ESET Server Security for Linux (File Security) 7 Owner's manual

Category
Antivirus security software
Type
Owner's manual
ESET File Security for Linux
User guide
Click here to display the online version of this document
Copyright ©2023 by ESET, spol. s r.o.
ESET File Security for Linux was developed by ESET, spol. s r.o.
For more information visit https://www.eset.com.
All rights reserved. No part of this documentation may be reproduced, stored in a retrieval system or transmitted
in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise without
permission in writing from the author.
ESET, spol. s r.o. reserves the right to change any of the described application software without prior notice.
Technical Support: https://support.eset.com
REV. 3/18/2023
1 Introduction 1 .......................................................................................................................................
1.1 Key features of the system 1 ..........................................................................................................
2 Release notes 1 ....................................................................................................................................
3 System requirements 3 ........................................................................................................................
4 Installation 5 ........................................................................................................................................
4.1 Uninstall 7 ....................................................................................................................................
4.2 Mass deployment 7 .......................................................................................................................
5 Update, upgrade 13 .............................................................................................................................
5.1 Update mirror 15 ..........................................................................................................................
5.2 Automatic product component updates 15 .......................................................................................
6 Activate ESET File Security for Linux 16 ...............................................................................................
6.1 Where can I find my license 17 .......................................................................................................
6.2 Activation status 18 ......................................................................................................................
7 Using ESET File Security for Linux 18 ...................................................................................................
7.1 Dashboard 20 ...............................................................................................................................
7.2 Scans 21 ......................................................................................................................................
7.2 On-Demand Scan via Terminal 22 .......................................................................................................
7.2 Exclusions 23 .............................................................................................................................
7.3 Detections 27 ...............................................................................................................................
7.3 Quarantine 27 ............................................................................................................................
7.4 Events 29 .....................................................................................................................................
8 Configuration 30 ..................................................................................................................................
8.1 Detection engine 30 ......................................................................................................................
8.1 Exclusions 31 .............................................................................................................................
8.1 Real-time file system protection 34 .....................................................................................................
8.1 Cloud-based protection 35 ...............................................................................................................
8.1 Malware scans 37 ........................................................................................................................
8.1 ICAP scan 37 ..............................................................................................................................
8.1 Cleaning levels 37 ........................................................................................................................
8.1 Shared local cache 38 ....................................................................................................................
8.1 ThreatSense parameters 38 .............................................................................................................
8.1 Additional ThreatSense parameters 40 .................................................................................................
8.2 Update 41 ....................................................................................................................................
8.3 Tools 41 .......................................................................................................................................
8.3 Proxy Server 41 ..........................................................................................................................
8.3 Web interface 41 .........................................................................................................................
8.3 Log files 43 ...............................................................................................................................
8.3 Scheduler 44 .............................................................................................................................
8.4 Listen address and port 44 .............................................................................................................
9 Remote Management 45 ......................................................................................................................
10 Use case examples 45 .......................................................................................................................
10.1 Integrate ICAP server with EMC Isilon 45 .......................................................................................
10.2 Retrieve module information 47 ....................................................................................................
10.3 Schedule scan 47 ........................................................................................................................
11 File and folder structure 48 ................................................................................................................
12 Troubleshooting 51 ............................................................................................................................
12.1 Collect logs 51 ............................................................................................................................
12.2 Forgot my password 52 ................................................................................................................
12.3 Update failed 53 .........................................................................................................................
12.4 Using the noexec flag 53 ..............................................................................................................
12.5 Realtime protection cannot start 54 ..............................................................................................
12.6 Disable Realtime protection at boot 55 ..........................................................................................
13 Known issues 55 ................................................................................................................................
14 Glossary 56 ........................................................................................................................................
15 End User License Agreement 56 ........................................................................................................
16 Privacy Policy 62 ................................................................................................................................
1
Introduction
ESET's state-of-the-art scanning engine has unsurpassed scanning speed and detection rates combined with a
very small footprint that makes ESET File Security for Linux (EFSL) the ideal choice for any server on Linux.
Main functionality is covered by the On-demand scanner and On-access scanner.
The On-demand scanner can be started by a privileged user (usually a system administrator) through the
command line interface, the web interface or by the operating system's automatic scheduling tool (e.g., cron).
The term On-demand refers to file system objects being scanned by either user or system demand.
The On-access scanner is invoked whenever a user and/or operating system attempts to access file system
objects. This also clarifies the use of the term On-access; because a scan is triggered by any attempt to access file
system objects.
Key features of the system
Automatic product updater
Redesigned web interface for easy management and overview of security of your system
On-access scan by ESET's lightweight in-kernel module
Comprehensive scan logs
Redesigned, easy-to-use setup page with a search bar
SELinux support
Quarantine
Manageable via ESET Security Management Center
Release notes
ESET File Security for Linux version 7.2 hotfix (7.2.578)
Fixed: A potential vulnerability in the on-access scanner - reported internally
Fixed: Memory leak could occur under special circumstances
Fixed: On-demand scan issues resulted in a system freeze
ESET File Security for Linux version 7.2 hotfix
New: Ability to check for an update of application via the upd command-line utility or from the WebGUI.
New: Ability to enable automatic update of application during server restart
2
New: Support for Ubuntu 20.04 LTS
New: Support for RedHat Enterprise Linux (RHEL) 8
New: Support for CentOS 8
New: Support for Debian 10
New: Support of ICAP scanning for Nutanix
New: Support for EncFS file system
Improved: Performance and system footprint of real-time protection scanner
Improved: Changes in WebGUI settings needs to be confirmed or discarded before leaving settings section
SELinux compatibility on CentOS
Fixed: On-demand scan enabled from WebGUI might not remove all detections if they exist in separate
partitions
Fixed: Real-time protection scanner could slow down a machine during the boot process in certain
scenarios
Fixed: Error "Cannot accept the connection" when too many connections were opened to icapd
Fixed: Enabling "Shut down computer after scan" task from ESMC did not work
Fixed: A rare kernel crash could occur when unloading modules
Removed: Support for rspamd spam filtering system
Other minor bug fixes and optimizations
ESET File Security for Linux version 7.1 hotfix
New: Added ICAP scanning support for Citrix ShareFile
New: Updated Software End User License Agreement
Improved: Performance of Real-time protection scanner
Improved: Odscan utility in command line is able to return status of On-demand scan as exit code
Fixed: An issue causing excessive error logging into syslog
Fixed: An issue causing excessive error logging into event log during update
Fixed: An issue where activation with offline licenses did not work
Fixed: Some words in the scan detail page in WebGUI were not translated
Fixed: Other minor bug fixes and improvements
3
ESET File Security for Linux version 7.1
New: Scheduler - the ability to schedule an on-demand scan through Web interface or an ESET Security
Management Center policy
New: List of files which were not scanned during an on-demand scan (for example, password-protected
files) is available in scan details
New: Support for changed exclusions workflow in upcoming ESET Security Management Center 7.1 release
New: Support for subscription licenses
New: Ability to "Restore and Exclude" quarantined samples through Web interface
New: Automatic log maintenance
Improved: Output of modules date and versions in terminal
Improved: Update of third-party components
Improved: List of on-demand scans triggered by ESET Security Management Center console
Improved: More clear error messages
Fixed: Compatibility issues with SSSD on SELinux
Fixed: Activation on SELinux via Http proxy
Fixed: SELinux denies port change of ICAP and Web interface
Fixed: "Log all objects” setting has been removed temporarily
Fixed: Cannot change ESET File Security for Linux Web interface password through ESET Security
Management Center
Fixed: Web interface improvements
Fixed: Bug fixes & many under-the-hood optimizations regarding performance and stability
System requirements
Hardware requirements depend on the server role. The following minimum hardware requirements must be met
before the installation process in order to run ESET File Security for Linux properly:
processor Intel/AMD x64
700MB of free hard disk space
256MB of free RAM
glibc 2.12 or later
4
2.6.32 and later Linux OS kernel versions
Any locale with UTF-8 encoding
ESET File Security for Linux has been tested and is supported on the listed operating systems' latest minor
releases. Update your operating system before installing efs.
RedHat Enterprise Linux (RHEL) 6 64-bit
RedHat Enterprise Linux (RHEL) 7 64-bit
RedHat Enterprise Linux (RHEL) 8 64-bit
CentOS 6 64-bit
CentOS 7 64-bit
Centos 8 64-bit
Ubuntu Server 16.04 LTS 64-bit
Ubuntu Server 18.04 LTS 64-bit
Ubuntu Server 20.04 LTS 64-bit
Debian 9 64-bit
Debian 10 64-bit
SUSE Linux Enterprise Server (SLES) 12 64-bit
SUSE Linux Enterprise Server (SLES) 15 64-bit
ESET File Security for Linux has been tested and is supported on the latest minor releases of the listed operating
systems. Update your operating system before installing ESET File Security for Linux.
AWS and ELREPO kernels
Linux distributions with AWS or ELREPO kernel are not supported.
ESET File Security for Linux should also work on the most recent and frequently used open-source Linux
distributions if:
the hardware requirements criteria above are met,
and software dependencies are not missing in the Linux distribution used.
5
NOTE
Secure Boot is not supported.
Remote management via ESET Security Management Center.
Supported browsers
The ESET File Security for Linux Web interface works in the following browsers:
Google Chrome
Mozilla Firefox
Microsoft Edge
Safari
SELinux support
SELinux is supported in the following distributions:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Centos 6
Centos 7
Centos 8
Installation of EFS SELinux module policy requires selinux-policy-devel package to be installed. To start the OS
without ESET File Security for Linux SELinux module, use the eset_selinux=0 kernel parameter during OS boot.
Installation
ESET File Security for Linux is distributed as a binary file (
.bin
).
NOTE
Make sure your OS has the most recent updates installed before installation of ESET File Security
for Linux.
Remove version 4.x first
If you have ESET File Security for Linux version 4.x installed, remove it first. Version 7.x is not
compatible with version 4.x.
If you have been using ESET Remote Adminstrator to manage ESET File Security for Linux version
4, upgrade to ESET Security Management Center in order to manage version 7 remotely.
6
Installation via Terminal
To install or upgrade your product, run the ESET distribution script with root privileges for the appropriate OS
distribution that you have:
• ./efs-<VERSION>.x86_64.bin
• sh ./efs-<VERSION>.x86_64.bin
See available command-line arguments.
To display the available parameters (arguments) of ESET File Security for Linux binary file, run the following
command from a terminal window:
bash ./efs-<VERSION>.x86_64.bin -h
Available parameters
Short form Long form Description
-h --help Display command-line arguments
-n --no-install Do not perform installation after unpacking
-y --accept-license Do not show the license, license has been accepted
-f --force-install Force installation via package manager without asking
-g --no-gui Do not setup/start GUI after installation
Gain .deb or .rpm installation package
To gain .deb or .rpm installation package suitable for your OS, run ESET distribution script with
"-n" command-line argument:
sudo ./efs-<VERSION>.x86_64.bin -n
or
sudo sh ./efs-<VERSION>.x86_64.bin -n
To see the dependencies of the installation package, run one of the following commands:
• dpkg -I <deb package>
• rpm -qRp <rpm package>
Follow the on-screen instructions. Once you accept the product License Agreement, installation will complete and
displays the Web interface login details.
The installer would inform you of any dependency problems.
Installation via ESET Security Management Center (ESMC)
To deploy ESET File Security for Linux remotely on your computers, refer to the ESMC Software Install online help
section.
To enable regular updates of detection modules, activate ESET File Security for Linux.
7
If needed, enable the Web interface remotely.
Third-party apps
A summary of third-party apps used by ESET File Security for Linux can be found in the
NOTICE_mode file stored at
/opt/eset/efs/doc/modules_notice/
.
Uninstall
To uninstall your ESET product, use the terminal window as a superuser to execute the command of removing
packages corresponding to your Linux distribution.
Ubuntu/Debian based distributions:
• apt-get remove efs
• dpkg --purge efs
Red Hat based distributions:
• yum remove efs
• rpm -e efs
Mass deployment
This topic provides a high-level overview of mass deployment of ESET File Security for Linux via Puppet, Chef and
Ansible. The code blocks below contain only basic examples of how packages could be installed. They might differ
per linux distribution.
Package selection
Before you start the mass deployment of ESET File Security for Linux, you have to decide which package to use.
ESET File Security for Linux is distributed as a .bin package. However, you can obtain deb/rpm package by running
the ESET distribution script with "-n" command-line argument.
Puppet
Precondition
bin or deb/rpm package available on puppet-master
puppet-agent connected to puppet-master
Bin package
Deployment steps:
copy the bin installation package to the desired machines
8
run the bin installation package
Puppet manifest sample
node default {
file {"/tmp/efs-7.0.1081.0.x86_64.bin":
mode => "0700",
owner => "root",
group => "root",
source => "puppet:///modules/efs/efs-7.0.1081.0.x86_64.bin"
}
exec {"Execute bin package installation":
command => '/tmp/efs-7.0.1081.0.x86_64.bin -y -f'
}
}
Deb/rpm package
Deployment steps:
copy deb/rpm installation package according to distribution family to the desired machines
run the deb/rpm installation package
Dependencies
Dependencies have to be resolved before starting the installation
9
Puppet manifest sample
node default {
if $osfamily == 'Debian' {
file {"/tmp/efs-7.0.1081.0.x86_64.deb":
mode => "0700",
owner => "root",
group => "root",
source => "puppet:///modules/efs/efs-7.0.1081.0.x86_64.deb"
}
package {"efs":
ensure => "installed",
provider => 'dpkg',
source => "/tmp/efs-7.0.1081.0.x86_64.deb"
}
}
if $osfamily == 'RedHat' {
file {"/tmp/efs-7.0.1081.0.x86_64.rpm":
mode => "0700",
owner => "root",
group => "root",
source => "puppet:///modules/efs/efs-7.0.1081.0.x86_64.rpm"
}
package {"efs":
ensure => "installed",
provider => 'rpm',
source => "/tmp/efs-7.0.1081.0.x86_64.rpm"
}
}
}
Chef
Precondition
bin or deb/rpm package available on Chef server
Chef client connected to Chef server
Bin package
Deployment steps:
copy the bin installation package to the desired machines
run the bin installation package
10
Chef recipe sample
cookbook_file '/tmp/efs-7.0.1084.0.x86_64.bin' do
source 'efs-7.0.1084.0.x86_64.bin'
owner 'root'
group 'root'
mode '0700'
action :create
end
execute 'package_install' do
command '/tmp/efs-7.0.1084.0.x86_64.bin -y -f'
end
Deb/rpm package
Deployment steps:
copy deb/rpm installation package according to distribution family to the desired machines
run the deb/rpm installation package
Dependencies
Dependencies have to be resolved before starting the installation
11
Chef recipe sample
cookbook_file '/tmp/efs-7.0.1084.0.x86_64.deb' do
source 'efs-7.0.1084.0.x86_64.deb'
owner 'root'
group 'root'
mode '0700'
action :create
only_if { node['platform_family'] == 'debian'}
end
cookbook_file '/tmp/efs-7.0.1084.0.x86_64.rpm' do
source 'efs-7.0.1084.0.x86_64.rpm'
owner 'root'
group 'root'
mode '0700'
action :create
only_if { node['platform_family'] == 'rhel'}
dpkg_package 'efsu' do
source '/tmp/efs-7.0.1084.0.x86_64.deb'
action :install
only_if { node['platform_family'] == 'debian'}
end
rpm_package 'efsu' do
source '/tmp/efs-7.0.1084.0.x86_64.rpm'
action :install
only_if { node['platform_family'] == 'rhel'}
end
Ansible
Precondition
bin or deb/rpm package available on Ansible server
ssh access to target machines
Bin package
Deployment steps:
copy the bin installation package to the desired machines
run the bin installation package
12
Playbook task sample
....
- name: "INSTALL: Copy configuration json files"
copy:
src: efs-7.0.1084.0.x86_64.bin
dest: /home/ansible/
- name : "Install product bin package"
shell: bash ./efs-7.0.1084.0.x86_64.bin -y -f -g
.....
Deb/rpm package
Deployment steps:
copy deb/rpm installation package according to distribution family to the desired machines
run the deb/rpm installation package
Playbook task sample
....
- name: "Copy deb package to VM"
copy:
src: ./efs-7.0.1085.0.x86_64.deb
dest: /home/ansible/efs-7.0.1085.0.x86_64.deb
owner: ansible
mode: a+r
when:
- ansible_os_family == "Debian"
- name: "Copy rpm package to VM"
copy:
src: ./efs-7.0.1085.0.x86_64.rpm
dest: /home/ansible/efs-7.0.1085.0.x86_64.rpm
owner: ansible
mode: a+r
when:
- ansible_os_family == "RedHat"
- name: "Install deb package"
apt:
deb: /home/ansible/efs-7.0.1085.0.x86_64.deb
state: present
when:
- ansible_os_family == "Debian"
- name: "Install rpm package"
yum:
name: /home/ansible/efs-7.0.1085.0.x86_64.rpm
state: present
when:
- ansible_os_family == "RedHat"
....
13
Update and upgrade
Update of modules
Product modules, including detection modules, are updated automatically.
To launch the update of detection modules manually, click Modules update > Check and update, and wait till the
update completes.
If an ESET File Security for Linux update was not stable, roll back the module updates to a previous state. Click
Dashboard > Modules update > Module rollback, select the desired duration, click Rollback now.
To update all product modules from a Terminal window, execute the following command:
/opt/eset/efs/bin/upd -u
Update and rollback via Terminal
Options -
short form Options - long form Description
-u --update Update modules
-c --cancel Cancel downloading modules
-e --resume Unblock updates
-r --rollback=VALUE Rolls back to the oldest snapshot of the scanner
module and blocks all updates for VALUE hours
-l --list-modules Display the list of product modules *
--server=ADDRESS Update server address
--username=USERNAME Username to authenticate update eligibility
--password=PASSWORD Password to authenticate update eligibility
--proxy-addr=ADDRESS Proxy server address
--proxy-port=PORT Proxy server port
--proxy-username=USERNAME Username to access the proxy server protected by
username/password
--proxy-password=PASSWORD Password to access the proxy server protected by
username/password
--update-server-type=UPDATE_TYPE Type of update server
--list-update-server-type List of available types of update servers
--check-app-update Check the availability of new product version in the
repository**
--download-app-update Download new product version if available**
--perform-app-update Download and install new product version if
available**
--accept-license Accept license changes**
14
* - available from ESET File Security for Linux version 7.1
** - available from ESET File Security for Linux version 7.2
Important
The upd utility cannot be used to make changes in product configuration.
Example
To stop updates for 48 hours and roll back to the oldest snapshot of the scanner module, execute the following
command as a privileged user:
sudo /opt/eset/efs/bin/upd --rollback=48
To resume automatic updates of the scanner module, execute the following command as a privileged user:
sudo /opt/eset/efs/bin/upd --resume
To update from a mirror server available at IP address "192.168.1.2" and port "2221", execute the following
command as a privileged user:
sudo /opt/eset/efs/bin/upd --update --server=192.168.1.2:2221
Upgrade ESET File Security for Linux to a later version
New versions of ESET File Security for Linux are issued to implement improvements or fix issues that cannot be
resolved by automatic updates to program modules.
Note
An upgrade from ESET File Security for Linux version 4 to version 7 is not possible. A clean new
installation is needed. The settings from version 4 cannot be imported to version 7.
Which product version is currently installed?
There are two methods to determine the product version of ESET File Security for Linux:
1.In the Web interface, navigate to Help > About.
2.Execute /opt/eset/efs/sbin/setgui -v in a Terminal window.
How to upgrade ESET File Security for Linux?
Local options
Run an OS-related installation package as described in the Installation section
15
In the Web interface, navigate to Dashboard > Product update, click Check for update
Use the upd utility with the --perform-app-update parameter
Configure automatic updates/upgrades
Remote management via ESET Security Management Center (ESMC)
If managing ESET File Security for Linux through ESMC, you can initiate upgrade the following ways:
Software install task
In the Web interface, navigate Dashboard > ESET Applications > right-click ESET File Security for Linux >
Update installed ESET products...
Configure automatic updates/upgrades
Update mirror
Several ESET security products (ESET Security Management Center, ESET Endpoint Antivirus, etc.) allow you to
create copies of update files that can be used to update other workstations on the network. The use of a mirror—
a copy of the update files in the LAN environment—is convenient because the update files do not need to be
downloaded from the vendor update server repeatedly by each workstation. Updates are downloaded to the
local mirror server and then distributed to all workstations to avoid the risk of network traffic overload. Updating
client workstations from a mirror optimizes network load balance and saves internet connection bandwidth.
Configure ESET File Security for Linux to use an update mirror
1.In the Web interface navigate to Setup > Update > Primary Server.
2.In the Basic section, switch the toggle next to Choose automatically to turn it off.
3.In the Update server field, type the URL address of the mirror server in one of the following forms:
a.http://<IP>:<port>
b.http://<hostname>:<port>
4.Enter the applicable username and password.
5.Click Save.
If there are more mirror servers available in your network, repeat the steps above to configure the secondary
update servers.
Automatic product component updates
In ESET File Security for Linux version 7.2 you can activate automatic product component updates, including
upgrade to later product versions:
16
1. In the Web interface, navigate to Setup > Update.
2. In the Program Component Update section, select Auto-update from the Update mode list-box.
3. If you prefer to use a custom update server for product component updates:
a.Define the server address in the Custom server field.
b.Enter the Username and Password in the corresponding fields.
4. Click Save.
If managing ESET File Security for Linux via ESET Security Management Center, configure the above mentioned
automatic updates through Policies.
To alter the configuration of ESET File Security for Linux:
1. In ESET Security Management Center click Policies > New policy and type a name for the policy.
2. Click Settings, and select ESET Endpoint for Linux (V7+) from the drop-down menu.
3. Adjust the desired settings and click Save in each dialog where you made a change.
4. Click Finish.
Update mode
Auto-update - new packages are automatically downloaded and then installed upon the next restart of OS. If
there have been updates to the End User License Agreement, the user has to accept the updated End User
License Agreement before downloading the new package.
Never-update - new packages are not downloaded, but the product displays the availability of new packages in
the Dashboard.
Activate ESET File Security for Linux
Activate your ESET File Security for Linux using a license obtained from your ESET distributor.
Activate using Web interface
1. Log in to the Web interface
2. Click Dashboard > License tile and select the desired method of activation:
a.Activate with License Key
b.Offline license
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28
  • Page 29 29
  • Page 30 30
  • Page 31 31
  • Page 32 32
  • Page 33 33
  • Page 34 34
  • Page 35 35
  • Page 36 36
  • Page 37 37
  • Page 38 38
  • Page 39 39
  • Page 40 40
  • Page 41 41
  • Page 42 42
  • Page 43 43
  • Page 44 44
  • Page 45 45
  • Page 46 46
  • Page 47 47
  • Page 48 48
  • Page 49 49
  • Page 50 50
  • Page 51 51
  • Page 52 52
  • Page 53 53
  • Page 54 54
  • Page 55 55
  • Page 56 56
  • Page 57 57
  • Page 58 58
  • Page 59 59
  • Page 60 60
  • Page 61 61
  • Page 62 62
  • Page 63 63
  • Page 64 64
  • Page 65 65
  • Page 66 66
  • Page 67 67
  • Page 68 68

ESET Server Security for Linux (File Security) 7 Owner's manual

Category
Antivirus security software
Type
Owner's manual

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI