Configuration Parameters

The component uses configuration parameters which are specified in the [SMBSpider] section of the integrated Appendix D. Configuration File of Dr.Web for UNIX File Servers.

LogLevel

{logging level}

Logging level of the component.

If the parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method

ExePath

{path to file}

Path to the executable file of the component.

Default value: <opt_dir>/bin/drweb-smbspider-daemon

•For Linux, Solaris: /opt/drweb.com/bin/drweb-smbspider-daemon

•For FreeBSD: /usr/local/libexec/drweb.com/bin/drweb-smbspider-daemon

Start

{Boolean}

The component must be launched by the Dr.Web ConfigD configuration daemon.

When you specify the Yes value for this parameter, it instructs the configuration daemon to start the component immediately; and when you specify the No value, it instructs the configuration daemon to terminate the component immediately.

Default value: No

SambaChrootDir

{path to directory}

Defines the path to the root directory of the SMB file storage (can be redefined by the file server with the help of the chroot restriction).

Used as a prefix inserted at the beginning of all paths to files and directories residing in the file server’s storage and describes the path relative to the root of the local file system.

If not specified, the path to the file system root is used /.

Default value: (not specified)

SmbSocketPath

{path to file}

Path to the socket file which enables interaction between SpIDer Guard for SMB and VFS SMB modules.

The path is always relative and is a supplement for the path specified as the SambaChrootDir parameter value (if the SambaChrootDir parameter is empty, than the path to the file system root is supplemented /).

Default value: var/run/.com.drweb.smb_spider_vfs

ActionDelay

{time interval}

Delay time between the moment when a threat is detected and the moment when SpIDer Guard for SMB applies the action specified for this threat type. During this time period, the file is blocked.

Default value: 24h

MaxCacheSize

{size}

Size of cache used by VFS SMBmodules to store data on scanned files in monitored SMB directories.

If 0 is specified, data is not cached.

Default value: 10mb

[*] ExcludedPath

{path to file or directory}

Path to the shared directory object which must be skipped during scanning. You can specify a directory or file path. It is also possible to use file masks (which contain the characters '?' and '*', as well as character classes '[ ]', '[! ]', '[^ ]').

You can specify a list as the parameter value. The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list the files /etc/file1 and directory /usr/bin.

1.Adding of values to the configuration file.

•Two values in one string

[SMBSpider]
ExcludedPath = "/etc/file1", "/usr/bin"

•Two strings (one value per a string)

[SMBSpider]
ExcludedPath = /etc/file1
ExcludedPath = /usr/bin

2.Adding values via the command drweb-ctl cfset.

# drweb-ctl cfset SMBSpider.ExcludedPath -a /etc/file1
# drweb-ctl cfset SMBSpider.ExcludedPath -a /usr/bin

If a directory is specified, all directory content will be skipped.

Default value: (not specified)

[*] IncludedPath

{path to file or directory}

Path to the shared directory object, which must be scanned. You can specify a directory or file path. It is also possible to use file masks (that contain the characters '?' and '*', as well as character classes '[ ]', '[! ]', '[^ ]').

Example: Add to the list the files /etc/file1 and directory /usr/bin.

1.Adding of values to the configuration file.

•Two values in one string

[SMBSpider]
IncludedPath = "/etc/file1", "/usr/bin"

•Two strings (one value per a string)

[SMBSpider]
IncludedPath = /etc/file1
IncludedPath = /usr/bin

2.Adding values via the command drweb-ctl cfset.

# drweb-ctl cfset SMBSpider.IncludedPath -a /etc/file1
# drweb-ctl cfset SMBSpider.IncludedPath -a /usr/bin

If a directory is specified, all directory content will be scanned.

Note that this parameter has higher priority than the ExcludedPath parameter (see above); that is, if the same object (file or directory) is specified in both parameter values, this object will be scanned.

Default value: (not specified)

[*] AlertFiles

{Boolean}

Indicates whether a text file is created next to an object blocked by SMB directory monitor as malicious. The created text file describes the reason why the object was blocked. The created file will be named as <name of the blocked file>.drweb.alert.txt.

Allowed values:

•Yes—Files are created.

•No—Files are not created.

Default value: Yes

[*] OnKnownVirus

{action}

Action applied by Dr.Web for UNIX File Servers to a known threat (virus, etc.) detected by using signature analysis during the scanning initiated by SpIDer Guard for SMB.

Allowed values: Block, Cure, Quarantine, Delete

Default value: Cure

[*] OnIncurable

{action}

Action applied by Dr.Web for UNIX File Servers to an incurable threat (that is, an attempt to apply Cure failed) detected during the scanning initiated by SpIDer Guard for SMB.

Allowed values: Block, Quarantine, Delete

Default value: Quarantine

[*] OnSuspicious

{action}

Action applied by Dr.Web for UNIX File Servers to an unknown threat (or suspicious objects) detected by using heuristic analysis during the scanning initiated by SpIDer Guard for SMB.