To install Sophos Anti-Virus so that it is updated automatically by Sophos Enterprise Console, see the Sophos Enterprise Console startup guide for Linux, NetWare, and UNIX instead of this guide.

Sophos documentation is published at

http://www.sophos.com/en-us/support/documentation/

Sophos Anti-Virus for UNIX and Linux

2 System requirements

For system requirements, go to the system requirements page of the Sophos website

(

http://www.sophos.com/en-us/products/all-system-requirements.aspx

startup guide

3 About Sophos Anti-Virus for UNIX and Linux

3.1 What Sophos Anti-Virus does

Sophos Anti-Virus detects and deals with viruses (including worms and Trojans) on your UNIX or Linux computer. As well as being able to detect all UNIX and Linux viruses, it can also detect all other viruses that might be stored on your UNIX or Linux computer and transferred to other computers. It does this by scanning your computer.

3.2 How Sophos Anti-Virus protects your computer

Sophos Anti-Virus enables you to run an on-demand scan. An on-demand scan is a scan that you initiate. You can scan anything from a single file to everything on your computer that you have permission to read. You can either manually run an on-demand scan or schedule it to run unattended.

Sophos Anti-Virus for UNIX and Linux

4 Installing Sophos Anti-Virus on a standalone computer

4.1 Download Sophos Anti-Virus

1. Log in to

http://www.sophos.com/en-us/Sophos/Support/Downloads.aspx

with your MySophos username and password.

2. Go to the standalone installer web page for UNIX (unmanaged), which includes both UNIX and Linux installers.

3. On the web page that is displayed, download the Sophos Anti-Virus version 4 tarball for your platform to a temporary directory, for example

/tmp

4.2 Extract the installation files

1. Change to the temporary directory to which you downloaded the Sophos Anti-Virus tarball.

2. Untar the tarball to the temporary directory:

tar -xzvf tarball where tarball is the tarball filename.

A directory sav-install

is created in the temporary directory, which contains the extracted installation files.

4.3 Run the installation script

To perform this procedure, you must be logged on to the computer as root.

1. Change to the directory sav-install

startup guide

2. Run the installation script:

./install.sh

A warning about the environment variable MANPATH might be displayed. You can safely ignore this warning, as the installation is performed correctly.

By default, the script copies:

■

The

sweep

program to

/usr/local/bin

■ The shared library to

/usr/local/lib

■ Virus data to

/usr/local/sav

■

The manual page to

/usr/local/man

Note: You can specify the files that are installed and the directories to which they’re installed by running the script with various options. For more information, run the script with the option

-h

4.4 Check environment variables

You need to ensure that your system’s environment variables include the directories that Sophos

Anti-Virus uses.

1. If you are running the sh, ksh or bash shell, open

/etc/profile

for editing.

If you are running the csh or tcsh shell, open

/etc/login

for editing.

Note: If you do not have a login script or profile, carry out the following steps at the command prompt. You must do this every time that you restart the computer.

2. Check that the environment variables include the directories that Sophos Anti-Virus uses:

PATH should include

/usr/local/bin

MANPATH should include

/usr/local/man

LD_LIBRARY_PATH should include

/usr/local/lib

Note: On AIX, the library environment variable is LIBPATH, and on HP-UX it is SHLIB_PATH.

3. If the environment variables do not include these directories, add them as follows. Do not change any of the existing settings.

If you are running the sh, ksh or bash shell, type:

PATH=$PATH:/usr/local/bin export PATH

MANPATH=$MANPATH:/usr/local/man export MANPATH

Sophos Anti-Virus for UNIX and Linux

LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib export LD_LIBRARY_PATH

If you are running the csh or tcsh shell, type:

setenv PATH values:/usr/local/bin

setenv MANPATH values:/usr/local/man

setenv LD_LIBRARY_PATH values:/usr/local/lib where values are the existing settings.

Note: On some systems, for example FreeBSD and Linux, you can enable Sophos Anti-Virus to use the Sophos Anti-Virus shared libraries by running

ldconfig

. This might require editing of

/etc/ld.so.conf

4. Save the login script or profile.

4.5 Add the latest virus data

To detect viruses that have been discovered since your version of Sophos Anti-Virus was compiled, you must add the latest virus data. This is in the form of IDE files. An IDE file is a file that enables

Sophos Anti-Virus to detect and disinfect a particular virus.

1. Go to

http://www.sophos.com/downloads/ide/

2. Download the compressed IDEs file for your version of Sophos Anti-Virus.

3. Extract the IDEs to the directory

/usr/local/sav

Note: If you specified a different directory for virus data when you ran the installation script, you must extract the IDEs to that directory instead.

startup guide

5 Run an on-demand scan of the computer

Having just installed Sophos Anti-Virus, we recommend that you scan the whole computer for viruses, especially if it’s a server and you want to minimize the possibility of spreading viruses to the other computers. To do this, you run an on-demand scan.

■

To run an on-demand scan of the computer, type:

savscan /sweep /

Sophos Anti-Virus for UNIX and Linux

6 What happens if viruses are detected

If an on-demand scan detects a virus, by default Sophos Anti-Virus displays a command-line alert.

It reports the virus on the line which starts with

>>>

followed by either

Virus

Fragment

SWEEP virus detection utility

Version 4.79.0 [Linux/Intel]

Virus data version 4.79, July 2012

Includes detection for 3759929 viruses, Trojans and worms

System time 13:43:32, System date 20 July 2012

IDE directory is: /usr/savides/

Using IDE file nyrate-d.ide

. . . . . . . . . . . . . .

Using IDE file injec-lz.ide

Quick Scanning

>>> Virus 'EICAR-AV-Test' found in file /usr/mydirectory/eicar.src

33 files scanned in 2 seconds.

1 virus was discovered.

1 file out of 33 was infected.

Please send infected samples to Sophos for analysis.

For advice consult www.sophos.com or email [email protected]

End of Sweep.

For information about cleaning up viruses, see the Sophos Anti-Virus for UNIX and Linux user

manual for version 4.

startup guide

7 Updating Sophos Anti-Virus

To enable Sophos Anti-Virus to detect all the latest viruses, you must update it:

■

Each month, when we release the new version of Sophos Anti-Virus.

■

When a significant new virus emerges.

7.1 Updating Sophos Anti-Virus each month

Sophos releases a new version of Sophos Anti-Virus each month, according to the schedule on

http://www.sophos.com/downloads/release_dates/

7.1.1 Clear old virus data

■ Delete all

*.ide

files from the directory

/usr/local/sav

Note: If you specified a different directory for virus data when you ran the installation script, you must delete the

*.ide

files from that directory instead.

7.1.2 Download Sophos Anti-Virus

1. Log in to

http://www.sophos.com/en-us/Sophos/Support/Downloads.aspx

with your MySophos username and password.

2. Go to the standalone installer web page for UNIX (unmanaged), which includes both UNIX and Linux installers.

3. On the web page that is displayed, download the Sophos Anti-Virus version 4 tarball for your platform to a temporary directory, for example

/tmp

7.1.3 Extract the installation files

1. Change to the temporary directory to which you downloaded the Sophos Anti-Virus tarball.

2. Untar the tarball to the temporary directory:

tar -xzvf tarball where tarball is the tarball filename.

A directory sav-install

is created in the temporary directory, which contains the extracted installation files.

Sophos Anti-Virus for UNIX and Linux

7.1.4 Run the installation script

To perform this procedure, you must be logged on to the computer as root.

1. Change to the directory sav-install

2. Run the installation script:

./install.sh

A warning about the environment variable MANPATH might be displayed. You can safely ignore this warning, as the installation is performed correctly.

By default, the script copies:

■

The

sweep

program to

/usr/local/bin

■ The shared library to

/usr/local/lib

■ Virus data to

/usr/local/sav

■

The manual page to

/usr/local/man

-h

7.1.5 Add the latest virus data

Sophos Anti-Virus to detect and disinfect a particular virus.

1. Go to

http://www.sophos.com/downloads/ide/

2. Download the compressed IDEs file for your version of Sophos Anti-Virus.

3. Extract the IDEs to the directory

/usr/local/sav

Note: If you specified a different directory for virus data when you ran the installation script, you must extract the IDEs to that directory instead.

7.2 Update Sophos Anti-Virus when a significant new virus emerges

You can receive email notifications about new viruses by registering at

http://www.sophos.com/en-us/about-us/email-notifications.aspx

To update Sophos Anti-Virus when a significant new virus emerges:

1. Go to

http://www.sophos.com/downloads/ide/

2. Download the compressed IDEs file for your version of Sophos Anti-Virus.

startup guide

3. Extract the IDEs to the directory

/usr/local/sav

Note: If you specified a different directory for virus data when you ran the installation script, you must extract the IDEs to that directory instead.

Sophos Anti-Virus for UNIX and Linux

8 Remove Sophos Anti-Virus

To perform this procedure, you must be logged on to the computer as root.

All directories below refer to the installation defaults. If you specified different directories when you ran the installation script, you must apply these instructions to those directories instead.

1. Delete the

sweep

program:

/usr/local/bin/sweep

2. Delete the shared library:

/usr/local/lib/libsavi.*

3. Delete the virus data directory:

/usr/local/sav

4. Delete the configuration file:

/etc/sav.conf

5. Delete the manual page:

/usr/local/man/man1/sweep.1

Note: On SCO systems, delete

/usr/local/man/man.1/sweep.1

instead.

startup guide

9 Appendix: Install Sophos Anti-Virus on networked computers

This procedure assumes that there is a trust relationship between the computers.

To perform this procedure, you must be logged on to the computer as root.

If you have multiple, networked UNIX or Linux computers, you may want to install and update

Sophos Anti-Virus from a central directory, rather than carrying out installation at each computer separately.

To install Sophos Anti-Virus on networked computers:

1. On one of the computers, create a directory that is accessible by all the other computers.

2. Download Sophos Anti-Virus to this directory, by following the steps in

Download Sophos

Anti-Virus

(section 4.1).

Repeat these steps for all the different platforms on your network.

3. Extract the installation files to this directory, by following the steps in

Extract the installation files

(section 4.2).

If you have more than one platform on your network, extract the files into separate subdirectories.

4. Change to the directory sav-install

5. Use

ssh

to run the installation script on each computer from the shared directory:

ssh -l username hostname / .install.sh where username is your user ID and hostname is the name of the computer on which you want to install Sophos Anti-Virus. You can put this command into a script to install Sophos

Anti-Virus on all computers that share the same platform.

-h

If you have more than one platform on your network, ensure that you run the installation script from the correct set of installation files for each platform.

On older UNIX systems,

ssh

might not be available. You can use

rsh

instead, although it is less secure.

6. If you want to check the environment variables on each computer, follow the steps in

Check environment variables

(section 4.4) for each computer.

7. If you want to ensure each computer is able to detect viruses that have been discovered since your version of Sophos Anti-Virus was compiled, follow the steps in

Add the latest virus data

(section 4.5) for each computer.

Sophos Anti-Virus for UNIX and Linux

10 Technical support

You can find technical support for Sophos products in any of these ways:

■

Visit the SophosTalk community at

community.sophos.com/

and search for other users who are experiencing the same problem.

■

Visit the Sophos support knowledgebase at

www.sophos.com/en-us/support.aspx

■ Download the product documentation at

www.sophos.com/en-us/support/documentation/

■ Send an email to

[email protected]

, including your Sophos software version number(s), operating system(s) and patch level(s), and the text of any error messages.

startup guide

11 Legal notices

2014 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos

Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

dtoa.c

The author of this software is David M. Gay.

1991, 2000 by Lucent Technologies.

Permission to use, copy, modify, and distribute this software for any purpose without fee is hereby granted, provided that this entire notice is included in all copies of any software which is or includes a copy or modification of this software and in all copies of the supporting documentation for such software.

THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED

WARRANTY. IN PARTICULAR, NEITHER THE AUTHOR NOR LUCENT MAKES ANY

REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY

OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.

fenv.h (applicable to FreeBSD only)

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" AND ANY

EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR

ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

Sophos Anti-Virus for UNIX and Linux

STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN

ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.

OpenSSL Cryptography and SSL/TLS Toolkit

The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact [email protected].

OpenSSL license

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

3. All advertising materials mentioning features or use of this software must display the following acknowledgment:

“This product includes software developed by the OpenSSL Project for use in the OpenSSL

Toolkit. (http://www.openssl.org/)”

4. The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact [email protected].

5. Products derived from this software may not be called “OpenSSL” nor may “OpenSSL” appear in their names without prior written permission of the OpenSSL Project.

6. Redistributions of any form whatsoever must retain the following acknowledgment:

“This product includes software developed by the OpenSSL Project for use in the OpenSSL

Toolkit (http://www.openssl.org/)”

THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS” AND ANY EXPRESSED

OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE

LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

startup guide

This product includes cryptographic software written by Eric Young ([email protected]). This product includes software written by Tim Hudson ([email protected]).

Original SSLeay license

This package is an SSL implementation written by Eric Young ([email protected]). The implementation was written so as to conform with Netscape’s SSL.

This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4,

RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson

([email protected]).

Copyright remains Eric Young’s, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer.

3. All advertising materials mentioning features or use of this software must display the following acknowledgement:

“This product includes cryptographic software written by Eric Young ([email protected])”

The word “cryptographic” can be left out if the routines from the library being used are not cryptographic related :-).

4. If you include any Windows specific code (or a derivative thereof) from the apps directory

(application code) you must include an acknowledgement:

“This product includes software written by Tim Hudson ([email protected])”

THIS SOFTWARE IS PROVIDED BY ERIC YOUNG “AS IS” AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,

INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER

CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

Sophos Anti-Virus for UNIX and Linux

OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH

DAMAGE.

The license and distribution terms for any publically available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution license [including the GNU Public License.]

Protocol Buffers

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

■

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

■

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

■

Neither the name of Google Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED

TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED

TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Simple ECMAScript Engine

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

startup guide

3. Neither the name of David Leonard nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

“AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED