Free Tools

Discussions Sophos AV for Linux - how to enable quarantine on-access scanning

Free Tools requires membership for participation - click to join

Thread Info

State Verified Answer
Locked Locked
Replies 4 replies
Subscribers 8 subscribers
Views 6656 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos AV for Linux - how to enable quarantine on-access scanning

Paul Nerie over 5 years ago

I have installed Sophos AV on Linux, and on-access scanning is enabled.

When I review the logs, there are entries like 'Threat detected in <path>: Troj/PHP-BB (Open) (The file is still infected).

Usually the path is a temporary folder used in PHP sites, and the file reported does not exist anymore.

I've been reading the SAV for Linux guide, and I cannot see any info regarding putting files detected by on-access scans into quarantine.

How do I enable or configure this?

Or is it on by default and the files in the log do not exist anymore because they were already quarantined?

Thanks in advance!

This thread was automatically locked due to age.

Parents

0 QC over 5 years ago

Hello Paul Nerie,

the available actions for on-access detections are disinfect and delete. Both are disabled by default. quarantine is only available for on-demand scans (savscan).
AFAIK the on-access scanner permits deletes so the files might have been deleted by the application.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Nerie over 5 years ago in reply to QC

Thanks Christian.

I'm actually not sure if the files were deleted by the on-access scan since they are in the temp folders. They may have been deleted automatically.

Also if the disinfect and delete options are disabled by default (and I haven't enabled them), then it's almost sure that they weren't deleted by the on-access scan.

Would you know how to enable disinfect option by default?

- Paul
Cancel
Vote Up 0 Vote Down

Cancel
+1 QC over 5 years ago in reply to Paul Nerie

Hello Paul,

as per section 15.5.1 in the configuration guide: /opt/sophos-av/bin/savconfig add AutomaticAction disinfect.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Nerie over 5 years ago in reply to QC

Thanks again! I'll check it out.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Paul Nerie over 5 years ago in reply to QC

Thanks again! I'll check it out.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data