Plesk Premium Antivirus is shipped with Plesk in the form of RPM
packages.
Directory Structure
Root directory: /opt/drweb/
Configuration files:
-
/etc/drweb/is a directory with various configuration files. -
/etc/drweb/drweb32.iniis the default configuration file for drwebd
engine. -
/etc/drweb/drweb_qmail.confis the configuration file for the
qmail-queue filter. -
/etc/drweb/users.confstores the configuration for every mail name for
which antivirus is enabled.
Virus databases: /var/drweb/bases/*vdb
Quarantine directory: /var/drweb/infected/
Log file: /var/drweb/log/drwebd.log
Managing the Antivirus
The Dr.Web service is a standalone drwebd daemon (also called engine),
which is started from the /etc/init.d/drwebd script. You can also stop
and start it again with the following command:
# /etc/init.d/psa stopall
# /etc/init.d/psa start
Note: these commands stop and start other Plesk services: DNS server, mail
server, and so on
You can also manage it within the Services Management page in the
Server Administration Panel.
The interaction with drwebd is established through the Dr.Web client. It
can change antivirus parameters and start checking files. The client
displays a full list of its attributes if run without attributes. Also,
it can extract detailed operational information from the engine. The
following command gives information about the Dr.Web version and virus
database.
# /opt/drweb/drwebdc -sv -sb
By default, the virus databases are updated every 30 minutes by means of
the cron task: /opt/drweb/update/update.pl > dev/null 2>&1
Filtering Mail
Dr.Web substitutes the native qmail-queue filter used for transferring
incoming messages to the qmail queue with its own utility. The utility’s
configuration settings are stored in the /etc/drweb/drweb_handler.conf
file.
Dr.Web filtering is activated on the mail name level. If enabled it can
check incoming, outgoing or both kinds of messages. The information is
stored in the /etc/drweb/users.conf file. The following is an example of
three mail names with different Dr.Web configurations:
# grep domain01 /etc/drweb/users.conf
allow any regex ^[email protected]$
allow to regex ^[email protected]$
allow from regex ^[email protected]$
In the above configuration, Dr.Web will check viruses in:
- Incoming and outgoing messages for
[email protected] - Incoming messages for
[email protected] - Outgoing messages for
[email protected]