Anti virus

From Atomicorp Wiki
Revision as of 17:05, 27 November 2012 by Mshinn (Talk | contribs)

Jump to: navigation, search

Contents

Description

ASL has a kernel space anti-virus/anti-malware module. This module is not activated by default. The basic behaviour when activated is to prevent the malware from being read, executed or written to the hard disk, and to send an alert via logs, email and the ASL gui.

Installation

Step 1) ASL kernel 2.6.29 and above required


Step 2) Install kernel modules

 yum install kmod-dazuko

Step 3) if your kernel is locked (this is the default), you will need to reboot your system.

Configuration

Enable

Enable the appropriate settings in the ASL GUI for your needs. Please see the [ASL AntiMalware Configuration documentation].

These are the recommended settings:

Option Recommended Setting
CLAMAV_ENABLED yes
CLAMAV_ENABLE_DAZUKO yes
CLAMAV_TCPADDRESS 127.0.0.1
CLAMAV_SCANONOPEN yes
CLAMAV_SCANONCLOSE yes
CLAMAV_SCANONEXEC yes
CLAMAV_CLAMUKO_MAXFILESIZE 10m

Set directories to protect/monitor

Set directories to monitor in /etc/asl/dazuko-include. (Note this file may not exist, this is normal). One line per entry

 /path/to/directory
 /path/to/directory2

We do not recommend you set your entire filesystem to be monitored. This is not necessary on most Linux systems, will waste CPU resources, and in general is pointless for a privileged user like root (root could just turn off the system). We recommend that you configure the system to scan directories that non-privileged users can write, upload and modify code in. For example, these directories are a good starting point for most systems:

 /var/www/
 /home
 /var/tmp
 /tmp

DO NOT INCLUDE SIGNATURE DIRECTORIES such as:

 /var/clamav
 /var/lib/clamav
 /etc/httpd/modsecurity.d/

Your should also not include system directories, such as /proc, /sys and /dev.

Set directories to exclude

Set directories to exclude in /etc/asl/dazuko-exclude. (Note this file may not exist, this is normal). One line per entry

 /path/to/directory/exclude1
 /path/to/directory/exclude2

Plesk notes

If you are running a control panel, such as Plesk, that puts apache configuration files in /var/www and if you have included /var/www in dazukos include paths (a good idea for web servers), and those configuration files and directories can only be modified by root (which is the case with Plesk), then you should exclude those directories. They contains dozens of files each, and a failure to exclude them will cause long startup times for Apache as the antimalware system will be forced to scan every configuration file (which is not necessary). This is unnecessary and will take several minutes to complete. The directories you should exclude, at minimum, are:

 /var/www/vhosts/www.example.com/statistics/
 /var/www/vhosts/www.example.com/conf/
 /var/www/vhosts/www.example.com/pd/

Replace www.example.com with your domain names. You can not use wildcards. If you are using a system that puts your virtual hosts in /var/www/vhosts you can use this command to get a list of directories to ignore:

 find /var/www/vhosts/ -type d  | egrep "/(statistics|conf|pd)$"

A future version of ASL will configure this automatically.

Other control panels

For other controls, such as cpanel, Interworx, etc. you will want to exclude any configuration directories as per the Plesk example above (your directories will vary), in particular you will want to exclude any locally generated Apache logs. For example, with Interworx you will also want to exclude directories such as:

 /home/example/var/example.com/logs

Update policy

Update the security policy with:

 asl -s -f

Reboot

Reboot the system into the ASL kernel.

 reboot
Personal tools