User manual F-SECURE INTERNET GATEKEEPER FOR LINUX 4.01 ADMINISTRATOR GUIDE

[. . . ] F-Secure Internet Gatekeeper for Linux A Comprehensive Internet and Anti-Virus Solution Version 4 20100125 Administrator's Guide F-Secure Internet Gatekeeper for Linux/Administrator's Guide About this Guide This guide describes the installation and uninstallation, usage, and settings for F-Secure Internet Gatekeeper for Linux. Please note that "F-Secure Internet Gatekeeper for Linux" is also referred to as "the product" and "Internet Gatekeeper" in this guide. Symbols Symbol Description Provides important information that you need to consider. Indicates that related information on the topic is available in a different chapter or another document. Fonts Arial bold Font (blue) Description Used to refer to menu names and commands, to buttons and other items in a dialog box. Arial italics (blue) Arial italics (black) Courier New Courier New bold SMALL CAPS (BLACK) Arial underlined (blue) Arial italics Used to refer to chapters in the manual, and to book titles of other manuals. [. . . ] The Subject field and filename are converted to UTF-8 before being compared. The conversion is done for "encoded-word ("=?" charset "?" encoding "?" encoded-text "?=")" written in RFC-2047. To scan for character sets other than UTF-8 (such as Shift-JIS or Unicode), specify the codes as hexadecimal values. For example, specify the following to search for the text "" in Shift-JIS format: \x8a¥xae¥x91¥x53¥x96¥xb3¥x97¥xbf You can use utilities such as the following to perform the kanji code conversion. Linux: Use the iconv command as follows: # echo -n '<search character string>' | iconv -f <character set currently used in Linux> -t <character set into which to convert> | od -t x 1 Example: # echo -n '' | iconv -f EUC-JP -t SJIS | od -t x1 0000000 8a ae 91 53 96 b3 97 bf 0000010 * Insert "¥x" in front of each hexadecimal value. (Example: \x8a¥xae¥x91¥x53¥x96¥xb3¥x97¥xbf) Windows: Use a utility program such as the following: StrHex(http://www. pleasuresky. co. jp/strhex. php3) Comparison method Specifies how to compare text. Case sensitive Distinguish between upper and lower case characters when comparing. Prefix search Compare whether the leading characters of the specified field match the character string. 58 F-Secure Internet Gatekeeper for Linux/Administrator's Guide In the text body, this checks whether the character string matches the leading characters of each line. Backward search Compare whether the trailing characters of the specified field match the character string. In the text body, this checks whether the character string matches the trailing characters of each line. Not The rule is satisfied if there is no match with the specified character string. "AND" with previous rule The rule is satisfied if both the specified rule and the previous rule are satisfied. In this case, the previous rule is typically set to "no action". "AND" with previous rule in the same MIME part The rule is satisfied if both the specified rule and the previous rule are satisfied for the same MIME part. You can use this to specify a rule for both the Content-Type and file name of an attached file, for example. In this case, the previous rule is typically set to "no action". When you specify e-mail addresses, do not use forward or backward matching. This is because the From, To, and other headers contain additional characters before and after the e-mail address (example: "Xxx Yyy <aaa@example. com>"). Filter as Specifies the judgment result if the specified rule is satisfied. Select one of "spam", "not spam", or "no action". The specified list of conditions is saved in /opt/f-secure/fsigk/conf/spam/custom. txt. The "Judgment", "Field name", "Compare method", and "Text to scan for" are separated by tabs. · The "Judgment" setting is specified as "BLACK" (spam), "WHITE" (not spam), or "NONE" (no action). · "Field name" contains either a field name or "FILENAME" (file name), "FILESIZE" (file size), "TEXTBODY" (text body), "HTMLBODY" (HTML body), "URLHOST" (link host name), "RELAYIP" (relay addresses), or "ALWAYS" (always). [. . . ] Communication is processed by using the UNIX domain socket (fsavd-socket-0 in the install directory). Up to 500 KB of memory cannot be shared per process. 162 F-Secure Internet Gatekeeper for Linux/Administrator's Guide fsavd Handles the scanning engine process. The process uses a minimum of 2 processes for each service (http, smtp, pop, ftp), and the maximum number of processes it can use for each service is equal to the logical number of CPUs in the system (2 CPUs: 2 processes, 4 CPUs: 4 processes). Around 50 MB of memory cannot be shared per process. 163 F-Secure Internet Gatekeeper for Linux/Administrator's Guide 11. 14 Detection Names If F-Secure Internet Gatekeeper for Linux detects a virus, the virus name is recorded in a log. [. . . ]