samba3-vscan INSTALL,1.1.1.1,1.2
Rainer Link <[email protected]> Sat, 23 Jul 2005 15:02:47 +0000
| Newsgroups | gmane.comp.security.virus.openantivirus.cvs |
|---|---|
| Message-ID | <[email protected]> |
Update of /cvsroot/openantivirus/samba3-vscan In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv11280 Modified Files: INSTALL Log Message: removed references to Samba 2.2.x Index: INSTALL =================================================================== RCS file: /cvsroot/openantivirus/samba3-vscan/INSTALL,v retrieving revision 1.1.1.1 retrieving revision 1.2 diff -u -d -r1.1.1.1 -r1.2 --- INSTALL 23 Jul 2005 14:33:54 -0000 1.1.1.1 +++ INSTALL 23 Jul 2005 15:02:44 -0000 1.2 @@ -1,7 +1,7 @@ -Installation instructions for samba-vscan -***************************************** +Installation instructions for samba3-vscan +****************************************** -Copyright (C) by Rainer Link, 2001-2004 +Copyright (C) by Rainer Link, 2001-2005 OpenAntiVirus.org <rainer-pBPPa8WU5k41Tgt60Rntydi2O/[email protected]> This software is licensed under the GNU General Public License (GPL) @@ -15,8 +15,7 @@ Contents ======== -Instructions for Samba 2.2.0 to 2.2.3 -Instructions for Samba >= 2.2.4 or Samba 3.0 +Instructions for Samba 3.0 Log checking Anti-virus product-specific information Check the license of your anti-virus product @@ -24,90 +23,15 @@ How to report bugs, give feedback or send patches Donations - - -Instructions for Samba 2.2.0 to 2.2.3 -------------------------------------- - -The use of those versions are NOT recommended, as they contain some -security vulnerabilities. Even if your vendor provides patched -version to fix those issues, those Samba contain a bug which prevents -the use of run-time configuration settings. -Moreover, VFS support is broken in these Samba releases. I would suggest -to use the latest 2.2.x release (as the time of this writing Samba -2.2.8a). -To get VFS working, you have to apply the provided -samba-<version>-vfs.dif, re-configure Samba (./configure --enable-vfs) -and re-compile Samba. - -As the parsing for the "vfs options" parameter is broken in these Samba -releases, you must use the compile-time settings and can not use a run-time -configuration file per share. Once again, please consider to use the latest -2.2.x release. - -The following compile time settings are available in -<product>/vscan-<product>.h, so change into the directory of the anti-virus -product you want to use, i.e. - -cd openantivirus -vi vscan-oav.h - -* VSCAN_SCAN_ON_OPEN: if it's set to True (default), files will be scanned on - open -* VSCAN_SCAN_ON_CLOSE: if it's set to True (default), files will be scanned - on close -* VSCAN_MAX_SIZE: scanning a (very) large file may slow down performance - (too much). Therefore, you can specify if a file is larger than x bytes, - it shouldn't be scanned. Please set it for your needs. If it's set to 0, - all files, regardless of their file size, will be scanned. -* VSCAN_DENY_ACCESS_ON_ERROR: if communication to the virus scanning daemon - fails, you may either deny access to file(s) or not. You can change this - behaviour via the VSCAN_DENY_ACCESS_ON_ERROR setting. If it's set to - True (default), access will be _denied_. -* VSCAN_DENY_ACCESS_ON_MINOR_ERROR: basically the same as - VSCAN_DENY_ACCESS_ON_ERROR but related to minor errors. Not really - implemented in all modules. -* VSCAN_SEND_WARNING_MESSAGE: if it's set to True (default), a virus - notification message via winpopup service is send to the remote client - computer. On Windows95/98, the "winpopup" program must be run. -* VSCAN_INFECTED_FILE_ACTION: three values are possible - - INFECTED_QUARANTINE: an infected file will be renamed and - moved into a specific quarantine directory - (see below). If quarantining fails, the file - will _not_ be deleted. - - INFECTED_DELETE: an infected file will be removed - - INFECTED_DO_NOTHING: the infected file will remain untouched -* SCAN_QUARANTINE_DIRECTORY: the quarantine directory for infected files, - default is "/tmp" - it should be a directory not reachable via (Samba) - shares. Keep in mind this directory must be world-read/writable and - the sticky-bit should be set. -* VSCAN_QUARANTINE_PREFIX: a quarantined file will be renamed, via this - setting the prefix can be specified. Default is "vir-". -* VSCAN_MAX_LRUFILES: the maximum number of last recently accessed file entries, - default is 100. If set to 0, the lru access mechanism is disabled. Please - see chapter "Avoid multiple scans of a file caused by Windows behaviour". -* VSCAN_LRUFILES_INVALIDATE_TIME: specifies the time in seconds, after an - lru accessed file entry is considered as invalidated. The default is - 5 seconds. Please see the chapter "Avoid multiple scans of a file - caused by Windows behaviour". -* VSCAN_FT_EXCLUDE_LIST: MIME-types of files to be excluded from - scanning, separated by semi-colon. Wildcards are not possible. Use - this feature with care. - -After you may have adjusted these settings to your needs, please -refer to the next section on how to actually build and install -samba-vscan. - - -Installation instructions for Samba >= 2.2.4 or Samba 3.0 +Installation for Samba 3.0 --------------------------------------------------------- Step 1: Prerequisite -VFS support works out-of-the-box in these Samba releases. As for compiling this -module the config.h file of Samba is needed, you have to run ./configure in -<samba-source>/source (yes, you need the Samba sources. A binary-only -Samba installation is not sufficient). For Samba 3.0 you also have to -run "make proto" in <samba-source>/source. +As for compiling this module the config.h file of Samba is needed, you have +to run "./configure" and "make proto" in <samba-source>/source (yes, you +need the Samba sources. A binary-only Samba installation is not sufficient, +to build a VFS module. Of course you can use the VFS module then later with +your binary-only Samba version, as shipped as RPM or Deb for example). Step 2: copying the sources (optional) You may copy recursively the complete samba-vscan directory to @@ -120,9 +44,8 @@ If you do this step, you do not need the configure parameter --with-samba-source=DIR later on. -Step 3: compile-time settings (optional for Samba 2.2.4 and any later version): -In Samba 2.2.4 and better (or Samba 3.0), the "vfs options" parsing works -correctly, so you can use the run-time configuration file on a per share +Step 3: compile-time settings (optional): +You can use the run-time configuration file on a per share basis, if you like. Of course, the compile time settings are still usable (and will be overwritten by the run-time configuration file, if any) @@ -224,30 +147,6 @@ Step 6: configure Samba -Samba 2.2.x: - -Edit /etc/smb.conf and add the following entry (that's only an example): - [vscan] - comment = virus-protected /tmp directory - path = /tmp - vfs object = /usr/lib/samba/vfs/vscan-oav.so - vfs options = config-file = /etc/samba/vscan-oav.conf - writeable = yes - browseable = yes - guest ok = yes - - -Basically you have to add a vfs object line to your shares -which should be virus-protected by this module. If you'd like to use the -run-time configuration file, simply add the -vfs options = config-file = /path/config-file -(different settings for several shares can be achieved by using a different -name of the configuration file for each share). If you want to protect _all_ -shares your Samba server offers, simply add the vfs object line (and the -vfs options line, if you like) to the [global] section. - -Samba 3.0: - Edit /etc/smb.conf and add the following entry (that's only an example): [vscan] comment = virus-protected /tmp directory @@ -534,23 +433,23 @@ rpmbuild SPECS/samba.spec IMPORTANT: if you do a rebuild with rpmbuild, the entire - BUILD/samba-2.2.7/ directory will get erased, so don't use rpmbuild past + BUILD/samba-<version>/ directory will get erased, so don't use rpmbuild past this point! Then insert the samba-vscan into the tree: - cd /usr/src/redhat/BUILD/samba-2.2.7/examples/VFS - bunzip < ~/samba-vscan-0.3.2.tar.bz2 | tar -xvf - + cd /usr/src/redhat/BUILD/samba-<version>/examples/VFS + bunzip < ~/samba-vscan-<version>.tar.bz2 | tar -xvf - and compile samba-vscan: - cd /usr/src/redhat/BUILD/samba-2.2.7/examples/VFS/samba-vscan-0.3.2 + cd /usr/src/redhat/BUILD/samba-<version>/examples/VFS/samba-vscan-<version> I'm using kaspersky4, which puts its libraries in a different place... - cd /usr/src/redhat/BUILD/samba-2.2.7/examples/VFS/samba-vscan-0.3.2/kaspersky/ + cd /usr/src/redhat/BUILD/samba-<version>/examples/VFS/samba-vscan-<version>/kaspersky/ mv Makefile Makefile.KAV3 mv Makefile.KAV4 Makefile check the default settings - cd /usr/src/redhat/BUILD/samba-2.2.7/examples/VFS/samba-vscan-0.3.2/kaspersky/ + cd /usr/src/redhat/BUILD/samba-<version>/examples/VFS/samba-vscan-<version>/kaspersky/ vi vscan-kavp.h # defaults look good ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click