4.1.2. Procedure – ZCV — Configuring the zorp-utils package

Purpose: 

If you are installing ZCV, then configure the zavupdate tool that updates the databases of the virus filtering engines:

Steps: 

1. FTP proxy: The zavupdate application can download database updates through FTP or HTTP. Enter the URL of the FTP proxy to be used (or NONE if the updates can be downloaded directly without using a proxy server).

   

   Figure 4.3. Configuring zorp-utils - Configuring the FTP proxy for database updates

2. HTTP proxy: The zavupdate application can download database updates through FTP or HTTP. Type the URL of the HTTP proxy to be used (or NONE if the updates can be downloaded directly without using a proxy server).

   

   Figure 4.4. Configuring zorp-utils - Configuring the HTTP proxy for database updates

3. Send update logs in email: zavupdate can send the logs of the periodic antivirus (AV) update to the administrator through email. Type the address of the administrator and the subject to be used in these emails. If you do not want email notifications, enter NONE.

   

   Figure 4.5. Configuring zorp-utils - Specifying the administrator's email address

   Note
   It is not advised to use a personal email address. Instead, use an address of a shared folder that can be accessible to whom it belongs. It can also be the address of a mailing list. In this way, more than one administrator can be notified at the same time, and the archive of the messages can be accessed by more than one administrator.

4. Specifying email prefix: zavupdate can add a prefix to the subject of the emails it sends to make sorting the messages easier for the administrator. Type a prefix (for example the name of the host in square brackets), or leave these fields blank. You can use command subtitution using backticks (`) to include the output of any Linux shell command in the subject. This command will be run before sending the email and the output of the command will be the prefix of the email.

   Note

   This setting can only be changed manually later. Therefore, make sure that you enter a value that you will not want to change. As a best practice, use a command rather than a fixed name. A command will dynamically follow the changes to your infrastructure, however, a fixed name will not. For example, if you use the name of the host myhost1 and later you rename your host myhost2, you will still be receiving emails with the myhost1 prefix and that can be confusing.

   

   Figure 4.6. Configuring zorp-utils - Specifying a prefix for the administrator's email messages

   In practice, it can be used in your mail client (or on the mail server) to move these mails (with the given prefix) automatically to a subfolder in the inbox. Also, it can be used to differentiate between emails originating from several firewalls. This can be especially useful if, for example, you have several firewalls and you want to easily identify the firewall that had an unsuccessful update.

   Example 4.1.
   For example, if you use hostname --long as prefix, you can later determine the exact origin of the message from the prefix, because it will display the Fully Qualified Domain Name (FQDN) of the host.

   Note
   If you want to change this setting later, you can reconfigure zorp-utils with the following terminal command: dpkg-reconfigure zorp-utils

5. Verbosity level of zavupdate: Select the level of verbosity of zavupdate.

   First the zavupdate options are displayed:

   

   Figure 4.7. Configuring zorp-utils - Configuring the verbosity of zavupdate — options

   Each level includes the logs of the levels above, for example, Verbose logging will include all errors and successful update messages too.

   • No logging: logging is disabled

   • Errors only: only error messages are logged

   • Normal logging: error messages and successful updates are logged

   • Verbose logging: detailed logging

   • Everything: everything is logged, including the output of the update programs of ClamAV and/or NOD32

   Then you can select the actual log level:

   

   Figure 4.8. Configuring zorp-utils - Configuring the verbosity of zavupdate log level

6. Specify the firewall's Balasys Support System technical account username and password to enable the firewall to access the Zorp repository and to download the updates.

   

   Figure 4.9. Configuring zorp-utils - Specifying the user name for the technical uer to access Zorp repository

   

   Figure 4.10. Configuring zorp-utils - Specifying the technical user’s password to access Zorp repository

7. Configuring zavupdate: Specify the actual minutes when the zavupdate process shall start in every hour. In case the necessary licenses are also purchased for the URL filter database, the upgrade for the URL database will also be performed as part of the zavupgade process. The upgrade for the URL filter database though will be performed only in the hours being specified in the next step.

   

   Figure 4.11. Configuring zavupdate - Specifying the actual minutes for the zavupdate process to start

8. Specify the timing for the URL filter database: Specify the actual hours when the upgrade of the URL filter database shall take place. Provide the actual hours for the time of the upgrade.

   

   Figure 4.12. Specifying the exact time for the upgrade

9. Fill in this field only if it is required. (optional step)

   In specific cases, based on an agreement between Balasys and the customer, the customer has a mirror URL filtering database. The location of this mirror database can be specified here.

   In any other cases, please leave this field empty or add the value NONE.

   

   Figure 4.13. Configuring zorp-utils - Updating URL filtering database

10. Choose the size of the URL filter database.

    At this stage, the administrator can choose the size of the URL filtering database. The database can be a smaller-sized, optimized database (the recommended version) for usual scenarios, which requires 1 GB storage space and 300 MB daily update traffic, or a normal database for more extensive scenarios, which requires 6 GB storage space and 2 GB daily update traffic. If there are no specific needs, we recommend to choose the optimized database.

    

    Figure 4.14. Configuring zorp-utils - Selecting the size of the URL filtering database