$Id: README.DrWeb,v 1.7 2002/07/27 20:11:22 mjt Exp $

DrWeb antivirus is available from www.sald.com.  At a time this writing
(29-sept-2001), no commercial version  of this software for linux is
available in most countries (reportedly it is available in Poland).
Demo version can be obtained from http://www.drweb.ru/get.
It is one of the best antivirus products, and I personally recommend
to use it (and in fact I use it here heavily).
It is very simple to use product -- all the daemon, command-line scanner
and command-line daemon client.
It seems that DrWeb authors are very accurate programmers.  While
DrWeb for unix is relatively new product, it shows very good background
and has a long and nice history.  It is available for MS DOS for about
10 years now, and MS Windows version and versions for some other platforms
are available too.

I run the DrWeb daemon chrooted here -- this is just because I was
"impressed" of inaccurate design and implementation of other antivirus
software and somewhat afraid of possible security problems.  No, I
don't want to say that DrWeb is bad, but my expirience with other
antiviruses was somewhat unhappy instead.  Note that chrooting the
daemon gains little in security, the most important parts are correct
filesystem and process permissions.

Some good explanation about running antivirus daemon and it's client
given in avcheck manpage.  Here I'll show only brief steps on how to
set up DrWeb daemon to scan mail messages for viruses.

First, create one unix group, avgroup, and two users, avdaemon and avpclient,
having group avgroup as primary group for both:

  groupadd avgroup
  useradd -g avgroup -d /non/existant -s /bin/false -c "DrWeb Daemon" avdaemon
  useradd -g avgroup -d /non/existant -s /bin/false -c "DrWeb Client" avclient

(note: this example works on Linux, on other platform command lines
might be different).

Then, create directories where all the DrWeb stuff will be placed (assuming
your current umask is 022), and setup device entries that may be needed:

  mkdir /var/spool/drweb
  cd /var/spool/drweb
  mkdir bases run tst dev
  chown avdaemon:avgroup run
  chown avclient:avgroup tst
  chmod 750 tst run
  cp -a /dev/null /dev/zero dev/

Example of directory listing on a linux machine:

drwxr-xr-x    6 root     root         1024 Jul 24 14:29 ./
drwxr-xr-x    2 root     root         1024 Jul 24 14:26 bases/
-rw-r--r--    1 root     root       570368 Jul 12 04:28 drweb32.dll
-rwxr-xr-x    1 root     root       931192 May 15 03:59 drwebd*
-rw-r--r--    1 root     root          501 Nov 20  2001 drwebd32.ini
-r--r--r--    1 root     root         1165 Aug 14  2001 drwebd32.key
drwxr-x---    2 avdaemon avgroup      1024 Jul 24 14:29 run/
drwxr-x---    2 avclient avgroup      1024 Jul 27 18:20 tst/
drwxr-xr-x    2 root     root         1024 Oct  1  2001 etc/
-rw-r--r--    1 root     root          815 Feb  2  2000 etc/localtime
drwxr-xr-x    2 root     root         1024 May 10 11:42 dev/
crw-rw-rw-    1 root     root       1,   3 Aug 14  2000 dev/null
crw-rw-rw-    1 root     root       1,   5 Aug 14  2000 dev/zero

You may also add a /dev/log entry, but it requires additional
syslog daemon configuration.

See also below some addidional and/or different steps required
on other OSes or when kavdaemon linked dynamically (notable,
/dev/zero device file may be needed to dynamically load libraries).
Note that starting from 4.26 on Linux, DrWeb does not need device
entries anymore since it distributed as statically linked executable.

The "idea" is using the principle of least privilege: only give those
permissions that are absolutely necessary.

Some descriptions for those directories inside /var/spool/drweb:

  /var/spool/drweb itself: a root for all avp "activity"/files.
    This directory will be modified only during the installation,
    drwebd and avcheck will not write to it or modify files here.

  bases/  here we will place DrWeb's antivirus bases.  It shouldn't be
    writable for DrWeb daemon and client, but should be readable for
    daemon.  Having all bases in separate directory simplifies
    maintenance.

  run/ here drwebd will create it's control socket, pid file and logfile,
    as will be set up later (see below).  The directory should be writable
    for daemon, accessible for client (as a member of avgroup), and
    unaccessible for any other user (so that noone else will be able to
    talk with the daemon)

  tst/  this is a main testing directory, where mail files will be
    placed temporary for checking by a daemon.  Should be writable
    for avclient user (the client that will actually process mail),
    accessible for avdaemon (so that daemon will be able to read a
    file from there for testing), and unaccessible for anyone else,
    to enshure that no one will look to our mail messages.

Next, fill in bases/ directory with current antivirus bases (root:root,
mode 644 will sufficie), and place daemon itself (drwebd),  it's
configuration file (drweb32.ini) and antivirus engine file (drweb32.dll)
into top-level /var/spool/drweb directory.

DrWeb configuration files.  Remember that drwebd will be run chrooted,
so will see /var/spool/drweb as a root of it's filesystem (/) -- so all
paths should be adjusted accordingly.

drweb32.ini file, the only configuration file drweb uses, consists of
"sections" (name of section is placed in square brackets) and a list
of "name=value" pairs in each section.  Every program in DrWeb
distribution can use it's own section (e.g. command-line scanner for
Linux looks into [Linux:Scanner] section).  All "name=value" pairs
listed before the first section name specifies global parameters
that will be applied to all programs.  Format of this file and a
list of all recognized parameter names described in documentation
included into DrWeb distribution.

Since we will run only one program with this configuration file
(drwebd, the daemon), it is sufficient to specify no sections at
all in this configuration file.

Here is my version of drweb32.ini file, together with some comments.

===cut===
; where main antivirus engine resides: /var/spool/drweb/drweb32.dll
EnginePath = "/drweb32.dll"
; where to find antivirus bases: /var/spool/drweb/bases
VirusBase = "/bases/*.vdb"
; key file: for demo version, use drwebd.key from distro.
; Having a valid key is important (be it demo or licensed).
; If DrWeb starts up, watch for "Registration info" message
Key = "/drweb32.key"
; Use unix socket in /var/spool/drweb/run/sock
SocketMode = Unix
SocketFile = "/run/sock"
; Place DrWeb Daemon pid into /var/spool/drweb/run/pid (used in initscript)
PidFile = "/run/pid"
; Logging: log goes to /var/spool/drweb/run/log
LogFileName = "/run/log"
LogToFile = Yes
LimitLog = Yes
MaxLogSize = 512
LogTime = Yes
LogScanned = No
LogPacked = No
LogArchived = No
; Various options (most are self-explanatory)
ScanFiles = ByFormat
HeuristicAnalysis = Yes
CheckPackedFiles = Yes
CheckArchives = Yes
CheckEMailFiles = Yes
; DoS prevention control.
MaxFileSizeToExtract = 20480 ; Kb; do not fill up spool space
MaxCompressionRatio = 200 ; treat archive as mailbomb if compressed too high
FileTimeout = 900 ; sec per request
MaxChildren = 16 ; we'll configure this at an MTA side too
===cut===

Next, you will need to place avcheck, it's `infected' helper and
uchroot somewhere.  I recommend to copy them into the same directory,
/var/spool/drweb, for simplicity.

Now, start the drweb.  The following big commandline is needed
to properly setup environment.  Do not worry about it's length --
it should be placed into startup script.

  nice \
  /var/spool/drweb/uchroot -u avdaemon /var/spool/drweb \
  /drwebd -ini:/drweb32.ini

Some resource limits can be specified here as well.

Drwebd will display it's startup progress and then switch to
background.  Look into /var/spool/drweb/run/log file for additional
messages if any (drwebd writes useful information into it's logfile).

Look into rc.drwebd script provided with avcheck distribution --
it is a complete startup script that may be used on many unixes
to start drwebd this way.

Now, after drwebd is ready, you can test the installation:

 /var/spool/drweb/uchroot -u avclient / \
 /var/spool/drweb/avcheck -n -f root -d /var/spool/drweb/./tst \
  -s drweb:/var/spool/drweb/run/sock root < eicar.msg

(Note that uchroot above used just like `su' command.)
Your infected script should run.  In case of any trouble,
avcheck will print an error message to stderr and exit with
EX_TEMPFAIL code, so you will be able to correct the problem.

In order to ensure that antivirus detection actually works,
you can temporary substitute infected script with this one:

  #! /bin/sh
  MAIL=$1 MSG="$2" FROM="$3"; shift 3
  echo "$MAIL (from $FROM, to $*) is infected:"
  echo "$MSG"
  rm -f $MAIL
  exit 0

Running the above line with this script should produce the
something like the following:

  /var/spool/drweb/./tst/123.msg (from root, to root) is infected:
  infected by EICAR-Test-File

After you know that your DrWeb setup works, you can configure
your mailsystem.  Read the corresponding readme file for this.

Notes about additional steps setting chroot jail.

The above mentopned sequence of commands to create chroot jail works on
Linux.  On other OSes, slightly different commands should be used,
especially when creating device entries.

On Solaris, device entries should be created as follows (thank to
Piotr Klaban for this):

  mknod conslog c 21 0
  mknod console c 0 0
  mknod null c 13 2
  mknod syscon c 0 0
  mknod sysmsg c 60 0
  chmod 666 null
  chmod 620 conslog console syscon sysmsg
  chgrp avgroup conslog console syscon sysmsg
  chgrp sys null

If drwebd executable linked dynamically (check with ldd command),
you need to create lib directory inside /var/spool/drweb, and copy some
system libraries to it.  ldd will show what libraries are needed,
for example (on my solaris box):
  ldd drwebd
    libc.so.1 =>	/usr/lib/libc.so.1
    libdl.so.1 =>	/usr/lib/libdl.so.1
    ...
Copy all specified files (/usr/lib/libc.so.1 and so on) into
/var/spool/drweb/lib directory, and do not forget the dynamic linker
itself (on Solaris, it is /lib/ld.so.1, on Linux - /lib/ld-linux.so.2
(for glibc2), on BSD - ?).

