Symantec AntiVirus for Network Attached Storage Integration Guide

Transcription

1 Symatec AtiVirus for Network Attached Storage Itegratio Guide

2 2 Symatec AtiVirus for Network Attached Storage Itegratio Guide The software described i this book is furished uder a licese agreemet ad may be used oly i accordace with the terms of the agreemet. Documetatio versio Legal Notice Copyright 2010 Symatec Corporatio. All rights reserved. Symatec ad the Symatec Logo are trademarks or registered trademarks of Symatec Corporatio or its affiliates i the U.S ad other coutries. Other ames may be trademarks of their respective owers. This Symatec product may cotai third party software for which Symatec is required to provide attributio to the third party ( Third Party Programs ). Some of the Third Party Programs are available uder ope source or free software liceses. The Licese Agreemet accompayig the Software does ot alter ay rights or obligatios you may have uder those ope source or free software liceses. Please see the Third Party Legal Notice Appedix to this Documetatio or TPIP ReadMe File accompayig this Symatec product for more iformatio o the Third Party Programs. The product described i this documet is distributed uder liceses restrictig its use, copyig, distributio, ad decompilatio/reverse egieerig. No part of this documet may be reproduced i ay form by ay meas without prior writte authorizatio of Symatec Corporatio ad its licesors, if ay. THE DOCUMENTATION IS PROVIDED AS IS AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS, AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON- INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licesed Software ad Documetatio are deemed to be commercial computer software as defied i FAR ad subject to restricted rights as defied i FAR Sectio Commercial Computer Software - Restricted Rights ad DFARS , Rights i Commercial Computer Software or Commercial Computer Software Documetatio, as applicable, ad ay successor regulatios. Ay use, modificatio, reproductio release, performace, display or disclosure of the Licesed Software ad Documetatio by the U.S Govermet shall be solely i accordace with the terms of this Agreemet. Symatec Corporatio 350 Ellis Street Moutai View, CA

3 3 Techical support Cotactig Techical Support Symatec Techical Support maitais support ceters globally. Techical Support s primary role is to respod to specific queries about product features ad fuctioality. The Techical Support group also creates cotet for our olie Kowledge Base. The Techical Support group works collaboratively with the other fuctioal areas withi Symatec to aswer your questios i a timely fashio. For example, the Techical Support group works with Product Egieerig ad Symatec Secuirty Respose to provide alertig services ad virus defiitio updates. Symatec s maiteace offerigs iclude the followig: A rage of support optios that give you the flexibility to select the right amout of service for ay site orgaizatio Telephoe ad Web-based support that provides rapid respose ad up-tothe-miute iformatio Upgrade assurace that delivers automatic software upgrade protectio Global support purchased o a regioal busiess hours or 24 hours a day, 7 days a week basis Premium service offerigs that iclude Accout Maagemet Services For iformatio about Symatec s Maiteace Programs, you ca visit our Web site at the followig URL: All support services will be delivered i accordace with your support agreemet ad the the-curret eterprise techical support policy. Customers with a curret maiteace agreemet may access Techical Support iformatio at the followig URL: Before cotactig Techical Support, make sure that you have satisfied the system requiremets that are listed i your product documetatio. Also, you should be at the computer o which the problem occurred, i case it is ecessary to replicate the problem. Whe you cotact Techical Support, please have the followig iformatio available: Product release level Hardware iformatio Available memory, disk space, ad NIC iformatio Operatig system Versio ad patch level

4 4 Network topology Router, gateway, ad IP address iformatio Problem descriptio: Error messages ad log files Troubleshootig that was performed before cotactig Symatec Recet software cofiguratio chages ad etwork chages Licesig ad registratio Customer Service If your Symatec product requires registratio or a licese key, access our techical support Web page at the followig URL: Customer service iformatio is available at the followig URL: Customer Service is available to assist with the followig types of issues: Questios regardig product licesig or serializatio Product registratio updates such as address or ame chages Geeral product iformatio (features, laguage availability, local dealers) Latest iformatio about product updates ad upgrades Iformatio about upgrade assurace ad maiteace cotracts Iformatio about the Symatec Buyig Programs Advice about Symatec s techical support optios Notechical presales questios Issues that are related to CD-ROMs or mauals Support agreemet resources If you wat to cotact Symatec regardig a existig maiteace agreemet, please cotact the maiteace agreemet admiistratio team for your regio as follows: Asia-Pacific ad Japa Europe, Middle-East, ad Africa North America ad Lati America customercare_apac@symatec.com semea@symatec.com supportsolutios@symatec.com

5 Cotets Techical support Chapter 1 Chapter 2 Itroducig Symatec AtiVirus for Network Attached Storage About Symatec AtiVirus for Network Attached Storage About software compoets About Symatec Sca Egie About the coector Supported storage devices How to use the Symatec AtiVirus for Network Attached Storage documetatio About the Symatec Sca Egie Implemetatio Guide About the Symatec AtiVirus for Network Attached Storage Itegratio Guide Why you eed virus protectio i a etwork attached storage eviromet 16 How the sca egie protects agaist viruses About Symatec Security Respose About preparig for istallatio Widows system requiremets Solaris system requiremets Liux system requiremets Post-istallatio tasks Cofigurig Symatec AtiVirus for NetApp Filer About software compoets How Symatec Sca Egie works with the NetApp Filer cliet What happes whe a file is scaed About coectig to Symatec Sca Egie About limitig scaig by file type About hadlig ifected files About user idetificatio ad otificatio whe a virus is foud About preparig for istallatio About cofigurig Symatec Sca Egie Editig the service startup properties Cofigurig RPC protocol optios... 31

6 6 Cotets Notifyig the NetApp Filer whe virus defiitios are updated Notifyig a requestig user that a virus was foud About quaratiig urepairable ifected files Specifyig which embedded files to sca Schedulig LiveUpdate to update virus defiitios automatically Cofigurig Rapid Release updates to occur automatically About cofigurig the cliet NetApp Filer About verifyig that the sca egie is registered with the filer About activatig virus scaig About specifyig the file extesios to be scaed o the NetApp Filer 43 About workig with uresposive sca egies How virus scaig affects backups o NetApp Filer About clearig the scaed files cache About otifyig a requestig user that a virus was foud Chapter 3 Cofigurig Symatec AtiVirus for Su StorageTek 5000 NAS Appliace About software compoets How Symatec Sca Egie works with the Su StorageTek 5000 NAS Appliace 48 How are files scaed How cachig works About specifyig which file types are scaed About specifyig the sca policy About hadlig ifected files o the NAS device About preparig for istallatio About cofigurig Symatec Sca Egie Cofigurig ICAP-specific optios Specifyig which file types to sca o the sca egie Specifyig cotaier hadlig limits Schedulig LiveUpdate to update virus defiitios automatically Cofigurig Rapid Release updates to occur automatically About cofigurig the Su StorageTek 5000 NAS Appliace Registerig Symatec Sca Egie About cofigurig virus scaig o the Su StorageTek 5000 NAS Appliace Recommedatios while itegratig multiple sca egies Chapter 4 Cofigurig Symatec AtiVirus for Su Storage 7000 Series About software compoets How Symatec Sca Egie works with the Su Storage 7000 Series NAS device

7 Cotets 7 66 How are files scaed How cachig works About specifyig which file types are scaed About specifyig the sca policy About hadlig ifected files o the NAS device About preparig for istallatio About cofigurig Symatec Sca Egie Cofigurig ICAP-specific optios Specifyig which file types to sca o the sca egie Specifyig cotaier hadlig limits Schedulig LiveUpdate to update virus defiitios automatically Cofigurig Rapid Release updates to occur automatically About cofigurig the Su Storage 7000 Series NAS device Registerig Symatec Sca Egie About cofigurig virus scaig o the Su Storage 7000 Series NAS device Recommedatios while itegratig multiple sca egies Chapter 5 Cofigurig Symatec AtiVirus for BlueArc Storage System ad Hitachi High-performace NAS Platform, powered by BlueArc About software compoets How Symatec Sca Egie works with BlueArc Storage System ad Hitachi High-performace NAS Platform What happes whe a file is scaed About coectig to Symatec Sca Egie About limitig scaig by file type About hadlig ifected files About user idetificatio ad otificatio whe a virus is foud About preparig for istallatio About cofigurig Symatec Sca Egie Editig the service startup properties Cofigurig RPC protocol optios Notifyig a requestig user that a virus was foud About quaratiig urepairable ifected files Specifyig which embedded files to sca Schedulig LiveUpdate to update virus defiitios automatically Cofigurig Rapid Release updates to occur automatically About cofigurig BlueArc Storage System or Hitachi High-performace NAS Platform About verifyig that the sca egie is registered with the NAS Server 98 About activatig virus scaig... 98

8 8 Cotets About specifyig the file extesios to be scaed o the NAS Server 98 About executig a full file system sca About workig with uavailable sca egies About workig with uresposive sca egies Chapter 6 Chapter 7 Chapter 8 Cofigurig Symatec AtiVirus for Hitachi Essetial NAS Platform About software compoets How Symatec Sca Egie works with the Hitachi Essetial NAS Platform 102 What happes whe a file is scaed About hadlig ifected files About cofigurig Symatec Sca Egie Cofigurig ICAP-specific optios Specifyig which file types to sca o the sca egie About specifyig cotaier hadlig limits Schedulig LiveUpdate to update virus defiitios automatically Cofigurig Symatec AtiVirus for ONStor EverON About software compoets How Symatec Sca Egie works with the ONStor EverON What happes whe a file is scaed About hadlig ifected files About cofigurig Symatec Sca Egie Cofigurig ICAP-specific optios Specifyig which file types to sca o the sca egie About specifyig cotaier hadlig limits Schedulig LiveUpdate to update virus defiitios automatically About cofigurig the ONStor VirusSca Applet Cofigurig the VirusSca Applet for the Symatec Sca Egie Cofigurig Symatec AtiVirus for EMC Celerra Network Server About software compoets How Symatec Sca Egie works with EMC Celerra Network Server How are files scaed About scaig o read About specifyig which file types are scaed About specifyig the sca policy About preparig for istallatio About cofigurig Symatec Sca Egie Cofigurig ICAP-specific optios Specifyig which file types to sca o the sca egie...131

9 Cotets 9 About specifyig cotaier hadlig limits Schedulig LiveUpdate to update virus defiitios automatically Cofigurig Rapid Release updates to occur automatically About cofigurig EMC Celerra Network Server About istallig the Celerra Ati Virus Aget About registerig Symatec Sca Egie About cofigurig virus scaig o EMC Celerra Network Server.137 About startig the Virus-checkig cliet About executig a full file system sca Kow issue with EMC Celerra Network Server Recommedatios while itegratig multiple sca egies Idex

10 10 Cotets

11 Chapter 1 Itroducig Symatec AtiVirus for Network Attached Storage This chapter icludes the followig topics: About Symatec AtiVirus for Network Attached Storage Supported storage devices How to use the Symatec AtiVirus for Network Attached Storage documetatio Why you eed virus protectio i a etwork attached storage eviromet About preparig for istallatio Post-istallatio tasks About Symatec AtiVirus for Network Attached Storage Symatec AtiVirus for Network Attached Storage provides virus scaig ad repair services for a umber of etwork-attached storage (NAS) devices. You ca sca files for viruses automatically as they are accessed from storage before the requestig user gais access to it. Based o a cofigurable virus sca policy, whe a virus is foud i a file, the file is repaired. The clea file is stored o the NAS device ad oly the is the requestig user grated access.

12 12 Itroducig Symatec AtiVirus for Network Attached Storage About Symatec AtiVirus for Network Attached Storage About software compoets I most cases, addig virus scaig to a supported NAS device requires istallatio ad cofiguratio of the followig compoets: Symatec Sca Egie, which provides the virus scaig ad repair services See About Symatec Sca Egie o page 12. Coector, which lets the NAS device commuicate with Symatec Sca Egie See About the coector o page 13. Figure 1-1 shows a typical itegratio of a etwork attached storage device with Symatec Sca Egie. Figure 1-1 Itegratio of a etwork attached storage device with the Symatec Sca Egie 1. The cliet tries to access a file o the etwork attached storage device. 2. The etwork attached storage device, by meas of a coector, seds the file to the Symatec Sca Egie for scaig. 3. Symatec Sca Egie scas the file, repairs it if it is ifected, ad returs the clea file to the etwork attached storage device. 4. The etwork attached storage device writes the cleaed file to disk, caches the fact that the file has bee cleaed, ad seds the file to the cliet. About Symatec Sca Egie Symatec Sca Egie, formerly marketed as Symatec AtiVirus Sca Egie, is a carrier-class cotet scaig egie. Symatec Sca Egie provides cotet scaig capabilities to ay applicatio o a IP etwork, regardless of platform. Ay applicatio ca pass files to Symatec Sca Egie for scaig.

13 Itroducig Symatec AtiVirus for Network Attached Storage Supported storage devices 13 Symatec Sca Egie accepts sca requests from cliet applicatios that use the followig protocols: The Iteret Cotet Adaptatio Protocol (ICAP), versio 1.0, as preseted i RFC 3507 (April 2003) A proprietary implemetatio of remote procedure call (RPC) Symatec Sca Egie ative protocol Symatec Sca Egie is icluded i the Symatec AtiVirus for Network Attached Storage distributio package. For more iformatio about the sca egie, see the Symatec Sca Egie Implemetatio Guide o the product CD. About the coector The coector hadles the commuicatio betwee the sca egie ad the NAS device ad iterprets the results that are retured from the sca egie after scaig. The maufacturer of the NAS device develops ad provides support for the coector. The coector typically is istalled ad cofigured o the NAS device. (I some cases, the maufacturer pre-istalls the coector.) I some cases, o coector is ecessary. The NAS device hadles the commuicatio with the sca egie, ad ay cofiguratio optios are available directly o the device. Supported storage devices Symatec AtiVirus for Network Attached Storage supports the followig storage devices: Network Appliace (NetApp) Filer Su StorageTek 5000 NAS Appliace Su Storage 7000 Series BlueArc Storage System Hitachi High-performace NAS Platform Hitachi Essetial NAS Platform ONStor EverON EMC Celerra Network Server

14 14 Itroducig Symatec AtiVirus for Network Attached Storage How to use the Symatec AtiVirus for Network Attached Storage documetatio Table 1-1 gives the list of storage devices, its supported versios, ad the protocol that Symatec Sca Egie uses to iterface with these storage devices. Table 1-1 Supported storage devices ad protocols Storage device Protocol used Supported versio Network Appliace (NetApp) Filer RPC Data ONTAP versio 6.1.3R2 or later Su StorageTek 5000 NAS Appliace ICAP Su NAS Firmware 4.21 M1 or later Su Storage 7000 Series ICAP Su Storage 7xxx versio BlueArc Storage System RPC 4.0 or later Hitachi High-performace NAS Platform RPC 4.0 or later Hitachi Essetial NAS Platform ICAP 6.2 or later ONStor EverON ICAP 4.0 or later EMC Celerra Network Server ICAP CAVA 4.5 or later Note: If the sca egie uses RPC protocol to iterface with your etwork attached storage device, Symatec Sca Egie must be istalled o Widows 2000 Server/Widows 2003 Server/Widows 2008 Server platforms oly. How to use the Symatec AtiVirus for Network Attached Storage documetatio To cofigure Symatec AtiVirus for Network Attached Storage to work with oe of the supported NAS devices, you eed the documetatio that is icluded i the Symatec AtiVirus for Network Attached Storage distributio package. You eed the documetatio that is provided by the maufacturer of the NAS device as well. The Symatec AtiVirus for Network Attached Storage distributio package icludes the followig documets: Symatec Sca Egie Implemetatio Guide Symatec AtiVirus for Network Attached Storage Itegratio Guide

15 Itroducig Symatec AtiVirus for Network Attached Storage How to use the Symatec AtiVirus for Network Attached Storage documetatio 15 The maufacturer of the NAS device develops the coector to itegrate Symatec Sca Egie. The maufacturer of the NAS device also prepares ad distributes supportig documetatio for the coector. Obtai the coector ad ay supportig documetatio from the maufacturer if you do ot receive it with the NAS device. About the Symatec Sca Egie Implemetatio Guide Use the Symatec Sca Egie Implemetatio Guide as the primary guide for istallig ad cofigurig Symatec Sca Egie. This guide cotais the iformatio that you eed to cosider about the sca egie cofiguratio optios. Refer to the Symatec AtiVirus for Network Attached Storage Itegratio Guide for istructios o cofigurig Symatec Sca Egie to work with a specific NAS device. About the Symatec AtiVirus for Network Attached Storage Itegratio Guide The Symatec AtiVirus for Network Attached Storage Itegratio Guide icludes a chapter for each supported NAS device. Use the guidace ad recommedatios that are i the appropriate chapter of this guide with the maufacturer-prepared documetatio to implemet virus scaig. Each chapter i the Symatec AtiVirus for Network Attached Storage Itegratio Guide icludes the followig iformatio: Geeral iformatio o how ativirus scaig works with the NAS device Virus scaig fuctioality ca differ depedig o the capabilities of the NAS device ad the complexity of the coector. Some of the virus scaig fuctios iclude hadlig of ifected files, timig of file scaig, ad loggig of ifectios foud. This sectio provides a overview of how Symatec Sca Egie ad the NAS device iteract durig virus scaig.

16 16 Itroducig Symatec AtiVirus for Network Attached Storage Why you eed virus protectio i a etwork attached storage eviromet Iformatio for cofigurig the sca egie to work with the NAS device Iformatio o cofigurig the NAS device to work with the sca egie This sectio discusses the cofiguratio optios o the sca egie that must be cofigured to work with the NAS device. It may highlight other optios that are importat i settig up comprehesive virus protectio as well. This iformatio does ot replace the Symatec Sca Egie Implemetatio Guide. Cosult the implemetatio guide for istallatio iformatio ad for additioal iformatio o cofigurig Symatec Sca Egie to meet your eeds. This sectio discusses ay cofiguratio optios o the NAS device that must be cofigured to work with Symatec Sca Egie. It may make recommedatios for cofigurig the NAS device to esure comprehesive virus protectio. This iformatio does ot replace the documetatio that is provided by the maufacturer of the NAS device. Cosult the product documetatio for additioal iformatio o cofigurig the NAS device for virus scaig. Kow issues This sectio describes the issues that ca affect operatio betwee Symatec Sca Egie ad the NAS device. Why you eed virus protectio i a etwork attached storage eviromet Network attached storage provides may beefits, such as icreased performace, heterogeeous data access, data redudacy, ease of storage maagemet, ad real-time backup recovery. However, the implemetatio of a NAS system itroduces security risks that should be addressed. Data ca be accessed ad compromised more quickly whe it is cosolidated ito a cetralized NAS system. This occurs because NAS systems are typically coected directly to the local etwork. Istallig virus protectio software at key locatios i the corporate etwork is ot sufficiet to protect data o NAS servers. Examples of such key locatios are firewalls, gateways, ad desktops.

17 Itroducig Symatec AtiVirus for Network Attached Storage Why you eed virus protectio i a etwork attached storage eviromet 17 Dedicated ativirus protectio for a NAS system should be part of a comprehesive security policy for the followig reasos: Storage servers are susceptible to attacks from viruses, worms, Troja horses, ad other malicious code because large umber of users access them ad they cotai large amouts of data. Malicious code ca result i lost, stole, or corrupted files, which ca result i costly dowtime to the eterprise. The NAS system ca become a vector for the malicious code whe a threat is stored o the NAS system. It ca compromise the computers ad the data of the users who access the NAS system. Malicious code ca be replicated multiple times i multiple locatios through NAS backup, mirrorig of data, ad archivig. The malicious code ca be re-itroduced to the NAS system whe NAS data that cotais malicious code is restored from oe of these locatios. This re-itroductio ca potetially reifect the etwork. Malicious code could replicate o the NAS system i multiple locatios ad ifect other parts of the etwork. The effort to remove a threat becomes a time-cosumig task that ivolves sigificat dowtime as well as time ad moey for data recovery. The NAS system ca be used as a access poit to the rest of the etwork or as a lauch poit for a attack. For example, a deial-of-service attack ca be lauched i a NAS system. Idustry regulatios ad laws ow require that orgaizatios that maitai fiacial, medical, persoal, ad data should protect the data from beig stole, altered, or destroyed. Orgaizatios are legally resposible for providig comprehesive protectio for stored data. How the sca egie protects agaist viruses Symatec Sca Egie detects viruses, worms, ad Troja horses i all major file types (for example, Widows files, DOS files, ad Microsoft Word ad Excel files). Symatec Sca Egie icludes a decomposer that hadles most compressed ad archive file formats ad ested levels of files. You ca cofigure the sca egie to limit scaig to certai file types by a file extesio ad file type exclusio list. Symatec Sca Egie provides protectio agaist those cotaier files that ca cause deial-of-service attacks. Examples are those cotaier files that are overly large, that cotai large umbers of embedded compressed files, or that have bee desiged to use resources maliciously ad degrade performace. You ca specify the maximum amout of time that the sca egie devotes to

18 18 Itroducig Symatec AtiVirus for Network Attached Storage About preparig for istallatio extractig a file ad its cotets, the maximum file size for cotaier files, ad the maximum umber of ested levels to be decomposed for scaig. Symatec Sca Egie also detects mobile code such as Java, ActiveX, ad stadaloe script-based threats. Symatec Sca Egie uses Symatec ativirus techologies, icludig Bloodhoud, for heuristic detectio of ew or ukow viruses; NAVEX, which provides protectio from ew classes of viruses automatically through LiveUpdate; ad Striker, for the detectio of polymorphic viruses. The sca egie ca also be cofigured to sed alerts whe specific thresholds are met or exceeded. For example, if the same type of virus has bee detected te times i a 20-miute iterval, the sca egie ca be cofigured to sed a alert to ay of the sca egie loggig or alertig destiatios. About Symatec Security Respose Symatec Sca Egie is supported by the Symatec Security Respose team. These Symatec egieers work 24 hours per day, 7 days per week, trackig ew virus outbreaks ad idetifyig ew virus threats. For more iformatio about protectio agaist a specific virus, visit the Symatec Security Respose Web site at: For more iformatio, see the Symatec Sca Egie Implemetatio Guide. About preparig for istallatio Before you istall Symatec Ativirus for Network Attached Storage, you should esure that your computer meets the system requiremets for istallig the sca egie. The sca egie is icluded o the Symatec AtiVirus for Network Attached Storage CD. If the sca egie uses RPC protocol to iterface with your etwork attached storage device, Symatec Sca Egie must be istalled o Widows 2000 Server/Widows 2003 Server/Widows 2008 Server platforms oly. For more iformatio about istallig the sca egie, see the Symatec Sca Egie Implemetatio Guide o the product CD.

19 Itroducig Symatec AtiVirus for Network Attached Storage About preparig for istallatio 19 Widows system requiremets The followig are the system requiremets for istallig Symatec AtiVirus for Network Attached Storage o a Widows 2000 Server/Widows 2003 Server/Widows 2008 Server: Operatig system Widows 2000 Server with the latest service pack Widows Server 2003 (32-bit) Widows Server 2003 R2 (32-bit) Widows Server 2003 R2 (64-bit) Widows Server 2008 (32-bit) Widows Server 2008 (64-bit) Widows Server 2008 R2 (64-bit) Processor Memory Disk space Petium 4 processor 1 GHz or higher 1 GB of RAM or higher 500 MB of hard disk space Hardware 1 etwork iterface card (NIC) ruig TCP/IP with a static IP address Iteret coectio to update defiitios 100 Mbits/s Etheret lik (1 Gbit/s recommeded) Software J2SE Rutime Eviromet (JRE) 5.0 (update 13 or later) or JRE 6.0 The most curret versio of JRE 5.0 ad JRE 6.0 at the time of product ship is provided o the product CD i the followig folder: Tools\Java\Wi32 Oe of the followig Web browsers to access the Symatec Sca Egie cosole Microsoft Iteret Explorer 6 (SP1) or later Use Microsoft Iteret Explorer to access the Symatec Sca Egie cosole from a Widows cliet computer. Mozilla Firefox 1.5 or later Use Mozilla Firefox to access the Symatec Sca Egie cosole from a Solaris or Liux cliet computer. The Web browser is oly required for Web-based admiistratio. You must istall the Web browser o a computer from which you wat to access the Symatec Sca Egie cosole. The computer must have access to the server o which Symatec Sca Egie rus.

20 20 Itroducig Symatec AtiVirus for Network Attached Storage About preparig for istallatio Solaris system requiremets The followig are the system requiremets for istallig Symatec AtiVirus for Network Attached Storage o a Su Solaris system: Operatig system Solaris 9 ad 10 Esure that your operatig system has the latest patches that are available. Processor Memory Disk space SPARC 1 GB of RAM or higher 500 MB of hard disk space Hardware 1 etwork iterface card (NIC) ruig TCP/IP with a static IP address Iteret coectio to update defiitios 100 Mbits/s Etheret lik (1 Gbit/s recommeded) Software J2SE Rutime Eviromet (JRE) 5.0 (update 13 or later) or JRE 6.0 The most curret versio of JRE 5.0 ad JRE 6.0 at the time of product ship is provided o the product CD i the followig folder: Tools\Java\Solaris If you istall the self-extractig JRE, esure that you ote the istallatio locatio. You must provide the locatio of the JRE if the istaller is uable to detect it. Oe of the followig Web browsers to access the Symatec Sca Egie cosole Mozilla Firefox 1.5 or later Use Mozilla Firefox to access the Symatec Sca Egie cosole from a Solaris or Liux cliet computer. Microsoft Iteret Explorer 6 (SP1) or later Use Microsoft Iteret Explorer to access the Symatec Sca Egie cosole from a Widows cliet computer. The Web browser is oly required for Web-based admiistratio. You must istall the Web browser o a computer from which you wat to access the Symatec Sca Egie cosole. The computer must have access to the server o which Symatec Sca Egie rus.

21 Itroducig Symatec AtiVirus for Network Attached Storage About preparig for istallatio 21 Liux system requiremets The followig are the system requiremets for istallig Symatec AtiVirus for Network Attached Storage o a Liux system: Operatig system Red Hat Liux Eterprise Server 3 ad 4 Red Hat Liux Advaced Server 3 ad 4 Red Hat Eterprise Liux 5 SuSE Liux Eterprise Server 9 ad 10 Red Hat Eterprise Liux 5 (64-bit) Processor Memory Disk space Petium 4 processor 1 GHZ or higher 1 GB of RAM or higher 500 MB of hard disk space Hardware 1 etwork iterface card (NIC) ruig TCP/IP with a static IP address Iteret coectio to update defiitios 100 Mbits/s Etheret lik (1 Gbit/s recommeded)

22 22 Itroducig Symatec AtiVirus for Network Attached Storage Post-istallatio tasks Software Esure that the followig packages are istalled: GNU sharutils or later Use this package to expad the Rapid Release packages. compress or later Use this package to expad the Rapid Release packages. GNU C Library (glibc) iitscripts This package is required for Red Hat Liux oly. aaa_base package This package is required for SuSE oly. J2SE Rutime Eviromet (JRE) 5.0 (update 13 or later) or JRE 6.0 The most curret versio of JRE 5.0 ad JRE 6.0 at the time of product ship is provided o the product CD i the followig folder: Tools\ Java\RedHat Istall the JRE usig Red Hat Package Maager (RPM). Esure that you ote the istallatio locatio. You must provide the locatio of the JRE if the istaller is uable to detect it. Oe of the followig Web browsers to access the Symatec Sca Egie cosole Mozilla Firefox 1.5 or later Use Mozilla Firefox to access the Symatec Sca Egie cosole from a Solaris or Liux cliet computer. Microsoft Iteret Explorer 6 (SP1) or later Use Microsoft Iteret Explorer to access the Symatec Sca Egie cosole from a Widows cliet computer. The Web browser is oly required for Web-based admiistratio. You must istall the Web browser o a computer from which you wat to access the Symatec Sca Egie cosole. The computer must have access to the server o which Symatec Sca Egie rus. Post-istallatio tasks The Symatec AtiVirus for Network Attached Storage coectors do ot require licesig from Symatec. However, you must istall the appropriate liceses for Symatec Sca Egie. These liceses are required to activate ativirus scaig fuctioality for the sca egie ad to receive updated virus defiitios. For more iformatio about licesig, see the Symatec Sca Egie Implemetatio Guide.

23 Itroducig Symatec AtiVirus for Network Attached Storage Post-istallatio tasks 23 After you istall ad cofigure the sca egie, you must cofigure the coector for your etwork attached storage device to sed files to the sca egie. For more iformatio about itegratig a specific coector with the sca egie, see the appropriate chapter i this guide.

24 24 Itroducig Symatec AtiVirus for Network Attached Storage Post-istallatio tasks

25 Chapter 2 Cofigurig Symatec AtiVirus for NetApp Filer This chapter icludes the followig topics: About software compoets How Symatec Sca Egie works with the NetApp Filer cliet About preparig for istallatio About cofigurig Symatec Sca Egie About cofigurig the cliet NetApp Filer About software compoets Symatec AtiVirus for Network Attached Storage provides virus scaig ad repair capabilities for Network Appliace (NetApp) Filer storage appliaces. Cofigure the followig compoets to add ativirus scaig to the NetApp Filer: Symatec Sca Egie, which provides the virus scaig ad repair services For more iformatio, see the Symatec Sca Egie Implemetatio Guide.

26 26 Cofigurig Symatec AtiVirus for NetApp Filer How Symatec Sca Egie works with the NetApp Filer cliet The NetApp Filer Some optios are cofigured directly o the NetApp Filer. No additioal code is ecessary to coect Symatec Sca Egie to the NetApp Filer. See About cofigurig the cliet NetApp Filer o page 42 How Symatec Sca Egie works with the NetApp Filer cliet Symatec AtiVirus for Network Attached Storage provides virus scaig ad repair capabilities for the NetApp Filer storage appliaces that support Data ONTAP versio or later. Each Filer must be ruig Data ONTAP or later if you pla to use a sigle Symatec Sca Egie to support multiple Filer storage appliaces. Symatec Sca Egie must be istalled o a computer that is ruig Widows 2000 Server/Widows 2003 Server/Widows 2008 Server. It must be located i the same domai as the NetApp Filer for which it provides scaig ad repair services. Symatec Sca Egie uses the proprietary Network Appliace adaptatio of the RPC protocol to iterface with NetApp Filer storage appliaces. A sigle Symatec Sca Egie ca support multiple NetApp Filers. You ca use multiple sca egies to support oe or more filers for sites with larger sca volumes. Load balacig is hadled through the NetApp Filer iterface. Virus scaig o the NetApp Filer is available oly for those files that are requested through the Commo Iteret File System (CIFS). Files that are requested through the Network File System (NFS) are ot scaed for viruses. What happes whe a file is scaed The NetApp Filer submits files to Symatec Sca Egie for scaig o both read ad write. That is, files are scaed whe they are accessed from storage (read), reamed (write) ad whe submitted for storage, if modified (write). Whe a user tries to access a file, the filer passes the file to Symatec Sca Egie for scaig. After a file is scaed, Symatec Sca Egie idicates the scaig results to the filer. If a file is ifected ad ca be repaired, the sca egie returs the repaired file based o a cofigurable virus sca policy. Clea files are passed to the requestig user after the filer receives the scaig results. The repaired file is passed to the requestig user if the file is ifected ad ca be repaired. The stored versio of the ifected file is the replaced with the repaired file. The user is deied access to the file if the file is ifected ad

27 Cofigurig Symatec AtiVirus for NetApp Filer How Symatec Sca Egie works with the NetApp Filer cliet 27 caot be repaired, ad the ifected file is deleted from storage. Symatec Sca Egie ca be cofigured to quaratie these urepairable files. See About quaratiig urepairable ifected files o page 36. The filer caches scaig results for each clea file to avoid redudat scas of those files that have already bee scaed. The cache is purged whe the virus defiitios o Symatec Sca Egie are updated, the vsca reset commad is ru o the filer, or whe the sca egie is restarted. If the cache is full ad a file that is ot i the cache is accessed, the oldest iformatio i the cache is purged. This esures that the scaig results for the ewly scaed file ca be stored. About coectig to Symatec Sca Egie A coectio is maitaied betwee each NetApp Filer ad Symatec Sca Egie. Symatec Sca Egie moitors the coectio with each NetApp Filer by checkig the coectio at a cofigured time iterval. The sca egie tries to recoect if it determies that the coectio is ot active. (The umber of times that the sca egie tries to re-establish the coectio ca also be cofigured.) About limitig scaig by file type Viruses are foud oly i the file types that cotai executable code. Oly those file types that ca cotai viruses eed be scaed. Limitig scaig by file type saves badwidth ad time. You have the followig levels of cotrol over which files are scaed: You ca cotrol the files that are iitially submitted to the sca egie by the NetApp Filer for scaig The NetApp Filer lets you specify by file extesio the files that are to be passed to Symatec Sca Egie for scaig. You cofigure the file types that you wat to submit for scaig through the NetApp Filer iterface i accordace with the product documetatio. See About specifyig the file extesios to be scaed o the NetApp Filer o page 43.

28 28 Cofigurig Symatec AtiVirus for NetApp Filer How Symatec Sca Egie works with the NetApp Filer cliet You ca cotrol the files that are embedded i archival file formats (for example,.zip or.lzh files) that are to be scaed by Symatec Sca Egie The sca egie lets you specify the file types ad the file extesios that you do ot wat to sca. The file extesios exclusio list ad the file type exclusio list achieve this purpose. You ca also sca all file types regardless of extesio. You cofigure which embedded files are scaed through the Symatec Sca Egie admiistrative iterface. See Specifyig which embedded files to sca o page 37. About hadlig ifected files You ca cofigure Symatec Sca Egie to do ay of the followig whe a ifected file is foud: Sca Oly Sca ad repair files Sca ad repair or delete Dey access to the ifected file, but do othig to the ifected file. Try to repair the ifected file, ad dey access to ay urepairable file. Try to repair the ifected file, ad delete ay urepairable file. You ca also cofigure the sca egie to quaratie urepairable files. See About quaratiig urepairable ifected files o page 36. About user idetificatio ad otificatio whe a virus is foud Whe a virus is foud i a file that is requested from the NetApp Filer, Symatec Sca Egie automatically obtais (for loggig purposes) idetificatio iformatio about the user who requested the ifected file. This iformatio icludes the security idetifier of the user ad the IP address ad host ame of the requestig computer. The idetificatio iformatio supplemets the iformatio that is cotaied i Ifectio Foud log messages that are logged to the local logs, the Widows Evet Log, ad SMTP. This iformatio does ot appear i the Ifectio Foud messages that are logged to SNMP or SSIM.

29 Cofigurig Symatec AtiVirus for NetApp Filer About preparig for istallatio 29 Note: Symatec Sca Egie ca obtai oly the iformatio that is made available by the NetApp Filer. I some cases, all or some of this iformatio is ot available. The iformatio that is obtaied is reported i the related log etries. Ay idetificatio iformatio that is ot obtaied from the NetApp Filer is omitted from the log messages ad from the user otificatio widow. You also ca cofigure Symatec Sca Egie to otify the requestig user that the retrieval of a file failed because a virus was foud.the otificatio message icludes the followig: Date ad time of the evet File ame of the ifected file Virus ame ad ID Virus defiitio date ad revisio umber Maer i which the ifected file was hadled (for example, the file was repaired or deleted) Sca policy Dispositio of the file Duratio of sca time ad coectio time To use the user otificatio feature, the Widows Messeger service must be ruig o the computer that is ruig Symatec Sca Egie, ad o the user s computer. See Notifyig a requestig user that a virus was foud o page 35. About preparig for istallatio The Network Appliace Filer storage appliace must support Data ONTAP versio or later to iterface with Symatec Sca Egie. If you pla to use a sigle Symatec Sca Egie to support multiple filer storage appliaces, each filer must support Data ONTAP versio or later. As a prerequisite, esure that each NetApp Filer for which the sca egie is to provide scaig ad repair services meets this requiremet. To use RPC, Symatec Sca Egie must be istalled o a computer that is ruig Widows 2000 Server/Widows 2003 Server/Widows 2008 Server. The computer o which you pla to istall Symatec Sca Egie must meet the system requiremets that are listed i the Symatec Sca Egie Implemetatio Guide.

30 30 Cofigurig Symatec AtiVirus for NetApp Filer About cofigurig Symatec Sca Egie After you istall Symatec Sca Egie, cofigure the NetApp Filer to work with the sca egie. See About cofigurig the cliet NetApp Filer o page 42. About cofigurig Symatec Sca Egie Cofigure Symatec Sca Egie to use RPC as the commuicatio protocol. The Iteret Cotet Adaptatio Protocol (ICAP) is the default protocol at istallatio, but you ca chage the protocol to RPC through the admiistrative iterface. The you ca cofigure the RPC-specific optios. See Cofigurig RPC protocol optios o page 31 You must also chage the Widows service startup properties to idetify a accout that has the appropriate permissios. See Editig the service startup properties o page 30. Editig the service startup properties If you chage the protocol settig to RPC, you eed to chage the service startup properties to idetify a accout that has the followig appropriate permissios: The user accout must have local admiistrator permissios o the computer that has the sca egie. The user accout must have Backup Operator privileges or above o the NetApp Filer. You must chage the service startup properties if the list of NetApp Filers is edited as well. To edit the service startup properties 1 I the Widows 2000/2003/2008 Cotrol Pael, click Admiistrative Tools. 2 Click Services. 3 I the list of services, right-click Symatec Sca Egie, ad the click Properties. 4 I the Properties dialog box, o the Log O tab, click This Accout. 5 Type the accout ame ad password for the user accout that has local admiistrator rights o the computer that has the sca egie. This accout should also have domai backup operator privileges or above. Use the followig format for the accout ame: domai\userame

31 Cofigurig Symatec AtiVirus for NetApp Filer About cofigurig Symatec Sca Egie 31 6 Click OK. 7 Stop ad start the Symatec Sca Egie service. For more iformatio o stoppig ad startig the Symatec Sca Egie service, see the Symatec Sca Egie Implemetatio Guide. Cofigurig RPC protocol optios After you istall Symatec Sca Egie, you ca cofigure settigs that are specific to the RPC protocol. You must maually stop ad start the sca egie service whe you chage to the RPC protocol. A proper coectio to the NetApp Filer is esured. Table 2-1 describes the protocol-specific optios for RPC. Table 2-1 Optio RPC cliet list Protocol-specific optios for RPC Descriptio A sigle Symatec Sca Egie ca support oe or more NetApp Filers. NetApp Filers must be located i the same domai as the sca egie. You must provide the IP address of each NetApp Filer. Note: Multiple sca egies ca support a sigle NetApp Filer. Cofigure the multiple sca egies through the NetApp Filer iterface. Check RPC coectio every secods Maximum umber of recoect attempts Symatec Sca Egie maitais a coectio with the NetApp Filer. Symatec Sca Egie ca be cofigured to check the coectio with the NetApp Filer at a prescribed iterval to esure that the coectio is active. The default value is 20 secods. You ca cofigure the sca egie to make a specified umber of tries to re-establish a lost coectio with the NetApp Filer. By default, Symatec Sca Egie is cofigured to try to recoect with the NetApp Filer idefiitely. Note: Do ot set a maximum umber of recoect attempts if the sca egie provides scaig for multiple NetApp Filers. Use the default settig.

32 32 Cofigurig Symatec AtiVirus for NetApp Filer About cofigurig Symatec Sca Egie Table 2-1 Optio Ativirus sca policy Protocol-specific optios for RPC Descriptio You ca cofigure Symatec Sca Egie to do oe of the followig whe a ifected file is foud: Sca oly: Dey access to the ifected file, but do othig to the ifected file. Sca ad repair files: Try to repair the ifected file, ad dey access to ay urepairable file. Sca ad repair or delete: Try to repair the ifected file, ad delete ay urepairable file from archive files. Note: You must select Sca ad repair or delete if you pla to quaratie the ifected files that caot be repaired. For more iformatio, see the Symatec Sca Egie Implemetatio Guide. Automatically sed ativirus update otificatios You ca cofigure Symatec Sca Egie to automatically otify the NetApp Filer whe ew virus defiitios are used. This otificatio causes the NetApp filer to clear its cache of scaed files. Cofigure RPC protocol optios To cofigure RPC, do the followig: Provide a IP address for each NetApp Filer for which Symatec Sca Egie should provide scaig services. You ca add or delete filers from this list at ay time. Cofigure the additioal RPC-specific optios. To edit the list of NetApp Filers 1 O the Symatec Sca Egie admiistrative iterface, i the left pae, click Cofiguratio. 2 Uder Views, click Protocol. 3 I the right pae, uder Select Commuicatio Protocol, click RPC. The cofiguratio settigs are displayed for the selected protocol. 4 I the Maual Restart Required dialog box, click OK. Wheever you switch protocols, you must restart the server. You ca cotiue to make ad apply chages i the admiistrative iterface. However, the chages do ot take effect util you restart the Symatec Sca Egie service.

33 Cofigurig Symatec AtiVirus for NetApp Filer About cofigurig Symatec Sca Egie 33 5 To add a NetApp Filer to the list of RPC cliets, type the IP address of the NetApp Filer for which Symatec Sca Egie should provide scaig services. Type oe etry per lie. 6 To delete a NetApp Filer from the list of RPC cliets, select ad delete the IP address of the NetApp Filer. 7 O the toolbar, select oe of the followig: Save Apply Saves your chages. You ca cotiue to make chages i the admiistrative iterface util you are ready to Applies your chages. Your chages are ot implemeted util you You must perform a maual restart for the chages to take place ad for a proper coectio to the NetApp Filer. To cofigure additioal RPC-specific optios 1 O the Symatec Sca Egie admiistrative iterface, i the left pae, click Cofiguratio. 2 Uder Views, click Protocol. 3 Uder RPC Cofiguratio, i the Check RPC coectio every box, type how frequetly Symatec Sca Egie checks the RPC coectio with the NetApp Filer to esure that the coectio is active. The default iterval is 20 secods. 4 I the Maximum umber of recoect attempts box, type the maximum umber of tries that the Symatec Sca Egie should udertake to reestablish a lost coectio with the NetApp Filer. The default settig is 0. Symatec Sca Egie tries idefiitely to reestablish a coectio. Use the default settig if the sca egie provides scaig for multiple NetApp Filers. 5 I the Ativirus sca policy list, select how you wat Symatec Sca Egie to hadle ifected files. The default settig is Sca ad repair or delete.

34 34 Cofigurig Symatec AtiVirus for NetApp Filer About cofigurig Symatec Sca Egie 6 O the toolbar, select oe of the followig: Save Apply Saves your chages. You ca cotiue to make chages i the admiistrative iterface util you are ready to Applies your chages. Your chages are ot implemeted util you You must perform a maual restart for the chages to take place ad for a proper coectio to the NetApp Filer. Notifyig the NetApp Filer whe virus defiitios are updated Whe Symatec Sca Egie scas a file, it is stored i the NetApp Filer s cache. This cached file is set to ay user who subsequetly requests the same file thus coservig scaig resources. You ca cofigure the sca egie to automatically otify the NetApp Filer whe the sca egie begis usig ew virus defiitios. This otificatio prompts the NetApp Filer to clear its cache of scaed files. Ay ew requests for files causes the file to be set to the sca egie agai for scaig. The scaed clea files are cached, ad these cached files are set to the requestig user. You ca maually clear the cache of scaed files at the commad lie iterface of the NetApp Filer as well. See About clearig the scaed files cache o page 44. The process of automatically otifyig the NetApp Filer about virus defiitios updates could affect system performace, depedig o how frequetly you schedule LiveUpdate. You ca sed the otificatio maually to miimize the impact o scaig resources. To automatically otify the NetApp Filer whe virus defiitios are updated 1 O the admiistrative iterface, i the left pae, click Cofiguratio. 2 Uder Views, click Protocol. 3 Uder RPC Cofiguratio, check Automatically sed AtiVirus update otificatios. This optio is disabled by default.

35 Cofigurig Symatec AtiVirus for NetApp Filer About cofigurig Symatec Sca Egie 35 4 O the toolbar, select oe of the followig: Save Apply Saves your chages. You ca cotiue to make chages i the admiistrative iterface util you are ready to Applies your chages. Your chages are ot implemeted util you You must perform a maual restart for the chages to take place. To maually otify the NetApp Filer whe virus defiitios are updated 1 O the admiistrative iterface, i the left pae, click Cofiguratio. 2 Uder Views, click Protocol. 3 I the left pae, uder Tasks, click Sed AtiVirus Update Notificatio. Notifyig a requestig user that a virus was foud You ca cofigure Symatec Sca Egie to otify the requestig user that the retrieval of a file failed because a virus was foud. The otificatio message is displayed oly if the user uses a Widows computer. I additio, the requestig user s computer must be i the same domai as the sca egie. Both the user s computer ad the sca egie must have the Widows Messeger service ruig to use this feature. The otificatio message icludes the followig iformatio: The date ad time of the evet The evet security level (for example, Warig) The sca policy (for example, sca ad repair or delete) The file ame of the ifected file The virus ame ad ID The maer i which the ifected file was hadled (for example, the file was repaired or deleted) The dispositio of the file (for example, ifected) The IP address ad ame of the requestig user s computer The date ad revisio umber of the virus defiitios used The duratio (i secods) of sca ad coectio time