Virus Blockers Common - Revision history

Dmorris at 16:24, 12 June 2017

2017-06-12T16:24:16Z

← Older revision		Revision as of 16:24, 12 June 2017
Line 2:		Line 2:

	This section reviews the different settings and configuration options available for the virus scanners.		This section reviews the different settings and configuration options available for the virus scanners.


			=== Status ===

			This displays the current status and some statistics.

			{{AppScreenshot\|virus-blocker\|status}}


	=== Scan Options ===		=== Scan Options ===

Dmorris at 16:18, 12 June 2017

2017-06-12T16:18:05Z

← Older revision		Revision as of 16:18, 12 June 2017
Line 3:		Line 3:
	This section reviews the different settings and configuration options available for the virus scanners.		This section reviews the different settings and configuration options available for the virus scanners.

			=== Scan Options ===

	~~=== Web ===~~		Scan options configure what network traffic and content to scan.

	~~This section reviews the different settings and configuration~~ options ~~for web~~ traffic.

	* '''Scan HTTP''': This enables or disables HTTP scanning.		* '''Scan HTTP''': This enables or disables HTTP scanning.

	* '''~~File Types~~''': ~~The File Types section allows you to scan files by file extension - just select (or add) your chosen file extension, check your preferred action (scan or not), and save.~~		* '''Scan SMTP''': This option enables scanning of SMTP '''message attachments'''.

	* '''~~MIME Types~~'''~~: The MIME Types section allows you to scan files by MIME types - just select (or add) your chosen file extension, check your preferred action (scan or not), and save.~~

	~~{{AppScreenshot\|virus-blocker\|web}}~~


	~~=== Email ===~~

	~~This section reviews the different settings and configuration options for email traffic~~.

	* '''Scan SMTP''': This option enables scanning of SMTP '''message attachments'''.
	* '''Action''': The selected action will be taken on a message if a virus is found.		* '''Action''': The selected action will be taken on a message if a virus is found.
	:Setting Action to '''Remove Infection''' will remove the infected attachment and wrap the original email for delivery to the intended recipient. If set to '''Pass Message''', the original message will be wrapped and delivered with the attachment intact. In both cases, the subject line is prepended with "[VIRUS]". '''Block''' will block the message from being delivered.		:Setting Action to '''Remove Infection''' will remove the infected attachment and wrap the original email for delivery to the intended recipient. If set to '''Pass Message''', the original message will be wrapped and delivered with the attachment intact. In both cases, the subject line is prepended with "[VIRUS]". '''Block''' will block the message from being delivered.

	~~{{AppScreenshot\|virus-blocker\|email}}~~


	~~=== FTP ===~~

	~~This section reviews the different settings and configuration options for FTP traffic.~~

	* '''Scan FTP''': This enables or disables scanning of FTP downloads.		* '''Scan FTP''': This enables or disables scanning of FTP downloads.

	{{AppScreenshot\|virus-blocker\|~~ftp~~}}		{{AppScreenshot\|virus-blocker\|scan-options}}

Dmorris at 16:15, 12 June 2017

2017-06-12T16:15:23Z

← Older revision		Revision as of 16:15, 12 June 2017
Line 13:		Line 13:

	* '''MIME Types''': The MIME Types section allows you to scan files by MIME types - just select (or add) your chosen file extension, check your preferred action (scan or not), and save.		* '''MIME Types''': The MIME Types section allows you to scan files by MIME types - just select (or add) your chosen file extension, check your preferred action (scan or not), and save.

			{{AppScreenshot\|virus-blocker\|web}}


Line 22:		Line 24:
	* '''Action''': The selected action will be taken on a message if a virus is found.		* '''Action''': The selected action will be taken on a message if a virus is found.
	:Setting Action to '''Remove Infection''' will remove the infected attachment and wrap the original email for delivery to the intended recipient. If set to '''Pass Message''', the original message will be wrapped and delivered with the attachment intact. In both cases, the subject line is prepended with "[VIRUS]". '''Block''' will block the message from being delivered.		:Setting Action to '''Remove Infection''' will remove the infected attachment and wrap the original email for delivery to the intended recipient. If set to '''Pass Message''', the original message will be wrapped and delivered with the attachment intact. In both cases, the subject line is prepended with "[VIRUS]". '''Block''' will block the message from being delivered.

			{{AppScreenshot\|virus-blocker\|email}}


Line 29:		Line 33:

	* '''Scan FTP''': This enables or disables scanning of FTP downloads.		* '''Scan FTP''': This enables or disables scanning of FTP downloads.

			{{AppScreenshot\|virus-blocker\|ftp}}


Line 40:		Line 46:
	* FTP. Match the server IP address or domain address (if a reverse DNS address exists).		* FTP. Match the server IP address or domain address (if a reverse DNS address exists).
	* Email. Match the client or server IP address or domain address (if a reverse DNS address exists).		* Email. Match the client or server IP address or domain address (if a reverse DNS address exists).

			{{AppScreenshot\|virus-blocker\|pass-sites}}


Line 49:		Line 57:

	Using all available engines is recommended.		Using all available engines is recommended.

			{{AppScreenshot\|virus-blocker\|advanced}}

Dmorris at 16:30, 27 December 2016

2016-12-27T16:30:08Z

← Older revision		Revision as of 16:30, 27 December 2016
Line 49:		Line 49:

	Using all available engines is recommended.		Using all available engines is recommended.


	==== File extensions ====		==== File extensions ====
Line 57:		Line 58:
	A understanding of security tradeoffs and pragmatism is essential before changing these settings. Unlike the other URL-based scanning of other apps like Web Filter, Virus Blocker runs in depth analysis of the file, including signatures, heuristics, and emulation. Unlike host-based antivirus, the gateway is a unique resource shared among the whole network and furthermore it has no ability to scan-on-exec as it has no knowledge of what the client plans to execute, unlike host-based antivirus. Scanning is expensive and turning on certain extensions (like .png files) can cripple the network.		A understanding of security tradeoffs and pragmatism is essential before changing these settings. Unlike the other URL-based scanning of other apps like Web Filter, Virus Blocker runs in depth analysis of the file, including signatures, heuristics, and emulation. Unlike host-based antivirus, the gateway is a unique resource shared among the whole network and furthermore it has no ability to scan-on-exec as it has no knowledge of what the client plans to execute, unlike host-based antivirus. Scanning is expensive and turning on certain extensions (like .png files) can cripple the network.
	Analyzing reports to see how many scans are being done and if those resources are being spent on worthwhile scan resources is a good exercise. It is not uncommon to see millions of scans of some application's update.		Analyzing reports to see how many scans are being done and if those resources are being spent on worthwhile scan resources is a good exercise. It is not uncommon to see millions of scans of some application's update.


	==== MIME types ====		==== MIME types ====

	Similar to file extensions, but ~~these list~~ the MIME types to be scanned, regardless of extension. The same logic and warnings apply here as well.		Similar to file extensions, but this lists the MIME types to be scanned, regardless of extension. The same logic and warnings apply here as well.

Dmorris at 03:48, 27 December 2016

2016-12-27T03:48:40Z

@@ Line 32: / Line 32: @@
 === Pass Sites ===
 This section allows you to specify sites that are not scanned.  The list uses the [[Glob Matcher]] syntax.
 : NOTE: Use caution when adding sites to this list!
@@ Line 39: / Line 40: @@
 * FTP.  Match the server IP address or domain address (if a reverse DNS address exists).
 * Email.  Match the client or server IP address or domain address (if a reverse DNS address exists).

Dmorris at 17:36, 4 April 2016

2016-04-04T17:36:11Z

New page

== Settings ==

This section reviews the different settings and configuration options available for the virus scanners.

=== Web ===

This section reviews the different settings and configuration options for web traffic.

* '''Scan HTTP''': This enables or disables HTTP scanning.

* '''File Types''': The File Types section allows you to scan files by file extension - just select (or add) your chosen file extension, check your preferred action (scan or not), and save.

* '''MIME Types''': The MIME Types section allows you to scan files by MIME types - just select (or add) your chosen file extension, check your preferred action (scan or not), and save.

=== Email ===

This section reviews the different settings and configuration options for email traffic.

* '''Scan SMTP''': This option enables scanning of SMTP '''message attachments'''.
* '''Action''': The selected action will be taken on a message if a virus is found.
:Setting Action to '''Remove Infection''' will remove the infected attachment and wrap the original email for delivery to the intended recipient. If set to '''Pass Message''', the original message will be wrapped and delivered with the attachment intact. In both cases, the subject line is prepended with "[VIRUS]". '''Block''' will block the message from being delivered.

=== FTP ===

This section reviews the different settings and configuration options for FTP traffic.

* '''Scan FTP''': This enables or disables scanning of FTP downloads.

=== Pass Sites ===
This section allows you to specify sites that are not scanned. The list uses the [[Glob Matcher]] syntax.
: NOTE: Use caution when adding sites to this list!

For each protocol, the behavior is as follows:
* HTTP. Match the HTTP Host header.
* FTP. Match the server IP address or domain address (if a reverse DNS address exists).
* Email. Match the client or server IP address or domain address (if a reverse DNS address exists).