ESET FILE SECURITY User Manual

18
ESET File Security
initialization statement, insert the following line:
/sbin/modprobe dazuko
For BSD OS's the line
  /sbin/kldcongdazuko
mustbeinsertedintothe‘/usr/local/etc/rc.d/esets_daemon.sh’script.
Warning! It is extremely important that these steps be executed in the exact order given. If the
kernel module is not located within the kernel modules directory ‘modprobe’ (resp. ‘kldload’ in
BSD OS) the module will not properly load, resulting in system hang-up.
5.3. On-access scanner using preload LIBC library
In previous sections we described the integration of the On-access scanner powered by
Dazuko with Linux/BSD file system services. In this section we would like to point out that the
technique using Dazuko may not be desired by system administrators who maintain critical
systems where:
The source code and/or configuration files related to the currently running kernel are not y
available
The kernel is more monolithic than modular y
The Dazuko module simply does not support the given OS y
In any of these cases, the On-access scanning technique based on the preload LIBC library
should be used. See section 5.3.1 below for detailed information. Please note that this section is
relevant only for Linux OS users and contains information regarding the operation, installation
and configuration of the On-access scanner using the preload library 'libesets_pac.so'.
5.3.1. Operation principle
The On-access scanner libesets_pac.so(ESETSPreloadlibrary-basedleAccessController)isa
shared objects preloaded library which is activated at system start-up. This library is used by
lesystemserversforLIBCcallstootherdevicessuchasFTPserver,Sambaserveretc.Everyle
systemobject is scanned based on customizable le accesseventtypes.The followingevent
types are supported by the current version:
open events
Thisleaccesstypeisactivatediftheword'open'ispresentinthe'event_mask‘parameter
intheeset.cfgle([pac]section).
close events
Thisleaccesstypeisactivatediftheword‘close‘ispresentinthe‘event_mask‘parameterin
theeset.cfgle([pac]section).Inthiscase,allledescriptorandFILEstreamclosefunctionsof
the LIBC are intercepted.
exec events
Thisleaccesstypeisactivatediftheword‘exec‘ispresentinthe‘event_mask‘parameterin
theeset.cfg([pac]section).Inthiscase,allexecfunctionsoftheLIBCareintercepted.Allopened,

ESET FILE SECURITY Specifications

General

Real-time Protection	Yes
Advanced Machine Learning	Yes
Multi-layered Defense	Yes
Ransomware Shield	Yes
Web Control	Yes
Botnet Protection	Yes
Exploit Blocker	Yes
Device Control	Yes
Antivirus	Yes
Antispyware	Yes
Anti-Phishing	Yes
File Server Security	Yes
Cloud-Powered Scanning	Yes
Network Attack Protection	Yes
Two-Way Firewall	No
Anti-Spam	No
Management	ESET PROTECT
Category	Software
Supported Operating Systems	Windows Server
Deployment Options	Remote
System Requirements	1 GHz processor, 512 MB RAM
License	Subscription-based