.\" Copyright (c) 2002 Granch Ltd. All rigts reserved. .\" .\" All or some portions of this file are derived from material licensed .\" to the Grahcn Ltd. and are reproduced herein with the permission of .\" Granch Ltd. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" 3. Neither the name of the author nor the names of any co-contributors .\" may be used to endorse or promote products derived from this software .\" without specific prior written permission. .\" .\" THIS SOFTWARE IS PROVIDED BY GRANCH LTD. AND THEIR CONTRIBUTORS ``AS IS'' .\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" @(#)kavmilter.8 0.91.3 (Granch Ltd.) 09/07/02 .\" .Dd July 10, 2002 .Dt KAVMILTER 8 .Os .Sh NAME .Nm kavmilter .Nd sendmail antivirus filter, based on milter API .Sh SYNOPSIS .Nm kavmilter .Op Fl c Ar socket .Op Fl s Ar KAV socket .Op Fl d .Op Fl D Ar Debug level .Op Fl hv .Op Fl p Ar tmpdir .Op Fl t Ar sendmail timeout .Op Fl T Ar KAV timeout .Op Fl m Ar {reject|discard} .Op Fl P Ar PID file name .Op Fl C Ar config file name .Sh DESCRIPTION .Nm Kavmilter is a sendmail filter, based on Milter API, intedned to do antiviral check through Kaspersky Antivirus. It doesn't checks mail itself, but passes it to preliminary setuped Kaspersky Antivirus to check, reads result, and, depending it, discards/rejects or passes mail. This check issued .Ql in-place delivery processing, so, nor extracting, nor extra reinjecting in/out mail queue doesn't issued. But this program is .Sy NOT mail transfer agent and .Sy NOT antivirus itself. at first glance it is a set of hooks, which executed when sendmail takes some appropriate actions - connecting remote server, receiving .Li MAIL FROM or .Li RCPT TO, transferring header or body of message, etc. .Pp The options are as follows: .Bl -tag -width indent .It Fl c Ar sendmail-socket Specifies name of sendmail communication socket. This name must be identical with name, specified in sendmail configuration file. Default is .Sy /var/run/kavmilter .It Fl s Ar KAV-socket Specifies name of Kaspersky Antivirus Daemon communication socket (can be set in command-line by them). Default is .Sy /var/run/AvpCtl .It Fl d Specified work in daemon mode. Daemon mode is usually work mode for filter, .Ql no-daemonized mode can apply only when debugging. But default value is .Sy NOT to go to daemon mode. .It Fl D Ar debug-level Specifies level of debugging. Can be set from 0 to 100. Valuable values are 0, 10, 20, 50, 100. More value - more debugging information. Default value is .Sy 0 .It Fl h Prints help about parameteres usage and exits .It Fl v Prints version number about program and exits .It Fl p Ar temp-directory Specifies directory to save files to pass it to antiviral check. Be aware - this parameter .Sy MUST specifiled same directory, which was specified in KAV Daemon start script as .Qq allowed to check directory, else KAV won't check your files! .It Fl t Ar sendmail-connect-timeout Specifies timeout to connect to sendmail. This value passes to Milter API directly. Sets the number of seconds libmilter will wait for an MTA connection before timing out a sendmail socket. It must be enough large to finish filter read message from MTA. When timeout occured before read finished usually filter returns error with messages as below .Bf -symbolic .Bd -unfilled Milter (filter): read (L) returned -1, expected 5: Broken pipe Milter (filter): to error state Milter: data, reject 451 4.7.1 Please try again later .Ef or similar .Ed .It Fl T Ar KAV-connect-timeout Specifies timeout to connect to KAV Daemon socket. This timeout must be enough large to finish Kaspersky Daemon checking a mail message. When timeout occured before Kaspersky Daemon finished, filter returns error, mail will be rejected with error as below .Bf -symbolic .Bd -unfilled Milter (filter): read (L) returned -1, expected 5: Broken pipe Milter (filter): to error state Milter: data, reject 451 4.7.1 Please try again later .Ef or similar .Ed .It Fl m Ar {reject | discard} Specifies action with infected or suspicious files. When action is .Sy reject infected mail will be rejected to sender and receiver's postmaster with message .Pp .Sy 554 5.7.1 DANGER! Message from to infected: .Pp suspicious mail will be rejected to sender and receiver's postmaster with message .Pp .Sy 554 5.7.1 WARNING! Message from to suspicion: .Pp When action is .Sy discard infected mail will be silently discarded .It Fl P Ar PID-file-name Specifies place to store file with .Nm PID number (usable in scripts). Default is .Sy /var/run/kavmilter.pid. When specified, should specify a full path and file name. .It Fl C Ar config-file Specifies alternate configuration file .Pq other than in-compiled When specified, should specify full path and filename. File should be readable and containing valid configuration directives for .Nm To list directives and information about configuration file. see .Xr kavmilter.conf 5 . .El .Sh IMPLEMENTATION NOTES To working properly, you .Sy MUST install and properly configure your Kaspersky Antiviral Daemon (KAV) .Ar BEFORE you'll try to start filter. Moving infected or suspicious files does by KAV itself. KAV should be configure to not to show packer information and OK messages. When KAV started, their .Dq allowed to check parameter .Fl o Brq objects should specified same path, as filter's parameter .Fl p. Below are lines to include in your defUnix.prf (or your profile file) to secure the .Ql properly configuration ( .Ql properly means here that it is properly to work with filter). .Pp .Bd -unfilled .Bq Report Report=Yes UseSysLog=No ReportFileName=/kavscan.rpt Append=No ReportFileLimit=Yes ReportFileSize=500 WriteTime=No WriteExtInfo=No ExtReport=Yes RepCreateFlag=600 UseCR=No RepForEachDisk=Yes LongStrings=Yes ShowOK=No ShowPack=No ShowPassworded=Yes ShowSuspision=Yes ShowWarning=Yes ShowCorrupted=Yes ShowUnknown=Yes .Bq ActionWithInfected InfectedCopy=Yes InfectedFolder= CopyWithPath=No CopyEqual=No ChangeExt=No NewExtension=Virs ChownTo=None ChModTo=0600 .Bq ActionWithSuspicion SuspiciousCopy=Yes SuspiciousFolder= CopyWithPath=No CopyEqual=No ChangeExt=No NewExtension=Susp ChownTo=None ChModTo=0600 .Ed .Pp In .Sy contrib subdirectory in source tree you can find script to start KAV daemon in system starting process. .Sy BE AWARE! At default this script uses next default layout to Kaspersky Antiviral Daemon: .Bl -tag -width indent .It Pa /usr/local/avpbsd/avpBSD Here are KAV binaries: KAV daemon, KAV scanner, KAV inspector, etc., ini-file , profile file and report file. .It Pa /usr/local/avpbsd/avpBases Here are KAV antiviral bases and file avp.set .It Pa /usr/local/avpbsd/avprun Here are AvpCtl file, AvpPid file and here will be stored temporary files, contained mail to check. .It Pa /usr/local/avpbsd/roachbox Here are stored infected or suspicious mail, moved here by KAV Daemon. .El .Sh FILES .Bl -tag -width indent .It Pa /var/run/AvpCtl Default data pipe to communicate with Kaspersky Antiviral Daemon. .Sy MUST exist before mail filter will be started. Can be redefined with .Fl s command-line parameter. .It Pa /var/run/kavmilter Default data pipe to communicate with Sendmail. Creating by filter. This pipe is only the way to sendmail to communicate with filter. Can be redefine with .Fl c command-line parameter .It Pa /usr/local/etc/kavmilter.conf Default configuration file to filter. To information about configuration file directives see .Xr kavmilter.conf 5 .It Pa /var/run/kavmilter.pid Default file to keep PID number of daemon. Usable to scripts. .It Pa /tmp/Binf_DDMMYYHHMMSS.XXXXXX Default temp files to temporary saving mail text to performing antiviral check. .Sy DDMMYYHHMMSS here is day (2 digits), month (2 digits), year (2 digits), hour, minute and second appropriately. .Sy XXXXXX here is a pattern to generate unique temp file name by .Fn mkstemp. When mail found as infected or suspicious, file moved in special folder with this name (see .Sx IMPLEMENTATION NOTES ) .El .Sh DIAGNOSTICS Level of displaying debul information depends from .Fl D parameter. Next debug levels are avaivalbe: .Bl -tag -width ".Sy more than 100" .It Sy 0 - 10 None of debugging information will be presented .It Sy 11 - 20 Messages about open sendmail communication socket (displayed by sendmail) and about starting parameters .It Sy 21 - 50 Additionally displays prepared message to reject, address of message buffer and it's length .It Sy 51 - 100 Additionally displays constructed temp file name, return code from KAV and length of KAV return message .It Sy more than 100 Additionally displays message when end of virus name coudn't be found and message uses first 16 chars from its name. .El .Pp When any of errors occured, filter writes error diagnostic in syslog. Filter diagnoses quite all error situations - missing KAV daemon, missing valuable files, errorrs in permissions, etc. .Sh COMPATIBILITY This version of filter was tested and debugged with Kaspersky Antiviral Daemon version 4.0.0.1. I haven't possibility to check filter with all set of daemons, so you should keep in mind, that with daemon prior to 4.0.0.1 filter may don't work properly. When you want, you can send me bugfix report, but you'll check stablity of new (where this bug will be fixed) version yourself. .Sh SEE ALSO .Rs .Xr sendmail 8 .Xr kavdaemon 8 .Xr kavmilter.conf 5 .%A Sendmail, Inc. .%T Filtering Mail with Sendmail .%D 2000, 2001 .%O /usr/src/contrib/sendmail/libmilter/docs .Re .Sh HISTORY The first revision of .Nm Manual page was finished 17 July 2002 .Pp Last edition: add -C (--config-file) parameter description at 29 Oct 2002 .Sh AUTHORS This manual page was written by .An Rashid N. Achilov Aq shelton@granch.ru .