F-Secure Policy Manager; Integrity Checking - F-SECURE ANTI-VIRUS LINUX SERVER SECURITY Administrator's Manual

E.2

F-Secure Policy Manager

E.3

Integrity Checking

Q. How can I use F-Secure Linux Server Security with F-Secure
Policy Manager 6.0x for Linux?
A. F-Secure Policy Manager Server has to be configured to retrieve new
riskware and spyware databases for the product.
Note that these instructions apply to F-Secure Policy Manager Server
6.0x for Linux only, the product is not compatible with other Linux or
Windows F-Secure Policy Manager Server versions.
Add a line to the /etc/opt/f-secure/fspms/fspms-fsauasc.conf file by
running this command:
echo "avpe=republish" >> /etc/opt/f-secure/fspms/
fspms-fsauasc.conf
Q. Symlinks are not working for Integrity Checking or Rootkit
Protection, what can I do?
A. You may be denied to load a kernel module if the file containing the
kernel module is a symlink and the real file where the symlink points
to is not in the Integrity Checking baseline. The same applies if
modprobe or insmod utilities (the module loaders) use files or libraries
which are symlinks and the file where the symlink points to is not in
the baseline.
For example, modprobe uses /lib/libz.so.1, which is really a symlink to
a real file /lib/libz.so.1.2.2. The symlink is in the baseline but the real
file is not. In this case, modprobe is not allowed to run as it tried to
open a file that is not in the baseline.
You should never add only symlinks to the baseline, you should
always add both the symlink and the real file where the symlink
points.
CHAPTER E
Troubleshooting
95