Virus Scanner Support

Introduction

When sharing files, security is a key aspect. The Myota Vault Anti-Virus extension helps by protecting against malicious software like trojans or viruses.

You can get the Anti-Virus extension from the marketplace.

  • When uploading, files are forwarded from the Myota Vault to a malware scanning engine before they are written to the storage. When a file is recognized as malicious, it can be logged and prevented from being uploaded to the server to ensure that files in Myota Vault are free of malware. More sophisticated rules may be specified by the admin in the Myota Vault interface User Name  Settings  Admin  Security.

  • When downloading, the files are scanned again to prevent infections to spread, which were not known by the scanner at the time of the upload and therefore missed.

General Info

Native Mode

Out of the box, the Myota Vault Anti-Virus extension works with Clam AntiVirus (ClamAV) as the directly supported virus scanner. It detects all forms of malware including trojans, viruses and worms and scans compressed files, executables, image files, PDF, as well as many other file types. The Myota Vault Anti-Virus application relies on the underlying ClamAV virus scanning engine, to which the admin points Myota Vault when configuring the application. The ClamAV virus definitions need to be kept up to date in order to provide effective protection.

ICAP

Starting with Anti-Virus version 1.0.0, the app also offers an ICAP integration only available with Enterprise installations. Admins can integrate their favorite enterprise-grade antivirus scanners through the open standard Internet Content Adaptation Protocol (ICAP). With this setup, Myota Vault can delegate the scanning of uploaded files to another machine, the ICAP server. The ICAP server then checks them and either greenlights them or, if malicious code is found, treats the offending file(s) as specified in the settings and notifies the Myota Vault. Myota Vault can then act accordingly and based on the settings made reject the upload. Offloading the anti-virus scans to another dedicated server can greatly improve performance compared to running the ClamAV virus scanner on the same machine as Myota Vault.

Starting with Anti-Virus version 1.1.0, additional scanners like the FortiSandbox and McAfee Web Gateway have been added as selectable ICAP scanners.

Antivirus scanner modes

The following image shows the currently supported scanners including how they are connected.

Common notes

A file is parsed and an exit code returned, or an exit code is evaluated if no result is available to determine the response from the scan. In case of an infected file, the appropriate action is always to delete the file. Though the setting can be made, the choice delete or log for the infected condition only applies to the special case of background scans.

The whole file is scanned when it is moved or saved to the final location. Individual chunks are not scanned.

When Infected Files are Found

During an upload these actions are taken:

  • The upload is blocked.

  • The event is logged in the Myota Vault log.

  • The event is reported and/or logged by the client / Web UI.

During a background scan, the app can take one of two actions:

  • Log Only: Log the event.

  • Delete file: Delete the detected file.

Set When infected files were found during a background scan to the value that suits your needs.

Enable the Myota Vault Anti-Virus App

The Anti-Virus app needs to be enabled with the following the admin console command:

Ways of Configuration

Configure the Anti-Virus App Using GUI

Navigate to Settings  Admin  Security, where you’ll find the "Antivirus Configuration" panel to configure the Anti-Virus app via the GUI.

Configure the Anti-Virus App Using the admin console

All of the configuration settings for the Anti-Virus app are configurable by passing the relevant key and value to the the admin console config:app:set files_antivirus command. For example:

To get a current option, run for example:
Available configuration settings, availability is av_mode dependent
Setting Description Default

av_cmd_options

Extra command-line options (comma-separated) to pass to ClamAV.

av_host

The host name or IP address of the antivirus server.

av_infected_action

The action to take when infected files were found during a background scan.
It can be set to only_log or delete.

only_log

av_max_file_size

The maximum file size limit;
-1 means no limit.

-1

av_mode

The Anti-Virus binary operating mode.
It can be set to one of the following options:

  • Native Mode

    • daemon, ClamAV Daemon (TCP Socket)

    • socket, ClamAV Daemon (Unix Socket)

    • executable, ClamAV Executable

  • ICAP

    • icap, ClamAV & Kaspersky (ICAP)

    • fortinet, Fortinet (ICAP)

    • mawgw, MacAfee Webgateway / Skyhigh Secure Webgateway (ICAP)

executable

av_request_service

ICAP request service, dependent on the ICAP mode

  • avscan for ClamAV,

  • req for Kaspersky ScanEngine,

  • respmod for Fortinet and McAfee Webgateway/ Skyhigh Secure Webgateway.

av_response_header

ICAP response header holding the virus information, dependent on the ICAP mode

  • X-Virus-ID or
    X-Infection-Found for ClamAV and Kaspersky ScanEngine,

  • X-Virus-Name for McAfee Webgateway / Skyhigh Secure Webgateway,

  • X-Virus-ID for Fortinet.

av_path

The path to the clamscan executable.

/usr/bin/clamscan

av_port

The port number of the antivirus server.
Allowed values are 1 - 65535.

av_scan_background

Should scans run in the background?

true

av_socket

The name of ClamAV’s UNIX socket file.

/var/run/clamav/clamd.ctl

av_stream_max_length

The maximum stream length that ClamAV will accept in bytes (*).

26214400

(*) …​ The Stream Length value sets the number of bytes to read in one pass and defaults to 26214400 bytes (twenty-six megabytes). This value should be no larger than the PHP memory_limit settings or physical memory if memory_limit is set to -1 (no limit).

ClamAV In Native Mode

ClamAV Feature List

  • Operates on all major operating systems, including Windows, Linux, and macOS.

  • Detects all forms of malware including Trojan horses, viruses, and worms.

  • Scans compressed files, executables, image files, Flash, PDF, as well as many others.

What’s more, ClamAV’s Freshclam daemon automatically updates its malware signature database at scheduled intervals.

ClamAV Integration Into Myota Vault

Myota Vault integrates with ClamAV natively in several ways, see Configuration Modes.

  • Scanner exit status rules are used to handle errors when ClamAV is run in CLI mode.

  • Scanner output rules are used in daemon/socket mode only.

Scanning Notes for ClamAV

  1. Files are checked when they are uploaded or updated and before they are downloaded.

  2. Myota Vault does not maintain a cache of previously scanned files.

  3. If the app is either not configured or is misconfigured, then it rejects file uploads.

  4. If ClamAV is unavailable, then the app rejects file uploads.

  5. A file size limit applies both to background scans and to file uploads.

  6. After installing ClamAV and the related tools, you will have two configuration files: /etc/freshclam.conf and /etc/clamd.d/scan.conf.

  7. We recommend that you enable verbose logging in both clamd.conf and freshclam.conf initially, to verify correct operation of both.

Installing ClamAV

Installing ClamAV can be achieved in multiple ways. Most easiest is to use a Dokerised environment. The image and a documentation link can be found on DockerHub.

Alternatively you can install ClamAV natively on Ubuntu with the following command
sudo apt install clamav clamav-daemon

This automatically creates the default configuration files and launches the clamd and freshclam daemons.

Enabling and Running ClamAV

Enable and start the clamd service with following commands
sudo systemctl daemon-reload
sudo systemctl enable clamav-daemon.service
sudo systemctl start clamav-daemon.service

When successful, an output similar to the following should appear on the terminal:

Synchronizing state of clamav-daemon.service with SysV service script with
/lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable clamav-daemon

ClamAV Virus Database Updates

  1. You can manually start the updating process with this command:

    sudo freshclam

    You should update manually at least once before using ClamAV within Myota Vault. The initial update can take several minutes. In case of persisting issues running freshclam, you can gently end the process with the following command:

    sudo pkill -15 -x freshclam

    and retry manually updating again.

  2. To automate the update process, run this cron entry for example.

    # m   h  dom mon dow  command
47  *  *  *  *  /usr/bin/freshclam --quiet
    Avoid any multiples of 10 to better distribute the load on the ClamAV virus pattern servers. This can reduce the load on the servers and therefore update times.

Configuring ClamAV within Myota Vault

If the app is enabled but either not or incorrectly configured, it will strictly reject all uploads for the whole instance!

ClamAV can be configured in the following two ways:

  1. By using the Antivirus Configuration panel

  2. By from the admin console set.

Change Log Level Temporarily

Once ClamAV is installed, select Settings  General (Admin) and, in the "Log" section, temporarily set Log level to "Everything (fatal issues, errors, warnings, info, debug)".

Configuration Mode

ClamAV can run in an Myota Vault Dockerised deployment only in ClamAV Daemon (TCP Socket) mode.

In ClamAV Daemon (TCP Socket) mode, ClamAV runs on a different server.

  1. Set Mode to "ClamAV Daemon (TCP Socket)".

  2. Set Host to the host name or IP address of the remote server running ClamAV, and set Port to the server’s port number.

    The port number is the value of TCPSocket of ClamAV which usually can be found on the host running ClamAV at /etc/clamav/clamd.conf.

Set Back Log Level

When you are satisfied with how ClamAV is operating, you might want to go back and change all of your logging to less verbose levels.

Configuration Warnings

The Anti-Virus App shows one of three warnings if it is misconfigured or ClamAV is not available. You can see an example of all three below.

ICAP

ICAP is an open standard supported by many antivirus products. With the release of the Anti-Virus app 1.0.0, other virus scanners beside ClamAV can be used via ICAP if you are running it on an Myota Vault Enterprise Edition.

Currently the only tested and supported virus scanners are:

  • ClamAV,

  • Kaspersky ScanEngine,

  • FortiSandbox and

  • McAfee Web Gateway / Skyhigh Secure Web Gateway.

Due to the wide distribution of the ICAP standard, more products can be implemented on request. The use of ICAP requires an enterprise license. The functionality can be tested without a license with a grace period of 24 hours.

Either saving a setting using ICAP via the GUI or using the admin console setting and set the av_mode to one of the ICAP modes triggers a grace period of 24 hours if you don’t have an Enterprise license but want to test ICAP.

Depending on your ICAP server, select one of the following example configurations.

General ICAP Settings Using the admin console

Common Settings

Use the following admin console settings to set configurations based on your environment:

  1. Set the IP address of your anti-virus server:

  2. Specify the port of the anti-virus server:

  3. Enable background scans:

  4. Specify what to do with the offending file:

    Possible values are `delete` and `only_log`.

    Note that this setting is only used when av_scan_background is set to true.

Mode Dependent Settings

The following settings are just examples and must be adjusted for the scanner you use. For possible values see Configure the Anti-Virus App Using the admin console

  1. Set the ICAP mode:

  2. Set the request service:

  3. Set the response header:

ClamAV & Kaspersky (ICAP)

If you decide to use ClamAV, you must first install and configure c-icap on sourceforge. With regard to selecting ClamAV in their configuration, see the section: ModulesConfiguration.

  1. Install ClamAV based on the instructions at the beginning of this document and c-icap as referenced above.

  2. Select ClamAV & Kaspersky (ICAP) from the drop-down menu in the Anti-Virus app:

    ClamAV & Kasperski (ICAP), width=350]

The older versions of Kaspersky’s KAV did not send back the virus/infection name in an ICAP header. Starting with KAV v2.0.0, the header to transport the virus can be configured. Default: No header is sent. For more configuration details see Using Kaspersky Scan Engine in ICAP mode.

McAfee Web Gateway / Skyhigh Secure Web Gateway (ICAP)

Follow the procedure below to configure Myota Vault for the McAfee Web Gateway 10.x and higher in ICAP Mode.

  1. Install McAfee Web Gateway based on their instructions.

  2. Select McAfee Web Gateway / Skyhigh Secure Web Gateway (ICAP) from the drop-down menu in the Anti-Virus app.

    McAfee Web Gateway / Skyhigh Secure Web Gateway (ICAP),width=350]

McAfee provides demo versions with limited runtime for evaluation purposes. Have a look at the McAfee Web page for the Web Gateway.

Fortinet (ICAP)

  1. Install FortiSandbox based on their instructions.

  2. Select Fortinet from the drop-down menu in the Anti-Virus app.

    McAfee Web Gateway / Skyhigh Secure Web Gateway (ICAP),width=350]

Fortinet provides some demo versions of the FortiSandbox. Have a look at their product page for more information.

Response Rule Configuration (Advanced)

Do not change the rules hidden under Advanced unless you know exactly what you’re doing. The defaults should work best. If you have special requirements, contact us at consulting@myota.io.

Myota Vault provides the ability to customize how it reacts to the response given by an antivirus scan. To do so, under Admin  Security (Admin) click Advanced, which you can see in the screenshot below, you can view and change the existing rules. You can also add new ones.

Rules can match on either an exit status (e.g., 0, 1, or 40) or a pattern in the string returned from ClamAV (e.g., /.*: (.\*) FOUND$/).

Here are some points to bear in mind about rules:

  • Scanner exit status rules are used to handle errors when ClamAV is run in CLI mode, while

  • Scanner output rules are used in daemon/socket mode.

  • Daemon output is parsed by regexp.

  • In case there are no matching rules, the status is: Unknown, and a warning will be logged.

Default Rule Set

The default rule set for ClamAV is populated automatically with the following rules:
Exit Status or Signature Description Marks File As

0

Clean

1

Infected

40

Unknown option passed

Unchecked

50

Database initialization error

Unchecked

52

Not supported file type

Unchecked

53

Can’t open directory

Unchecked

54

Can’t open file

Unchecked

55

Error reading file

Unchecked

56

Can’t stat input file

Unchecked

57

Can’t get absolute path name of current working directory

Unchecked

58

I/O error

Unchecked

62

Can’t initialize logger

Unchecked

63

Can’t create temporary files/directories

Unchecked

64

Can’t write to temporary directory

Unchecked

70

Can’t allocate memory (calloc)

Unchecked

71

Can’t allocate memory (malloc)

Unchecked

/.*: OK$/

Clean

/.*: (.*) FOUND$/

Infected

/.*: (.*) ERROR$/

Unchecked

The rules are always checked in the following order:

  1. Infected

  2. Error

  3. Clean

In case there are no matching rules, the status would be Unknown and a warning would be logged.

Update an Existing Rule

  1. You can change the rules to either match an exit status or the scanner’s output.

    • To match on an exit status, change the

      • Match by dropdown list to Scanner exit status and

      • in the "Scanner exit status or signature to search" field, add the status code to match on.

    • To match on the scanner’s output, change the

      • Match by dropdown list to Scanner output and

      • in the Scanner exit status or signature to search field, add the regular expression to match against the scanner’s output.

  2. Then, while not mandatory, add a description of what the status or scan output means. After that, set what Myota Vault should do when the exit status or regular expression you set matches the value returned by ClamAV. To do so, change the value of the dropdown in the Mark as column.

    The dropdown supports the following three options:
    Option Description

    Clean

    The file is clean and contains no viruses

    Infected

    The file contains a virus

    Unchecked

    No action should be taken

With all these changes made, click the [✓] on the left-hand side of the Match by column, to confirm the change to the rule.

Add A New Rule

To add a new rule, click the button marked Add a rule at the bottom left of the rules table. Then follow the process outlined in Update An Existing Rule.

Delete An Existing Rule

To delete an existing rule, click the rubbish bin icon on the far right-hand side of the rule that you want to delete.