/*
 * -------------------------------------------------------------
 *
 *   Samba VFS SpIDer configuration file description
 *
 *  $Revision: 1.50 $
 *
 * -------------------------------------------------------------
 */

    Configuration file is an ordinary text file with the following rules:

[Section 1 name]
Parameter1 = volume
.....
ParameterN = volume

.....

[Section X name]
Parameter1 = volume
.....
ParameterY = volume

The parameters will be described in the following way:

---
parameter_name = parameter_type (default_value or 'absent')

parameter description
---

All the parameters may be of the following four types:
- string parameters (STRING), and here paths, names, actions etc. 
- list of strings parameters (STRING_LIST), these are strings separated by ","
- numeric ones (COUNT), these are signless numbers from 0 to 2^31 - 1,
- octal ones (OCTAL), these are numbers in octal representation
- Boolean ones (BOOL), these variables may have such values as:
     yes, on, true - to enable,
     no, off, false - to disable the option set by this parameter,
  any of the adduced variants possible, letter case is not taken into account.
- address specification (ADDRESS), these variables may correspond to the 
  following : TYPE:TRANSPORT_ADDRESS
  Admissible the following types:
      inet - TCP sockets used, than TRANSPORT_ADDRESS has the following :
             PORT@HOST_NAME
             HOST_NAME may be either direct IP address, or host domain name.
             Example:
               Address = local:/var/drweb/ipc/.agent
      local - local UNIX sockets used, than TRANSPORT_ADDRESS 
             is a mere path to the socket file.
             Example:
               Address = local:/opt/drweb/run/.drweb-agent
- list of addresses specifications (ADDRESS_LIST)

Now let's stop at the options that may be specified. 


    In the [DaemonCommunication] section the parameters regarding the
.filter-daemon interaction are described.

Address = ADDRESS_LIST (absent)

This parameter specifies daemon transport address to which the filter will
give out scanning jobs. One more type of addresses is available for this
parameter:
   pid - shows that the real address must be read from the daemons pid file.
         Example:
           Address = pid:/opt/drweb/run/drwebd.pid
   Example of some addresses:
     Address = pid:/opt/drweb/run/drwebd.pid, inet:3000@srv2.example.com

Cache = BOOL (on)

This option may be used only if TCP sockets are utilized to provide the
connection with the daemon. If it is enabled (yes, on, true) and the daemon
host address is a domain name, than its IP will be requested only once (at
the filer start) and this very IP will be used in future; if the option is
disabled, IP will get ascertained at every request (which is quite a
slow-speed operation).

Timeout = COUNT (0)

This option specifies the timeout (in seconds) value for the whole handling 
session of an object. If the daemon failed to give answer within the
timeout period, than the action specified by ProcessingErrors option is
undertaken (see below). 0 value corresponds to infinite timeout.

UseTcpNodelay = BOOL (no)

This option set\unset option TCP_NODELAY for connection with daemon.
Do not set this option if you have not network problem.


    In the [Scanning] section the scanning process parameters are described.

HeuristicAnalysis = BOOL (on)

Enable/disable heuristic analyser to detect unknown viruses, although it
makes possible false alarms.

StripPath = COUNT (0)

Strip the smallest prefix containing StripPath leading shashes from each 
path passed to scanning.  A  sequence  of one or more adjacent slashes is 
counted as a single slash.  
NOTE: Option works same the -p parameter in patch utility (man patch) 
NOTE: See alse example after PrefixPath description.
EXAMPLE: path = /some/path/to/file.ext
         StripPath = 1 -> path = some/path/to/file.ext
         StripPath = 2 -> path = path/to/file.ext

PrefixPath = STRING (absent)

Path that prefixes scan paths. Works after path modification by StripPrefix 
option. It's option usefull for collaboration chrooted MTA or Samba and 
non-chrooted (or chrooted to another root) DrWeb Daemon. 
ATTENTION: PrefixPath must not ends by slash.
EXAMPLE: path = /some/path/to/file.ext
         PrefixPath = /my/prefix -> path = /my/prefix/some/path/to/file.ext

EXAMPLE: Full path conversion
  StripPath = 3
  PrefixPath = /jail
Source path received by SpIDer: spool/file.ext
1. After expanding to full path : /mnt/smb/spool/file.ext
2. After processing StripPath : spool/file.ext
3. After processing PrefixPath : /jail/spool/file.ext
DrWeb Daemon will be scan path : /jail/spool/file.ext

MaxFileSizeToScan = COUNT (0)

Max size of file (in Kbytes) will been scanned, if 0 all files will been 
scanned. If you set value differs from 0, you decrease level of defense, but
this option can be usefull.

ScanMode = STRING (onAccess)

Scanning mode one of:
* onAccess (alias for old onReadWrite, that acceptable too) - files will been 
  scanned always on openning (open, run) and on closing (create, modify)
* onRead - files will been scanned on openning only (open, run). More optimal
  (by speed) that onAccess, but infection is possible, because infected file
  can be wrotten to share, and executed by user that has local access to share
  (not thru smbfs).
* onWrite - files will been scanned on closing only if file was modified, 
  to avoid virus infection share already must be clear (scanned and cured), 
  but virus infection still possible - local user can put infected file on 
  Samba share if he has local access (not thru smbfs). Very fast mode.

   In the [Actions] section the actions the filter undertakes in different
cases are described.

LicenseLimit = STRING (pass)

The action taken if an object was not checked by license limitations.
Actions:
pass - allow access to such files 
reject - block operations with such a files 

Infected = STRING (quarantine)

Action taken against a found infected file. 
Possible actions: 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 
cure - try to cure an infected file 

Suspicious = STRING (quarantine)

Action taken against a found suspicious file - a possible new virus.
Possible actions : 
pass - allow access to such files 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 

Incurable = STRING (quarantine)

Action taken for incurable files. 
Possible actions: 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 

Adware = STRING (quarantine)

Action taken against a found advertizing software also known as AdWare.
Possible actions : 
pass - allow access to such files 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 

Dialers = STRING (quarantine)

Action taken against a found dialer program.
Possible actions : 
pass - allow access to such files 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 

Jokes = STRING (quarantine)

Action taken against a found joke program also known as hoax.
Possible actions : 
pass - allow access to such files 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 

Riskware = STRING (quarantine)

Action taken against a found potentially dangerous software.
Possible actions : 
pass - allow access to such files 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 

Hacktools = STRING (quarantine)

Action taken against a found intrusion tool also known as hacktool.
Possible actions : 
pass - allow access to such files 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 

Archives = STRING (reject)

Action taken for archives (including MAIL, HTML, POWERPOINT, etc pseudo
archives) that contains infected file(s). To enable deletion such archives
please add "EnableDeleteArchiveAction = yes" to daemon section in /etc/drweb/drweb32.ini.
Possible actions: 
reject - block operations with such a files 
discard - delete such a files 
rename - block operations and rename such a files 
quarantine - move to "quarantine" such a files 

SkipObject = STRING (reject)

The action taken if an object which cannot be checked by the antivirus
daemon is found in the file (e.g., a passworded archive or scanning has been 
aborted by timeout). 
Possible actions: 
pass - allow access to such files 
reject - block operations with such a files 

ArchiveRestriction = STRING (reject)

The action taken against an object found in the file which cannot be
checked by the antivirus daemon because its compression rate (or the
embedded file) exceeds the maximum compression rate specified in the
daemons configuration file (see MaxCompressionRatio, MaxFileSizeToExtract and
MaxArchiveLevel in /etc/drweb/drweb32.ini). 
Possible actions: 
pass - allow access to such files 
reject - block operations with such a files 

ScanningErrors = STRING (reject)

The action taken if any errors occurred during the file processing by
the daemon (e.g. memory shortage or no rights to access the file).
Possible actions: 
pass - allow access to such files 
reject - block operations with such a files 

ProcessingErrors = STRING (reject)

The action taken if any errors occurred during the file processing by
the filter (e.g. memory shortage or could not stablish connection with the
daemon). 
Possible actions: 
pass - allow access to such files 
reject - block operations with such a files 

SendNotifyToUser = BOOL (off)

To inform or not to inform the user that a virus has been found in the file.
Windows Messenger service (aka WinPopup) is used for notifications.

SendNotifyToAdmin = BOOL (off)

To inform or not to inform the administrator that a virus has been found in 
user file. Windows Messenger service (aka WinPopup) is used for notifications. 
Notification would be sent to host with address AdminAddress (see below).

NOTE: To notify unix workstation you can use LinPopup (for Linux) or add to smb.conf:
message command = /usr/bin/mail -s Messages from %f on %m' {address} < %s ; rm %s
where {address} is a destination e-mail address for notifications.

AdminAddress = STRING (absent)

Address of administrator host. Address is used to inform administrator about
scanning events. 
NOTE: Currently only IP address notation is allowed.

ShellScriptForBlockedFile = STRING (absent)

Path to shell script has been ran for blocked files. SpIDer pass to script 
following parameters:
* FileName - name of blocked file
* UserName - login name of user that access to blocked file
* UserHost - hostname or IP of user that access to blocked file

'    In the [Logging] section the parameters of outputting the information
on filter operating are described.

Level = STRING (Quiet)

Set the detalization level of the output information. Currently available next 
values: Quiet, Errors, Alerts, Info, Verbose, Debug. Operational information 
will be output with SyslogPriority priority and SyslogFacility facility.

SyslogFacility = STRING (Daemon)

Logging type if syslogd system service is used. Available values: Daemon, Mail, 
Local0 .. Local7

SyslogPriority = STRING (Info)

Logging priority if syslogd system service is used. Available values: Debug, 
Info, Notice, Alert.

