s4s_clamsap.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE chapter
[
  <!ENTITY % entities SYSTEM "generic-entities.ent">
    %entities;
]>
<?xml-stylesheet href="urn:x-suse:xslt:profiling:docbook50-profile.xsl"
   type="text/xml"
   title="Profiling step"?>
<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xi="http://www.w3.org/2001/XInclude" xmlns:xlink="http://www.w3.org/1999/xlink" version="5.0" xml:lang="en" xml:id="cha-clamsap">
 <title>Protecting against malware with &clamsap;</title>
 <info>
  <dm:docmanager xmlns:dm="urn:x-suse:ns:docmanager">
   <dm:bugtracker/>
   <dm:translation>yes</dm:translation>
  </dm:docmanager>
 </info>
  <para>
   &clamsap; integrates the &clamav; anti-malware toolkit into &netweaver; and
   &sap; Mobile Platform applications. &clamsap; is a shared library that
   links between &clamav; and the &netweaver; Virus Scan Interface (NW-VSI).
   The version of &clamsap; shipped with &productname;
   &productnumber; supports NW-VSI version 2.0.
  </para>
 <important>
  <title>Avoid false positive reports for large files exceeding maximum file size</title>
  <remark>toms 2021-10-20: See https://www.suse.com/support/kb/doc/?id=000020324</remark>
  <para> By default, &clamav; does not scan files exceeding various limits like
   file sizes, nesting level, or scan time. Such files are reported as "OK". The
   current default settings for the &clamav; virus scan engine in the
    <command>clamscan</command> commandline tool and the <systemitem
    class="daemon">clamd</systemitem> scan daemon are set in a way that: </para>
  <itemizedlist>
   <listitem>
    <para>Files and archives are scanned, but only up to the configured or default limits
     for size, nesting level, scan time, etc.</para>
   </listitem>
   <listitem>
    <para>
     The scan engine reports these files as being "OK".
    </para>
   </listitem>
   <listitem>
    <para>
     This could potentially allow attackers to bypass the virus scanning.
    </para>
   </listitem>
  </itemizedlist>
  <para> Alerts can be enabled to set the
    <option>--alert-exceeds-max=yes</option> option on the
    <command>clamscan</command> commandline or via <option>AlertExceedsMax
    TRUE</option> in <filename>clamd.conf</filename> for daemon based scans.
   Settings these options will cause a "FOUND" report of status type
    <literal>Heuristics.Limits.Exceeded</literal>. You need to handle such
   files differently in front-ends or processing of reports.
  </para>
  <para>
   Before enabling the alert, ensure that front-ends will not suddenly
   quarantine or remove those files.
  </para>
 </important>

 <sect1 xml:id="sec-clamsap-install">
  <title>Installing &clamsap;</title>
  <procedure>
   <step>
    <para>
     On the application host, install the packages for &clamav; and
     &clamsap;. To do so, use the command:
    </para>
    <screen>&prompt.user;<command>sudo zypper install clamav clamsap</command></screen>
   </step>
   <step>
    <para>
     Before you can enable the daemon
     <systemitem class="daemon">clamd</systemitem>, initialize the malware
     database:
    </para>
    <screen>&prompt.user;<command>sudo freshclam</command></screen>
   </step>
   <step>
    <para>
     Start the service <systemitem class="daemon">clamd</systemitem>:
    </para>
    <screen>&prompt.user;<command>sudo systemctl start clamd</command></screen>
   </step>
   <step>
    <para>
     Check the status of the service
     <systemitem class="daemon">clamd</systemitem> with:
    </para>
    <screen>
&prompt.user;<command>systemctl status clamd</command>
● clamd.service - ClamAV Antivirus Daemon
Loaded: loaded (/usr/lib/systemd/system/clamd.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2017-04-11 10:33:03 UTC; 24h ago
[...]
    </screen>
   </step>
  </procedure>
 </sect1>
 <sect1 xml:id="sec-clamsap-scannergroup">
  <title>Creating a virus scanner group in &nw;</title>
  <procedure>
   <step>
    <para>
     Log in to the &nw; installation through the GUI. Do not log in as
     a <systemitem class="username">DDIC</systemitem> or
     <systemitem class="username">SAP*</systemitem> user, because the virus
     scanner needs to be configured cross-client.
    </para>
   </step>
   <step>
    <para>
     Create a Virus Scanner Group using the transaction
     <guimenu>VSCANGROUP</guimenu>.
    </para>
    <informalfigure>
     <mediaobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-scanner-group-display.jpg"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-scanner-group-display.jpg" width="85%"/>
      </imageobject>
      <textobject role="description">
       <phrase>Edit View Scanner Group with editable table</phrase>
      </textobject>
     </mediaobject>
    </informalfigure>
   </step>
   <step>
    <para>
     To switch from view mode to change mode, click the button <guimenu>Change View</guimenu>
     (<inlinemediaobject>
      <textobject role="description">
       <phrase>Change View</phrase>
      </textobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-viewmode-icon.png" width="1em"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-viewmode-icon.png" width="0.8em"/>
      </imageobject>
     </inlinemediaobject>).
    </para>
    <para>
      Confirm the message <guimenu>This table is cross-client</guimenu> by
      clicking the check mark. The table is now editable.
    </para>
   </step>
   <step>
    <para>
     Select the first empty row. In the text box
     <guimenu>Scanner Group</guimenu>, specify
     <literal>CLAMSAPVSI</literal>. Under
     <guimenu>Group Text</guimenu>, specify <literal>CLAMSAP</literal>.
    </para>
    <para>
     Make sure that <guimenu>Business Add-in</guimenu> is not checked.
    </para>
    <informalfigure>
     <mediaobject>
      <textobject role="description">
       <phrase>Edit View Scanner Group with editable table</phrase>
      </textobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-scanner-group-change.jpg"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-scanner-group-change.jpg" width="85%"/>
      </imageobject>
     </mediaobject>
    </informalfigure>
   </step>
   <step>
    <para>
     To save the form, click the button <guimenu>Save</guimenu>
     (<inlinemediaobject>
      <textobject role="description">
       <phrase>Save</phrase>
      </textobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-save-icon.png" width="1em"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-save-icon.png" width="0.8em"/>
      </imageobject>
     </inlinemediaobject>).
    </para>
   </step>
  </procedure>
 </sect1>
 <sect1 xml:id="sec-clamsap-library">
  <title>Setting up the &clamsap; library in &nw;</title>
  <procedure>
   <step>
    <para>
     In the &nw; GUI, call the transaction <guimenu>VSCAN</guimenu>.
     <!-- wording: "call"? Maybe "open"? - sknorr, 2017-04-13 -->
    </para>
   </step>
   <step>
    <para>
     To switch from view mode to change mode, click the button
     <guimenu>Change View</guimenu>
     (<inlinemediaobject>
      <textobject role="description">
       <phrase>Change View</phrase>
      </textobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-viewmode-icon.png" width="1em"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-viewmode-icon.png" width="0.8em"/>
      </imageobject>
     </inlinemediaobject>).
    </para>
    <para>
      Confirm the message <guimenu>This table is cross-client</guimenu> by
      clicking the check mark. The table is now editable.
    </para>
   </step>
   <step>
    <para>
     Click <guimenu>New entries</guimenu>.
    </para>
   </step>
   <step>
    <para>
     Fill in the form accordingly:
    </para>
    <itemizedlist>
     <listitem>
      <para>
       <guimenu>Provider Type</guimenu>: <literal>Adapter (Virus Scan Adapter)</literal>
      </para>
     </listitem>
     <listitem>
      <para>
       <guimenu>Provider Name</guimenu>: <literal>VSA_<replaceable>HOSTNAME</replaceable></literal>
       (for example: <literal>VSA_SAPSERVER</literal>)
      </para>
     </listitem>
     <listitem>
      <para>
       <literal>Scanner Group</literal>: The name of the scanner group that
       you set up in <xref linkend="sec-clamsap-scannergroup"/> (for example:
       <literal>CLAMSAPVSI</literal>)
      </para>
     </listitem>
     <listitem>
      <para>
       <guimenu>Server</guimenu>:
       <literal><replaceable>HOSTNAME</replaceable>_<replaceable>SID</replaceable>_<replaceable>INSTANCE_NUMBER</replaceable></literal>
       (for example: <literal>SAPSERVER_P04_00</literal>)
      </para>
     </listitem>
     <listitem>
      <para>
       <guimenu>Adapter Path</guimenu>: <filename>libclamdsap.so</filename>
      </para>
     </listitem>
    </itemizedlist>
    <informalfigure>
     <mediaobject>
      <textobject role="description">
       <phrase>Form New Entries: Details of Added Entries</phrase>
      </textobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-scanner-definition-add.jpg"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-scanner-definition-add.jpg" width="85%"/>
      </imageobject>
     </mediaobject>
    </informalfigure>
   </step>
   <step>
    <para>
     To save the form, click the button
     <inlinemediaobject>
      <textobject role="description">
       <phrase>Save</phrase>
      </textobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-save-icon.png" width="1em"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-save-icon.png" width="0.8em"/>
      </imageobject>
     </inlinemediaobject>.
    </para>
   </step>
  </procedure>
 </sect1>
 <sect1 xml:id="sec-clamsap-changedir">
  <title>Configuring the default location of virus definitions</title>
  <para>
   By default, &clamav; expects the virus definitions to be located in <filename
    class="directory">/var/lib/clamsap</filename>.
   To change this default location, proceed as follows:
  </para>
  <procedure>
   <step>
    <para>
     Log in to the &nw; installation through the GUI. Do not log in as
     a <systemitem class="username">DDIC</systemitem> or
     <systemitem class="username">SAP*</systemitem> user, because the virus
     scanner needs to be configured cross-client.
    </para>
   </step>
   <step>
    <para>
     Select the <literal>CLAMSAPVSI</literal> group.
    </para>
   </step>
   <step>
    <para>
     In the left navigation pane, click <guimenu>Configuration Parameters</guimenu>.
    </para>
   </step>
   <step>
    <para>
     To switch from view mode to change mode, click the button <guimenu>Change View</guimenu>
     (<inlinemediaobject>
      <textobject role="description">
       <phrase>Change View</phrase>
      </textobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-viewmode-icon.png" width="1em"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-viewmode-icon.png" width="0.8em"/>
      </imageobject>
     </inlinemediaobject>).
    </para>
    <para>
      Confirm the message <guimenu>This table is cross-client</guimenu> by
      clicking the check mark. The table is now editable.
    </para>
    <figure xml:id="fig-clamsap-add-entry">
     <title></title>
     <mediaobject>
      <imageobject role="html">
       <imagedata fileref="sap-new-scanner-clamsap-add-entries.jpg" width="95%"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-new-scanner-clamsap-add-entries.jpg" width="85%"/>
      </imageobject>
     </mediaobject>
    </figure>
   </step>
   <step>
    <para>
     Click <guimenu>New Entries</guimenu> and select <parameter>INITDRIVERDIRECTORY</parameter>.
    </para>
    <figure xml:id="fig-clamsap-add-value">
     <title></title>
     <mediaobject>
      <imageobject role="html">
       <imagedata fileref="sap-new-scanner-clamsap-add-value.jpg" width="95%"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-new-scanner-clamsap-add-value.jpg" width="85%"/>
      </imageobject>
     </mediaobject>
    </figure>
   </step>
   <step>
    <para>
     Enter the path to a different virus scanner location.
    </para>
   </step>
   <step>
    <para>
     To save the form, click the button <guimenu>Save</guimenu>
     (<inlinemediaobject>
      <textobject role="description">
       <phrase>Save</phrase>
      </textobject>
      <imageobject role="html">
       <imagedata fileref="sap-nw-save-icon.png" width="1em"/>
      </imageobject>
      <imageobject role="fo">
       <imagedata fileref="sap-nw-save-icon.png" width="0.8em"/>
      </imageobject>
     </inlinemediaobject>).
    </para>
   </step>
  </procedure>
 </sect1>
 <sect1 xml:id="sec-clamsap-engage">
  <title>Engaging &clamsap;</title>
  <para>
   To run &clamsap;, go to the transaction <guimenu>VSCAN</guimenu>. Then
   click <emphasis>Start</emphasis>.
  </para>
  <figure xml:id="fig-clamsap-scanner-change">
   <title>Change view <quote>virus scan provider definition</quote></title>
   <mediaobject>
    <imageobject role="html">
     <imagedata fileref="sap-nw-scanner-definition-change.jpg"/>
    </imageobject>
    <imageobject role="fo">
     <imagedata fileref="sap-nw-scanner-definition-change.jpg" width="85%"/>
    </imageobject>
   </mediaobject>
  </figure>
  <para>
   Afterward, a summary will be displayed, including details of the &clamsap;
   and &clamav; (shown in <xref linkend="fig-clamsap-summary"/>).
  </para>
  <figure xml:id="fig-clamsap-summary">
   <title>Summary of &clamsap; data</title>
   <mediaobject>
    <imageobject role="html">
     <imagedata fileref="sap-nw-scanner-summary.jpg"/>
    </imageobject>
    <imageobject role="fo">
     <imagedata fileref="sap-nw-scanner-summary.jpg" width="85%"/>
    </imageobject>
   </mediaobject>
  </figure>
 </sect1>
 <sect1 xml:id="sec-clamsap-more">
  <title>For more information</title>
  <para>
   For more information, also see the project home page
   <link xlink:href="https://sourceforge.net/projects/clamsap/"/>.
  </para>
 </sect1>
</chapter>