Quarantine

Quarantine is used for isolation of infected and suspicious files. If quarantine action is applied to a file, it is moved to the Quarantine directory. Path to this directory is specified in the Path parameter in the [Quarantine] configuration file section.

When a file is moved to Quarantine, 6 random characters are appended to its name. In addition to this file, auxiliary file with service information (path to the original location, permissions, etc.) is created. Its name is the same as the modified name of the quarantined file with an added -info postfix. Permissions for both files are set according to FilesMode parameter in the [Quarantine] section.

Example:

eicar.com – original file name;

eicar.comf8JRCG – modified file name;

eicar.comf8JRCG-info – auxiliary file name.

Some additional file properties supported by NSS (such as quotas and NSS attributes) can be saved to Quarantine together with the file. These properties are automatically reset when the file is restored from the Quarantine directory. For file properties to be saved, enable Linux extended attributes in NSS by adding the following lines to the /etc/opt/novell/nss/nssstart.cfg file:

/ListXattrNWMetadata
/CtimeIsMetadataModTime

For details on Linux extended attributes, refer to the Open Enterprise Server documentation.