User manual AVIRA ANTIVIR UNIX WEBGATE

[. . . ] User Manual Avira AntiVir WebGate Avira WebGate Suite www. avira. com Contents Chapter 1. About this Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1. 2 The Structure of the Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] If this option is deactivated, all archives are forwarded, regardless of the settings for ArchiveMaxSize, ArchiveMaxRecursion and ArchiveMaxRatio. BlockSuspiciousArchive 0 ArchiveMax Ratio Block Suspicious Archive Block Encrypted Archive BlockPartial Archive Block Extensions Blocking password-protected archives: If this option is activated, WebGate blocks password-protected archives. BlockEncryptedArchive 0 If enabled, multi-volume archives will be blocked. BlockPartialArchive 0 Blocking certain file extensions: WebGate can block files that have certain extensions. BlockExtensions exe scr pif Quarantine directory: By default, blocked files are deleted. For example, MoveConcerningFilesTo /home/quarantine Path and name of the logfile: All important WebGate operations are logged through a syslog daemon. For example, LogFile /var/log/avwebgate. log Level for log notes: This option defines the logging level for WebGate notifications (possible values: 0 to 7). The values correspond to Unix standard levels used in syslog: Move Concerning FilesTo LogFile LogLevel Avira GmbH AntiVir WebGate 37 Configuration 0: EMERGENCY 1: ALERT 2: CRITICAL 3: ERROR 4: WARNING 5: NOTICE 6: INFO 7: DEBUG For example, LogLevel 4 means that the logfile contains all EMERGENCY, ALERT, CRITICAL, ERROR and WARNING notifications. LogLevel 4 Syslog Facility Syslog facility: WebGate sends notifications to syslog daemon for all important operations. Default: SyslogFacility user The detail level of these messages depends on the settings for LogLevel. EmailTo Email messages: AntiVir WebGate is able to send emails with additional information (for example about the relevant file), if it detects a virus or unwanted program. For example, EmailTo root@localhost Header analysis: In case of a proxy chain network, a downstream proxy server can make no analysis based on the Client's IP address, because it sees all requests as coming from the same address: from the proxy upstream. So the proxy knows only the address of its direct communication partners' and not the address of the computer issuing the request. If the AddXForwardedForHeader option is active, WebGate adds a header field (X-Forwarded-For) to the HTTP request or adds the IP address of the Client it received the request from. In this way WebGate can forward the Client IP address to the downstream proxy servers. These are then able to analyze the header field and to use the included indirect data for example, for access control mechanisms or for logging purposes. This option could also enable the use of ACLs for a Squid proxy, which is configured by WebGate as parent proxy. The parent proxy must certainly hold the necessary functionality for header analysis. AddXForwardedForHeader 0 AddX ForwardedFor Header 38 AntiVir WebGate Avira GmbH Configuration Allow Client Addresses Allowing connections for certain Clients/ networks: WebGate can activate certain Clients or networks using this option. A network is set typing a '/' and its netmask (for example, 192. 168. 1. 0/24). AllowClientAddresses 127. 0. 0. 1 192. 168. 0. 0/16 If you do not specify any IP address, the access is not restricted. If you specify at least one IP address, the access is permitted only to the entered IPs. Anyone else has no access. Forbidden Agents Denying access to specific user agents: You can specify one or more user agent strings that will be denied access. [. . . ] When typical virus-like functions are found, the respective macro is classified as "suspicious". The base component of a Unix operating system, which performs elementary functions (e. g. A file containing reports generated by the program at run-time, when a certain event occurs. These can be interferences such as viruses or other software, which the user generally considers as unwanted (see also Unwanted Programs). [. . . ]