openSolaris 2008 - Using the Vscan Service - System Administration Guide: Security Services

Using the Vscan Service

Scanning files for viruses is available when the following requirements are met:

At least one scan engine is installed and configured.
The files reside on a file system that supports virus scanning.
Virus scanning is enabled on the file system.
The vscan service is enabled.
The vscan service is configured to scan files of the specified file type.

The following table points to the tasks you perform to set up the vscan service.

Task	Description	For Instructions
Install a scan engine.	Install and configure one or more of the supported third-party products listed in Table 4-1.	See the product documentation.
Enable the file system to allow virus scans.	Use the file system command to enable virus scans if necessary. For example, scans are disabled by default in the ZFS file system.	How to Enable Virus Scanning on a File System
Enable the vscan service.	Use the `svcadm`(1M) command to start the scan service.	How to Enable the Vscan Service
Add a scan engine to the vscan service	Use the `vscanadm`(1M) command with its `add-engine` subcommand to include the scan engine in the vscan service.	How to Add a Scan Engine
Configure the vscan service.	Use the `vscanadm`(1M) command to view and change vscan properties.	How to View Vscan Properties How to Change Vscan Properties
Configure the vscan service for specific file types.	Use the `vscanadm`(1M) command to set the file type.	How to Exclude Files From Virus Scans

How to Enable Virus Scanning on a File System

Use the file system command to allow virus scans of files. For example, to include a ZFS file system in a virus scan, use the zfs(1M) command.

Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. The ZFS file system allows some administrative tasks to be delegated to specific users. For more information about Delegated Administration, see the ZFS Administration Guide. For more information about roles, see Configuring RBAC (Task Map). To configure a role with the Primary Administrator profile, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration.
Enable virus scanning on a ZFS file system, for example, pool/volumes/vol1.
```
# zfs set vscan=on path/pool/volumes/vol1
```

How to Enable the Vscan Service

Use the “VSCAN Management” RBAC profile to obtain the authorizations needed for managing the vscan service.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map).
Use the svcadm(1M) command to enable virus scanning.
```
# svcadm enable vscan
```

How to Add a Scan Engine

Use the “VSCAN Management” RBAC profile to obtain the authorizations needed for managing the vscan service.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map).
To add a scan engine to the vscan service with default properties, type:
```
#vscanadm add-engine engine_ID
```
See the manpage for the vscanadm(1M) command for a description of the command.

How to View Vscan Properties

View the properties of the vscan service, of all scan engines, or of a specific scan engine.
- To view the properties of a particular scan engine, type:
```
# vscanadm get-engine engineID
```
- To view the properties of all scan engines, type:
```
# vscanadm get-engine
```
- To view one of the properties of the vscan service, type:
```
# vscanadm get -p property
```
  where property is one of the parameters described in the manpage for the vscanadm(1M) command.
  For example, if you want to see the maximum size of a file that can be scanned, type:
```
# vscanadm get max-size
```

How to Change Vscan Properties

You can change the properties of a particular scan engine and the general properties of the vscan service. Many scan engines limit the size of the files they scan, so the vscan service's max-size property must be set to a value less than or equal to the scan engine's maximum allowed size. You then define whether files that are larger than the maximum size, and therefore not scanned, are accessible.

Use the “VSCAN Management” RBAC profile to obtain the authorizations needed for managing the vscan service.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map).
View the current properties by using the vscanadm show command.
Set the maximum size for virus scans to, for example, 128 megabytes.
```
# vscanadm set -p max-size=128M
```
Specify that access is denied to any file that is not scanned due to its size.
```
# vscanadm set -p max-size-action=deny
```
See the manpage for the vscanadm(1M) command for a description of the command.

How to Exclude Files From Virus Scans

When you enable antivirus protection, you can specify that all files of specific types are excluded from the virus scan. Because the vscan service affects the performance of the system, you can conserve system resources by targeting specific file types for virus scans.

Use the “VSCAN Management” RBAC profile to obtain the authorizations needed for managing the vscan service.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map).
View the list of all file types included in the virus scan.
```
# vscanadm get -p types
```
Specify the types of files to be scanned for virus:
- Exclude a specific file type, for example the JPEG type, from the virus scan.
```
# vscanadm set -p types=-jpg,+*
```
- Include a specific file type, for example executable files, in the virus scan.
```
# vscanadm set -p types=+exe,-*
```
See the manpage for the vscanadm(1M) command for a description of the command.