| blob | 3970383ce4256633d7d0d1d752a8b1ea3e947fe6 |
1 '\" te
2 .\" Copyright (c) 2007 Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH VSCANADM 1M "Jul 7, 2009"
7 .SH NAME
8 vscanadm \- vscan service configuration utility
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBvscanadm\fR \fBset\fR \fB-p\fR \fIproperty\fR=\fIvalue\fR [\fB-p\fR \fIproperty\fR=\fIvalue\fR]...
13 .fi
15 .LP
16 .nf
17 \fBvscanadm\fR \fBget\fR [\fB-p\fR \fIproperty\fR]...
18 .fi
20 .LP
21 .nf
22 \fBvscanadm\fR \fBimport\fR \fB-p\fR \fIproperty\fR \fIfilename\fR
23 .fi
25 .LP
26 .nf
27 \fBvscanadm\fR \fBexport\fR \fB-p\fR \fIproperty\fR \fIfilename\fR
28 .fi
30 .LP
31 .nf
32 \fBvscanadm\fR \fBvalidate\fR \fB-p\fR \fIproperty\fR \fIfilename\fR
33 .fi
35 .LP
36 .nf
37 \fBvscanadm\fR \fBadd-engine\fR [\fB-p\fR \fIproperty\fR=\fIvalue\fR]... \fIengine_id\fR
38 .fi
40 .LP
41 .nf
42 \fBvscanadm\fR \fBremove-engine\fR \fIengine_id\fR
43 .fi
45 .LP
46 .nf
47 \fBvscanadm\fR \fBset-engine\fR \fB-p\fR\fIproperty\fR=\fIvalue\fR [\fB-p\fR \fIproperty\fR=\fIvalue\fR]... \fIengine_id\fR
48 .fi
50 .LP
51 .nf
52 \fBvscanadm\fR \fBget-engine\fR [\fB-p\fR \fIproperty\fR=\fIvalue\fR]... [\fIengine_id\fR]
53 .fi
55 .LP
56 .nf
57 \fBvscanadm\fR \fBshow\fR
58 .fi
60 .LP
61 .nf
62 \fBvscanadm\fR \fBstats\fR [\fB-z\fR]
63 .fi
65 .SH DESCRIPTION
66 .sp
67 .LP
68 The \fBvscanadm\fR command sets and displays properties of the \fBvscan\fR
69 service, \fBvscand\fR(1M), and provides scan statistics.
70 .sp
71 .LP
72 File system exemption from virus scanning may be configured per file system
73 using the appropriate file system administrative command, for example
74 \fBzfs\fR(1M).
75 .sp
76 .LP
77 Scan engines are third-party applications on external hosts that perform the
78 actual virus scanning operation on files. Multiple scan engines can be
79 configured for use by the \fBvscan\fR service. A minimum of two scan engines is
80 recommended. File scan requests are distributed among the configured scan
81 engines to achieve load balancing. A scan engine is identified by its
82 \fIengine_id\fR. The \fIengine_id\fR is a user defined string of up to 64
83 bytes.
84 .sp
85 .LP
86 The \fBvscan\fR service properties are divided into two categories: scan engine
87 properties, which are specific to a scan engine definition, and general
88 properties, which apply to the service and are not scan engine-specific.
89 .SH SUBCOMMANDS
90 .sp
91 .LP
92 \fBvscanadm\fR recognizes the following subcommands:
93 .sp
94 .ne 2
95 .na
96 \fB\fBvscanadm set\fR \fB-p\fR \fIproperty\fR=\fIvalue\fR [\fB-p\fR
97 \fIproperty\fR=\fIvalue\fR]...\fR
98 .ad
99 .sp .6
100 .RS 4n
101 Sets the values of \fBvscan\fR service general properties.
102 .sp
103 .ne 2
104 .na
105 \fB\fB-p\fR \fIproperty\fR=\fIvalue\fR\fR
106 .ad
107 .RS 21n
108 Specifies a property value
109 .RE
111 .RE
113 .sp
114 .ne 2
115 .na
116 \fB\fBvscanadm get\fR [\fB-p\fR \fIproperty\fR]...\fR
117 .ad
118 .sp .6
119 .RS 4n
120 Displays the values of \fBvscan\fR service general properties. If no properties
121 are specified, all \fBvscan\fR service general properties are displayed.
122 .sp
123 .ne 2
124 .na
125 \fB\fB-p\fR \fIproperty\fR\fR
126 .ad
127 .RS 15n
128 Specifies a property value
129 .RE
131 .RE
133 .sp
134 .LP
135 The following properties are available for the \fBvscanadm set\fR and
136 \fBvscanadm get\fR subcommands:
137 .sp
138 .ne 2
139 .na
140 \fB\fBmax-size\fR\fR
141 .ad
142 .RS 19n
143 The maximum size of files that should be virus scanned. Files exceeding
144 \fImax-size\fR are not scanned. The \fImax-size-action\fR property determines
145 whether access should be allowed or denied to files that exceed \fImax-size\fR.
146 .sp
147 The value of \fImax-size\fR is a string with a numeric (decimal) component and
148 an optional letter component that specifies a unit size, in the format
149 "N[.N][KMGTP][B]".
150 .sp
151 Following the numeric component, the optional unit can be specified as either
152 one or two characters. For example, either "K" or "KB" can be used to specify
153 kilobytes. Unit specifiers are not case-sensitive, and must follow the numeric
154 value immediately with no intervening whitespace.
155 .sp
156 With either no unit specifier, or a unit specifier of only "B", the numeric
157 value is assumed to be in bytes. The default value is 1GB.
158 .sp
159 Note that while the \fBvscan\fR service defines a maximum file size for
160 scanning, scan engines also typically define their own maximum file size
161 setting. It is recommended that \fImax-size\fR be set to a value less than or
162 equal to the maximum file size for the scan engine(s).
163 .RE
165 .sp
166 .ne 2
167 .na
168 \fB\fBmax-size-action\fR\fR
169 .ad
170 .RS 19n
171 Specifies whether access will be allowed or denied to files larger than
172 \fImax-size\fR. Files larger than \fImax-size\fR are not virus scanned. Valid
173 values are:
174 .sp
175 .ne 2
176 .na
177 \fBallow\fR
178 .ad
179 .RS 9n
180 allow access to files larger than \fImax-size\fR (no virus scan). This is the
181 default value.
182 .RE
184 .sp
185 .ne 2
186 .na
187 \fBdeny\fR
188 .ad
189 .RS 9n
190 deny access to files larger than \fImax-size\fR (no virus scan)
191 .RE
193 .RE
195 .sp
196 .ne 2
197 .na
198 \fB\fBvscanadm import\fR \fB-p\fR \fIproperty\fR \fIfilename\fR\fR
199 .ad
200 .sp .6
201 .RS 4n
202 Imports the property value from the specified file. The file must contain a
203 single line specifying the value of a single property.
204 .RE
206 .sp
207 .ne 2
208 .na
209 \fB\fBvscanadm export\fR \fB-p\fR \fIproperty\fR \fIfilename\fR\fR
210 .ad
211 .sp .6
212 .RS 4n
213 Exports the property value to the specified file. The file must contain a
214 single line specifying the value of a single property.
215 .RE
217 .sp
218 .ne 2
219 .na
220 \fB\fBvscanadm validate\fR \fB-p\fR \fIproperty\fR \fIfilename\fR\fR
221 .ad
222 .sp .6
223 .RS 4n
224 Validates the property value in the specified file. The file must contain a
225 single line specifying the value of a single property.
226 .RE
228 .sp
229 .LP
230 The following properties are available for the \fBvscanadm import\fR,
231 \fBvscanadm export\fR, and \fBvscanadm validate\fR subcommands:
232 .sp
233 .ne 2
234 .na
235 \fB\fBtypes\fR\fR
236 .ad
237 .RS 9n
238 A comma-separated list of file type extension matching rules. This list defines
239 which types of files are scanned and which should be excluded during virus
240 scanning. Each rule comprises the rule indicator [+|-], followed by a file type
241 \fIexpresssion\fR against which a file's type extension is compared. The file
242 type \fIexpresssion\fR is case insensitive and may include the "*" and "?"
243 wildcards. There should be no whitespace between the rule indicator and the
244 file type \fIexpresssion\fR. If a comma is included within the file type
245 expression, it must be escaped using a "\e" (backslash). A file type extension
246 does not include its preceding dot.
247 .sp
248 The rule indicator is a single character and can be one of:
249 .sp
250 .in +2
251 .nf
252 + include file type in virus scanning
253 - exclude file type from virus scanning
254 .fi
255 .in -2
256 .sp
258 When a file is being evaluated as a candidate for virus scanning, its file type
259 will be compared with the rules defined in types. The first rule matched will
260 be applied. If no match is found, the file will be virus scanned. The total
261 length of the types string can not exceed 4096 bytes. The default content of
262 the types list is "+*".
263 .RE
265 .sp
266 .ne 2
267 .na
268 \fB\fBvscanadm add-engine\fR [\fB-p\fR \fIproperty\fR=\fIvalue\fR]...
269 \fIengine_id\fR\fR
270 .ad
271 .sp .6
272 .RS 4n
273 Adds a new scan engine identified by \fIengine_id\fR. The default values are
274 used for any scan engine properties that are not specified. The hostname
275 defaults to the \fIengine_id\fR.
276 .sp
277 .ne 2
278 .na
279 \fB\fB-p\fR \fIproperty\fR=\fIvalue\fR\fR
280 .ad
281 .RS 21n
282 Specifies a property value
283 .RE
285 .RE
287 .sp
288 .ne 2
289 .na
290 \fB\fBvscanadm remove-engine\fR \fIengine_id\fR\fR
291 .ad
292 .sp .6
293 .RS 4n
294 Remove scan engine identified by \fIengine_id\fR, removing all of its
295 configuration property values.
296 .RE
298 .sp
299 .ne 2
300 .na
301 \fB\fBvscanadm set-engine\fR \fB-p\fR\fIproperty\fR=\fIvalue\fR [\fB-p\fR
302 \fIproperty\fR=\fIvalue\fR]... \fIengine_id\fR\fR
303 .ad
304 .sp .6
305 .RS 4n
306 Creates or updates the configuration property values for the scan engine
307 identified by \fIengine_id\fR.
308 .sp
309 .ne 2
310 .na
311 \fB\fB-p\fR \fIproperty\fR=\fIvalue\fR\fR
312 .ad
313 .RS 21n
314 Specifies a property value
315 .RE
317 .RE
319 .sp
320 .ne 2
321 .na
322 \fB\fBvscanadm get-engine\fR [\fB-p\fR \fIproperty\fR=\fIvalue\fR]...
323 [\fIengine_id\fR]\fR
324 .ad
325 .sp .6
326 .RS 4n
327 Displays the values of the specified scan engine properties for the scan engine
328 identified by \fIengine_id\fR. If no \fIengine_id\fR is specified, this
329 subcommand displays the specified scan engine property values for all
330 configured scan engines. If no properties are specified, this subcommand
331 displays all \fBvscan\fR service scan engine properties.
332 .sp
333 .ne 2
334 .na
335 \fB\fB-p\fR \fIproperty\fR=\fIvalue\fR\fR
336 .ad
337 .RS 21n
338 Specifies a property value
339 .RE
341 .RE
343 .sp
344 .LP
345 The following properties are available for the \fBvscanadm add-engine\fR,
346 \fBvscanadm remove-engine\fR, \fBvscanadm set-engine\fR, and \fBvscanadm
347 get-engine\fR subcommands:
348 .sp
349 .ne 2
350 .na
351 \fB\fBenable\fR\fR
352 .ad
353 .RS 18n
354 Specifies whether the scan engine is enabled or disabled. Valid values are "on"
355 (enabled) and "off" (disabled). The default is "on" (enabled). A scan engine
356 cannot be enabled if its host property is invalid.
357 .RE
359 .sp
360 .ne 2
361 .na
362 \fB\fBhost\fR\fR
363 .ad
364 .RS 18n
365 Hostname or \fBIPv4\fR format \fBIP\fR address of the scan engine.
366 .RE
368 .sp
369 .ne 2
370 .na
371 \fB\fBport\fR\fR
372 .ad
373 .RS 18n
374 \fBICAP\fR port number of the scan engine. The numeric value ranges from 0 to
375 65535. The default \fBICAP\fR port is 1344.
376 .RE
378 .sp
379 .ne 2
380 .na
381 \fB\fBmax-connection\fR\fR
382 .ad
383 .RS 18n
384 The maximum number of concurrent connections that may be established with a
385 scan engine. The numeric value ranges from 1 to 512. This property defaults to
386 8.
387 .RE
389 .sp
390 .ne 2
391 .na
392 \fB\fBvscanadm show\fR\fR
393 .ad
394 .RS 23n
395 Displays the values of all \fBvscan\fR service general properties and scan
396 engine properties.
397 .RE
399 .sp
400 .ne 2
401 .na
402 \fB\fBvscanadm stats\fR [\fB-z\fR]\fR
403 .ad
404 .RS 23n
405 Displays or resets the following \fBvscan\fR service statistics:
406 .RS +4
407 .TP
408 .ie t \(bu
409 .el o
410 number of files scanned
411 .RE
412 .RS +4
413 .TP
414 .ie t \(bu
415 .el o
416 number of infected files
417 .RE
418 .RS +4
419 .TP
420 .ie t \(bu
421 .el o
422 number of failed scan requests
423 .RE
424 .RS +4
425 .TP
426 .ie t \(bu
427 .el o
428 scan errors (including a per scan engine error count)
429 .RE
430 .sp
431 .ne 2
432 .na
433 \fB\fB-z\fR\fR
434 .ad
435 .RS 6n
436 Resets \fBvscan\fR service statistics counters to zero
437 .RE
439 .RE
441 .SH EXAMPLES
442 .LP
443 \fBExample 1 \fRSetting the Maximum Size Limit
444 .sp
445 .LP
446 To set the maximum size limit for files to be virus scanned to 128 megabytes,
447 enter
449 .sp
450 .in +2
451 .nf
452 # vscanadm set -p max-size=128M
453 .fi
454 .in -2
455 .sp
457 .LP
458 \fBExample 2 \fRAllowing Access to Files
459 .sp
460 .LP
461 To allow access to files exceeding the maximum file size, enter
463 .sp
464 .in +2
465 .nf
466 # vscanadm set -p max-size-action=allow
467 .fi
468 .in -2
469 .sp
471 .LP
472 \fBExample 3 \fRSetting File Types
473 .sp
474 .LP
475 To set the types so that only files of type "odt", "exe" and "jpg" are virus
476 scanned, enter
478 .sp
479 .in +2
480 .nf
481 # vscanadm set -p types=+odt,+exe,+jpg,-*
482 .fi
483 .in -2
484 .sp
486 .sp
487 .LP
488 To set the types so that all file types except "doc" are virus scanned, enter
490 .sp
491 .in +2
492 .nf
493 # vscanadm set -p types=-doc,+*
494 .fi
495 .in -2
496 .sp
498 .LP
499 \fBExample 4 \fRDisplaying the File Types List
500 .sp
501 .LP
502 To display the file types list, enter
504 .sp
505 .in +2
506 .nf
507 # vscanadm get -p types
508 .fi
509 .in -2
510 .sp
512 .LP
513 \fBExample 5 \fRAdding the Scan Engine
514 .sp
515 .LP
516 To add the scan engine "\fBmy_eng\fR" using the default values, enter
518 .sp
519 .in +2
520 .nf
521 # vscanadm add-engine my_eng
522 .fi
523 .in -2
524 .sp
526 .LP
527 \fBExample 6 \fRDisabling the Scan Engine
528 .sp
529 .LP
530 To disable the scan engine "\fBmy_eng\fR", enter
532 .sp
533 .in +2
534 .nf
535 # vscanadm set-engine -p enable=off my_eng
536 .fi
537 .in -2
538 .sp
540 .LP
541 \fBExample 7 \fRDisplaying Scan Engine Properties
542 .sp
543 .LP
544 To display the properties of the scan engine "\fBmy_eng\fR", enter
546 .sp
547 .in +2
548 .nf
549 # vscanadm get-engine my_eng
550 .fi
551 .in -2
552 .sp
554 .LP
555 \fBExample 8 \fRRemoving Scan Engine
556 .sp
557 .LP
558 To remove the scan engine "\fBmy_eng\fR", enter
560 .sp
561 .in +2
562 .nf
563 # vscanadm remove-engine my_eng
564 .fi
565 .in -2
566 .sp
568 .LP
569 \fBExample 9 \fRDisplaying Vscan Service General and Scan Engine Properties
570 .sp
571 .LP
572 To Display all vscan service general properties and scan engine properties,
573 enter
575 .sp
576 .in +2
577 .nf
578 # vscanadm show
579 .fi
580 .in -2
581 .sp
583 .SH EXIT STATUS
584 .sp
585 .LP
586 The following exit values are returned:
587 .sp
588 .ne 2
589 .na
590 \fB\fB0\fR\fR
591 .ad
592 .RS 12n
593 Successful completion.
594 .RE
596 .sp
597 .ne 2
598 .na
599 \fB\fBnon-zero\fR\fR
600 .ad
601 .RS 12n
602 An error occurred.
603 .RE
605 .SH ATTRIBUTES
606 .sp
607 .LP
608 See \fBattributes\fR(5) for descriptions of the following attributes:
609 .sp
611 .sp
612 .TS
613 box;
614 c | c
615 l | l .
616 ATTRIBUTE TYPE ATTRIBUTE VALUE
617 _
618 Interface Stability Uncommitted
619 _
620 Utility output format Not-An-Interface
621 .TE
623 .SH SEE ALSO
624 .sp
625 .LP
626 \fBvscand\fR(1M), \fBzfs\fR(1M), \fBattributes\fR(5), \fBsmf\fR(5)
627 .SH NOTES
628 .sp
629 .LP
630 All users are permitted to use \fBvscanadm\fR to view \fBvscan\fR properties
631 and statistics. To set property values or reset statistics, the following
632 authorizations are required:
633 .sp
634 .ne 2
635 .na
636 \fB\fBsolaris.smf.value.vscan\fR\fR
637 .ad
638 .sp .6
639 .RS 4n
640 change the property values or reset statistics
641 .RE
643 .sp
644 .ne 2
645 .na
646 \fB\fBsolaris.manage.vscan\fR\fR
647 .ad
648 .sp .6
649 .RS 4n
650 refresh the service to apply property value changes
651 .RE
653 .sp
654 .LP
655 To add or remove properties (\fBadd-engine\fR, \fBremove-engine\fR) the
656 following authorizations are required:
657 .sp
658 .ne 2
659 .na
660 \fB\fBsolaris.smf.modify.application\fR\fR
661 .ad
662 .sp .6
663 .RS 4n
664 add or remove property group
665 .RE
667 .sp
668 .ne 2
669 .na
670 \fB\fBsolaris.manage.vscan\fR\fR
671 .ad
672 .sp .6
673 .RS 4n
674 refresh the service to apply property value changes
675 .RE
677 .sp
678 .LP
679 All of these authorizations are included in the "\fBVSCAN\fR Management"
680 profile.