C-icap-modules-0.2.x Configuration Reference
Modules/Subsystems
Configuration parameters
Description: This is an antivirus services which uses the open source
clamav antivirus.
This module add the following log formating codes for use with
the LogFormat configuration parameter:
%{virus_scan:virus}Sa Prints the virus name or "-".
%{virus_scan:action}Sa Prints "passed" if the object scanned and no
virus found, "blocked" if a virus found and
object blocked, and "partiallyblocked" if a
virus found but some of the data transmitted
to the user.
Example:
LogFormat myVScanFmt "%tl, %>a %is %Ib %Ob %huo [Action: %{virus_scan:action}Sa] [Virus: %{virus_scan:virus}Sa]"
acl VSCAN service virus_scan
AccessLog /var/log/c-icap-access-vscan.log myVScanFmt VSCAN
The following additional formatting codes can be used with the service
templates (the VIRUS_FOUND, VIR_MODE_HEAD, VIR_MODE_PROGRESS,
VIR_MODE_TAIL and VIR_MODE_VIRUS_FOUND templates exist under the c-icap
templates directory):
%VVN The virus name.
%VVV The clamav Antivirus name/version.
%VU The HTTP url.
%VFR The downloaded file requested name. For use with virelator mode.
%VFS Expected http body data size (Content-Length header). For use
with virelator mode.
%VF The name of the local file where the data stored. For use with
with virelator mode.
%VHS An HTTP URL to get stored object. For use with virelator mode.
See also the VirHTTPUrl configuration parameter.
%VPR Profile name (Exist only if virus_scan profiles are enabled).
Description: This is an URL blacklist/whitelist icap service
This module add the following log formating codes for use with
the LogFormat configuration parameter:
%{url_check:matched_cat}Sa Print all matched url categories
%{url_check:action}Sa The service decision for requested url:
MATCHED, BLOCKED or ALLOWED
%{url_check:action_cat}Sa Print the categories for which the
decision taken
Example:
LogFormat myUrlCheck "%tl, %>a %im %is %huo [MatchedCat: %{url_check:matched_cat}Sa] [Action4cat: %{url_check:action_cat}Sa] [Action: %{url_check:action}Sa]"
acl URLCHECK service srv_url_check
AccessLog /var/log/c-icap-access-url_check.log myUrlCheck URLCHECK
The following additional formatting codes can be used with the
service template "DENY":
%UU The HTTP url
%UH The HTTP host
%UM The matched Categories
%UB The blocked category
Example: Service url_check_module srv_url_check.so
Configuration parameters description
- virus_scan.ScanFileTypes
-
Format:
virus_scan.ScanFileTypes type1 [type2] ...
Description: the list of file types or groups of file types which will be
scanned for viruses. For supported types look in c-icap.magic
configuration file.
Default: None set.
- virus_scan.SendPercentData
-
Format:
virus_scan.SendPercentData percent
Description: the percentage of data that can be sent by the c-icap server
before receiving the complete body of a request.
This feature in conjuction with the folowing can be usefull
becouse if the download of the object takes a lot of time
the connection of web client to proxy can be expired.
It must be noticed that the data which delivered to the
web client maybe contains a virus or a part of a virus
and can be dangerous. In the other hand partial data
(for example 5% data of a zip or an exe file) in most
cases can not be used.
Set it to 0 to disable this feature.
Default: virus_scan.SendPercentData 0
- virus_scan.StartSendPercentDataAfter
-
Format:
virus_scan.StartSendPercentDataAfter bytes
Description: Only if the object is bigger than size then the percentage
of data which defined by SendPercentData sent by the c-icap
server before receiving the complete body of request.
Default: virus_scan.StartSendPercentDataAfter 0
- virus_scan.Allow204Responces
-
Format:
virus_scan.Allow204Responces on|off
Description: Disable 204 responces outside previews for virus_scan if
your icap client does not support it.
Default: virus_scan.Allow204Responces on
- virus_scan.MaxObjectSize
-
Format:
virus_scan.MaxObjectSize Bytes
Description: The maximum size of files which will be scanned by
clamav.You can use K and M indicators to define size
in kilobytes or megabytes.
Default: virus_scan.MaxObjectSize 5M
- virus_scan.UseClamd
-
Format:
virus_scan.UseClamd on|off
Description: Whether to use clamd or not
Default: virus_scan.UseClamd off
- virus_scan.ClamdSocket
-
Format:
virus_scan.ClamdSocket path
Description: The path of the clamd socket to use
Default: virus_scan.ClamdSocket /var/run/clamav/clamd.ctl
- virus_scan.ClamAvTmpDir
-
Format:
virus_scan.ClamAvTmpDir path
Description: clamav's temporary directory.
Default: virus_scan.ClamAvTmpDir /var/tmp
- virus_scan.ClamAvMaxFilesInArchive
-
Format:
virus_scan.ClamAvMaxFilesInArchive Num
Description: Sets the maximum number of files in archive. Used
by clamav library. Set it to 0 to disable it.
Default: virus_scan.ClamAvMaxFilesInArchive 0
- virus_scan.ClamAvMaxFileSizeInArchive
-
Format:
virus_scan.ClamAvMaxFileSizeInArchive Bytes
Description: Sets the maximal archived file size. Used by clamav
library. Set it to 0 to disable it.
Default: virus_scan.ClamAvMaxFileSizeInArchive 100M
- virus_scan.ClamAvMaxScanSize
-
Format:
virus_scan.ClamAvMaxScanSize Bytes
Description: Sets the maximum amount of data to be scanned for each input
file. Used by clamav library. Set it to 0 to disable it.
Default: virus_scan.ClamAvMaxScanSize 100M
- virus_scan.ClamAvMaxRecLevel
-
Format:
virus_scan.ClamAvMaxRecLevel level
Description: The maximal recursion level. Used by clamav library.
Set it to 0 to disable it.
Default: virus_scan.ClamAvMaxRecLevel 5
- virus_scan.VirSaveDir
-
Format:
virus_scan.VirSaveDir path
Description: The directory where the downloaded files stored.
Must be a directory where a web server has access.
Default: No set
Example: virus_scan.VirSaveDir /srv/www/htdocs/downloads/
- virus_scan.VirHTTPUrl
-
Format:
virus_scan.VirHTTPUrl URL
Description: The url which used by the web client to retrieve
downloaded file. The file where the download stored
can has diferent name than the original, if a file
with the same name exists in the directory. In the
url the "%f" can be used to specify the real name
of downloaded file.
You can use the small cgi program "get_file.pl"
which exists in contrib directory of c-icap-modules
distribution.
Default: No set
Example: virus_scan.VirHTTPUrl "http://fortune/cgi-bin/get_file.pl?usename=%f&remove=1&file="
- virus_scan.VirUpdateTime
-
Format:
virus_scan.VirUpdateTime seconds
Description: The secs is the interval between the "progress of download"
messages in seconds.
Default: virus_scan.VirUpdateTime 15
- virus_scan.VirScanFileTypes
-
Format:
virus_scan.VirScanFileTypes type1 type2 ...
Description: The list of file types and groups of file types,
for which this mode must be used.
Default: None set
Example: virus_scan.VirScanFileTypes ARCHIVE EXECUTABLE
- url_check.EarlyResponses
-
Format:
url_check.EarlyResponses on|off
Description: Set it to off if your ICAP client does not support early responses.
Should not required to touch this parameter.
Default: url_check.EarlyResponses on
Example: url_check.EarlyResponses off
- url_check.LookupTableDB
-
Format:
url_check.LookupTableDB DBName type lookup_table_path
Description: DBName is a a name for this database
type can be one of the following:
host: defines a hostnames database. Matches if the hostname
exist in ths database.
url: defines a URL's database. Matches if a part of the
http url exist in this database. WARNING: The url arguments
are not included in search
For example the www.site.com/to/path/page.html?arg1&arg2
matches if any of the following exist in this database:
www.site.com/to/path/page.html
www.site.com/to/path/
www.site.com/to/
www.site.com/
site.com/to/path/page.html
site.com/to/path/
site.com/to/
site.com/
com/to/path/page.html
com/to/path/
com/to/
com/www.site.com/to/path/page.html
www.site.com/to/path/
www.site.com/to/
www.site.com/
site.com/to/path/page.html
site.com/to/path/
site.com/to/
site.com/
com/to/path/page.html
com/to/path/
com/to/
com/
full_url: it defines a URL's database. This type of url databases
includes url arguments while searching in the database.
It does the same checks with the "url" databases plus
the checks including the arguments:
www.site.com/to/path/page.html?arg1&arg2
site.com/to/path/page.html?arg1&arg2
com/to/path/page.html?arg1&arg2
Default:
- url_check.LoadSquidGuardDB
-
Format:
url_check.LoadSquidGuardDB DBName SquidGuardDBPath
Description: Defines a squidGuard database. A such database normaly contains
one domain and one urls database, and checked with the same way
the squidGuard use it.
DBName is the database name
SquidGuardDBPath is the path of the database.
Default: None set
Example: url_check.LoadSquidGuardDB porn /usr/local/blacklists-toulouse/porn/
- url_check.Profile
-
Format:
url_check.Profile ProfileName pass|block DBName[{subcat1, subcat2, ...}]|ALL
Description: It is used to define policy profiles. The use of "default" as
ProfileName is reserved and defines a default policy for all
requests for which no profile defined
Default: None set
Example: url_check.Profile BlockPorn block porn
url_check.Profile default block multisurbl{127.0.0.126}
url_check.Profile default pass ALL
- url_check.ProfileAccess
-
Format:
url_check.ProfileAccess ProfileName [!]acl1 ...
Description: It is used to select policy profile to apply based on acls
Default: None set
Example: acl Foo group foo
url_check.ProfileAccess BlockPorn Foo