


                   Doctor Web, Ltd.

                 Dr.Web(R) for Linux
                 Updating components

                 Administrator Manual

                  Version 5.0.0

====================================================================
All the materials published herein are the property of Doctor Web, Ltd.
and may not be reproduced in any form without written permission of
Doctor Web, Ltd. and proper attribution.

Dr.Web is a registered trademark of Doctor Web, Ltd.

Other product names mentioned herein are trademarks or registered
trademarks of their respective companies.

There might be further improvements and changes in the software not
described in this manual. The revised and amended versions of
this manual are available at www.drweb.com.
====================================================================

(C) 2003-2009 Doctor Web, Ltd.
Russia, Moscow - Saint Petersburg
http://www.drweb.com/


          CONTENTS

1. INTRODUCTION    
2. UPDATING MODULE Dr.Web Updater
  2.1. Running the updating module. Command line parameters.
  2.2. Configuration file. Parameters for updating module.
3. CONTACTS


          1. INTRODUCTION

Dr.Web program components require regular updating. 
For successful operation of antivirus and traffic filtering modules, virus
bases of the known viruses and content-specific black and white lists must
be updated regularly.

Virus base contains several *.vdb files, representing separate parts
of it. On update servers these files are also stored in lzma-archives.
When new viruses appear, small files (only several Kbytes in size) with base
segments describing these viruses are released for amendment.

Add-ons are the same for all supported platforms. There are two types of them:
daily "hot" add-ons (drwtoday.vdb) and regular weekly updates (drwXXXYY.vdb -
where XXX is for untivirus version number, and YY is a sequential number,
beginning from 00).

"Hot" add-ons may be issued daily or even several times a day to provide
effective protection against new viruses. This type of add-ons must be
installed over the old ones: i.e. previous drwtoday.vdb file will be
overwritten.

When new regular add-on is released, all records from drwtoday.vdb are copied
to drwXXXYY.vdb, and new empty drwtoday.vdb file is issued.

If you want to update virus base manually, you must install all missing
regular add-ons first, and then overwrite drwtoday.vdb file.

To add the add-on to the main virus base place corresponding file to
/var/drweb/bases/ directory or to any other directory
specified in the configuration file.

Signatures for virus-like malicious programs (adware, dialers, hacktools,
etc.) are supplied in two additional files - drwrisky.vdb è drwnasty.vdb -
with the structure similar to virus bases. These files are also updated
regularly: dwrXXYYY.vdb and dwnXXYYY.vdb are for regular updates, and
dwrtoday.vdb and dwntoday.vdb are for "hot" updates.

From time to time (as brand new viruses and antivirus techniques appear),
new versions of the antivirus package are released, containing the updated
algorithms, implemented in the antivirus Engine. At the same time, all
released add-ons are brought together, and the new package version is
completed with the updated main virus base with descriptions of all known
viruses. Usually, when upgrading the package to the new version the
portability of bases is assured: i.e. new bases can be linked up to the
old engine. Please note, that this does not guarantee detection or curing of
new viruses, as it requires upgrading of algorithms in the antivirus engine.

After regular updating, virus bases attain the following structure:

- drwebase.vdb - general virus database, received with the new version of the
  package;
- drwXXXXX.vdb - regular weekly add-ons;
- drwtoday.vdb - "hot" add-ons issued daily or several times a day;
- drwnasty.vdb - general database of malware, received with the new version
  of the package;
- dwnXXXYY.vdb - regular weekly add-ons;
- dwntoday.vdb - "hot" add-ons issued daily or several times a day;
- drwrisky.vdb - general database of riskware, received with the new version
  of the package;
- dwrXXXYY.vdb - regular weekly add-ons;
- dwrtoday.vdb - "hot" add-ons issued daily or several times a day.

Content-specific black and white lists consist of files with *.dws extension.
Every file contains list of URLs access to which must be blocked or permitted.

For automatic receipt and installation of the anti-virus add-ons and
content-specific black and white lists you must use a special updating module.

          2. UPDATING MODULE Dr.Web Updater

2.1. Running the updating module. Command line parameters

Updating module Dr.Web Updater is a script "update.pl" written in perl.
It can be found in directory containing executable program files.

Dr.Web Updater settings are stored in main configuration file (drweb32.ini
by default) from /etc/drweb/ directory. If you want to use alternative
configuration file, specify the full path to it by command line parameter
at start.

To run the script use the following command:

> /opt/drweb/update.pl [parameters]

not-need-restart parameter can be specified as command line parameter. 
It can be used in several ways:

a. If not-need-restart parameter is not specified, maild, icapd and drwebd
    daemons will be restarted after update.pl script finishes its work.
    (Note: daemons will be restarted only if any of their components has been
    updated/removed/added during script operation.)
b. If not-need-restart parameter is specified, but no value is set for it, 
    maild, icapd and drwebd daemons will not be restarted after update.pl
    script finishes its work.
c. Daemons names are used as values for not-need-restart parameter. Several
    names can be specified in one string, without white spaces and with comma,
    used as delimiter. Values are case insensitive.
    Daemons, which names are specified as parameter values, will not be
    restarted. 

Allowed parameter values are: maild, icapd, drwebd.

Examples:
    1) /opt/drweb/update.pl -not-need-restart
    2) /opt/drweb/update.pl -not-need-restart=maild,icapd
    3) /opt/drweb/update.pl -not-need-restart=drwebd.

Also you can specify the name of the module (Daemon or Scanner) to update
as a command line parameter. If it is not specified, information from
configuration file is used.

NOTE. It appears to be necessary to specify the certain module, when Daemon
and Scanner have different version numbers, or when they are installed into
different directories.

At this stage, two formats of the command line parameters for Dr.Web Updater
are supported.  Using the first format, you can specify only one parameter -
full name of the program configuration file. With the second version the
following parameters can be specified in any order:

--ini=configuration_file__full_name

--what=component_for_updating

If the name of the configuration file is not specified,
/etc/drweb/drweb32.ini is used.

Instead of "component_for_updating" - "scanner" or "daemon" values must be
specified.

The updating process includes the following stages:

- Dr.Web Updater reads the configuration file;

- Parameters to be used are located in [Updater] section of configuration
  file, except for the following:
  
  EnginePath - serves both to determine the Daemon version and to specify
  the directory, where updated drweb32.dll file is downloaded;

  VirusBase - serves to specify the directory, where updated virus bases are
  downloaded.

  UpdatePath - serves to specify the directory, where all other updated files
  are downloaded.

  PidFile - serves to specify path to file, from which the drwebd process identifier
  used for the restart of the Daemon reload is read.

- Dr.Web Updater requests the list of updates from the server, then tries to
  download lzma-archives of the corresponding bases. If no lzma-archives are
  found, it downloads necessary bases in *.vdb and *.dws formats. To extract
  files from lzma-archives special lzma-utility is used, path to which is
  specified by LzmaDecoderPath parameter value in the [Updater] section.

- Downloaded updates are placed to the corresponding directories as it is
  described above. All files for the current Dr.Web version will be downloaded.
  If some sections of any previous versions are found, only *.vdb files will
  be downloaded.


2.2. Configuration file. Parameters for updating module

The configuration file is a text file, therefore it can be edited by any text
editor. It has the following structure:

--- Beginning of file ---
[Name of section 1]
Parameter1 = value1, ..., valueK
.....
ParameterM = value1, ..., valueK

......

[Name of section X]
Parameter1 = value1, ..., valueK
.....
ParameterY = value1, ..., valueK
--- end of file ---

If the line begins with ";" or "#" symbols, it is considered to be the line of
comments. These lines are skipped when reading parameters from the
configuration file.

If any parameter is commented out or not specified, it does not mean
that this parameter has no value. In this case the hardcoded default value
will be used. Only some parameters are optional or do not have default values.
Every such case will be described separatedly.

Parameter values can be included in brackets (and must be included
in brackets when contain white spaces). Some parameters can have several
values, with comma used as delimiter. If values are included in {},
then the parameter may take only one value from the specified.

Settings for Dr.Web Updater module can be found in [Updater] section of the
main configuration file.

Parameters will be described as follows:

ParameterName = ParameterPseudoValue
        Parameter description
        {May have or not several values}
        Default value:
                {value | unspecified}

Parameters are described in the order they are presented in main configuration
file. 

UpdatePluginsOnly = {Yes | No}
        With "Yes" value specified Dr.Web Updater will not update Daemon and
        Scanner. It will update only plug-ins.
        Default value: 
                No.

Section = {Daemon | Scanner}
        Specifies from which section Updater will take settings to determine
        program version, paths to virus bases, etc.
        Value of this parameter can be overridden by --what= command line
        parameter at start.
        Default value:
                Daemon

ProgramPath = {path to file}
        Path to the Daemon/Scanner. It is used by Dr.Web Updater for
        getting the product version and API information of the installed
        executable file.
        Default value:
                /opt/drweb/drwebd

SignedReader = {path to file}
        This program is used by Dr.Web Updater to read signed files.
        Default value:
                /opt/drweb/read_signed

LzmaDecoderPath = {path to file}
        Path to program used for unpacking of lzma-archives.
        Default value:
                /opt/drweb

LockFile = {path to file}
        Path to lock file used to prevent sharing of certain files during their
        processing by Dr.Web Updater.
        Default value:
                /var/drweb/run/update.lock

CronSummary = {Yes | No}
        If "Yes" value is specified, Dr.Web Updater will output statistics on
        each session to stdout. This mode can be used to send administrator
        notifications by email, if Updater is run by the cron daemon.
        Default value:
                Yes

DrlFile = {path to file}
        Path to file containing list of accessible Dr.Web updating servers.
        Dr.Web Updater selects the server from this list in a random manner.
        This file is signed by Doctor Web, Ltd. and must not be modified by
        the user. It is updated automatically.
        Default value:
                /var/drweb/bases/update.drl


DrlDir = {path to directory}
        Path to directory where signed *.drl files for every plug-in are stored.
        Default value:
                /var/drweb/drl/

Parameters used by Dr.Web Updater for managing the wget system utility
are described below:

Timeout = {number in seconds}
        Sets the --timeout parameter value for the wget system utility. The
        value is valid for one download session, not for the whole
        updating procedure. The empty value or the absence of the
        parameter mean unspecified value of the timeout.
        Default value:
                90

Tries = {numerical value}
        Number of attempts to be made by Dr.Web Updater to establish
        a connection with update server.
        Default value:
                3

ProxyServer = {name or IP address of a proxy-server}
        Name or IP address of a proxy-server used by Dr.Web Updater.
        Default value:
                empty (proxy-server is not used)

ProxyLogin = {name}
        Sets the --proxy-user parameter value of the wget system utility.
        Default value:
                empty

ProxyPassword = {password}
        Sets the --proxy-passwd parameter value of the wget system utility.
        Default value:
                empty

Log settings for Dr.Web Updater are specified below:

LogFileName = {filename}
        Log file name. You can specify syslog as log filename and logging
        will be carried out by syslogd system service. In this case
        SyslogFacility and SyslogPriority parameters must be also specified.
        As syslog uses several files for logging various events of different
        importance, these two parameters and syslog configuration file
        (usually /etc/syslogd.conf) determine location where information
        is logged to.
        Default value:
                /var/drweb/log/updater.log

LogLevel = {Debug | Verbose | Info | Warning | Error}
        Log verbosity level.
        Default value:
                Verbose


          3. CONTACTS

Dr.Web program is developing permanently.
To get news and new information about updates, please visit our web-site:
http://www.drweb.com

Marketing dept.:
http://buy.drweb.com
e-mail: sales@drweb.com

Support:
http://support.drweb.com
E-Mail: support@drweb.com

Please include the following information into your problem report:

- full name and version of your UNIX distribution;
- Dr.Web version that is logged during program start.
