InterScan VirusWall is available as a download from Trend Micro. UC has a site license. The serial number for the license is IVEF-9997-0258-6837-5455.

InterScan VirusWall locations on DOP Servers

cd /etc/iscan
/usr/local/apache/bin/htpasswd .htpasswd admin

mv /etc/rc2.d/S99IScanHttpd /etc/init.d/IScanHttpd
/etc/init.d/IScanHttpd stop                                                 

                                                             
/etc/init.d/IScanHttpd start

Manual Upgrade of Virus Pattern

1. Go to the local iscan website and note the pattern number under "Pattern Update".
2. Download the latest file from http://www.trendmicro.com/ftp/products/pattern/cpr/
3. Untar it in /etc/iscan

   cd /etc/iscan
   tar -xf /tmp/ptnNN.tar
   

4. Restart the scanner by going to the local iscan website, go to "Turn On/Turn Off", click on "Off" then click on "On".
5. Go to "Pattern Update" and verify that the version number was bumped up.

#!/bin/sh
# Sadly, Trend Micro's update does not work under Solaris 10.
#
# If you use this, update root's crontab to look like:
# #0 * * * * /etc/iscan/prescan.cgi
# 30 * * * *  /bin/csh -c "/usr/local/adm/trendpatternupdate" > /tmp/trendpatt
ernupdate.log 2>&1

# Download the latest pattern tar file
updateURL=`lynx -dump http://www.trendmicro.com/download/viruspattern.asp | gr
ep http://www.trendmicro.com | grep ".tar" | awk '{print $2}'`
cd /tmp
# wget -nv means "turn off verboseness, without being quiet."
wget -nv $updateURL
tarfile=/tmp/`basename $updateURL`

maillog=/tmp/trendpatternupdate_mail.txt
echo "Downloaded $tarfile:" > $maillog
echo "`ls -l $tarfile`" >> $maillog

# Check to what we last updated to.
lastpatternfile=`ls -1tr /etc/iscan/lpt*vpn.[0-9]* | tail -1`
lastpatternnumber=`echo $lastpatternfile | awk '{print substr($0,length($0)-2,
 3)}'`
newpatternnumber=`basename $updateURL | awk '{print substr($0,4,3)}'`

# Only update if we have to
if [ "$lastpatternnumber" = "$newpatternnumber" ]; then
    cat $maillog
    echo "$0: patterns are the same: ($lastpatternnumber == $newpatternnumber)
, no need to restart"
    rm -f $tarfile
    exit
fi

echo "$0: Updating from $lastpatternnumber to $newpatternnumber" >> $maillog

# Untar and restart the daemon
cd /etc/iscan
tar -xf $tarfile
/etc/rc2.d/S99ISmaild stop
sleep 1
shouldBeEmpty=`/bin/ps -ef | grep /etc/iscan/isdelvd | grep -v grep`
if [ "x$shouldBeEmpty" != "x" ]; then
    echo "$0: WARNING: /etc/rc2.d/S99ISmaild stop failed to stop, isdelvd is s
till running" >> $maillog
    echo "$shouldBeEmpty" >> $maillog
fi
/etc/rc2.d/S99ISmaild start

shouldNotBeEmpty=`/bin/ps -ef | grep /etc/iscan/isdelvd | grep -v grep`
if [ "x$shouldNotBeEmpty" = "x" ]; then
    echo "$0: WARNING: /etc/rc2.d/S99ISmaild failed to start, run" >> $maillog
    echo "/etc/rc2.d/S99ISmaild by hand" >> $maillog
fi

echo "Restarted isdelvd:" >> $maillog
echo "$shouldNotBeEmpty" >>  $maillog                                         

/usr/ucb/Mail -s "Trend Pattern Update: `basename $updateURL" root < $maillog
cat $maillog

rm -f $tarfile

InterScan VirusWall Upgrade Instructions

• Don't forget to change the password at https://www.gigascale.org:8443/interscan to www's password
• Edit /etc/iscan/S99ISmaild, changing all instances of "ps" to "/bin/ps".
• Follow the SSL instructions below.
• Restart the IScan httpd daemon
• Don't forget to review the settings and test virus scanning by sending an email with the a test attachment obtainable at http://www.trendmicro.com/vinfo/testfiles.

InterScan VirusWall Installation instructions

1. Go to the Trend Micro DOWNLOAD website and choose "InterScan VirusWall".
2. Download the Solaris version, not the "Solaris - Sendmail version"
3. If prompted, Go to the "Already a customer" box and enter the first 6 characters of the serial number to download the file.
4. Untar the file into /home/tools/viruswall. There is a PDF manual included in the download, which you should read over to plan how to install it. The following notes are what I have done to install it initially on gigascale.
5. The installation script will ask for the full 24-character string serial number to unlock the software.

   IVEF-9997-0258-6837-5455
   

6. As root, run the installation script:
   • % cd /home/tools/viruswall
   • % ./isinst
   • Un-select FTP, HTTP subsystems to install, leaving just Base System, CGI Admin system, and E-Mail system.
   • When prompted, specify the iscan home directory as /export/home/iscan, instead of default /home/iscan.
   • Don't start up on exit of isinst.
7. Edit /etc/iscan/S99ISmaild, changing all instances of "ps" to "/bin/ps".
8. Set up the home directory for the user, iscan:

   % cd /home
   % ln -s /export/home/iscan .
   % cd /home/iscan
   
   % mkdir logs
   % chown iscan.iscan logs
   % mkdir virus
   % chown iscan.iscan virus
   

   Fix iscan's password and home directory:
   • Edit /etc/passwd, changing iscan's home directory from /export/home/iscan to /home/iscan.
   • Edit /etc/shadow and replace the password field for iscan with a copy of the password field for www.
   Fix the SSL certificate for the admin web application:
   • Edit /opt/trend/ISADMIN/IScan.adm/conf/httpd.conf:
     • Comment out the SSLCertificateFile directive, and copy & paste the directive from /usr/local/apache/conf/ssl.conf.
     • Do the same for the SSLCertificateKeyFile directive.
   • Restart the InterScan httpd:

     On Solaris:
         % /etc/rc2.d/S99IScanHttpd stop
         % /etc/rc2.d/S99IScanHttpd start
     On Linux:
         % /etc/init.d/iscanhttpds stop
     
         % /etc/init.d/iscanhttpds start
     

   Bring up the administration web tool at https://www.gigascale.org:8443/interscan.
   • As delivered, the user ID is "admin", and the password is "admin".
   • Click "Change Password" and change the password to match www's password.
   • Click "Configuration" in the left margin.
   • Check the box by "E-Mail Scan" to enable it.
   • Click the "Configuration" button by "E-Mail Scan".
   • Select the "Daemon mode" radio button, instead of "Command mode". Leave port number as 10025.
   • Change "Email scan log file location" to "/home/iscan/logs/log".
   • In the "Notifications:" subsection, uncheck "Warning to recipients" and "Warning to sender"
   • In the "Action on Viruses:" subsection, change "Quarantine Directory:" setting to "/home/iscan/virus".
   • In the "Miscellaneous" subsection, change the "Temporary directory location" to "/export/home1/tmp".
   • Select "Source relay check:" so as to avoid Open Relay problems.
   • Leave the rest of the page w/ default settings.
   • Click "Apply" at the bottom.
   • Go back to the "E-Mail Scan" Configuration page, and click "Additional Email Options" button.
   • Change local domain to "localhost #127.0.0.1 #128.32.48.209 #128.32.48.160 #128.32.48.161 gigascale.eecs.berkeley.edu gigascale.org chess.eecs.berkeley.edu embedded.eecs.berkeley.edu"
   • Click "Apply" at the bottom.
   • Click "Administration" link in left margin. Change both log file locations to "/home/iscan/logs/log". Click "Apply".
   • Click "Turn On/Off" in the left margin, and click the "On" button.
   Restart sendmail:

   On Solaris:
       % /etc/rc2.d/S88sendmail stop
       % /etc/rc2.d/S88sendmail start
   On Linux:
       % /etc/init.d/sendmail stop
       % /etc/init.d/sendmail start
   

   Test virus scanning by sending an email with the a test attachment obtainable at http://www.trendmicro.com/vinfo/testfiles.
   If you send a test virus, you will likely need to turn off virus checking on the sending machine.
   Also, carefully check the headers of the email message and the virus log on the server to be sure that relay.eecs is not intercepting the virus before it gets to gigascale
   You can also try pasting the following uuencoded version of eicar.com into a message

   begin 755 eicar.com.uu
   M6#5/(5 E0$%06S1<4%I8-30H4%XI-T-#*3=])$5)0T%2+5-404Y$05)$+4%.
   95$E625)54RU415-4+49)3$4A)$@K2"H-"C=]
   
   end
   

Relay Issues

In mh on doppler, I needed to edit /opt/nmh-1.0.4/etc/mts.conf

# List of smtp servers to try if using smtp support
servers: localhost

 chylands at yahoo.com: post: unexpected response; [RPLY] 554 <>... Relay operation rejected
send: message not delivered to anyone

Another thing to try would be the smart server entry in sendmail.cf

Mail -v postmaster

cxh@bennett 33% Mail -v postmaster
Subject: A test to postmaster
Body Message
.
EOT
cxh@bennett 34% postmaster... Connecting to [127.0.0.1] via relay...
220-InterScan Version 3.81-Build_1098 $Date: 11/24/2005 15:38:0005$: Ready
220 bennett.EECS.Berkeley.EDU ESMTP Sendmail 8.13.6/8.12.9; Wed, 17 Dec 200
8 11:16:40 -0800 (PST)
>>> EHLO bennett.EECS.Berkeley.EDU
250-bennett.EECS.Berkeley.EDU Hello localhost [127.0.0.1], pleased to meet 
you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-DELIVERBY
250 HELP
>>> VERB
250 2.0.0 Verbose mode
>>> MAIL From: SIZE=78
250 2.1.0 ... Sender ok
>>> RCPT To:
>>> DATA
050 ... aliased to root
503 Need RCPT (recipient)
050 root... aliased to cxh@eecs.berkeley.edu, marys@eecs.berkeley.edu
250 2.1.5 ... Recipient ok
>>> RSET
250 2.0.0 Reset state
/home/eecs/cxh/dead.letter... Saved message in /home/eecs/cxh/dead.letter
Closing connection to [127.0.0.1]
>>> QUIT
221 2.0.0 bennett.EECS.Berkeley.EDU closing connection

12/17/2008 11:16:40 smtp[11790]: smtp[133]: << 503 Need RCPT (recipient)(By ISUX)

503 Need MAIL before RCPT
(By ISUX)
orcpt=
ORCPT anti-relay skipped - [
check rcpt:
orcpt=
ORCPT anti-relay skipped -- [
554 <
>... Relay operation rejected
original server timeout/disconnect while waiting RCPT command response.
RCPT command Response (
): Not add recipient address(
) in the list.
rset
helo