Black-List And White-List - ESET GATEWAY SECURITY Installation Manual

ESETS configuration file. The section is as follows:
[http]
agent_enabled = yes
listen_addr = "192.168.1.10"
listen_port = 8080
action_av = "scan"
In order to provide individual parameters setting one has to define 'user_config' parameter
with the path to the special configuration file where the individual setting will be stored. In the
next example we create reference to the special configuration file 'esets_http_spec.cfg' located
within the ESETS configuration directory.
[http]
agent_enabled = yes
listen_addr = "192.168.1.10"
listen_port = 8080
action_av = "scan"
user_config = "esets_http_spec.cfg"
Once special configuration file referenced from within [http] section we have to create the
file in the ESETS configuration directory and provide it with an appropriate individual settings. The
next example shows individual setting of parameter 'action_on_processed' for client's IP address
192.168.1.40.
[|192.168.1.40]
action_av = "reject"
Note that the section header name of the special section contains identification of the HTTP
client for which we have created individual setting. The section body then contains individual
parameters specified for this identification. Thus with this special configuration an HTTP traffic
of all local network clients will be processed, i.e. scanned for infiltrations, with exception of the
client determined by IP address 192.168.1.40 that will be rejected, i.e. blocked in any case.

6.3. Black-list and white-list

In the next example we demonstrate the black-list and also white-list creation for the esets_
http configured as an HTTP proxy scanner. Note that we use configuration described in the
previous section for this purpose.
Thus in order to create black-list used by esets_http we have to create the following group
section within the special configuration file 'esets_http_spec.cfg' introduced in the previous
section.
[black-list]
action_av = "reject"
The next step is to add some HTTP server into the 'black-list' group. For this purpose we have
to create special section
[aaa.bbb.ccc.ddd]
parent_id = "black-list"
chapter 6
Important ESET Gateway Security mechanisms 25