LogLevel

{logging level}

Logging level of the component.

If the parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method

ExePath

{path to file}

Path to the executable file of the component.

Default value: <opt_dir>/bin/drweb-icapd

•For Linux, Solaris: /opt/drweb.com/bin/drweb-icapd

•For FreeBSD: /usr/local/libexec/drweb.com/bin/drweb-icapd

RunAsUser

{UID | user name}

The parameter determines under which user name the component should be run. The user name can be specified either as the user’s number UID or as the user’s login. If the user name consists of numbers (i.e. similar to number UID), it is specified with the “name:” prefix, for example: RunAsUser = name:123456.

When a user name is not specified, the component operation terminates with an error after the startup.

Default value: drweb

Start

{Boolean}

The component must be launched by the Dr.Web ConfigD configuration daemon.

When you specify the Yes value for this parameter, it instructs the configuration daemon to start the component immediately; and when you specify the No value, it instructs the configuration daemon to terminate the component immediately.

Default value: No

DebugDumpIcap

{Boolean}

Instructs to include detailed ICAP messages into the log file on the debug level (i.e. when you set LogLevel = DEBUG).

Default value: No

ListenAddress

{network socket}

Defines a network socket (IP address and port) on which Dr.Web ICAPD must listen for connections from HTTP proxy servers.

Default value: 127.0.0.1:1344

UsePreview

{Boolean}

Instructs Dr.Web ICAPD to use the ICAP preview mode.

It is recommended that you do not change the default value of this parameter, unless it is necessary.

Default value: Yes

Use204

{Boolean}

Defines whether Dr.Web ICAPD is allowed to return the response code 204 not only in the ICAP preview mode.

It is recommended that you do not change the default value of this parameter, unless it is necessary.

Default value: Yes

AllowEarlyResponse

{Boolean}

Defines whether Dr.Web ICAPD is allowed to use the ICAP’s early response mode, i.e. is allowed to start sending an “early” response to the client before the entire request has been received from the HTTP proxy server.

It is recommended that you do not change the default value of this parameter, unless it is necessary.

Default value: Yes

TemplatesDir

{path to directory}

Path to the directory that contains the templates for the HTML notifications sent upon blocking a web resource.

Default value: <var_dir>/templates/icapd

•For Linux, Solaris: /var/opt/drweb.com/templates/icapd

•For FreeBSD: /var/drweb.com/templates/icapd

Whitelist

{domain list}

List of domains that can be used as the white list (i.e. list of domains allowed for connection for users, even if these domains are included into blocked categories. In addition, user access will be allowed to all sub-domains of domains indicated in this list.)

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of domains example.com and example.net.

1.Adding of values to the configuration file.

•Two values in one string

•Two strings (one value per a string)

2.Adding values via the command drweb-ctl cfset.

Default value: (not set)

Blacklist

{domain list}

List of domains that can be used as the black list (i.e. list of domains forbidden for connection for users, even if these domains are not included into blocked categories. In addition, user access will be forbidden to all sub-domains of domains indicated in this list.)

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of domains example.com and example.net.

1.Adding of values to the configuration file.

•Two values in one string

•Two strings (one value per a string)

2.Adding values via the command drweb-ctl cfset.

Default value: (not set)

Adlist

{list of strings}

A list of regular expressions that describe advertisement URLs: URLs that match any of the regular expressions listed here are considered to be URLs of advertisements.

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list the following expressions '.*ads.+' and '.*/ad/.*\.gif$'.

1.Adding of values to the configuration file.

•Two values in one string

•Two strings (one value per a string)

2.Adding values via the command drweb-ctl cfset.

Regular expressions are specified using either the POSIX syntax (BRE, ERE) or the Perl syntax (PCRE, PCRE2).

Default value: (not set)

BlockInfectionSource

{Boolean}

Instructs to block attempted connections to websites containing malicious software (included into the InfectionSource category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockNotRecommended

{Boolean}

Instructs to block attempts of connection to non-recommended websites (included into the NotRecommended category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockAdultContent

{Boolean}

Instructs to block attempts of connection to websites containing adult content (included into the AdultContent category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockViolence

{Boolean}

Instructs to block attempts of connection to websites containing graphic violence (included into the Violence category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockWeapons

{Boolean}

Instructs to block attempts of connection to websites dedicated to weapons (included into the Weapons category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockGambling

{Boolean}

Instructs to block attempts of connection to gambling websites (included into the Gambling category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockDrugs

{Boolean}

Instructs to block attempts of connection to websites dedicated to drugs (included into the Drugs category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockObsceneLanguage

{Boolean}

Instructs to block attempts of connection to websites containing obscene language (included into the ObsceneLanguage category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockChats

{Boolean}

Instructs to block attempts of connection to chat websites (included into the Chats category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockTerrorism

{Boolean}

Instructs to block attempts of connection to websites dedicated to terrorism (included into the Terrorism category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockFreeEmail

{Boolean}

Instructs to block attempts of connection to websites of free email services (included into the FreeEmail category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockSocialNetworks

{Boolean}

Instructs to block attempts of connection to social networking websites (included into the SocialNetworks category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockDueToCopyrightNotice

{Boolean}

Instructs to block attempts of connection to websites that were added according to copyright holder requests (included into the DueToCopyrightNotice category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

ScanTimeout

{time interval}

Timeout for scanning one file initiated by Dr.Web ICAPD.

A value in the range from 1s to 1h can be specified

Default value: 30s

HeuristicAnalysis

{On | Off}

Indicates whether heuristic analysis is used for detection of unknown threats during data scanning initiated by Dr.Web ICAPD. The use of heuristic analysis raises the level of protection, but at the same time it increases the time spent on scanning.

Action applied to threats detected by the heuristic analyzer is specified as the BlockSuspicious parameter value.

Allowed values:

•On—instructs to use heuristic analysis when scanning.

•Off—instructs not to use heuristic analysis.

Default value: On

PackerMaxLevel

{integer}

Maximum nesting level when scanning packed objects. All objects at a deeper nesting level are skipped during data scanning initiated by Dr.Web ICAPD.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value: 8

ArchiveMaxLevel

{integer}

Maximum nesting level when scanning archives. All objects at a deeper nesting level are skipped during data scanning initiated by Dr.Web ICAPD.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value: 0

MailMaxLevel

{integer}

Maximum nesting level when scanning email messages and mailboxes. All objects at a deeper nesting level are skipped during data scanning initiated by Dr.Web ICAPD.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value: 0

ContainerMaxLevel

{integer}

Maximum nesting level when scanning other containers (for example, HTML pages). All objects at a deeper nesting level are skipped during data scanning initiated by Dr.Web ICAPD.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value: 8

MaxCompressionRatio

{integer}

Maximum compression ratio of compressed/packed objects (ratio between the uncompressed size and the compressed size). If the ratio for an object exceeds the limit, this object is skipped during data scanning initiated by Dr.Web ICAPD.

The compression ratio must not be smaller than 2.

Default value: 500

BlockKnownVirus

{Boolean}

Instructs to block the receiving or the sending of data if it contains any known threat.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockSuspicious

{Boolean}

Instructs to block the receiving or the sending of data if it contains any unknown threat (detected by the heuristic analyzer).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockAdware

{Boolean}

Instructs to block the receiving or the sending of data if it contains adware.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockDialers

{Boolean}

Instructs to block the receiving or the sending of data if it contains a dialer program.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockJokes

{Boolean}

Instructs to block the receiving or the sending of data if it contains joke program.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockRiskware

{Boolean}

Instructs to block the receiving or the sending of data if it contains riskware.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockHacktools

{Boolean}

Instructs to block the receiving or the sending of data if it contains a hacktool.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockUnchecked

{Boolean}

Instructs to block the receiving or the sending of data if it cannot be checked.

Default value: No