

GUI

19

GUI

26
29
35

38
Dr.Web for UNIX File Servers

40

Linux Solaris

40

FreeBSD

40

SELinux

OS Scanner Daemon

Dr.Web Updater

41

43
43

Administrator Manual

5
cron

44
45
46
50

Dr.Web Control Agent

52
52
54
54

[Logging]

54[Agent]55[Server]

56[EnterpriseMode]

57[StandaloneMode]

59[Update]60

Dr.Web Unix Control Agent

61
62
63

Dr.Web Monitor

68
68
69
70

[Logging]

70[Monitor]

71

Dr.Web Unix Monitor

74
75

Dr.Web Scanner

77

Administrator Manual

6
77
81
Dr.Web Scanner

94

Dr.Web Daemon

96
96
97

Dr.Web Daemon

107
108

Dr.Web Daemon

109
113

SAMBA

114
114

Dr.Web Samba SpIDer

114
115
116

Dr.Web console for UNIX file servers

126
126
130
131
132
136

138
139
139

Administrator Manual

7

Dr.Web for UNIX File Servers
Dr.Web for UNIX File Servers

Dr.Web for UNIX File Servers

Unix

OS

Dr.Web® Antivirus for UNIX File Servers for Linux
Dr.Web® Antivirus for UNIX File Servers for FreeBSD
Dr.Web® Antivirus for UNIX File Servers for Solaris x86
Dr.Web for UNIX File Servers Samba
Samba VFS SpIDer
DaemonSamba

vfs
Dr.WebDr.Web for UNIX File Servers
Dr.Web Samba VFS SpIDer - Samba

vfs
Dr.Web Daemon

Dr.Web Scanner Dr.Web Daemon - Samba VFS SpIDer
Dr.Web Monitor - Dr.Web
Dr.Web Control Agent - Dr.Web Enterprise Security Suite

Administrator Manual

8

Dr.Web Updater -Perl

Dr.Web Updater
Dr.Web Control Agent
Dr.Web Monitor
Dr.Web Scanner
Dr.Web Daemon
Samba
Dr.Web console for UNIX File Servers

Dr.Web for UNIX File Servers

OS
Linux
2.6
FreeBSD 6Intel x86
Solaris 10 Intel x86
32bit/64bit x86_64

64bit

32bit

:
Samba 3.0.x - 3.5.x
200MB
Web

50MB

Administrator Manual

9libglade2
libgtk2
libstdc++6
base64unzip
crontabGUI

X Window

GUI
Dr.WebWeb('+'): ALT+F1

ALT

F1%bin_dir, %etc_dir, %var_dir
OSAdministrator Manual10Linux, Solaris:%bin_dir = /opt/drweb/%etc_dir = /etc/drweb/%var_dir = /var/drweb/
FreeBSD:%bin_dir = /usr/local/drweb/%etc_dir = /usr/local/etc/drweb/%var_dir = /var/drweb/

Dr.Web for UNIX File Servers--- beginning of the file --[Section 1 name]Parameter1 = value1, ..., valueK...
ParameterM = value1, ..., valueK...
[Section X name]Parameter1 = value1, ..., valueK...
ParameterY = value1, ..., valueK--- end of the file --";""#"

Dr.Web for UNIX File Servers

Administrator Manual

11

Dr.Web for UNIX File Servers::

Names = XXXXX, YYYYY:

Names = XXXXX
Names = YYYYYParameterName = {xxxx}

numerical value - 0time 0smhd: 30s, 15m

size b0

Administrator Manual

12

k
m
g
: 20b, 15k

permissions : 755 (-rwxr-xr-x), 644 (-rw-r--r--)path to file/directory actions address - Dr.Web for UNIX File Servers
o inet - TCP
PORT@HOST_NAME
HOST_NAME
IP:

Address = inet:3003@127.0.0.1
o local -UNIX:

Address =drwebdo PID - PID

local:/var/drweb/run/.

text value string value Dr.Web for UNIX File Servers

Quiet, Error, Info, Alert, Notice, Warning, Verbose,

Administrator Manual

13

Debug Quiet

Dr.Web Samba VFS SpIDer : Debug,

Verbose,Info,

Alerts, Errors, Quiet
Dr.Web Daemon , Dr.Web Scanner : Error, Info, Notice,
Warning, Alert
Dr.Web Updater : Quiet, Error, Alert, Info, Debug,

VerboseAdministrator Manual

14

Dr.Web for UNIX File Servers
root

Dr.Web for UNIX File Servers
Package
Manager EPM
Window System
X Window

EPM

ESP
X
GUI
SystemGUI

Distribution Package for UNIXsystems
Dr.Web for UNIX File Servers

drweb-file-servers_[version number]~[OS name].
rundrweb-common:

drweb32.ini
drweb

drweb-bases:
rweb-common
drweb-libs:
drweb-epm6.0.0-libs: GUI

drweb
d

Administrator Manual

15

drweb-libs
drweb-epm6.0.0-uninst: GUI
drweb-epm6.0.0-libs
drweb-updater:
drweb-common, drweb-libs
drweb-boost144: Dr.Web Agent Dr.Web Monitor
drweb-libs
drweb-agent: Dr.Web Agentdrweb-common, drweb-boost144
drweb-daemon: Dr.Web Daemon
drweb-bases, drweb-libs
drweb-scanner: Dr.Web Scanner
drweb-bases, drweb-libs
drweb-monitor: Dr.Web Monitor
drweb-common, drweb-boost144
drweb-samba-web: Dr.Web Console for UNIX File
Servers Web

drwen-file-servers-doc: Dr.Web

for

UNIX

File

Servers

drweb-smbspider: Samba
SpIDerdrweb-libs

Sambadrweb-smbspider-src: Samba
64bit

drweb-libs drweb-libs32
64bit

32bit

Dr.Web for UNIX File Servers
CLI
GUI

Administrator Manual

16# chmod +x drweb-file-servers_[version number]~[OS name].run# ./drweb-file-servers_[version number]~[OSname].run
drweb-file-servers_[version number]~[OS name]
GUI

root

root
GUI

CLI

-noexec# ./drweb-file-servers_[version number]~[OSname].run --noexec
GUI# drweb-file-servers_[version number]~[OSname]/install.shGUI# drweb-file-servers_[version number]~[OSname]/[package].install%etc_dir/software/conf/[configuration_file_name].N

Administrator Manual

17[file_name].O
Samba
smb.confLinux:/usr/sbin/smbd
libsmb_spider.so.3.X.X
samba/vfs/smb_spider.soSamba/opt/drweb/lib/-->/usr/lib//etc/samba/smb.conf

Dr.Web Samba VFS
SpIDerSamba
Web Samba SpIDer

src

64bit

Samba

Dr.

drweb-smbspider-

Samba(http://us1.samba.org/samba/ftp/old-versions/).
Dr.Web Samba SpIDer# drweb-file-servers_[version number]~[OSname]]/drweb-smbspider-src.install[version
src/

drweb-file-servers_
number].src.tar.gz/usr//usr/src/# tar -xzvf drweb-smbspider-[version
number].src.tar.gz

Administrator Manual

18

drweb-smbspider-[version

number].src# ./configure –with-samba-source=/
directory/with/Samba/source/codes

m4 macroprocessor GCC

make

make

Dr.Web Samba SpIDer# make# make install

Distribution Package for UNIX
Systems
Dr.Web for UNIX File Servers# drweb-file-servers_[version number]~[OSname]/remove.sh
root

root

GUI

CLI

drweb

drweb

%etc_dir/software/conf/

Dr.Web[file_name].

O

Administrator Manual19/usr/lib/samba/vfs/smb_spider.
so

Samba
Remove link /usr/lib/samba/vfs/smb_spider.so
Please, update your config /etc/samba/smb.conf

Dr.Web for UNIX File Servers

smb.conf
vfs objects

vfs objects = smb_spider

Distribution Package for UNIX
Systems
Dr.Web for UNIX File Servers

GUI1.

# drweb-file-servers_[version number]~[OSname]/install.shGUI

Administrator Manual

20

1. GUI"Next""Cancel"2.

"Dr.Web
File Servers"for"Next"
2.

Administrator Manual

21

3.

Dr.Web"Custom Configuration"

3.

Custom Configuration

DrWeb anti-virus Daemon
Bases
DrWeb Common Files

DrWeb"Select
All""Select None"

4.

"Next"

Administrator Manual

22

4.

5.
"Accept and install""Next""Cancel installation""Next"

Administrator Manual

23

5.

6.

5
6.

drweb-file-servers_[version number]~[OS name]install.log

Administrator Manual24"Run interactive postinstall script"
Dr.Web for UNIX File Servers

7.

"Next"

Interactive post-install script

Dr.Web Samba SpIDer
Dr.WebDaemon, Dr.Web Agent, Dr.Web Monitor

Administrator Manual

25

8.

7.

Administrator Manual

26

9.

"Close"

GUI

GUI
1.

# drweb-file-servers_[version number]~[OSname]/remove.shGUI

Administrator Manual

27

10. GUI"Next""Cancel"2.
Dr.Web
EPM-packages
Dr.Web for UNIX File Servers
Dr.WebAdministrator Manual

28

11.

"Select
All""Select None"3.

"Next"
12.

Administrator Manual

29

4.
13.

5. "Close"

GUI

GUI

# drweb-file-servers_[version number]~[OS Name]/setup.sh

Administrator Manual

30

Dr.Web for UNIX File Servers

Y
N

Yes

No

Administrator Manual

31”Custom Configuration"

Administrator Manual32

Administrator Manual

33

Y

Yes

Dr.Web for UNIX File Servers

Administrator Manual

34

Dr.Web Samba SpIDer
Dr.WebDaemon,Dr.Web Agent, Dr.Web Monitor

Administrator Manual

35

GUI

Administrator Manual

36

Y

Yes

Administrator Manual

37

Administrator Manual

38

Dr.Web for UNIX File Servers

Dr.Web for UNIX File Servers

Dr.Web".key"

forUNIX File Servers %bin_dir

Dr.Web for UNIX File Servers

Dr.Webzip".key"zip

Dr.

Web Web".key"

Web

http://support.drweb.com/request/

Administrator Manual

39

Dr.Web for UNIX File Servers

25

25
http://support.drweb.com/

request/drweb32.ini

Key:

Key = %bin_dir/drweb32.key

2

Dr.WebDaemonDr.Web Scanner

Daemondrweb32.ini [Daemon]
MailCommand

Administrator Manual

Dr.Web for UNIX File Servers

Dr.Web for UNIX File Servers

Linux Solaris
Dr.Web for UNIX File Servers
1.
2. %bin_dir

drweb32.key
drweb32.ini

Key
Dr.Web Enterprise Security Suite
Dr.Web Control Agent

agent.

conf LicenseFile3.
4. %etc_dir drwebd.enable"1"
Dr.WebDaemon"0"
5. %etc_dir drweb-monitor.enable"1"
Dr.Web Monitor
6.
Dr.Web Daemon Dr.
Web Monitor
Dr.Web Monitor
Dr.Webfor UNIX File Servers
Dr.Web Control
Agent

FreeBSD
Dr.Web for UNIX File Servers
1.
2. %bin_dir

drweb32.key

Administrator Manual40

Dr.Web for UNIX File Servers

drweb32.ini
Key
Dr.Web Enterprise Security Suite
Dr.Web Control Agent

agent.

conf LicenseFile3.
4. /etc/rc.conf
Dr.Webdrweb_monitor_enable="YES"
Monitordrwebd_enable="YES"5.
Web Monitor
for UNIX File Servers

Dr.Web Daemon

Dr.Web Daemon Dr.
Dr.Web Monitor
Dr.WebDr.Web Control

Agent

SELinux

OS Scanner Daemon

SELinux

OS

Dr.Web Scanner Dr.Web Daemon

drweb-scanner drweb-daemon

policygentool

SELinxLinux:# policygentool drweb-scanner
real- Dr.Web Scanner%bin_dir/drweb.

#%bin_dir/drwebd.

policygentool

drweb-daemon

Administrator Manual

41

Dr.Web for UNIX File Servers

real- Dr.Web Daemon

3[module_name].te[module_name].fc[module_name].if[module_name].te
checkmodule -M -m -o module-name [module_name].
techeckpolicy

semodule_package -o [module_name].pp -m modulename

semodule -i [module_name].pp

Administrator Manual42

Dr.Web Updater

Dr.Web Updater
Dr.Web Updater

Dr.Web for UNIX File Servers
Perlupdate.pl

update.pl

Dr.Web for UNIX File Servers %bin_dir

Dr.Web

Updater%etc_dir/drweb32.ini[Updater]
update.pl$ %bin_dir/update.pl [parameters]

Dr.Web for UNIX File Servers".vdb"

drwXXXYY.vdb
YY 00

drwtoday.vdb
XXX:

drw60000.vdb

drwtoday.vdb
drwXXXYY.vdb

drwtoday.vdb
drwtoday.vdb

Dr.Web for UNIX File Servers %var_dir/bases/
drwrisky.vdb, drwnasty.vdb 2

Administrator Manual

43

Dr.Web Updater-

drwebase.vdb drwXXXYY.vdb drwtoday.vdb
drwtoday.vdb drwnasty.vdb dwnXXXYY.vdb dwntoday.vdb

dwntoday.vdb drwrisky.vdb dwrXXXYY.vdb dwrtoday.vdb

dwrtoday.vdb Dr.Web Updater /opt/drweb/update.pl30
crontab /etc/cron.d/drweb-update

cron
30

crontab /etc/cron.d/drweb-update

Administrator Manual

44

Dr.Web Updater

Dr.Web Updater--ini=path_to_configuration_file--what=component_to_be_updated
Component_to_be_updated

scanner

daemonUpdater--not-need-restart--not-need-restart--not-need-restart

update.pl

Dr.Web Daemon--not-need-restart

update.pl

Dr.Web Daemon--not-need-restart:$%bin_dir/update.plreload=drwebd--not-need-

Administrator Manual

45

Dr.Web Updater

Dr.Web Updater:%etc_dir/drweb32.ini[Updater] section
UpdatePluginsOnl
y = {Yes | No}

Yes
DaemonScanner:
UpdatePluginsOnly = No
Section{DaemonScanner}=|

Daemon Scanner--what--what:Section = Scanner

ProgramPath={path to file}

DaemonUpdater

ScannerDr.WebAPI:
ProgramPath = %bin_dir/drwebd
SignedReader={path to file}:
SignedReader
read_signed
LzmaDecoderPath= {path to file}=%bin_dir/lzma:
LzmaDecoderPath = %bin_dir

Administrator Manual46

Dr.Web Updater

LockFile = {pathto file}Dr.Web Updater:
LockFile
lock

CronSummary{Yes | No}

=

Yes

=

%var_dir/run/update.

Dr.Web

Updater
Updater cron:
CronSummary = Yes
DrlFile =to file}{path
URL
Dr.Web Updater
Dr.Web:
DrlFiledrl

CustomDrlFile ={path to file}=drl%var_dir/bases/update.

(*.drl)Dr.

Web:
CustomDrlFile
custom.drl

FallbackToDrl{Yes | No}

=

*.drl
Yes

=

%var_dir/bases/

Updater

CustomDrlFile

DrlFile:FallbackToDrl = Yes

Administrator Manual47

Dr.Web Updater

DrlDir = {pathto directory}

URL
Dr.Web
:
DrlDir = %var_dir/drl/

Timeout={numerical value
in seconds}:
Timeout = 90

Tries{numericalvalue}=

Dr.Web

Updater:

Tries = 3
ProxyServer={proxyservername or IP}

IP:
ProxyServer =ProxyLogin={proxyserveruser login}:
ProxyLogin =ProxyPassword ={proxyserveruser password}:
ProxyPassword =LogFileName={path to file orsyslogAdministrator Manual48

Dr.Web Updater:syslog}

LogFileName = syslog
SyslogFacility ={Daemon | Local0.. Local7 | Kern
| User | Mail}
LogLevel={Debug | Verbose| Info | Warning| Error | Quiet}
LotusdPidFile ={path to file}syslog:
SyslogFacility = Daemon:
LogLevel = Info
Lotus Daemon PID:
LotusdPidFile
drweblotusd.pid

MaildPidFile={path to file}=%var_dir/run/drweb-maild PID:
MaildPidFile = %var_dir/run/drwebmaild.pid

IcapdPidFile={path to file}

drweb-icapd PID:
IcapdPidFile=
drweb_icapd.pid

BlacklistPath ={pathtodirectory}%var_dir/run/.dws:BlacklistPath = %var_dir/dws

AgentConfPath ={path to file}

Agent
:

Administrator Manual49

Dr.Web Updater

AgentConfPath
conf
PathToVadeRetro= {path to file}=%etc_dir/agent.

libvaderetro.so:
PathToVadeRetrolibvaderetro.so=%var_dir/lib/

ExpiredTimeLimit= {number}:
ExpiredTimeLimit = 14
ESLockfile={path to file}

Dr.Web Updater cron:
ESLockfile=
es_updater.lock%var_dir/run/

1. Dr.Web Updater
2. Dr.Web Updater [Updater]
EnginePath, VirusBase, UpdatePath, PidFile
3. Dr.Web

Updaterlzma

lzma[Updater]

*.vdb
*.dws
LzmaDecoderPathlzma

Administrator Manual

50

Dr.Web Updater

4. Updating%var_dir/bases/

Administrator Manual51

Dr.Web Control Agent

Dr.Web Control Agent
Dr.Web Control Agent Agent
Dr.WebServers
Dr.Web for UNIX File Servers
Dr.Web Enterprise Security Suite
Monitor

for

UNIX

File

Dr.Web for UNIX File Servers

drweb-agent

Enterprise
Dr.Web Enterprise Security Suite
Dr.Web for UNIX File Servers
AgentStandalone Standalone
Agent
Enterprise Enterprise
Dr.Web for UNIX File Servers
Dr.Web Enterprise Security Suite
Dr.Web Enterprise
Security Suite

Dr.Web for UNIX FileEnterprise Security Suite
AgentStandalone

Servers

Dr.WebEnterprise1.

Administrator Manual52

Dr.Web Control Agent

2. Agent: %etc_dir/agent.conf[EnterpriseMode]
PublicKeyFile%var_dir/drwcsd.
Dr.Web Enterprise Security Suite

pub

Dr.Web Enterprise Security Suite

ServerHost

Dr.Web Enterprise Security

Suite IP
Dr.Web Enterprise Security
Suite
2193
3. Dr.Web Enterprise Security Suite
UserEnterpriseMode
Yes

ServerPort

Dr.Web for UNIX File Servers
MonitorEnterpriseStandalone
1. Agent: %etc_dir/agent.conf[StandaloneMode]
2. [EnterpriseMode]No

UseEnterpriseMode

Dr.Webfor UNIX File Servers

Administrator Manual53

Dr.Web Control AgentAgent-h, --help -v, --version - Agent-u, --update-all -f, --update-failed -C, --check-only -p, --newpwd - Dr.Web Enterprise Security Suite-d, --droppwd - Dr.Web Enterprise Security Suite
Dr.WebEnterprise

Security Suite-c <path to file>, --conf <path to file> -s <path to file>, --socket <socket> -P <path to file>, --pid-file <path to
file> - Agent PID-e <path to file>, --export-config <path
to file> - Dr.Web Enterprise Security Suite

Dr.Web Agent%etc_dir/agent.conf[Logging][Logging]

Dr.Web Agent

Administrator Manual54

Dr.Web Control Agent[Logging] section
AgentLevel = {Quiet |Error | Alert |Info | Debug}:
Level = Info

IPCLevel = {Quiet |Error | Alert |Info | Debug}

IPC:
IPCLevel = Error

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |User | Mail}
FileName = {path to
file or syslog}

syslog:
SyslogFacility = Daemon

syslog:FileName = syslog[Agent][Agent]Dr.Web Agent[Agent] section

MetaConfigDir ={path to directory}

drweb-agent
configuration files
Agent Dr.Web

meta-

Dr.Web:
MetaConfigDir = %bin_dir/

Administrator Manual55

Dr.Web Control Agent

agent/
UseMonitor = {Yes |No}

YesMonitor
File
Servers
drweb-agent

Dr.Web for UNIX:
UseMonitor = Yes
Agent Monitor

MonitorAddress ={address}

Monitor
Address:
MonitorAddress = local:%
var_dir/ipc/.monitor

MonitorResponseTime= {time in seconds}

drweb-monitor
MonitorAgent
drweb-monitor
Monitor:MonitorResponseTime = 5

PidFile = {path to
file}

Agent PID:
PidFile = %var_dir/run/drwebagent.pid[Server][Server]Dr.Web for UNIX File Servers

Dr.Web Agent[Server] section

Administrator Manual56

Dr.Web Control Agent

Agent

Address = {socket
address}:

Address = local:%var_dir/ipc/.
agent
Threads ={numerical value}

drweb-agent
Agent:
Threads = 2

Timeout = {time inseconds}

Agent

Dr.Web:Timeout = 15

[EnterpriseMode][EnterpriseMode]

Agent Enterprise[EnterpriseMode] section
UseEnterpriseMode ={Yes | No}Yes
drweb-agent"Enterprise mode""Standalone mode"No:
UseEnterpriseMode = No
ComputerName ={text value}

Dr.Web Enterprise Security Suite:
ComputerName =Administrator Manual57

Dr.Web Control Agent

VirusbaseDir ={path to directory}:
VirusbaseDir = %var_dir/bases
PublicKeyFile ={path to file}

Dr.Web Enterprise Security Suite:
PublicKeyFile = /opt/drweb/
drwcsd.pub
ServerHost = {IPaddress}

Dr.Web Enterprise Security Suite
IP:
ServerHost = 127.0.0.1

ServerPort = {portnumber}Dr.Web Enterprise Security Suite:
ServerPort = 2193

CryptTraffic = {Yes
| Possible | No}

Dr.Web Enterprise Security Suite
Agent:
CryptTraffic = possible

CompressTraffic ={Yes | Possible |No}

Dr.Web Enterprise Security Suite
Agent:
CompressTraffic = possible

Administrator Manual58

Dr.Web Control Agent

CacheDir = {path todirectory}

Dr.WebSecurity Suite

Enterprise:CacheDir = %var_dir/agent[StandaloneMode]
Agent Standalone[StandaloneMode][StandaloneMode] section
IP

StatisticsServer ={server address}:

StatisticsServer = stat.drweb.
com:80/update
StatisticsUpdatePer
iod = {time inminutes}:
StatisticsUpdatePeriod = 10

StatisticsProxy ={proxy server
address}

IP:
StatisticsProxy
localhost:3128=:
StatisticsProxy =StatisticsProxyAuth= {text value}:

Administrator Manual59

Dr.Web Control Agent

StatisticsProxyAuth
testpwd

=

test:

:
StatisticsProxyAuth =UUID = {identifier}
UUID

http://stat.drweb.com/
UUID
UUID

:
UUID =
LicenseFile = {pathto file}Dr.Web:
LicenseFile = %bin_dir/drweb32.key

ProtectedEmails ={lookups}:
ProtectedEmails = file:%
etc_dir/email.ini[Update]Dr.Web Enterprise Security Suite
Web for UNIX File Servers[Update]Dr.

[Update] section
CacheDir = {path todirectory}

Agent
:

Administrator Manual60

Dr.Web Control Agent

CacheDir = %var_dir/agent/cache
RegFile = {path tofile}:
RegFile = %var_dir/agent.reg
Timeout = {time inseconds}

Agent:
Timeout = 120

RootDir = {path todirectory}:
RootDir = /Dr.Web Enterprise Security Suite

Dr.Web Unix Control Agent"Configuration Services"

Yes

Dr.Web Agent

Agent
1.
Agent
2. [EnterpriseMode][Standalone]

Administrator Manual61

Dr.Web Control Agent

3. Agent Dr.Web
Agent

Dr.Web for UNIX File Servers
Security Suite

Enterprise

Dr.Web Enterprise
Agent

:

Agent
Dr.Web Enterprise Security Suite
Dr.Web Enterprise Security Suite
Agent

Dr.Web Enterprise Security Suite

Agent:
Agent Dr.Web

meta-configuration
meta-configuration[Agent]MetaConfigDir

meta-configuration

Agent

Agent metaconfiguration

amc-files

Application
EndApplication

id: Dr.Web Enterprise Security Suite
ConfFile:
Components:

ID

EndComponents

Administrator Manual62

Dr.Web Control Agent

Dr.Web Samba VFS SpIDer for Linuxamc-file:

Application "Dr.Web (R) SMB Filter"
ID

110

IniFile"/etc/drweb/smb_spider.conf"

Components
smb_spider
DaemonCommunication,
Scanning, Actions, Logging
EndComponents
EndApplication

Agent
drweb.com/

Dr.Webhttp://stat.

AgentEnterprise
Security Suite
Agent

Dr.WebEnterprise

UUID
MD5

UUID
UUID
UUID

Dr.Web
Agent

Agent

Dr.Webhttp://stat.drweb.com/

http://stat.drweb.com/

Dr.WebAdministrator Manual63

Dr.Web Control Agent

14.
:
1. Mail
2. Start date
3. Top4.

Files
End date
TOP:10 TOP:20
Plot graph

Administrator Manual64

Dr.Web Control Agent

5. QueryHTMLXML
http://info.drweb.com/export/xml/top

XML:<drwebvirustop
period="24"
top="5"vdbaseurl="http://info.drweb.com/
virus_description/"
updatedutc="2009-06-09
09:32:02"><item><vname>Win32.HLLM.Netsky</vname><dwvlid>62083</dwvlid><place>1</place><percents>34.201062139103</percents></item><item><vname>Win32.HLLM.MyDoom</vname><dwvlid>9353</dwvlid><place>2</place><percents>25.1303270912579</percents></item><item><vname>Win32.HLLM.Beagle</vname><dwvlid>26997</dwvlid><place>3</place><percents>13.4593034783378</percents></item><item><vname>Trojan.Botnetlog.9</vname><dwvlid>438003</dwvlid>

Administrator Manual65

Dr.Web Control Agent<place>4</place><percents>7.86446592583328</percents></item><item><vname>Trojan.DownLoad.36339</vname><dwvlid>435637</dwvlid><place>5</place><percents>7.31494163115527</percents></item></drwebvirustop>XML

period top updatedutc vname place percents -periodcom/view/<UID><UID>

http://stat.drweb.
MD5

http://stat.drweb.com/xml/<UID>
XML
<UID>
MD5
:

<drwebvirustop period="24" top="2" user="<UID>"
lastdata="2005-04-12 07:00:00+04">

Administrator Manual66

Dr.Web Control Agent<item><caught>69</caught><percents>24.1258741258741</percents><place>1</place><vname>Win32.HLLM.Netsky.35328</vname></item><item><caught>57</caught><percents>19.9300699300699</percents><place>2</place><vname>Win32.HLLM.MyDoom.54464</vname></item></drwebvirustop>XML

period top user lastdata vname place caught percents -periodAdministrator Manual67

Dr.Web Monitor

Dr.Web Monitor
Dr.Web Unix Monitor
Dr.Web Unix Monitor

Dr.Web for UNIX File Servers
MonitorMonitorMonitorMonitorMonitorDr.Web Enterprise Security Suite
File Servers

Dr.Web for UNIXEnterprise

MonitorStandalone Standalone
MonitorEnterprise Enterprise
Dr.Web for UNIX File Servers
Dr.Web Enterprise Security Suite
Dr.Web Enterprise
Security Suite

Administrator Manual68

Dr.Web Monitor

Dr.Web for UNIX FileEnterprise Security Suite
Monitor Standalone

Servers

Dr.WebEnterprise1.
2. Monitor

conf%etc_dir/monitor.
Yes

UseEnterpriseMode

Dr.Web for UNIX File Servers
AgentEnterpriseStandalone
1. Monitor%etc_dir/monitor.

conf
Monitor[Monitor]
2. [Monitor]

RunAppList

UseEnterpriseMode

No

Dr.Webfor UNIX File Servers

Dr.Web Monitor-h, --help -Administrator Manual69

Dr.Web Monitor-v, --version - Monitor-u, --update -C, --check-only -A, --check-all -c <path to file>, --conf <path to file> -r, --run component1[,component2]:-r AGENT, DAEMON

Dr.Web Monitor%etc_dir/monitor.conf[Logging]
Dr.Web Monitor[Logging][Logging] section
Level = {Quiet |Error | Alert |Info | Debug}

Monitor:Level = Info

IPCLevel = {Quiet |Error | Alert |Info | Debug}

IPC:
IPCLevel = Error

SyslogFacility ={Daemon | Local0 ..

syslogAdministrator Manual70

Dr.Web Monitor:

Local7 | Kern |User | Mail}

SyslogFacility = Daemon

FileName = {syslog| path to file}syslog:FileName = syslog[Monitor][ Monitor]

Monitor[Monitor] section

RunForeground{Yes | No}=

MonitorYesNo
daemontools
Yes:
RunForeground = No
User = {text value}

Monitor:
User = drweb

Groupvalue}={text

Monitor:Group = drweb

PidFileDir = {pathto directory}

Monitor PID

Administrator Manual71

Dr.Web Monitor:
PidFileDir = %var_dir/run/
ChDir = {path todirectory}

MonitorMonitor:
ChDir = /MetaConfigDir ={path to directory}meta-configuration files
Monitor Dr.
Web
Dr.Web:
MetaConfigDir = %etc_dir/
monitor/
Address = {socket
address}

Monitor:
Address = local:%var_dir/ipc/.
monitor

Timeout = {time inseconds}

MonitorDr.Web:Timeout = 5
TmpFileFmt = {textvalue}

path_to_file.XXXXXX X :Administrator Manual72

Dr.Web Monitor

TmpFileFmt = %var_dir/msgs/
tmp/monitor.XXXXXX
RunAppList = {textvalue}

MonitorDr.Web:RunAppList = AGENT
UseEnterpriseMode ={Yes | No}

Enterprise
YesEnterprise
Monitor
RunAppList
Agent
No

Standalone:

UseEnterpriseMode = No
RecoveryTimeList={time in seconds}
1

2:
RecoveryTimeList = 0,30,60
InjectCmd ={string}:
InjectCmd = "/usr/sbin/

Administrator Manual73

Dr.Web Monitor

sendmail -t"
Monitor Agent
Agent
Agent

AgentAddress ={socket address}

Dr.WebAddress:
AgentAddress = local:%var_dir/
ipc/.agent
AgentResponseTime ={time in seconds}

drweb-agent
Agent
Monitor drweb-agent
Agent:
AgentResponseTime = 5

Dr.Web Unix Monitor"Configuration Services"

Yes

Dr.Web Monitor

Monitor
1. Monitor
2. daemon
3.

Monitor

4. PID

PID

Administrator Manual74

Dr.Web Monitor

5. drweb-monitor
MonitorDr.Web Monitor"1"%etc_dir/drweb-monitor.enable
Linux

Solaris/etc/rc.conf
drweb_monitor_enable="YES"FreeBSD

mmc-files

mmc-files

Dr.

Web Monitor

Application
EndApplication

FullName Path Depends DAEMON

.

AGENT

Components
EndComponents-

Dr.Web Daemon for Linux mmc-file:

Application "DAEMON"
FullName"Dr.Web (R) Daemon"Path"/opt/drweb/"

Depends"AGENT"

Administrator Manual75

Dr.Web Monitor

Components# namemaxStopTime

args
maxStartTime
NotifyType UserGroupdrwebd "-a=local:/var/drweb/ipc/.agent--foreground=yes" 30 10 MAIL drweb:drweb
EndComponents
EndApplication

Administrator Manual76

Dr.Web Scanner

Dr.Web Scanner
Dr.Web Scanner

Dr.Web Scanner$ %bin_dir/drweb <path> [parameters]<path>
Scanner/path/file infected [virus] VIRUS_NAME

Report for "/opt/drweb/tmp":
Scanned: 34/32

Cured

Infected

: 0

: 5/5

Removed : 0

Modifications : 0/0

Renamed : 0

Suspicious

Moved

: 0

Speed

: 5233: 0/0

Scanning time : 00:00:02
KB/s

eicar.rus
eicar.rus
eicar.com
Dr.Web Scanner eicar.com

Administrator Manual77

Dr.Web Scanner%bin_dir/doc/eicar.com infected by Eicar
Test File (Not a Virus!)
Eicar Test File68
Scanner-ar

Scanner("- ")-?, -h, -help$ %bin_dir/drweb -h:path @[+]<file> sd fl :alar[d|m|r][n]ARJ, CAB,GZIP, RAR, TAR, ZIP etc

cn[d|m|r][n]

HTML,

RTF,

PowerPoint etc

ml[d|m|r][n]Administrator Manual78

Dr.Web Scanner

LZEXE, DIET, PKLITE,

upn
EXEPACK

FilesTypes

ex
ha
d
m
r
n
:

cu[d|m|r]
ic[d|m|r]sp[d|m|r]adw[d|m|r|i]dls[d|m|r|i]jok[d|m|r|i]
rsk[d|m|r|i]hck[d|m|r|i]
d
m
r
i
:

v, version

Scannerki
foreground[yes|no]
ot
oq
ok

UTF8
Scanner"Ok"

Administrator Manual79

Dr.Web Scanner

log=<path to file>
ini=<path to file>
lng=<path to file>-a=<Agent address> - Scanner--only-key

-

Agent

Scanner"-"-ar -cu -ha -ic -fl -ml -ok -sd -sp:$ drweb <path> -haScanner-ar -ha -fl- -ml -sd

cu
icd
spm
spr

Administrator Manual

80

Dr.Web Scanner

cu

Scanner

ScannerdScanner

Scannerr
eicar. #om"#"

Scannerm:%var_dir/infected/:$ drweb <path> -cu -icd -spm -ar -ha -fl-ml -sd# chmod a+x [file name]ScannerDr.Web Scanner
Scanner:%etc_dir/drweb32.ini-ini

Administrator Manual81

Dr.Web Scanner

Scanner$ %bin_dir/drweb -ini=%bin_dir/etc/drweb.
ini[Scanner]
drweb32.dll

EnginePath = {pathto file}:EnginePathdrweb32.dll
VirusBase = {pathto file}=%var_dir/lib/

"*"

","

:
VirusBase = %var_dir/bases/*.
vdb
UpdatePath = {pathto directory}

Updater

update.pl:

UpdatePath = %var_dir/updates/
TempPath = {path todirectory}:
TempPath = /tmp
LngFileName = {pathto file}:LngFileName = %bin_dir/lib/
ru_scanner.dwl

Administrator Manual82

Dr.Web Scanner

Key = {path to
file}:
Key = %bin_dir/drweb32.key

OutputMode ={Terminal | Quiet}

drweb
Terminal -Quiet -:
OutputMode = Terminal
HeuristicAnalysis ={Yes | No}:
HeuristicAnalysis = Yes
ScanPriority ={value}Scanner–20 ~ 19 Linux

20 Linux:
ScanPriority = 0
FilesTypes = {ext}

ScanFiles

ByType"*" "?":
FilesTypes = EXE, COM, SYS,
OV?, BAT, BIN, DRV, PRG, BOO,

Administrator Manual

83

Dr.Web Scanner

SCR, CMD, VXD, 386, DLL, FON,
DO?, XL?, WIZ, RTF, CL*, HT*,
VB*, JS*, INF, AR?, ZIP, R??,
PP?, OBJ, LIB, HLP, MD?, INI,
MBR, IMG, CSC, CPL, MBP, SHS,
SHB, PIF, SO, CHM, REG, XML,
PRC, ASP, LSP, MSO, OBD, THE*,
NWS, SWF, BMP, MPP, OCX, DVB,
CPY, MSG, EML
FilesTypesWarnings= {Yes | No}
ScanFiles

ByType:FilesTypesWarnings = Yes
ScanFiles = {All |ByType}All
ByTypeFileType:
ScanFiles = All

ScanSubDirectories= {Yes | No}:
ScanSubDirectories = Yes
CheckArchives ={Yes | No}

ZIP, RAR, ARJ, TAR, GZIP, CAB:

Administrator Manual84

Dr.Web Scanner

CheckArchives = Yes
CheckEMailFiles ={Yes | No}:
CheckEMailFiles = Yes
ExcludePaths ={path to directory}:
ExcludePaths = /proc,/sys,/dev

FollowLinks = {Yes
| No}:
FollowLinks = No
RenameFilesTo ={mask}
"#??"
"#"

"#"
"

??"
eicar.com
eicar.#om".#":
RenameFilesTo = #??
MoveFilesTo = {pathto directory}:
MoveFilesTo = %var_dir/
infected

EnableDeleteArchive
Action = {Yes | No},

multipart, htmlAdministrator Manual

85

Dr.Web Scanner

mbox:
EnableDeleteArchiveAction = No
InfectedFiles ={Report | Cure |Delete | Move |Rename | Ignore}

Report Cure Delete Move Rename Ignore Delete, Move, Rename:
InfectedFiles = Report
SuspiciousFiles ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :SuspiciousFiles = Report

IncurableFiles ={Report |Delete |Move | Rename |Report -Administrator Manual86Dr.Web Scanner

Ignore}Delete Move Rename Ignore :IncurableFiles = Report

ActionAdware ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionAdware = Report

ActionDialers ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionDialers = Report

ActionJokes ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore -Administrator Manual

87

Dr.Web Scanner:
ActionJokes = Report
ActionRiskware ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionRiskware = Report

ActionHacktools ={Report | Delete |Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionHacktools = Report

ActionInfectedMail= {Report | Delete| Move | Rename |Ignore}Report Delete Move Rename Ignore :ActionInfectedMail = Report

Administrator Manual88

Dr.Web Scanner

ActionInfectedArchive = {Report |Delete | Move |Rename | Ignore}

Report Delete Move Rename Ignore :ActionInfectedArchive = Report

ActionInfectedConta
iner = {Report |Delete | Move |Rename | Ignore}

Report Delete Move Rename Ignore :ActionInfectedContainer =ReportLogFileName = {filename or syslog}

syslog
SyslogFacility SyslogPriority:
LogFileName = syslog

SyslogFacility ={Daemon | Local0 ..
Local7 | Kern |User | Mail}syslog:
SyslogFacility = User

Administrator Manual

89

Dr.Web Scanner

SyslogPriority ={Alert | Warning |Notice | Info |Error}
LimitLog = {Yes |No}syslog:
SyslogPriority = Info

LogFileName = syslog
yes

Scanner.bak
MaxLogSize:
LimitLog = No
MaxLogSize ={value}LimitLog = Yes
0:
MaxLogSize = 512

LogScanned = {Yes |
No}

Yes
:
LogScanned = Yes

LogPacked = {Yes |No}

DIET, PKLITE

Yes

?

:
LogPacked = Yes
LogArchived = {YesYes

Administrator Manual

90

Dr.Web Scanner

:

| No}

LogArchived = Yes
LogTime = {Yes |No}

Yes
LogFileName=

syslog:
LogTime = Yes
LogStatistics ={Yes | No}

Yes:
LogStatistics = Yes

RecodeNonprintable= {Yes | No}:
RecodeNonprintable = Yes
RecodeMode ={Replace |QuotedPrintable}

RecodeNonprintable = Yes
Replace

RecodeChar
quoted-QuotedPrintable
printable:

RecodeMode = QuotedPrintable
RecodeChar = {"?" |"_" | ...}

RecodeMode=

Replace:
RecodeChar = "?"Administrator Manual91

Dr.Web Scanner

MaxCompressionRatio= {value}:
MaxCompressionRatio = 5000
CompressionCheckThreshold = {value}:CompressionCheckThreshold
500000(

MaxFileSizeToExtract = {value}=):
MaxFileSizeToExtract = 500000
MaxArchiveLevel ={value}:MaxArchiveLevel = 8
MaximumMemoryAlloca
tionSize = {valuein Mbytes}"0":Administrator Manual

92

Dr.Web Scanner

MaximumMemoryAllocationSize =0ScannerScanTimeout= {time in seconds}"0":
ScannerScanTimeout = 0
MaxBasesObsolescenc
ePeriod = {time inhours}"0":
MaxBasesObsolescencePeriod =24
ControlAgent ={Agent socket
address}

Agent
inet - TCP

local- UNIX, unix:ControlAgent =inet:4040@127.0.0.1,local:%
var_dir/ipc/.agent:
ControlAgent = local:%var_dir/
ipc/.agent
OnlyKey = {Yes |
No}

Yes

Scanner

Agent

Administrator Manual

93

Dr.Web Scanner

No

Scanner

Agent:
OnlyKey = No

Dr.Web Scanner
Dr.Web Scanner$ %bin_dir/drweb%bin_dir"drweb"Dr.Web Scanner

PATH
Dr.Web Scannerroot

ScannerDr.Web (R) Scanner for Linux, v6.0.1 (February
19, 2010)
Copyright (c) Igor Daniloff, 1992-2010
Support service: http://support.drweb.com/
To purchase: http://buy.drweb.com/
Program version: 6.0.1.10060 <API:2.2>
Engine version: 6.0.1.9170 <API:2.2>
Loading /var/drweb/bases/drwtoday.vdb
virus records: 1533-

Ok,

Loading /var/drweb/bases/drw60012.vdb
virus records: 3511-

Ok,

Administrator Manual

94

Dr.Web Scanner-------------------------------------------Loading /var/drweb/bases/drw60000.vdb
virus records: 1194-

Ok,

Loading /var/drweb/bases/dwn60001.vdb
virus records: 840-

Ok,

Loading /var/drweb/bases/drwebase.vdb
virus records: 78674-

Ok,

Loading /var/drweb/bases/drwrisky.vdb
virus records: 1271-

Ok,

Loading /var/drweb/bases/drwnasty.vdb
virus records: 4867-

Ok,

Total virus records: 538681
Key file: /opt/drweb/drweb32.key
Key file number: XXXXXXXXXX
Key file activation date: XXXX-XX-XX
Key file expiration date: XXXX-XX-XX

Scanner

Administrator Manual

95

Dr.Web Daemon

Dr.Web Daemon
Dr.Web Daemon

Dr.WebDr.WebDaemonDr.Web Daemon

Dr.Web for UNIX File Servers
SpIDer Dr.Web Daemon

Samba Dr.Web Samba VFS

Dr.Web Daemon"-"-?, -h-help$ drwebd -hDr.Web Daemon-ini=<path to file>-lng=<path to file>ru_daemon.dwl--foreground=<yes|no>"Yes"
DaemonDaemon--check-onlyline<command"No"parametersfor

Administrator Manual96

Dr.Web Daemon

checking>-a=<Agent address>--only-key

Daemon
Agent

Agent

Dr.Web Daemon
Daemon(:%etc_dir/drweb32.ini)-ini[Daemon]EnginePathto file}=drweb32.dll{path:
EnginePathdrweb32.dll

VirusBase ={listof files or masks}=%var_dir/lib/

"*"

","

=

%var_dir/bases/*.

:
VirusBasevdb
UpdatePath =to directory}{path

Updater update.pl:
UpdatePath = %var_dir/updates/

Administrator Manual

97

Dr.Web Daemon

TempPath = {path todirectory}
TempPath = %var_dir/spool/
Key
=
file}

{path

to
:
Key = %bin_dir/drweb32.key

MailAddressesList{path to file}

=
15

30

:
MailAddressesList
email.ini
OutputMode={Terminal | Quiet}=%etc_dir/drweb
Terminal -Quiet -:
OutputMode = Terminal
RunForeground{Yes | No}=

DaemonYesNodaemontools:
RunForeground = No
User = {user name}

Daemon:User = drweb

Administrator Manual98

Dr.Web Daemon

PidFile
file}

=

{path

to

Daemon PID:
PidFile = %var_dir/run/drwebd.
pid

BusyFile = {path tofile}

DaemonPID/var/run/drwebd.
bsy.123456:
BusyFile
drwebd.bsy

ProcessesPool{processsettings}

=
pool

=

%var_dir/run/auto N -1

N-M - 1N
M
timeout=
seconds} -

{time

in

N

stop_timeout
seconds} -

=

{time

in

:
ProcessesPool = auto,timeout=120,stop_timeout=1,stat=no

Administrator Manual99

Dr.Web Daemon

OnlyKey
No}

=

{Yes

|

Yes

Agent

No

Agent
:

OnlyKey = No
ControlAgent{socket address}

=

Agent
inet - TCP
unix - UNIX

local
:

ControlAgent
inet:4040@127.0.0.1,local:%
var_dir/ipc/.agent=:
ControlAgent = local:%var_dir/
ipc/.agent
MailCommand{command}=DaemonUpdater:

MailCommandsendmail -i
root"
NotifyPeriod{value}=-bm"/usr/sbin/-f drweb --

=
"0"

:
NotifyPeriod = 14

Administrator Manual

100

Dr.Web Daemon

NotifyFile
to file}

=

{path

:
NotifyFile = %var_dir/.notify
NotifyType = {Ever| Everyday | Once}
Once - 1
Everyday Ever - Daemon:
NotifyType = Ever
FileTimeout={value in seconds}

1:
FileTimeout = 30
1

StopOnFirstInfected= {Yes | No}:
StopOnFirstInfected = No
ScanPriority{value}=Daemon–20 ~ 19 (Linux)

20 (Linux):
ScanPriority = 0
FilesTypes = {listof file extensions}

ScanFiles"*"

ByType"?"Administrator Manual101

Dr.Web Daemon:
FilesTypes = EXE, COM, SYS,
OV?, BAT, BIN, DRV, PRG, BOO,
SCR, CMD, VXD, 386, DLL, FON,
DO?, XL?, WIZ, RTF, CL*, HT*,
VB*, JS*, INF, AR?, ZIP, R??,
PP?, OBJ, LIB, HLP, MD?, INI,
MBR, IMG, CSC, CPL, MBP, SHS,
SHB, PIF, SO, CHM, REG, XML,
PRC, ASP, LSP, MSO, OBD, THE*,
NWS, SWF, BMP, MPP, OCX, DVB,
CPY, MSG, EML
FilesTypesWarnings= {Yes | No}
ScanFiles

ByType:FilesTypesWarnings = Yes
ScanFiles
ByType}

=

{All

|
All
ByTypeFileType:
ScanFiles = All

CheckArchives{Yes | No}=
ZIP, RAR, ARJ, TAR, GZIP, CAB:
CheckArchives = Yes

Administrator Manual102

Dr.Web Daemon

CheckEMailFiles{Yes | No}=:
CheckEMailFiles = Yes

ExcludePaths{path}=:
ExcludePaths = /proc,/sys,/dev

FollowLinks
| No}

=

{Yes
:
FollowLinks = No

RenameFilesTo{mask}

=
"#??"
"#"

"#"
"

??"
eicar.com
eicar.#om".#":
RenameFilesTo = #??
MoveFilesTo = {pathto directory}:
MoveFilesTo
infected/=%var_dir/Cure

BackupFilesTo={path to directory}:

Administrator Manual

103

Dr.Web Daemon

BackupFilesTo
infected/
LogFileName = {filename or syslog}=%var_dir/syslog
SyslogFacility SyslogPriority:
LogFileName = syslog

SyslogFacility={Daemon | Local0 ..
Local7|
Kern|
User | Mail}syslog

SyslogPriority{Alert | Warning
Notice|InfoError}=||

syslogLimitLog
No}

|

=

{Yes

:
SyslogFacility = Daemon:
SyslogPriority = Info:
LimitLog = No

MaxLogSize = {valuein Kbytes}

LimitLog = Yes
0:
MaxLogSize = 512

LogScanned = {Yes |
No}

Yes
:
LogScanned = Yes

Administrator Manual

104

Dr.Web Daemon

LogPacked
No}

=

{Yes

|

DIET, PKLITE

Yes

?

:
LogPacked = Yes
LogArchived
| No}

=

{Yes

Yes
:
LogArchived = Yes

LogTime
No}

=

{Yes

|

Yes
LogFileName=

syslog:
LogTime = Yes
LogProcessInfo{Yes | No}

=

PID

Yes
IP
:
LogProcessInfo = Yes

RecodeNonprintable= {Yes | No}:
RecodeNonprintable = Yes
RecodeMode{Replace
QuotedPrintable}=|

RecodeNonprintable = Yes
Replace

RecodeChar

QuotedPrintable
printable

quoted-:Administrator Manual

105

Dr.Web Daemon

RecodeMode = QuotedPrintable
RecodeChar = {"?" |"_" | ...}

RecodeMode=

Replace:
RecodeChar = "?"Socket=address}{socketinet - TCP
unix - UNIX

local

Socket = inet:3000@127.0.0.1,local:%
var_dir/.drwebd

Socket = 3000 127.0.0.1, 192.168.0.100

Socket = %var_dir/.drwebd 0660

Socket3000 0.0.0.0:
Socket = %var_dir/run/.daemon
Socket = 3000, localhost
SocketTimeout={value in seconds}:
SocketTimeout = 10

Administrator Manual106

Dr.Web Daemon

MaxCompressionRatio= {value}:
MaxCompressionRatio = 500
CompressionCheckThreshold = {value in
Kbytes}:CompressionCheckThreshold
1024=

MaxFileSizeToExtract={valuein
Kbytes}:MaxFileSizeToExtract = 40960
MaxArchiveLevel{value}=:MaxArchiveLevel = 8

Dr.Web Daemon
DaemonAdministrator Manual107

Dr.Web Daemon-ini%etc_dir/drweb32.ini

DaemonDaemon/var/log/

DaemonUser

drweb
Engine drweb32.dll

EnginedaemonDaemonDr.Web for UNIX File Servers

Daemon PID

Daemonpid

Dr.Web Daemon

SIGHUPSIGTERM
SIGKILL

DaemonDaemonAdministrator Manual108

Dr.Web Daemon

Dr.Web Daemon
Daemon$ netstat -a

TCP:--- cut --Active Internet connections (servers andestablished)
Proto Recv-Q Send-Q
Address State
tcp

0

0

raw

0

0 *:icmp

*:*

raw

0

0 *:tcp*:*

Local Address

localhost:3000*:*

Foreign

LISTEN

7
7

Active UNIX domain sockets (servers andestablished)
Proto

RefCnt

Flags

Type

I-NodePath

LISTENING

384

/dev/

unix 0gpmctl[ ACC ]unix

[ ]STREAM

CONNECTED

190

unix 1 [ ]@00000031

STREAM

CONNECTED

1091

0

unix 0 [ ACC ]font-unix/fs7100
unix

STREAM

State

STREAM

LISTENING

4

[ ]

DGRAM

293

unix 1
gpmctl[ ]STREAM

CONNECTED

unix

0

[ ]

DGRAM

450

unix

0

[ ]

DGRAM

433

unix

0

[ ]

DGRAM

416

@0000001b

403 /tmp/.

/dev/log
1092

/dev/

Administrator Manual

109

Dr.Web Daemon

unix

0

[ ]

DGRAM

308

--- cut ---

Unix

:

--- cut --Active Internet connections (servers andestablished)
Proto Recv-Q Send-Q
Address State

Local Addressraw

0

0 *:icmp

*:*

7

raw

0

0 *:tcp*:*

Foreign

7

Active UNIX domain sockets (servers andestablished)
Proto

RefCnt

Flags

Type

STREAM

State

I-NodeLISTENING

Path

unix 0gpmctl[ ACC ]

384 /dev/

unix

0

[ ]

STREAM

CONNECTED

190 @0000001b

unix

1

[ ]

STREAM

CONNECTED

1091 @00000031

unix 0 [ ACC ] STREAM
drweb/run/drwebd.skt

LISTENING

1127 /opt/

unix 0 [ ACC ]font-unix/fs7100

LISTENING

403 /tmp/.

unix

STREAM

4

[ ]

DGRAM

293

/dev/log

unix 1
gpmctl[ ]STREAM

CONNECTED

unix

0

[ ]

DGRAM

450

unix

0

[ ]

DGRAM

433

unix

0

[ ]

DGRAM

416

unix

0

[ ]

DGRAM

308

1092 /dev/--- cut --Daemon

Administrator Manual

110

Dr.Web Daemon

DaemonTCP

drwebdc:$ drwebdc -nHOSTNAME -pPORTNUM -sv -sb
Unix:$ drwebdc -uSOCKETFILE -sv -sb--- cut --- Version: DrWeb Daemon 5.00
- Loaded bases:
Base /var/drweb/bases/drwtoday.vdb
contains 5 records.
Base /var/drweb/bases/drw50003.vdb
contains 409 records.
Base /var/drweb/bases/drw50002.vdb
contains 543 records.
Base /var/drweb/bases/drwebase.vdb
contains 51982 records.
Base /var/drweb/bases/drw50001.vdb
contains 364 records.
Total 53303 virus-finding records.
--- cut --drwebdc
TCP:$ drwebdc -nHOSTNAME -pPORTNUM -sv -sb -v
UNIX:Administrator Manual111

Dr.Web Daemon$ drwebdc -uSOCKETFILE -sv -sb -v

dwlib: fd: connect() failed - Connection
refuseddwlib: tcp: connecting to 127.0.0.1:3300 failed
dwlib: cannot create connection with a DrWeb
daemonERROR: cannot retrieve daemon version
Error -12
Demon

readme.eicar
readme.eicar
eicar.com

TCP:$ drwebdc -nHOSTNAME -pPORTNUM -f eicar.com
UNIX:$ drwebdc -uSOCKETFILE -f eicar.com

Results: daemon return code 0x20
(known virus is found)
DaemonDaemonDaemon2GBDaemonAdministrator Manual112

Dr.Web Daemon

Dr.Web Daemon

DaemonDaemonDaemonDaemonDaemonDaemon root

Administrator Manual113

SAMBA

SAMBA

Dr.Web Daemon 5.0
Dr.Web Samba SpIDer
Samba 3.0.x ~ 3.5.x

Dr.Web Samba SpIDer
Samba

/etc/

samba/smb.conf--- cut --[drweb_audit]
comment = Dr.Web protected directory
path = /directory/to/protect/vfs objects = smb_spider
smb_spider: config = <path to configuration
file or Agent socket address>
writeable = yes
browseable = yes
guest ok = yespublic = yes--- cut --Samba

Administrator Manual114

SAMBAconfig%etc_dir/smb_spider.conf

Dr.Web Samba VFS SpIDer

Dr.Web AgentSamba

smb.conf

smb_spider: config = <Agent socket address>
:
UNIX

Agent

smb_spider: config = local:%var_dir/ipc/.agent
TCP

Agent

smb_spider: config = inet:4040@127.0.0.1
Agent
Agent
Agent

Dr.WebSamba SpIDer

Dr.Web Samba SpIDer
Dr.Web Samba SpIDer
Dr.Web Samba SpIDer Samba
Dr.Web Samba SpIDer%etc_dir/smb_spider.conf
Dr.Web Samba SpIDer Samba

Dr.Web Samba SpIDer

syslogsyslog

SyslogFacility = Daemon

Administrator Manual115

SAMBA

SyslogPriority = Info

Dr.Web Daemon
Dr.Web Samba VFS SpIDer

Dr.Web Samba VFS SpIDer
Dr.Web Samba VFS SpIDer: %etc_dir/smb_spider.conf

smb.conf

smb_spider: config = /my/new/path/smb_spider.
conf[DaemonCommunication]
Address = {FAMILY :ADDRESS}

Dr.Web Daemon
,
inet

TCP

PORT@HOST

local

UNIX

pid

Daemon PID:

Address = pid:%var_dir/run/drwebd.pid
Cache = {Yes | No}

IP
No
Address

TCP

Administrator Manual116

SAMBA

117:
Cache = Yes
Timeout = {value inseconds}0:
Timeout = 120
UseTcpNodelay ={Yes | No}

TCP

TCP_NODELAY:
UseTcpNodelay = No
[Scanning]
HeuristicAnalysis ={Off | On}:
HeuristicAnalysis = On
StripPath = {value}
0

1
"/"

2
2

:
path = /some/path/to/file.ext

Administrator Manual

SAMBA

118

StripPath = 1
path = some/path/to/file.ext

StripPath = 2
path = path/to/file.ext:
StripPath = 0
PrefixPath = {path}

StripPath"/":path = /some/path/to/file.ext
StripPath = 2
path = path/to/file.ext
PrefixPath = /just/another
path = /just/another/path/to/
file.ext:
PrefixPath =MaxFileSizeToScan ={size in Kbytes}

0:
MaxFileSizeToScan = 0
ScanMode = {onWrite| onRead |onAccess}
onAccess

Administrator Manual

SAMBA

onReadonWrite:
ScanMode = onAccess
RewriteDataBase ={Yes | No}

Samba

Yes

md5
:
RewriteDataBase = Yes

BlockedCacheSize ={size in bytes}0

md5

Daemon:BlockedCacheSize = 4096
AllowedCacheSize{size in bytes}

=
0
md5

Daemon:AllowedCacheSize = 4096

Administrator Manual119

SAMBA

LocalScan
No}

=

{Yes

|
:
LocalScan = yes[Actions]

LicenseLimit{reject | pass}=
pass
reject:LicenseLimit = reject

Infected = {reject| quarantine |discard | rename |cure}reject quarantine discard rename cure :Infected = quarantine

Suspicious ={reject |quarantine |discard | rename |pass}reject quarantine discard rename pass :Suspicious = quarantine

Incurable = {reject| quarantine |Administrator Manual120

SAMBA

discard | rename}reject quarantine discard rename :Incurable = quarantine

Adware = {reject |quarantine |discard | rename |pass}reject quarantine discard rename pass :Adware = quarantine

Dialers = {reject |quarantine |discard | rename |pass}reject quarantine discard rename pass :Dialers = quarantine

Jokes = {reject |quarantine |discard | rename |pass}reject quarantine discard rename pass :Administrator Manual121

SAMBA

Jokes = quarantine
Riskware = {reject| quarantine |discard | rename |passreject quarantine discard rename pass :Riskware = quarantine

Hacktools = {reject| quarantine |discard | rename |pass}reject quarantine discard rename pass :Hacktools = quarantine

Archives = {reject| quarantine |discard | rename}reject quarantine discard rename :Archives = quarantine

SkipObject ={reject | pass}

Administrator Manual122

SAMBAreject pass :SkipObject = pass
DaemonArchiveRestriction= {reject | pass}
reject pass :ArchiveRestriction = pass
ScanningErrors ={reject | pass}

Daemonreject pass :ScanningErrors = reject

ProcessingErrors ={reject | pass}

Samba SpIDer
reject pass :ProcessingErrors = reject

SendNotifyToUser ={Off | On}
PC
LinPopup

Windows

Messenger:
SendNotifyToUser = off

Administrator Manual123

SAMBA

124

SendNotifyToAdmin ={Off | On}
PC
LinPopup

Windows

Messenger

smb.
conf
message command = /usr/bin/mail -s 'Messages from %f on %m' {address} < %s ; rm %s{address}:
SendNotifyToAdmin = off
AdminAddress ={Address}

PC IP:
AdminAddress = "127.0.0.1"

ShellScriptForBlockedFile = {path to
file}

Dr.
Web Samba VFS SpIDer
FileName
UserName
UserHost
IP
DaemonReport

Daemon:ShellScriptForBlockedFile =Quarantine = {pathto directory}:

Administrator Manual

SAMBA

Quarantine = %var_dir/
infected/
QuarantineFilesMode= {accesspermissions}:
QuarantineFilesMode = 0660
[Logging]

Level = {Debug |Verbose | Info |Alerts | Errors |Quiet}:
Level = Info

SyslogFacility ={Local7 | ... |Local0 | Daemon |Mail}syslog

SyslogPriority ={Alert | Notice |Info | Debug}

syslog:
SyslogFacility = Daemon:
SyslogPriority = Info

Dr.Web Samba VFS SpIDer

Dr.Web AgentSamba

smb.conf

smb_spider: config = local:%var_dir/ipc/.agent

Administrator Manual

125

Dr.Web Console for UNIX file servers

Dr.Web console for UNIX file servers
Dr.Web for UNIX File Servers
servers
Web
WebminWebminwww.webmin.com/

Dr.Web Console for UNIX fileWeb

WebminDr.Web Console for UNIX file servers

http://

Perl

XML::Parser XML
XML::XPath XPathCGI CGI
Cwd
Data::Dumper
Text::Iconv iconv() Perlperl-devel
libperl-dev
JSON

JSON

Unix
JavaScript

ObjectNotation
WebminWeb

Web

Webmin 1.450
Firefox 3.0.7 (Mozilla/5.0 (Windows; U; Windows NT 5.1; ru;
rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7)

Dr.Web Console for UNIX File Servers

Administrator Manual

126

Dr.Web Console for UNIX file servers

WebminWebminServers

Dr.Web Console for UNIX File%bin_dir/web/

WebminWebmin Web

15. Webmin

WebminConfiguration

Webmin Modules

Administrator Manual

127

Dr.Web Console for UNIX file servers

16. Webmin configuration

1. Webmin Modules
From local file
Browse2.
%bin_dir/web/
Web console for UNIX File Servers

Dr.

Administrator Manual

128

Dr.Web Console for UNIX file servers

17. Webmin modules

3.
4.

Install Module
Servers
console for UNIX File Servers

Dr.Web

18. Dr.Web Console for UNIX File Servers

Administrator Manual

129

Dr.Web Console for UNIX file servers

Webmin Change Language
Console for UNIX File Servers

and

Theme

Dr.Web

19. Webmin

WebminWebminMake Changes
Dr.Web Console for UNIX File Servers

Module config

smb_spider.conf
20. Module configuration

Administrator Manual

130

Dr.Web Console for UNIX file servers

Dr.Web Console for UNIX File Servers

Back

21. Dr.Web Console for UNIX File Servers

Dr.Web Samba VFS SpIDer Dr.Web for UNIX File
Servers Web
Quarantine,

Configuration 2

more

Administrator Manual

131

Dr.Web Console for UNIX file servers

Preview

Continue Editing
Save
22.

Save

Administrator Manual132

Dr.Web Console for UNIX file servers

23.

Scanning , Action

Samba

Daemon Communication
24. Daemon communication

Dr.Web Daemon

Administrator Manual

133

Dr.Web Console for UNIX file servers

Scanning
25. Scanning

Scanning , Action

Samba

Administrator Manual

134

Dr.Web Console for UNIX file servers

Action
26. Action

Scanning , Action

Samba

Administrator Manual

135

Dr.Web Console for UNIX file servers

Logging
27. Logging

Dr.Web for UNIX File Servers

Administrator Manual

136

Dr.Web Console for UNIX file servers

28.

DeleteAdministrator Manual

137

138

Dr.Web for UNIX File Servers
web

http://www.drweb.com/:
http://buy.drweb.com/:
http://support.drweb.com/

OS
Dr.Web for UNIX File Servers

Administrator Manual

139

Dr.Web for UNIX File Servers
Web«universal»

1 2«economy» Dr.

3

Doctor Web
Doctor Web
http://partners.drweb.com/
Dr.Web Global Updating
Doctor Web

Dr.Web for UNIX File Servers
1

Administrator Manual© 2011 "Doctor Web"