------- MKS_VIR for Linux, FreeBSD, NetBSD, OpenBSD, Solaris8 for i386 ------

File: readme.txt
English language version: 2003.08.19
All comments please send to mkslinux@mks.com.pl

--------- Contents --------

Short changes description.
Where to get mks32.
Where to get licence.
Help.
Error codes.
Options description.
Examples.
E-mail addresses.
Links.

Mks as daemon
Automatic update of anti-virus databases.
E-mail scanning by .procmailrc
How to check mbox
Link to scripts for .procmail
Link to www page : howto integrate mks with amavis and MTA (qmail).


Short changes description.
--------------------------

version: 1.9.2
date:   2003.08.19
	Added unpack for LHA archives.
	Fixed bug with option --quit -Q (if used by mksd).
	Added catch for USR1 signal, treated as --quit option
	  for current file (used by mksd).

version: 1.9.1
date:   2003.07.20

        New options --quit i --exit.
          Option --quit (short -Q)
          after virus is find it quits scan current file
          and check next one.
          Option --exit, after virus is find program mks32 exits.
        Added UPX unpacking.
        Change in memory limit method for option --mem-limit

version: 1.9.0
date:   2003.07.02

        Change in database format, new file bazy4.tgz
        Old format bazy3.tgz will be available until end of 2003/08.

---------- rest of changes in change2.txt (soon)

=======================
-- Where to get mks32 -
=======================

English language page: http://linux.mks.com.pl/index_en.html

You can find it on page (Polish language): http://linux.mks.com.pl/

There are also other packed files,
especialy check mksd (daemon for mks32),
and contributed files in mkslinux-contrib.tgz

=======================
--------- Licence  ----
=======================

Licence in Polish language is in file licencja.txt,
in English you can find it in file licence.txt

=======================
--------- help --------
=======================

mks32 --help
mks32 -h
./mks32 --help
./mks32 -h

If program do not work (for example, there are missing dynamic libraries)
try to use static version:

mks32.static --help
./mks32.static --help

You may also install missing dynamic libs.

mks needs for work anti-virus databases,
they are mks*dat files (the number of files may change in future).

mks will find anti-virus databases on path given in  command line
or in configuration file.

WARNING: path for databases must end with /

Example of configuration file /etc/mks_vir.cfg

# comment
--mks-vir-dat-path=/usr/local/mks/bazy/
# end of file mks_vir.cfg

If there exist file /etc/mks_vir.cfg , then
test for new version of databases
you must give mks32 option -f with new configuration file,
for example:

mks32 -f ./mks.cfg -s test.txt

and in ./mks.cfg give new path to databases.

===================================
--------- Error codes      --------
===================================

mks may bitwise OR error codes during scan,
so for example error code 5 (hexadecimal 0x05) means: 1 + 4
All errors except 128 will be zeroed if you give option  --no-error

0  OK

Virus codes:

1  virus found
2  file was cured and is now clean
4  file deleted

Error codes:

8    0x08  exceeded archive level
64   0x40  error in reading options, program init, or file error

128  0x80  internal or fatal error

=======================
------ mks32 options --
=======================

mks32 actions , must have only one of them:

-s --scan   Only scan, no change in files.
-c --clean  Clean files. (warn: may fails).
-r --rename Change names of infected file.

Other options: 

-Q --quit   If program finds virus in file or archive,
            then it quits scan of this file
            and starts scanning next one.

--exit      If program finds virus in file or archive,
            then it quits scan end exits,
            no next files will be scanned.

-f config_file  Configuration file. Deafult /etc/mks_vir.cfg
                If in system ther is file  /etc/mks_vir.cfg
                then to test mks32 with anti-virus databases
                in new format you must make temporary configuration
                file, for example ./mks32.cfg , with new path
                to anti-virus databases files.
                Lines starting with '#' are comments.
                Configuration file cannot contain filenames to scan.
                One line should contain only one option.
                We advise using long-name options.

-m MKSPATH/  --mks-vir-dat-path=MKSPATH/
             Path to anti-virus database files,
             they are mks*dat files (for example mksbasea.dat)
             Waring: this path must be ended with one slash  '/'
             Example: --mks-vir-dat-path=/usr/local/mks/bazy/

-h --help    Writes help to stderr.
-V --version Writes version and system for witch was compiled.
--copyright  Writes out copyright.

--           End of options in command line.
             All names after "--" will be taken as filenames to scan.

-l FILELIST --list=FILELIST
             File which contain filenames to scan
             They should be relative to root path
             or have starting dot '.'

-S --filelist-on-stdin
             As above, but read filenames from standard input stdin.

-e --email-on-stdin
             Read e-mail from stdin, check it and write to stdout.
             Information about virus write to stderr.
             I advise use only --scan option from action optiosn,
             --cure is not implemented now.
             Note: cure may be given in other tools, check mksfiltr
             or mksscan in mksd documentation.
             (mksd is mks daemon)

-i --file-on-stdin
             Read file from stdin, check it, then write to stdout.

--archive-open=NUMBER
             Set to zero (0) will cause to not checking of archives
             and self-extracting files such as UPX

--no-error   Mask error 128 if it will occure during in scan.
             Will not be masked during init.
	     	
--error-virus-only
             Report only error codes with viruses.
             All errors above 4 will be masked.

--mem-limit=NUMBER[M|K]
             Set memory limit (use may use ulimit instead)
	     M = Megabyte, K = Kilobyte.
             Deafult value set to 32MB.

--filesize-limit=NUMBER[M|K]
             Set file size limit. Default - no limit.

--print-date-with-status
             Write during scanning
             after "mks_vir: " current date and time,
             then rest of line.
	 
Deafults:
scan, 
configuration file /etc/mks_vir.cfg
.dat files in /usr/local/bin
archive deep set to 8
memory limit set to 32MB.

==============================================
--------- Examples  --------
==============================================

All mks*dat files are in current path,
example mks.cfg is in current path,
it contains lines:

# start of mks.cfg
--mks-vir-dat-path=./
# koniec pliku mks.cfg

cat test.eml | mks32 -f ./mks.cfg -s -e 1> out.eml 2> out.log

Report file will be saved in mks.log.
If you want to see on console what happens:

cat test.eml | mks32 -f ./mks.cfg -s -e 1> out.eml

--
Scan file FILENAME in :

mks32 -f ./mks.cfg -s FILENAME

Cure FILENAME:

mks32 -f ./mks.cfg -c FILENAME

--
Scan file in current directory and subdirectories:

find . -type f -print | mks32 -f ./mks.cfg -s -S

The same but using option -l :

find . -type f -print > file-list
mks32 -f ./mks.cfg -s -l file-list 2> mks.log

--
Save report in mks.log file :

find . -type f | mks32 -f ./mks.cfg -s -S 2> mks.log

--
Delete infected attachment in e-mail :

cat email.txt | mks32 -s -e 1> email.out 2> email.err

Note: in mks32 there is not implemented cure of infected attachments.

===============================
--------- e-mail -------
===============================

There are two maillists (most Polish language):
MKS_VIR-LINUX-LIST      binaries of mks for Linux
MKS_VIR-INFO-LINUX      information about mks and files send to LIST

If you want to subscribe to some of above lists, send e-mail to

mkslinux@mks.com.pl

and write which one you want subscribe.
If you do not want to receive these lists, write it
and we remove your address.

All comment send to : mkslinux@mks.com.pl

Sometimes we are not able to reply to every e-mail
but all e-mails are readed.

If you have any problem, please send short description,
give the way to repeat problem on other machine,
version of system, versions of mks32 (and mksd if used),
attach logs from scan,
and if you can, attach one (or few) files on which
we may test problem.

Kamil Konieczny

----------------------
=======================
--------- Links -------
=======================

Main page:
	http://linux.mks.com.pl

Discussion on www:
	http://forum.mks.com.pl/

Script to automate getting new databases from Marcin Marciniak
	(warning: you must edit it to new databases)

Sendmail (libmilter) + amavis-perl + MKS
	 http://goorek.eu.org/sendmail_mks.html .
	 Opis podobnej konfiguracji znalezc mozna rowniez tutaj:
	 http://vega.umcs.lublin.pl/sendmail/amavis.html

Maildir, qmail, vpopmail , mks and mySQL
	 http://www.slubek.top.pl/linux/mks_vpopmail_mikroHOWTO
         Rafal Slubowski      rafal[at]newitech.com

Postfix and mks:
	http://www.arturo.eu.org/mks.html

Amavis and mks:
	http://www.raszyn.pl/~hunter/howto/mks.html

----

Note on Amavis or amavis-perl (Michal Jeczalik):
	/usr/sbin/mks32 -f /etc/mks.cfg -s $TEMPDIR/parts/*

Mks and exim (without amavis and without procmail):
	http://adomas.ng.pl/teksty/exim-mks.html

===================================
--------- automatic update for anti-virus databeses
===================================

See files in mksLinux-contrib.tgz on www page.

Marcin Marciniak wrote:

--- file /root/sprawdz----------
#!/bin/bash
/bin/rm -f /tmp/mks-headers-old >/dev/null 2>&1
/bin/mv /tmp/mks-headers /tmp/mks-headers-old
/usr/bin/lynx -dump -head 
http://mksupdate.mks.com.pl/mkslinux/bazy.tgz | /bin/grep Last-
Modified > /tmp/mks-headers
/usr/bin/diff /tmp/mks-headers /tmp/mks-headers-old | /usr/bin/awk '{print 
"/root/pobierz"}' |  /usr/bin/tail -1 | /bin/sh
------------- end of /root/sprawdz----

----- file /root/pobierz -------
#!/bin/bash
cd /tmp
/usr/local/bin/wget -nd 
http://mksupdate.mks.com.pl/mkslinux/bazy.tgz >> 
/var/log/pobieranie_mksvira
cd /var/mks
# stop qmail
/usr/bin/qmailctl stop >> /var/log/pobieranie_mksvira
sleep 5
#
/bin/tar zxvf /tmp/bazy.tgz >> /var/log/pobieranie_mksvira
/bin/chmod a+r /var/mks/*
# test downloaded files
/usr/local/bin/mks32 /tmp/mks-headers >> /var/log/pobieranie_mksvira
/usr/bin/qmailctl start >> /var/log/pobieranie_mksvira
---- koniec pliku /root/pobierz

Write to cron start of /root/sprawdz

---- additional fix to above letter ----

Modify second script - /root/pobierz
Before line starting wget you should add line:

rm -f /tmp/bazy.tgz >/dev/null 2>&1

Without this change, wget write new file to bazy.tgz.1 
and so on.

===================================
--------- mks i procmail --------
===================================

Example for .procmailrc (thanks to: Rafal Wiosna)

SHELL=/bin/bash
:0 fw
* !^FROM_DAEMON
| /usr/local/mks/mks32.static -c -e -f /usr/local/mks/mks.cfg \
        2>>/var/log/mks_vir.log | \
        formail -a "X-MKS-Scan: <`hostname`> `date -R`"

formail is needed because errorcode will ignore filter.
If you use --no-error, mks32 should always return code 0.

[Warn: what about if virus creates e-mail with FROM_DAEMON field ?]

------- /etc/procmailrc (thanks to: Pawel Femur Wojtal)

If you want to allow users creating their own $HOME/.procmailrc
try this:

:0 f
* !^FROM_DAEMON
| /usr/bin/mks32 -c -e 2>> /var/log/mks_vir.log


===========================================
--- how to check mbox
===========================================

Use following script with formail :

cp mbox mbox.bak
cat mbox | formail -s mks32 -e 1> mbox.out 2> mbox.err
cp mbox.out mbox

WARN: save backup of old mbox
or add integer counter N to backup.

cat mbox mbox.bak.N
cat mbox | formail -s mks32 -e 1> mbox.out.N 2> mbox.err.N
cp mbox.out.N mbox

===========================================
--- links to .procmail ---
===========================================

ftp://ftp.rubyriver.com/pub/jhardin/antispam/procmail-security.html

http://www.impsec.org/email-tools/procmail-security.html

http://www.raszyn.pl/~hunter/howto/mks.html

+++++++++++++++++++++++++++
+++++++++ KONIEC ++++++++++
+++++++++++++++++++++++++++

