McAfee GroupShield for Lotus Domino on Microsoft Windows

Transcription

1 Product Guide McAfee GroupShield for Lotus Domino on Microsoft Windows version 5.3

2 COPYRIGHT 2003 Networks Associates Technology, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc., or its suppliers or affiliate companies. To obtain this permission, write to the attention of the Network Associates legal department at: 5000 Headquarters Drive, Plano, Texas 75024, or call TRADEMARK ATTRIBUTIONS Active Firewall, Active Security, Active Security (in Katakana), ActiveHelp, ActiveShield, AntiVirus Anyware and design, Appera, AVERT, Bomb Shelter, Certified Network Expert, Clean-Up, CleanUp Wizard, ClickNet, CNX, CNX Certification Certified Network Expert and design, Covert, Design (stylized N), Disk Minder, Distributed Sniffer System, Distributed Sniffer System (in Katakana), Dr Solomon s, Dr Solomon s label, E and Design, Entercept, Enterprise SecureCast, Enterprise SecureCast (in Katakana), epolicy Orchestrator, Event Orchestrator (in Katakana), EZ SetUp, First Aid, ForceField, GMT, GroupShield, GroupShield (in Katakana), Guard Dog, HelpDesk, HelpDesk IQ, HomeGuard, Hunter, Impermia, InfiniStream, Intrusion Prevention Through Innovation, IntruShield, IntruVert Networks, LANGuru, LANGuru (in Katakana), M and design, Magic Solutions, Magic Solutions (in Katakana), Magic University, MagicSpy, MagicTree, McAfee, McAfee (in Katakana), McAfee and design, McAfee.com, MultiMedia Cloaking, NA Network Associates, Net Tools, Net Tools (in Katakana), NetAsyst, NetCrypto, NetOctopus, NetScan, NetShield, NetStalker, Network Associates, Network Performance Orchestrator, Network Policy Orchestrator, NetXray, NotesGuard, npo, Nuts & Bolts, Oil Change, PC Medic, PCNotary, PortalShield, Powered by SpamAssassin, PrimeSupport, Recoverkey, Recoverkey International, Registry Wizard, Remote Desktop, ReportMagic, RingFence, Router PM, Safe & Sound, SalesMagic, SecureCast, SecureSelect, Service Level Manager, ServiceMagic, SmartDesk, Sniffer, Sniffer (in Hangul), SpamKiller, SpamAssassin, Stalker, SupportMagic, ThreatScan, TIS, TMEG, Total Network Security, Total Network Visibility, Total Network Visibility (in Katakana), Total Service Desk, Total Virus Defense, Trusted Mail, UnInstaller, VIDS, Virex, Virus Forum, ViruScan, VirusScan, WebScan, WebShield, WebShield (in Katakana), WebSniffer, WebStalker, WebWall, What's The State Of Your IDS?, Who s Watching Your Network, WinGauge, Your E-Business Defender, ZAC 2000, Zip Manager are registered trademarks or trademarks of Network Associates, Inc. and/or its affiliates in the US and/or other countries. Sniffer brand products are made only by Network Associates, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO NETWORK ASSOCIATES OR THE PLACE OF PURCHASE FOR A FULL REFUND. Attributions This product includes or may include: Software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( Cryptographic software written by Eric A. Young (eay@cryptsoft.com) and software written by Tim J. Hudson (tjh@cryptsoft.com). Some software programs that are licensed (or sublicensed) to the user under the GNU General Public License (GPL) or other similar Free Software licenses which, among other rights, permit the user to copy, modify and redistribute certain programs, or portions thereof, and have access to the source code. The GPL requires that for any software covered under the GPL which is distributed to someone in an executable binary format, that the source code also be made available to those users. For any such software covered under the GPL, the source code is made available on this CD. If any Free Software licenses require that Network Associates provide rights to use, copy or modify a software program that are broader than the rights granted in this agreement, then such rights shall take precedence over the rights and restrictions herein. Software originally written by Henry Spencer, Copyright 1992, 1993, 1994, 1997 Henry Spencer. Software originally written by Robert Nordier, Copyright Robert Nordier. All rights reserved. Software written by Douglas W. Sauder. Software developed by the Apache Software Foundation ( International Components for Unicode ( ICU ) Copyright International Business Machines Corporation and others. All rights reserved. Software developed by CrystalClear Software, Inc., Copyright 2000 CrystalClear Software, Inc. FEAD Optimizer technology, Copyright Netopsystems AG, Berlin, Germany. Issued OCTOBER 2003 / GroupShield 5.3 for Lotus Domino on Microsoft Windows DOCUMENT BUILD 03-EN

3 Contents Preface Audience Conventions Getting information Contacting McAfee Security & Network Associates About GroupShield 5.3 for Lotus Domino Main features of GroupShield Types of scan What comes with GroupShield What s new in this release Viewing GroupShield using a web browser Web interface restrictions On-Access Scanning On-Access view On-Access document On-Access Scanner Statistics document On-Demand Scanning On-Demand view On-Demand document Configuring your GroupShield Server Server Settings view GroupShield Server Setup document GroupShield Server Status document Mail.box Scanning Mail.box Settings view Mail.box Scanning document Product Guide iii

4 Contents 6 Using Alert Notifications Alert Setup view Alert Message document About Content Scanning Content Scan Rules view Content Scanning Rule dialog boxes Examples of content scan rules Server Console Commands On-demand scan commands Configuration commands Using AutoUpdate About AutoUpdate Configuration view DAT Only File Update Properties document Engine Update Properties document Attach New DAT dialog box Attach New Engine dialog box Restore Previous Version dialog box Version Information dialog box Using the Quarantine Database Quarantine view Quarantine Report document Purge Options document Using the Log Database Log view GroupShield Log document GroupShield AutoUpdate Log document Sections and fields iv GroupShield 5.3 for Lotus Domino on Microsoft Windows

5 Contents 12 Using Alert Manager Multiple methods for staying informed Overview of alerting methods How many Alert Managers do you need? Opening the Alert Manager properties pages Additional information Configuring Alert Manager Viewing the Summary page Forwarding alert messages to other computers Sending an alert as a network message Sending alert messages to addresses Sending alert messages to pagers Sending alert messages to a printer Sending alert messages via SNMP Sending alert messages via the Desktop Management Interface Launching a program to send an alert Sending alert messages to Windows system logs Sending an alert by playing a sound Sending an alert to Terminal Server clients Setting up Centralized Alerting Customizing alert messages Enabling and disabling alert messages Changing priorities for alert messages Changing the text of alert messages Outbreak Manager Protecting against large-scale virus outbreaks Overview of features Outbreak detection Fast reaction Status and records How does Outbreak Manager work? Microsoft Windows service Interaction with other anti-virus software Product Guide v

6 Contents Using Outbreak Manager Creating new rules Modifying rules Deleting rules Copying rules Renaming rules Changing the order of the rules Enabling and disabling rules Viewing the status of your rules Viewing outbreak activity Viewing the Outbreak log The log view Configuring the log view Displaying record details Filtering the log records Adding a new filter Modifying a filter Deleting a filter Configuring columns Showing or hiding columns Changing the column sort order Using GroupShield Agents The Set Document Author Fields Agent Removing all Set Document Author Fields The Database Cleanup Agent The Synchronization Agent Creating an agent Using the Synchronization Agent Viewing the Synchronization Agent log The Decommission Servers Agent vi GroupShield 5.3 for Lotus Domino on Microsoft Windows

7 Contents A Optimizing your Configuration On-Access read scanning Banned content scanning Attachment scanning Schedules Excluding server tasks from scans Excluding server databases from scans Server threads Cached configuration Database purging and compaction Using backup software on servers running GroupShield Index Product Guide vii

8 Contents viii GroupShield 5.3 for Lotus Domino on Microsoft Windows

9 Preface This Product Guide introduces GroupShield 5.3 for Lotus Domino on Microsoft Windows, and provides the following information: Descriptions of new features in this release of the software. Detailed instructions for configuring and deploying the software. It also provides a roadmap for getting additional information or help. Audience This information is designed for system and network administrators who are responsible for their company s anti-virus and security program. Product Guide 9

10 Preface Conventions This guide uses the following conventions: Bold All words from the user interface, including options, menus, buttons, and dialog box names. Example Type the User name and Password of the desired account. Courier Text that represents something the user types exactly; for example, a command at the system prompt. Example To enable the agent, run this command line on the client computer: FRMINST.EXE /INSTALL=AGENT /SITEINFO=C: \TEMP\SITELIST.XML Italic Names of product manuals and topics (headings) within the manuals; emphasis; introducing a new term. Example Refer to the VirusScan Enterprise Product Guide for more information. <TERM> Angle brackets enclose a generic term. Example In the console tree under epolicy Orchestrator, right-click <SERVER>. NOTE WARNING Supplemental information; for example, an alternate method of executing the same command. Important advice to protect a user, computer system, enterprise, software installation, or data. 10 GroupShield 5.3 for Lotus Domino on Microsoft Windows

11 Getting information Getting information Installation Guide * System requirements and instructions for installing and starting the software. McAfee GroupShield 5.3 for Lotus Domino on Microsoft Windows Installation Guide Product Guide * Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures. McAfee GroupShield 5.3 for Lotus Domino on Microsoft Windows Product Guide Help Configuration Guide * Release Notes Contacts Product information and descriptions on configuring and using the user interface screens and fields is available from the GroupShield Help database that is accessed from within Lotus Notes. The database is called gsd_53help.nsf and is located in the Lotus\Domino\Data\McAfee folder For use with epolicy Orchestrator. Procedures for configuring, deploying, and managing your McAfee Security product through epolicy Orchestrator management software. ReadMe. Product information, resolved issues, any known issues, and last-minute additions or changes to the product or its documentation. Contact information for McAfee Security and Network Associates services and resources: technical support, customer service, AVERT (Anti-Virus Emergency Response Team), beta program, and training. This file also includes phone numbers, street addresses, web addresses, and fax numbers for Network Associates offices in the United States and around the world. * An Adobe Acrobat.PDF file on the product CD or the McAfee Security download site. A printed manual that accompanies the product CD. Note: Some language manuals may be available only as a.pdf file. Text files included with the software application and on the product CD. Help accessed from the software application.. Product Guide 11

12 Preface Contacting McAfee Security & Network Associates Technical Support Home Page KnowledgeBase Search PrimeSupport Service Portal * McAfee Security Beta Program Security Headquarters AVERT (Anti-Virus Emergency Response Team) Home Page Virus Information Library Submit a Sample AVERT WebImmune AVERT DAT Notification Service Download Site Home Page DAT File and Engine Updates Product Upgrades * Training ftp://ftp.nai.com/pub/antivirus/datfiles/4.x McAfee Security University Network Associates Customer Service Web US, Canada, and Latin America toll-free: rsity.htm services_corporate_division@nai.com Phone VIRUS NO or Monday Friday, 8 a.m. 8 p.m., Central Time For additional information on contacting Network Associates and McAfee Security including toll-free numbers for other geographic areas see the Contact file that accompanies this product release. * Logon credentials required. 12 GroupShield 5.3 for Lotus Domino on Microsoft Windows

13 About GroupShield 5.3 for Lotus Domino 1 GroupShield 5.3 is the powerful anti-virus solution for your Lotus Domino servers. GroupShield 5.3 supports McAfee SpamKiller 2.1, which provides powerful anti-spam scanning for your Lotus Domino servers. Full details of SpamKiller and how to use it can be found in the SpamKiller software and documentation. GroupShield plugs in to your existing Lotus Domino software. Once installed and running, GroupShield protects your Lotus Domino network by: Continually monitoring your Lotus Domino server and protecting it from viruses and potentially harmful software, which might be introduced through messages or Lotus Notes documents. GroupShield works in real time to detect and delete viruses as they attempt to enter or move through the system. Helping you maintain a virus-free environment by scanning databases on your Lotus Domino server. GroupShield can intercept, clean, and log an infected file attachment before it spreads. With GroupShield, you have unmatched control over your scans. You can: Initiate a scan at any time or set up a scan schedule for regular checking. See Main features of GroupShield 5.3 on page 14 for more details. Specify the databases, directories, and files that you want to scan. Choose how to respond to virus infections. If a virus is detected, you can respond by cleaning and removing the virus or by moving infected files to a quarantine database pending further action. Configure GroupShield to notify you and other users about virus infections. Configure GroupShield to automatically update the McAfee virus definition (DAT) files. See complete reports on the actions that GroupShield took. Product Guide 13

14 About GroupShield 5.3 for Lotus Domino Main features of GroupShield 5.3 Use GroupShield to manage the server s scanning activities. The features include: On-access scanning for your server s databases, so that all documents created, updated and read from the databases are checked for questionable content. See Chapter 2, On-Access Scanning. On-demand scanning for your server s databases, so that all documents in the databases are checked for questionable content at intervals defined by the administrator. See Chapter 3, On-Demand Scanning. Configuring the server s scan settings. See Chapter 4, Configuring your GroupShield Server. Mail router database(s) (Mail.box(es)) scan settings for a server, so that messages passing through the server are checked for questionable content. See Chapter 5, Mail.box Scanning. Alert notification messages that are generated when the scans detect questionable content. See Chapter 6, Using Alert Notifications. Content scan rules that can be used by your scans to check for banned textual content. See Chapter 7, About Content Scanning. AutoUpdate schedules so that GroupShield can be automatically kept up to date with the latest DAT files and virus-scanning engine, providing extensive protection against virus infection. See Chapter 9, Using AutoUpdate. GroupShield also includes: A Quarantine database for holding questionable items that are detected by the scans, so that you can inspect and restore them, as required. See Chapter 10, Using the Quarantine Database. A Log database for logging GroupShield s actions, so that you can view what has occurred. See Chapter 11, Using the Log Database. 14 GroupShield 5.3 for Lotus Domino on Microsoft Windows

15 Types of scan Types of scan GroupShield can scan a server s mail router databases (Mail.boxes) and other databases in a number of ways: On-Access scans These operations scan your Lotus Notes documents and attachments when they are created, updated or read.you can include any databases and directories, including the mail router databases. On-Demand scan schedules These schedules can run at specified times or on specified days, scanning your Lotus Notes documents and attachments frequently. You can also run the schedules at any time, at the click of a button. Mail router database(s) scans This operation is specific to the mail router databases, and scans the messages and attachments passing through the server. What comes with GroupShield 5.3 When you install GroupShield on your Lotus Domino server, a number of components are installed Databases The following GroupShield databases are installed: gsd53_config.nsf is the Configuration Manager database. Its purpose is to inform other GroupShield server tasks of the current scanning configuration. Each time you update a configuration in GroupShield, the Configuration Manager updates the information that it holds. gsd53_log.nsf is the Log database. This records the actions taken by the GroupShield Server tasks. For example, it records which databases have been scanned and the scan actions that were performed (when questionable content was detected). gsd53_quarantine.nsf is the Quarantine database. This stores Lotus Notes documents and attachments identified by GroupShield as containing questionable content. From the Quarantine database you can view and manage the Quarantined items. gsd53_update.nsf is the Update database that stores DAT files and virus-scanning engines for GroupShield. gsd53_help.nsf is the online Help database. Product Guide 15

16 About GroupShield 5.3 for Lotus Domino Templates The following GroupShield for Lotus Domino templates (.NTF) are also installed: gsd53_quarantine.ntf is the template used to create the Quarantine database. gsd53_log.ntf is the template used to create the Log database. gsd53_update.ntf is the template used to create the AutoUpdate functions. gsd53_ldi.ntf is a template used for debugging and testing purposes. Using this template can cause the GroupShield server to run very slowly. gsd53_config.ntf is the template used to refresh or rebuild the GroupShield configuration. These templates enable you to recreate GroupShield databases, in the event of the original databases becoming corrupted or being deleted. When GroupShield is installed on multiple Lotus Domino servers in the same domain, all databases except the quarantine database (gsd53_quarantine.nsf) and the log database (gsd53_log.nsf) are replicated across the servers. We recommend that you set the GroupShield databases to replicate once a day. Add-ins GroupShield installs the following add-in tasks on the Lotus Domino server: nmcafeeconfig is the Configuration Manager. Its task is to inform other GroupShield server tasks of the current scanning configuration. Each time you update a configuration in GroupShield, the Configuration Manager updates the information that it holds. nmcafeeoascan is the GroupShield on-access scanner that scans documents and messages as they arrive on the server. nmcafeeodscan is the GroupShield on-demand scanner that scans documents and messages according to your settings. nmcafeeupdate is the AutoUpdate task that automatically updates the McAfee DAT files and virus-scanning engines to ensure optimum virus detection. nmcafeereport is the Reporter task. It generates and sends the notification messages that you have configured, and creates log entries in the GroupShield Log database. Additional components McAfee Outbreak Manager monitors traffic to give timely warning of a major virus attack. It looks for multiple versions of the same virus, identical attachments or message throughput over a period that you specify. If the Outbreak Manager identifies abnormal behavior, it responds immediately according to rules that you choose. 16 GroupShield 5.3 for Lotus Domino on Microsoft Windows

17 What s new in this release Network Associates Alert Manager provides alerting options that notify you and other administrators of virus attacks. You can use the alerts individually or in combinations to suit your working environment. What s new in this release This release of GroupShield 5.3 introduces the following new features: epolicy Orchestrator version 3.0 support. For more information refer to the GroupShield 5.3 for Lotus Domino Configuration Guide for use with epolicy Orchestrator. McAfee SpamKiller support. This allows you to install and run SpamKiller alongside GroupShield, adding powerful anti-spam technology to the virus protection provided by GroupShield. New installation wizard. For more information refer to the GroupShield 5.3 for Lotus Domino Installation Guide. Viewing GroupShield using a web browser To access GroupShield using a web browser: 1 Open the web browser. 2 In the Address text box (or similar), type the following web address: IP address>/gsd5/gsd53_config.nsf Where <server IP address> is the IP address of the Lotus Domino server that contains GroupShield. NOTE Unless you have disabled password protection for the Lotus Domino server, you will be asked to log on to the server. Supply the administrator user name and password as required. The GroupShield web interface opens. You can use the web browser s Bookmark or Favorites feature to store the web address that you typed, so that you can open the Web Interface more quickly in future. Product Guide 17

18 About GroupShield 5.3 for Lotus Domino Web interface restrictions If you are using a web browser to access GroupShield, you cannot: Run an AutoUpdate schedule so that it is performed immediately. Delete items from the Quarantine database or configure the purging feature for the database. Restore documents from the Quarantine database. Delete entries from the Log database or configure the purging feature for the database. The Web Interface reports if GroupShield is running as an epolicyorchestrator Managed Server, but cannot switch this setting on or off. 18 GroupShield 5.3 for Lotus Domino on Microsoft Windows

19 On-Access Scanning 2 GroupShield can perform on-access scanning for your server s databases, so that all documents created, updated and read from the databases are checked for questionable content. When you first install GroupShield, a default on-access scan is created for you. This operation applies to all databases on the Lotus Domino server except the mail router database(s) (Mail.box(es)). The mail router database(s) scan settings are configured in the Mail.box(es)Settings view; see Mail.box Settings view on page 52. You can create any number of new on-access scans, and edit or delete the current operations. If an infected document has its form and default form removed, the on-access scan (during database replication) and on-demand scan schedules cannot scan the document because it cannot be opened. This only becomes an issue if the document is provided with a form and then opened when scanning is not being performed. The On-Access view in the GroupShield Configuration database lists the on-access scans that have been configured for GroupShield; see On-Access view on page 20. You can perform the following tasks with GroupShield: View on-access scans. Create a new on-access scan. Edit on-access scans. Check the configurations for on-access scans. Delete on-access scans. View which databases are scanned on the servers. Change which databases are scanned on a server. For information on performing a task, refer to the relevant topic in the GroupShield Help database. Product Guide 19

20 On-Access Scanning On-Access view The On-Access view lists the on-access scans that have been configured for GroupShield. Double-click an entry to display the configuration document where you can view and edit its settings. Columns The On-Access view contains the following columns of information for the on-access scans: Errors? Indicates whether the scan s settings are correct. OK (Green) indicates that the settings are correct. Error! (Red) indicates that the settings are either incorrect (they do not match the settings for the servers in the domain and your mail setup) or conflict with the settings of another scan (resulting in an unnecessary duplication of scan tasks). Configuration Name The name of the scan. Scan DB Reads Indicates whether the scan checks Lotus Notes documents when they are read. = yes, = no. If you select Disable database read scanning for the Server in the GroupShield Server Setup document, read access scanning is disabled for that server; see GroupShield Server Setup document on page 45. Scan DB Writes Indicates whether the scan checks Lotus Notes documents when they are created or updated. = yes, = no. This is overview information. To view the settings for a scan, double-click the scan to display its On-Access document; see On-Access document on page GroupShield 5.3 for Lotus Domino on Microsoft Windows

21 On-Access view Buttons The On-Access view contains the following buttons. Note that some of the Web Interface buttons have slightly different names: New Opens an On-Access document, allowing you to configure a new on-access scan; see On-Access document on page 22. Change On-Access Scanner Status Allows you to change whether a server s mail router database(s) (Mail.box(es)) or other databases are included in the GroupShield on-access scans. If the on-access scanning task is stopped and restarted, either by stopping and then restarting the individual task, the mcafeeconfig task or the Lotus Domino server, GroupShield automatically enables scanning for the server's mail (Mail.box(es)) and other (data) databases. Recompute Errors Checks that the settings for the scans are correct. If a configuration contains an error, pressing Recompute Errors will cause, the next time that you open the configuration document, a warning message to appear. The lines within the configuration document that contain the errors will also be numbered to assist you in correcting all the errors in the document. View OA Status Opens the On-Access Scanner Statistics document, showing you whether on-access scans are enabled (On) or disabled (Off) for the databases on each of the Lotus Domino servers in the current domain; see On-Access Scanner Statistics document on page 32. Archived Configurations Shows the on-access scans that have been archived as a result of GroupShield being managed by the epolicy Orchestrator software. On-access scans are archived when you set the Scan Settings, Server Settings document, Add/Remove epo Support button to add epolicy Orchestrator support. The scan settings are archived so that they do not conflict with those that are enforced by the epolicy Orchestrator software. If you stop using the epolicy Orchestrator software and want to restore the archived configurations in GroupShield, select the required scans, then click Restore Selected. Product Guide 21

22 On-Access Scanning On-Access document The On-Access document appears when you create or edit an on-access scan in the On-Access view. The document shows the current settings for the scan, allowing you to view and configure them, as required. Figure 2-1. On-Access document 22 GroupShield 5.3 for Lotus Domino on Microsoft Windows

23 On-Access document Sections and fields The main part of the On-Access document contains the following sections and fields: Name The name of the scan. Inclusions The databases and directories on the servers in this domain that are included in the scan. You can specify multiple entries. If you are editing the scan through a web browser, the numbers next to the scan entries are links that you can use to edit or remove the scan entries. This is additional functionality for the Web Interface. For information on configuring the scan entries, refer to the relevant topic in the GroupShield Help database. Exclusions The databases and directories on the servers in this domain that are excluded from the scan. You can specify multiple entries. Activities to Scan The following access methods are scanned. Database Writes Lotus Notes documents are scanned when they are created and updated. Database Reads Lotus Notes documents are scanned when they are read. WARNING Exercise caution when using the Database Reads checkbox because scanning documents each time they are read causes considerable system overhead. If you deselect both Database Writes and Database Reads, the scan is effectively disabled. If you have multiple Lotus Domino servers, the server s documents are only scanned on replication if write access scanning is enabled. This will have consequences wherever a read event takes place, for example, any database that you create from a template will not be scanned, as this is a read event. If Disable database read scanning for the Server is selected in the GroupShield Server Setup document for a server, read access is disabled for that server and overrides any read access scans for that server; see GroupShield Server Setup document on page 45. For information on configuring GroupShield for optimum performance, see Optimizing your Configuration on page 169. Product Guide 23

24 On-Access Scanning Objects to Scan Select or deselect the following objects for scanning: File Attachments Scans attached files for viruses, and can perform various scan actions if any are found. GroupShield can also block documents if their attachments exceed a specified size or exceed the maximum number allowed. LotusScript GroupShield scans messages for potentially harmful LotusScript objects. Various actions can be performed if these objects are found. See LotusScript scan settings on page 28. Lotus Formula GroupShield scans messages for potentially harmful Lotus formulae, such as button bombs that can coerce the user into choosing a damaging action, and various actions can be performed if these formulae are found. See Lotus Formula scan settings on page 30. Banned Content Scans documents for banned content using a selection of content scan rules, and can perform various actions if it finds this content. See Banned content scan settings on page 31. In some circumstances, the GroupShield on-access scanner stops checking a document when it finds questionable content. Therefore, if you select multiple scan parameters for a scan, such as LotusScript scanning and Lotus Formulae scanning, GroupShield might only perform the scan action for the scan parameter that first finds the questionable content. Digital Signatures Indicates whether you want the scan to clean infected attachments in documents that have a digital signature. When Lotus Domino stores a form or attachment with a document, the document becomes signed. In this situation, GroupShield can record the fact that the document, or the attachment, contains a virus, but it cannot carry out any cleaning, deleting or moving to Quarantine. To clean, delete or move to Quarantine any infected signed documents, select Break digital signature if necessary. NOTE If Break digital signature if necessary is not selected, GroupShield will scan the signed document, but can only log that the document is signed. GroupShield cannot quarantine or delete the document unless Break digital signature if necessary has been selected. If you have selected Break digital signature if necessary, you will receive a Lotus Domino warning every time you open the document in the Quarantine database. 24 GroupShield 5.3 for Lotus Domino on Microsoft Windows

25 On-Access document Additional sections and fields Depending on which checkboxes you select in the Objects to Scan section, extra sections and fields are added to the On-Access document, allowing you to configure further scan parameters and actions. For information on configuring these fields, see: Attachment scan settings on page 25 LotusScript scan settings on page 28. Lotus Formula scan settings on page 30. Banned content scan settings on page 31. Attachment scan settings When defining which Objects to Scan (page 24), if you select File Attachments, an additional section is displayed, Attachment Scan, where you can set the scanning and blocking options for files with attachments. Figure 2-2. Attachment scan settings The Attachment Scan section allows you to select the types of attached files that you want to check: All file attachments All attached files, regardless of file extension. NOTE Including all file types allows you to protect against viruses contained in files that have been renamed. This can, however, put a heavy load on the server if large numbers of attachments are received during periods of high server usage. Scan only specified attachments The specified types of attached files, based on the file extension. File types that are prone to infection are included and selected by default. Product Guide 25

26 On-Access Scanning The attachment scan options are: Scan compressed files Checks all contents of compressed files, created by utilities such as PKLITE. Scan archived files Checks all contents of archived files, such as.zip and self-extracting files. Enable file heuristics Uses heuristic scanning technology to identify potential new file viruses. Enable macro heuristics Uses heuristic scanning technology to identify potential new macro viruses. Enable OLE object scanning Checks all embedded or linked objects, such as macros. Find all macros Logs the event and continues. Delete all macros Removes the macros from the original document (users can still access the document), and logs the action in the Log database. This checkbox is only available if Find all macros is selected. You can view the Log database in the Log view; see Log view on page 90. If you select Find all Macros, or Find all macros and Delete all macros, the document is not quarantined, even if you select the quarantine option in the When a virus is found section. Find suspicious programs Scans for programs that might be dangerous but are not actually viruses. McAfee defines suspicious programs as legitimate applications that systems administrators might want to restrict to specific individuals within their organization, such as the Information Technology department. Examples of such applications are password crackers, software for taking remote control of a machine, and programs which can be used to identify security holes over a network. Find joke programs Scans for non-harmful tools or joke programs. An example of such programs is an applet that opens your computer s CD-ROM tray. The Find joke programs checkbox is only available if Find suspicious programs is selected. Treat password protected files as infected GroupShield treats all password-protected files as being infected. If this option is unchecked, GroupShield will log the file as unscannable and then continue. Treat unscannable files as infected any files that GroupShield cannot scan are treated as infected. 26 GroupShield 5.3 for Lotus Domino on Microsoft Windows

27 On-Access document The Attachment Blocking section allows you to: Block attachments by size Blocks all attachments over the specified size. Block attachments by number Blocks all attachments where more than the specified number of attachments are found. In the When a Virus is Found section, select the scan action that GroupShield performs when it finds a virus (or potential virus). This is also known as the primary action: Log and continue GroupShield logs the existence of the virus but does not clean the infected attachment. Users can access the Lotus Notes document and its infected attachment. WARNING Allowing a Lotus Notes document to remain infected is not recommended as it increases the chances of infection within your organization. We recommend that you use extreme caution with this option. Move document to quarantine GroupShield moves the Lotus Notes document and its attachments to the Quarantine database, so that they can be inspected. Users cannot access the Lotus Notes document and its attachments while they are in the Quarantine database. Clean infected attachment GroupShield attempts to clean the infected attachments. Move attachment to quarantine GroupShield removes the infected attachment from the Lotus Notes document and moves it to the Quarantine database with a copy of the document, so that they can be inspected. Users can access the original document but they cannot access the infected attachment. NOTE If the Move attachment to quarantine action has been selected with Block attachments by size or Block attachments by number, the whole document is moved to the Quarantine database, not just the attachment. In the If the Specified Action Fails section, select the next scan action that GroupShield performs if it is unable to perform the first action (specified for When a Virus is Found). The available actions depend on the first action that you have selected. This action is also known as the secondary action: Delete attachment GroupShield deletes the infected attachment. Users can still access the Lotus Notes document. Product Guide 27

28 On-Access Scanning Move attachment to quarantine GroupShield moves the infected attachment to the Quarantine database, so that it can be inspected. Users can access the Lotus Notes document but they cannot access the attachment while it is in the Quarantine database. Move document to quarantine GroupShield moves the Lotus Notes document and its attachments to the Quarantine database, so that they can be inspected. Users cannot access the Lotus Notes document and its attachments while they are in the Quarantine database. You can view the Quarantine database in the Quarantine view; see Quarantine view on page 84. GroupShield logs all the scan actions that it performs (as configured in the When a Virus is Found and If the Specified Action Fails sections) in its Log database. You can view the Log database in the Log view; see Log view on page 90. NOTE Previous versions of GroupShield 5.3 for Lotus Domino on Microsoft Windows always sent a copy of any infected file to the Quarantine database, regardless of the selected actions. As this can lead to the Quarantine database becoming very large, this version of GroupShield only copies files to Quarantine when that is the selected action, or if the selected actions fail. To reinstate the previous method, add the following line to the NOTES.INI file: GSD_QUARANTINE_FOR_CLEAN=1. LotusScript scan settings When configuring a scan or editing a server s mail settings, you can configure GroupShield to scan Lotus Notes documents for potentially harmful LotusScript objects. These are objects that can coerce the user into choosing a damaging action, and perform various actions if these objects are found. Figure 2-3. LotusScript scan settings 28 GroupShield 5.3 for Lotus Domino on Microsoft Windows

29 On-Access document If you chose to scan for LotusScript objects, additional LotusScript Scan Settings are available, allowing you to specify the scanning options. LotusScript Scan The section allows you to specify the LotusScript commands you want to block: Enter LotusScript commands to ban (separated by return). Specify the LotusScript commands that you want to detect. For example MkDir. You can click Browse and use the LotusScript dialog box to select the required commands. NOTE If you type more than one command, separate each command by pressing RETURN on your keyboard, to put each command on a separate line. When an Exception is Found The section allows you to define the action to take when the blocked LotusScript is found: Log and continue Records the existence of the LotusScript command but does not remove it from the Lotus Notes document. Users can access the document and the command. WARNING Allowing a potentially harmful LotusScript command to remain in the document is not recommended as it increases the chances of infection within your organization. We recommend that you use extreme caution with this option. Move document to quarantine Moves the Lotus Notes document and its LotusScript commands to the Quarantine database, so that they can be inspected. Users cannot access the Lotus Notes document and its LotusScript commands while they are in the Quarantine database. You can view the Quarantine database in the Quarantine view; see Quarantine view on page 84. GroupShield records all the scan actions that it performs (as configured in the When an Exception is Found section) in its Log database. You can view the Log database in the Log view; see Log view on page 90. Product Guide 29

30 On-Access Scanning Lotus Formula scan settings When configuring a scan or editing a server s mail settings, you can configure GroupShield to scan Lotus Notes documents for potentially harmful Lotus formulae, such as button bombs that can coerce the user into choosing a damaging action. Figure 2-4. Lotus Formula scan settings If you chose to scan for Lotus Formula objects, additional Formula Scan Settings are available, allowing you to specify the scanning options. Formula Scan The section allows you to specify the Lotus Formula commands you want to block: Enter formulae to ban (separated by Return): The formulae that you want to detect, for If you type more than one Lotus Formula, separate each Lotus Formula by pressing RETURN on your keyboard, to put each Lotus Formula on a separate line. You can click Browse and use the Formula dialog box to select the required formulae. When an Exception is Found The section allows you to define the action to take when the blocked Lotus Formula is found: Log and continue Records the existence of the Lotus Formula but does not remove it from the Lotus Notes document. Users can access the document and the Lotus Formula. WARNING Allowing a potentially harmful Lotus Formula to remain in the document is not recommended as it increases the chances of infection within your organization. We recommend that you use extreme caution with this option. Move document to quarantine GroupShield moves the Lotus Notes document and its Lotus formulae to the Quarantine database, so that they can be inspected. Users cannot access the Lotus Notes document and its Lotus formulae while they are in the Quarantine database. You can view the Quarantine database in the Quarantine view; see Quarantine view on page GroupShield 5.3 for Lotus Domino on Microsoft Windows