User manual KERIO TECHNOLOGIES WINROUTE FIREWALL 6 ADMINISTRATOR S GUIDE

[. . . ] Kerio WinRoute Firewall 6 Administrator's Guide Kerio Technologies s. This guide provides detailed description on configuration and administration of Kerio WinRoute Firewall, version 6. 6. 0. User interfaces Kerio StaR and Kerio Clientless SSL-VPN are focused in a standalone document, Kerio WinRoute Firewall -- User's Guide. The Kerio VPN Client application is described in a stand-alone document Kerio VPN Client -- User's Guide. [. . . ] This means that the client receives an incomplete (damaged) file which cannot be executed so that the virus cannot be activated. If no virus is found, WinRoute sends the client the rest of the file and the transmission is completed successfully. Optionally, a warning message informing about a virus detected can be sent to the user who tried to download the file (see the Notify user by email option). The purpose of the antivirus check is only to detect infected files, it is not possible to heal them!If the antivirus check is disabled in HTTP and FTP filtering rules, objects and files matching corresponding rules are not checked. Full functionality of HTTP scanning is not guaranteed if any non-standard extensions to web browsers (e. g. download managers, accelerators, etc. ) are used! 2. 3. 172 13. 3 HTTP and FTP scanning To set parameters of HTTP and FTP antivirus check, open the HTTP, FTP scanning tab in Configuration Content Filtering Antivirus. Figure 13. 7 Settings for HTTP and FTP scanning Use the If a virus is found. . . entry to specify actions to be taken whenever a virus is detected in a transmitted file: · Move the file to quarantine -- the file will be saved in a special directory on the WinRoute host. WinRoute administrators can later try to heal the file using an antivirus program and if the file is recovered successfully, the administrator can provide it to the user who attempted to download it. The quarantine subdirectory under the WinRoute directory is used for the quarantine (the typical path is C:\Program Files\Kerio\WinRoute Firewall\quarantine) Infected files (files which are suspected of being infected) are saved into this directory with names which are generated automatically. Name of each file includes information about protocol, date, time and connection number used for the transmission. 173 Chapter 13 Antivirus control Warning When handling files in the quarantine directory, please consider carefully each action you take, otherwise a virus might be activated and the WinRoute host could be attacked by the virus!· Alert the client -- WinRoute alerts the user who attempted to download the file by an email message warning that a virus was detected and download was stopped for security reasons. WinRoute sends alert messages under the following circumstances: The user is authenticated and connected to the firewall, a valid email address is set in a corresponding user account (see chapter 15. 1) and the SMTP server used for mail sending is configured correctly (refer to chapter 18. 3). Note: Regardless of the fact whether the Alert the client option is used, alerts can be sent to specified addresses (e. g. In the If the transferred file cannot be scanned section, actions to be taken when the antivirus check cannot be applied to a file (e. g. the file is compressed and password-protected, damaged, etc. ): · Deny transmission of the file -- WinRoute will consider these files as infected and deny their transmission. Hint It is recommended to combine this option with the Move the file to quarantine function -- the WinRoute administrator can extract the file and perform manual antivirus check in response to user requests. · Allow the file to be transferred -- WinRoute will treat compressed password-protected files and damaged files as trustful (not infected). However, it can be helpful for example when users attempt to transmit big volume of compressed password-protected files and the antivirus is installed on the workstations. HTTP and FTP scanning rules These rules specify when antivirus check will be applied. By default (if no rule is defined), all objects transmitted by HTTP and FTP are scanned. WinRoute contains a set of predefined rules for HTTP and FTP scanning. By default, all executable files as well as all Microsoft Office files are scanned. [. . . ] On Windows, routing table can be printed by the route print command, while on Unix systems (Linux, Mac OS X, etc. ) by the route command. However, they can be misused for ads, exploiting of user information, etc. Modern Web browsers usually support several script languages, such as JavaScript and Visual Basic Script (VBScript). SMTP Simple Mail Transfer Protocol is used for sending email between mail servers. [. . . ]