The anti-virus network may consist of one or several Proxy servers.
The main function of a Proxy server is to establish a connection between Dr.Web Server and Dr.Web Agents in cases when it is impossible to set up direct access (e.g. if Dr.Web Server and Dr.Web Agents are located in separate networks which do not have packet routing between them).
The Proxy server allows using any computer included in an anti-virus network for the following purposes:
•As update relay center to reduce the network load on the Server and on connection between the Server and the Proxy server, as well as to reduce the time required for protected stations to get updates by using the caching function.
•As a distribution center of virus events coming from protected stations to the Server, which also reduces network load and allows keeping up with cases when, for example, a group of stations is located in a network segment, which is isolated from the segment the Server is in.
|
To establish a connection between the Server and clients via the Proxy server, it is recommended to disable traffic encryption. For this, it is enough to set the no value for the Encryption parameter in the Dr.Web Server Configuration → General section. |
General Functions
A proxy server performs the following functions:
1.Network listening and receipt of connections according to the specified protocol and port.
2.Protocol translation (supported protocols: TCP/IP).
3.Data transmission between Dr.Web Server and Dr.Web Agents according to the Proxy server settings.
4.Caching of Agent and anti-virus package updates, which are translated by the Server. In case of using cache of the Proxy server to translate updates, following are provided:
•reducing of network traffic,
•reducing of Agent updates receiving time.
5.Supporting the traffic encryption between the Servers and the Agents.
|
Proxy servers can be composed to hierarchical structure. |
The general diagram of the anti-virus network when a Proxy server is used is illustrated in the figure below.
|
Diagram of the anti-virus network when a proxy server is used
Principle of Operation
When a proxy server is used, the following operations are performed
1.If the address of the Server is not specified on the Agent, the Agent sends a multicast request according to the protocol of the network.
2.If the Proxy server is set up to translate connections (the discovery="yes" parameter), a message about the availability of an operating Proxy server is sent to the Agent.
3.The Agent sets the received Proxy server parameters for Dr.Web Server. Further intercommunication is performed transparently for the Agent.
4.The Proxy server listens specified ports for incoming connections via given protocols according to the configuration file.
5.For each incoming connection from the Agent (or Dr.Web Server) the Proxy server establishes a connection with Dr.Web Server (or Agent).
The forwarding algorithm for the list of Dr.Web Servers
1.Proxy server loads to RAM the list of Dr.Web Servers from the drwcsd-proxy.conf configuration file (see the Appendices document, p. Appendix G4).
2.Dr.Web Agent connects to the Proxy server.
3.Proxy server forwards Dr.Web Agent to the first Server from Dr.Web Servers list loaded in the RAM.
4.Proxy server rotate the list in the RAM and moves Dr.Web Server from the first position to the end of list.
|
Proxy Server does not save changed order of Servers to its configuration file. After restart of Proxy server, the list of Dr.Web Servers is loaded to the RAM in original version, which is stored in the configuration file. |
5.When the next Agent connects to the Proxy server, procedure is repeated from the step 2.
6.If Dr.Web Server disconnects from the anti-virus network (e.g., gets offline or denies of service), the Agent connects to the Proxy server repeatedly and procedure is repeated from the step 2.
|
Network scanner which is launched from an external network (in respect to the Agents) is unable to locate the installed Agents. |
|
If the Replace NetBIOS names flag is set and anti-virus network contains the Proxy server, when for all stations connected to the Server via the Proxy server, in Dr.Web Security Control Center, the name of computer on which the Proxy server is installed, will be shown instead of stations names. |
Traffic Encryption and Compression
Proxy server supports traffic compression. Transferred data is processed regardless of whether traffic is compressed or not.
Proxy server supports traffic encryption. To support the encryption, the Proxy server must connect to the Server (see Installation Manual, p. Connecting the Proxy Server to the Dr.Web Server) and sign its certificate by certificate and private key of the Server. The traffic encryption between the Server and the Proxy server is performed using the Server certificate; the traffic encryption between the Agents and the Proxy server is performed using the Proxy server certificate that is signed by the Server certificate and private key.
Caching
Proxy server supports traffic caching.
Products are cached by revisions. Each revision stores in separate directory. Directories with all next revisions contain hard links on existing files from old revisions and originals for changed files. Thus, files for each version are stored on a hard drive in a single exemplar, all directories for next revisions contain only links on unchanged files.
According to the settings specified in the configuration file, the following actions are performed if the caching is enabled:
•Outdated revisions are periodically deleted. By default—once per hour.
•Only latest revisions are stored. All other, earlier revisions are considered outdated and are deleted. By default 3 last revisions are stored.
•Unused memory mapped files are periodically unloaded. By default—each 10 minutes.
Settings
The Proxy server does not have a GUI. Its settings can be edited by one of the following ways:
1.Remotely via the Control Center if the Proxy server is connected to Dr.Web Server (see Remote Configuration of the Proxy Server).
2.Locally via the configuration file. The format of the configuration file is described in the Appendices document, p. Appendix G4.
|
Only user with administrative rights on the computer can manage settings (edit configuration file) of Proxy server.
For proper operation of Proxy server under Linux system-based OS after computer reboot, you must edit system network configuration without Network manager. |
Starting and Stopping
To start and stop the Proxy server under Windows OS, open Control Panel → Administration → Services, then double-click drwcsd-proxy and select a necessary action in the opened window.
To start and stop the Proxy server under a UNIX-based OS, use the start and stop commands with scripts created during installation of the Proxy server (see the Installation Manual, p. Installing Proxy Server).
To start the Proxy-server under both Windows OS and UNIX system-based OS, you can run the drwcsd-proxy executable file with corresponding switches (see the Appendices document, p. H9. Proxy Server).