How to create and configure BitDefender vfs Samba module

In order to compile the BitDefender vfs module, the Samba server sources are required. There are two ways to obtain the source of the Samba server. If you use a rpm based system, download the src.rpm from the distro repository, or just use yum to download and install the src.rpm file.

For example, in Fedora Core, download the src.rpm file from the repository and install it with:

    # rpm -ivh samba-3.0.24.src.rpm

If the install is OK, go to /usr/src/redhat/SPECS and rebuild the src.rpm file:

    # cd /usr/src/redhat/SPECS
    # rpmbuild -bc samba.spec

It is possible you will need some more packages (libacl-devel, cups-devel, gnutls-devel, autoconf, libtool etc.) to rebuild the src.rpm package. If so, use the distro way to install the missing packages.

The other way is to get the latest source tarball from the Samba web site or the one that suites your installed version

# smbd -V

The next step is to compile the BitDefender vfs module. Go to /opt/BitDefender/var/src and unpack the BitDefender-Samba-vfs.tar.gz file using:

    # tar -xvf BitDefender-Samba-vfs.tar.gz

To compile the vfs, run in a console:

    # ./configure --with-samba-source=samba_source_directory

samba-source_directory is /usr/src/redhat/BUILD/samba-3.0.24 if the src.rpm is used, or it can be the path to the Samba sources from the tar.gz file. If there are no error messages, type:

    # make && make install

By default the vfs file bdvfs3.so is installed in /usr/lib/samba/vfs. This path can be changed by setting the ‘–with-install-dir’ parameter in the configure command.

The BitDefender Samba vfs module is activated/deactivated on a per-share basis. You can check it’s status by running the following command:

    # bdsafe samba vfs

The output will be something like this:

    global
        Path           :
        VFS            : disabled

    public
        Path           : /data/500GB/public/
        VFS            : disabled

To enable the BitDefender vfs for the public share, run:

    # bdsafe samba vfs enable public

To check the status of the public share, type:

    # bdsafe samba vfs status public

The output will look like this:

    public
        Path           : /data/500GB/public/
        VFS            : enabled
        Failure action : (default)
        Actions:
            On infected  : (default)
            On suspected : (default)
            On riskware  : (default)

To test if the BitDefender vfs for Samba is working, try to copy the EICAR test file from a windows machine into the public share. If it’s working, in the /opt/BitDefender/var/log/virus.log file, a new entry will appear and the test file will be deleted from the public share:

“05/06/2009 11:15:03 BDFILED MALWARE: /data/500GB/public/eicar.com (/data/500GB/public/eicar.com), malware: EICAR-Test-File (not a virus), status: Infected, action: Deleted (disinfect, delete, deny)”

Now your share is protected against malware by BitDefender.

For more information about the BitDefender vfs module, please read the INSTALL.samba-vfs file from your BitDefender installation.