F-SECURE ANTI-VIRUS LINUX CLIENT SECURITY - Manuel de service
F-Secure Anti-Virus
Linux Server Security
Administrator’s Guide
"F-Secure" and the triangle symbol are registered trademarks of F-Secure Corporation and F-Secure
product names and symbols/logos are either trademarks or registered trademarks of F-Secure
Corporation. All product names referenced herein are trademarks or registered trademarks of their
respective companies. F-Secure Corporation disclaims proprietary interest in the marks and names of
others. Although F-Secure Corporation makes every effort to ensure that this information is accurate,
F-Secure Corporation will not be liable for any errors or omission of facts contained herein. F-Secure
Corporation reserves the right to modify specifications cited in this document without prior notice.
Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of
this document may be reproduced or transmitted in any form or by any means, electronic or
mechanical, for any purpose, without the express written permission of F-Secure Corporation.
This product may be covered by one or more F-Secure patents, including the following:
Copyright © 2007 F-Secure Corporation. All rights reserved. 12000074-07B27
GB2353372 GB2366691 GB2366692 GB2366693 GB2367933 GB2368233
GB2374260
1
Contents
Chapter 1 Introduction 5
1.1 Welcome......................................................................................................................6
1.2 How the Product Works ...............................................................................................6
1.3 Key Features and Benefits...........................................................................................9
1.4 F-Secure Anti-Virus Server and Gateway Products...................................................11
Chapter 2 Deployment 13
2.1 Deployment on Multiple Stand-alone Linux Workstations..........................................14
2.2 Deployment on Multiple Centrally Managed Linux Workstations...............................14
2.3 Central Deployment Using Image Files......................................................................15
Chapter 3 Installation 16
3.1 System Requirements................................................................................................17
3.2 Installation Instructions...............................................................................................18
3.2.1 Stand-alone Installation..................................................................................19
3.2.2 Centrally Managed Installation.......................................................................21
3.3 Upgrading from a Previous Product Version..............................................................24
3.4 Upgrading the Evaluation Version..............................................................................25
3.5 Replicating Software Using Image Files ....................................................................26
3.6 Preparing for Custom Installation...............................................................................26
3.7 Unattended Installation ..............................................................................................27
3.8 Installing Command Line Scanner Only.....................................................................28
3.9 Creating a Backup......................................................................................................29
3.10 Uninstallation..............................................................................................................30
Chapter 4 Getting Started 31
4.1 Accessing the Web User Interface.............................................................................32
4.2 Basics of Using F-Secure Policy Manager.................................................................32
4.3 Testing the Antivirus Protection .................................................................................33
Chapter 5 User Interface - Basic Mode 34
5.1 Summary ...................................................................................................................35
5.2 Common Tasks..........................................................................................................36
Chapter 6 User Interface - Advanced Mode 37
6.1 Alerts..........................................................................................................................38
6.2 Virus Protection..........................................................................................................40
6.2.1 Real-Time Scanning.......................................................................................40
6.2.2 Scheduled Scanning.......................................................................................45
6.2.3 Manual Scanning............................................................................................46
6.3 Firewall Protection......................................................................................................51
6.3.1 General Settings.............................................................................................53
6.3.2 Firewall Rules.................................................................................................54
6.3.3 Network Services............................................................................................56
6.4 Integrity Checking ......................................................................................................59
6.4.1 Known Files....................................................................................................59
6.4.2 Verify Baseline................................................................................................63
6.4.3 Generate Baseline..........................................................................................63
6.4.4 Rootkit Prevention..........................................................................................65
6.5 General Settings ........................................................................................................66
6.5.1 Communications.............................................................................................66
6.5.2 Automatic Updates.........................................................................................68
6.5.3 About..............................................................................................................71
Chapter 7 Command Line Tools 72
7.1 Overview....................................................................................................................73
7.2 Virus Protection..........................................................................................................73
7.2.1 fsav.................................................................................................................73
3
7.2.2 dbupdate.........................................................................................................74
7.3 Firewall Protection......................................................................................................74
7.3.1 fsfwc ...............................................................................................................75
7.4 Integrity Checking ......................................................................................................75
7.4.1 fsic..................................................................................................................75
7.4.2 fsims...............................................................................................................76
7.5 General Command Line Tools...................................................................................76
7.5.1 fssetlanguage.................................................................................................76
7.5.2 fsma................................................................................................................77
7.5.3 fsav-config......................................................................................................78
AppendixA Installation Prerequisites 79
A.1 All 64-bit Distributions ............................................................................................... 80
A.2 Red Hat Enterprise Linux 4........................................................................................80
A.3 Debian 3.1 and Ubuntu 5.04, 5.10, 6.06 ....................................................................81
A.4 SuSE..........................................................................................................................82
A.5 Turbolinux 10 .............................................................................................................82
AppendixB Installing Required Kernel Modules Manually 83
B.1 Introduction ............................................................................................................... 84
B.2 Before Installing Required Kernel Modules................................................................84
B.3 Installation Instructions...............................................................................................84
AppendixC Riskware Types 86
C.1 Riskware Categories and Platforms.......................................................................... 87
AppendixD List of Used System Resources 90
D.1 Overview................................................................................................................... 91
D.2 Installed Files.............................................................................................................91
D.3 Network Resources....................................................................................................91
D.4 Memory......................................................................................................................92
D.5 CPU............................................................................................................................92
AppendixE Troubleshooting 93
E.1 User Interface............................................................................................................ 94
E.2 F-Secure Policy Manager...........................................................................................95
E.3 Integrity Checking ......................................................................................................95
E.4 Firewall.......................................................................................................................97
E.5 Virus Protection..........................................................................................................99
E.6 Generic Issues...........................................................................................................99
AppendixF Man Pages 102
AppendixG Config Files 171
G.1 fsaua_config............................................................................................................ 172
G.2 fssp.conf...................................................................................................................177
Technical Support 201
Introduction ...................................................................................................................... 202
F-Secure Online Support Resources ...............................................................................202
Web Club .........................................................................................................................203
Virus Descriptions on the Web .........................................................................................203
5
1INTRODUCTION
Welcome....................................................................................... 6
How the Product Works................................................................ 6
Key Features and Benefits........................................................... 9
F-Secure Anti-Virus Server and Gateway Products................... 11
6
1.1 Welcome
Welcome to F-Secure Anti-Virus Linux Server Security.
Computer viruses are one of the most harmful threats to the security of
data on computers. Viruses have increased in number from just a handful
a few years ago to many thousands today. While some viruses are
harmless pranks, other viruses can destroy data and pose a real threat.
The product provides an integrated, out-of-the-box ready security solution
with a strong real-time antivirus and riskware protection and a host
intrusion prevention (HIPS) functionality that provides protection against
unauthorized connection attempts from network, unauthorized system
modifications, userspace and kernel rootkits. The solution can be easily
deployed and managed either using the local graphical user interface or
F-Secure Policy Manager.
F-Secure Policy Manager provides a tightly integrated infrastructure for
defining and distributing security policies and monitoring the security of
different applications from one central location.
1.2 How the Product Works
The product detects and prevents intrusions and protects against
malware. With the default settings, workstations and servers are
protected right after the installation without any time spent configuring the
product.
Protection Against Malware
The product protects the system against viruses and potentially malicious
files.
When user downloads a file from the Internet, for example by clicking a
link in an e-mail message, the file is scanned when the user tries to open
it. If the file is infected, the product protects the system against the
malware.
CHAPTER1 7
Introduction
Real-time Scanning
Real-time scanning gives you continuous protection against viruses and
riskware items as files are opened, copied, and downloaded from the
Web. Real-time scanning functions transparently in the background,
looking for viruses whenever you access files on the hard disk, diskettes,
or network drives. If you try to access an infected file, the real-time
protection automatically stops the virus from executing.
Manual Scanning And Scheduled Scanning
When the real-time scanning has been configured to scan a limited set of
files, the manual scanning can be used to scan the full system or you can
use the scheduled scanning to scan the full system at regular intervals.
Automatic Updates
Automatic Updates keep the virus definitions always up-to-date. The virus
definition databases are updated automatically after the product has been
installed. The virus definitions updates are signed by the F-Secure
Anti-Virus Research Team.
Host Intrusion Prevention System
The Host Intrusion Prevention System (HIPS) detects any malicious
activity on the host, protecting the system on many levels.
Integrity Checking
Integrity Checking protects the system against unauthorized
modifications. It is based on the concept of a known good configuration -
the product should be installed before the server or workstation is
connected to the network to guarantee that the system is in a known good
configuration.
You can create a baseline of the system files you want to protect and
block modification attempts of protected files for all users.
8
Firewall
The firewall component is a stateful packet filtering firewall which is based
on Netfilter and Iptables. It protects computers against unauthorized
connection attempts. You can use predefined security profiles which are
tailored for common use cases to select the traffic you want to allow and
deny.
Protection Against Unauthorized System Modifications
If an attacker gains a shell access to the system and tries to add a user
account to login to the system later, Host Intrusion Prevention System
(HIPS) detects modified system files and alerts the administrator.
Protection Against Userspace Rootkits
If an attacker has gained an access to the system and tries to install a
userspace rootkit by replacing various system utilities, HIPS detects
modified system files and alerts the administrator.
Protection Against Kernel Rootkits
If an attacker has gained an access to the system and tries to install a
kernel rootkit by loading a kernel module for example through /sbin/
insmod or /sbin/modprobe, HIPS detects the attempt, prevents the
unknown kernel module from loading and alerts the administrator.
If an attacker has gained an access to the system and tries to install a
kernel rootkit by modifying the running kernel directly via /dev/kmem,
HIPS detects the attempt, prevents write attempts and alerts the
administrator.
Table des matières
Autres manuels F-SECURE Logiciel
F-SECURE
F-SECURE MOBILE SECURITY FOR UIQ - Manuel utilisateur
F-SECURE
F-SECURE PSB E-MAIL AND SERVER SECURITY Manuel utilisateur
F-SECURE
F-SECURE MOBILE SECURITY 3.1 FOR S60 Manuel utilisateur
F-SECURE
F-SECURE MOBILE ANTI-VIRUS FOR SERIES 60 Manuel utilisateur
F-SECURE
F-SECURE MOBILE SECURITY FOR BUSINESS - Manuel de service
F-SECURE
F-SECURE ONLINE BACKUP - HELP Manuel utilisateur
F-SECURE
F-SECURE ONLINE BACKUP 2.1 - WEB USER INTERFACE HELP Manuel utilisateur
F-SECURE
F-SECURE ANTI-VIRUS FOR MICROSOFT EXCHANGE 9.00 Guide de référence rapide
F-SECURE
F-SECURE MOBILE SECURITY 6 FOR S60 - Manuel utilisateur
F-SECURE
F-SECURE CLIENT SECURITY 9.00 - QUICK Manuel utilisateur
F-SECURE
F-SECURE MOBILE SECURITY 6 FOR ANDROID Manuel utilisateur
F-SECURE
F-SECURE MOBILE SECURITY 6 FOR S60 - Manuel utilisateur
F-SECURE
F-SECURE POLICY MANAGER 7.0 - Manuel de service
F-SECURE
F-SECURE MOBILE SECURITY FOR S60 - Manuel utilisateur
F-SECURE
F-SECURE MOBILE SECURITY 6 FOR WINDOWS MOBILE - Manuel utilisateur
F-SECURE
F-SECURE POLICY MANAGER PROXY 2.0 - Manuel de service
F-SECURE
F-SECURE MOBILE SECURITY FOR UIQ - Manuel utilisateur
F-SECURE
F-SECURE INTERNET GATEKEEPER FOR LINUX 4.01 - Manuel de service
F-SECURE
F-SECURE ANTI-VIRUS FOR MICROSOFT EXCHANGE 8.00 - Manuel de service
F-SECURE
F-SECURE MOBILE SECURITY 2010 FOR ANDROID Manuel utilisateur
Manuels Logiciel populaires d'autres marques
PS Audio
PS Audio PowerPlay Manuel du propriétaire
Brady
Brady LOCKOUT PRO 3.0 Manuel de service
Avaya
Avaya Interaction Center Manuel utilisateur
Texas Instruments
Texas Instruments TI-83 Plus Silver Edition Manuel
Novell
Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur
Oracle
Oracle Application 9i Manuel utilisateur
Acer
Acer RDM Manuel utilisateur
Canon
Canon Vixia HF21 Manuel utilisateur
Canon
Canon ZR950 Manuel utilisateur
Samsung
Samsung Auto Backup Manuel utilisateur
Polycom
Polycom Vortex EF2201 Instructions d'installation et d'utilisation
Brocade Communications Systems
Brocade Communications Systems Brocade 8/12c Manuel utilisateur