CacheGuard OS
User's Guide - Version EH-1.3.7


The Antivirus

The antivirus module blocks all malware coming from the Web so viruses, trojans and worms are all eradicated even before entering into your networks. This module works in forwarding (web) mode as well as in reverse (rweb) mode. In forwarding mode, it rejects all accesses to malware objects while in reverse mode all attempts to upload malware on a protected Web server are blocked. To activate the Antivirus module use the following commands:

The antivirus detects MS Office macro viruses, mobile malware, and other threats. It supports 32/64-bit Portable Executable files and 32-bit ELF files. Additionally, it handles the following files: The antivirus module scans not only simple files but looks inside archive and compression files. The following archive and compression formats are supported: Zip (+ SFX), RAR (+ SFX), Tar, Gzip, Bzip2, MS OLE2, MS Cabinet Files (+ SFX), MS CHM (Compiled HTML), MS SZDD compression format, BinHex, SIS (SymbianOS packages), AutoIt, NSIS.

Automatic Updating

The system periodically checks the malware signature database and if necessary, downloads updates by connecting to your regional servers using HTTP. Updates are downloaded from servers named db.<country-code>.clamav.net where the <country-code> is a two letters country code. To set the regional update server use the following commands: Use the command countrylist to get a list of valid country codes.

The Antivirus & WAF

CacheGuard is a Web gateway that protects against threats coming from the Web. If you implement CacheGuard in front of your Web servers (rweb or reverse mode), the Gateway may act as a WAF (Web Application Firewall) protecting your Web infrastructure against threats coming from the Internet. So when rweb, waf and antivirus are all activated, CacheGuard scans all attempts to upload files onto your Web servers and instantly blocks malware before they can reach Web servers. Note that the only supported method to upload a file is the POST method with an encryption type of multipart/form-data. For security reasons, the PUT method is always rejected by the system.

The Antivirus & MTA

The antivirus is mainly used by the integrated proxy to block malware in Web traffic. But it can also be used as a service offered to an MTA (Mail Transfer Agent). As an example consider that your MTA is located behind the internal interface of your appliance and has the IP address 10.0.10.250. To configure your appliance to provide access to your MTA use the following commands: Now you can configure you MTA to use the appliance as an antivirus service. The antivirus used by this appliance is ClamAV. Please refer to the documentation of your MTA to get help on how to connect it to the antivirus. For instance if your MTA is exim4 you should add the following line to your exim4 configuration file:

av_scanner = clamd: 10.0.10.254 8083

Testing the Antivirus

The European Expert Group for IT Security provides some virus file for testing purpose. You can find these files on the website http://www.eicar.org.