Kaspersky Embedded Systems Security for Linux
3.3.0
English

Contents

[Topic 236953]

Application settings configuration files

After the post-installation configuration, the application creates the following configuration files:

  • /var/opt/kaspersky/kess/common/agreements.ini

    The agreements.ini configuration file contains settings related to the License Agreement, Privacy Policy, and Kaspersky Security Network Statement.

  • /var/opt/kaspersky/kess/common/kess.ini

    The kess.ini configuration file contains the settings described in the following table.

If necessary, you can edit the values of the settings in these files.

The default values in these files should be changed only under the supervision of Technical Support specialists and in accordance with their instructions.

The kess.ini configuration file settings

Setting

Description

Values

The [General] section contains the following settings:

ScanMemoryLimit

Limit on the application's use of memory in megabytes.

Default value: 8192.

ExecArgMax

Number of arguments that the application captures from the exec call.

Default value: 50.

RevealSensitiveInfoInTraces

Display information in trace files that may contain personal data (for example, passwords).

True/Yes (default value) — display information in application trace files that may contain personal data.

False/No (default value) — do not display information that may contain personal data in trace files.

PackageType

Format of the installed application package.

RPM – an RPM package is installed.

DEB – a DEB package is installed.

Filled out automatically during the post-installation configuration of the application.

Locale

The locale used for the application events sent to Kaspersky Security Center.

The locale of the graphical interface and the application command line depends on the value of the LANG environment variable. If the locale that is not supported by Kaspersky Embedded Systems Security is specified as the value of the LANG environment variable, the graphical interface and the command line are displayed in English.

Locale in the format specified by RFC 3066.

If the Locale setting is not specified, the operating system locale is used. If the application fails to determine the operating system localization language or the operating system localization is not supported, the default value will be used – en_US.utf8.

UseFanotify

Indicates use of fanotify notifications.

True/Yes – The operating system supports fanotify notifications.

False/No – The operating system does not support fanotify notifications.

Filled out automatically during the initial setup of the application.

MachineId

The user's unique device ID.

Filled out automatically during the initial setup of the application.

CoreDumps

Enables the creation of a dump file when application failure occurs.

True/Yes (default value) – Create a dump file when the application fails.

False/No – Do not create a dump file when the application fails.

SocketPath

The path to the socket for remote connection, through which, for example, the graphical interface and the kess-control utility are connected.

Default value: /var/run/bl4control.

StartupTraces

Enables generation of trace files at application startup.

True/Yes – Create trace files at application startup.

False/No (default value) – Do not create trace files at application startup.

MaxInotifyWatches

Limit on the number of subscriptions to changes in files and directories (user watches) in /proc/sys/fs/inotify/max_user_watches.

Default value: 300000.

MaxInotifyInstances

Limit on the number of subscriptions to changes in files and directories for a single user.

Default value: 2048.

ExecEnvMax

The number of environment variables that the application captures from the command call.

Default value: 50.

AdditionalDNSLookup

Indicates use of a public DNS.

If there are errors accessing servers through the system DNS, the application uses a public DNS. This is needed for updating application databases and maintaining device security. The application will use the following public DNSes in this order:

  • Google Public DNS (8.8.8.8).
  • Cloudflare DNS (1.1.1.1).
  • Alibaba Cloud DNS (223.6.6.6).
  • Quad9 DNS (9.9.9.9).
  • CleanBrowsing (185.228.168.168).

The application's requests may contain domain addresses and the user's external IP address, since the application establishes a TCP/UDP connection with the DNS server. This information is necessary, for example, to check the certificate of a web resource when interacting via HTTPS. If the application is using a public DNS server, data processing rules are governed by the Privacy Policy of the corresponding service. If you need to block the application from using a public DNS server, contact Technical Support for a private patch.

True/Yes – Use a public DNS to access Kaspersky servers.

False/No (default value) – Do not use a public DNS to access Kaspersky servers.

The [Network] section contains the following settings:

WtpFwMark

A mark in the iptables rules for forwarding traffic to the application for processing by Web Threat Protection tasks. You may need to change this mark if a device with the application runs other software that uses the ninth bit of the TCP packet mask, and a conflict occurs.

A decimal value or hexadecimal number with the prefix 0x.

Default value: 0x100.

NtpFwMark

A mark in the iptables rules for forwarding traffic to the application for processing by Network Threat Protection tasks.

You may need to change this mark if a device with the application runs other software that uses the ninth bit of the TCP packet mask, and a conflict occurs.

A decimal value or hexadecimal number with the prefix 0x.

Default value: 0x200.

BypassFwMark

A mark used to indicate packets created or scanned by the application, so that the application does not scan them again.

A decimal value or hexadecimal number with the prefix 0x.

Default value: 0x400.

BypassNFlogMark

A mark used to indicate packages created or scanned by the application to prevent them from being logged by the iptable utility.

A decimal value or hexadecimal number with the prefix 0x.

Default value: 0x800.

ProxyRouteTable

Number of the routing table.

Default value: 101.

The [Watchdog] section contains the following settings:

TimeoutAfterHeadshot

Maximum time to wait for the controlled process to complete from the moment the Watchdog server sends the HEADSHOT signal to the controlled process.

Default value: 2 minutes.

 

StartupTimeout

Maximum time interval from the moment the REGISTER message is received to the moment the SUCCESSFUL_STARTUP message is received.

Default value: 3 minutes.

TimeoutAfterKill

 

Maximum time to wait for the controlled process to complete from the moment the Watchdog server sends the SIGKILL signal to the controlled process.

If the controlled process does not finish before this time elapses, the action specified by the --failed-kill setting is performed.

Default value: 2 days.

PingInterval

The interval with which the application attempts to send a PONG message to a server in response to a received PING message.

Default value: 2000 ms.

MaxRestartCount

 

Maximum number of consecutive unsuccessful attempts to start the application.

Default value: 5.

ActivityTimeout

 

Maximum time interval during which the application should send a message to the Watchdog server.

If a message is not received from the application within this time interval, the Watchdog server begins the procedure to terminate the controlled process.

Default value: 2 minutes.

ConnectTimeout

 

Maximum time from the start of the controlled process to the moment when a connection with the Watchdog server is established by the application.

If the application does not establish a connection in this time interval, the Watchdog server begins the procedure to terminate the controlled process.

Default value: 3 minutes.

RegisterTimeout

Maximum time from the moment the application connects to the Watchdog server to the moment the server receives a REGISTER message.

Default value: 500 ms.

TimeoutAfterShutdown

 

Maximum time to wait for the controlled process to complete from the moment the Watchdog server sends the SHUTDOWN signal to the controlled process.

Default value: 2 minutes.

MaxVirtualMemory

 

Limit on the use of virtual memory by the controlled process.

If the controlled process uses more virtual memory than this limit, the Watchdog server begins the procedure to terminate the controlled process.

off (default value) – The virtual memory size is not limited.

<value>MB – a value in megabytes.

MaxSwapMemory

 

Limit on the size of the swap file of the controlled process.

If the swap file of the controlled process exceeds this limit, the Watchdog server begins the procedure to terminate the controlled process.

off (default value) – The size of the swap file is not limited.

<value >% – a value between 0 and 100, expressing a percentage of memory.

<value>MB – a value in megabytes.

lowest/<value>%/<value>MB – the smaller value between the value as a percentage and the value in megabytes.

highest/<value>%/<value>MB– the larger value between the value as a percentage and the value in megabytes.

MaxMemory

 

Limit on the resident set size for the controlled process.

If the resident set size of the controlled process exceeds this limit, the Watchdog server begins the procedure to terminate the controlled process.

off – the resident set size is not limited.

<value >% – a value between 0 and 100, expressing a percentage of memory.

<value>MB – a value in megabytes.

lowest/<value>%/<value>MB – the smaller value between the value as a percentage and the value in megabytes.

highest/<value>%/<value>MB– the larger value between the value as a percentage and the value in megabytes.

Default value: highest/50%/2048MB/.

Page top

[Topic 247007]

Rules for editing application task configuration files

When editing a configuration file, adhere to the following rules:

  • Specify all mandatory settings in the configuration file. You can specify individual task settings without a file using the command line.
  • If a setting belongs to a certain section, specify it only in this section. You can specify the settings in any order within the one section.
  • Enclose the names of sections in square brackets [ ].
  • Enter the values of settings in the format <setting name>=<setting value> (spaces between the a setting name and its value are not processed).

    Example:

    [ScanScope.item_0000]

    AreaDesc=Home

    AreaMask.item_0000=*doc

    Path=/home

    Space and tab characters are ignored before the first quotation mark and after the last quotation mark of a string value, and at the beginning and end of a string value that is not enclosed in quotation marks.

  • If you need to specify several values for a setting, repeat the setting the same number of times as the number of values that you want to specify.

    Example:

    AreaMask.item_0000=*xml

    AreaMask.item_0001=*doc
  • Be case-sensitive when entering values for the following types of settings:
    • Names (masks) of scanned objects and excluded objects.
    • Names (masks) of threats.

    The remaining setting values are not case-sensitive.

  • Specify Boolean setting values as follows: Yes / No.
  • Use quotation marks to enclose string values containing a space character (for example, names of files and directories and their paths, expressions containing the date and time in the format "YYYY-MM-DD HH:MM:SS").

    You can enter the remaining values with or without quotation marks.

    Example:

    AreaDesc="Scanning of email databases"

    A single quotation mark in the beginning or end of a string is considered an error.

Page top
[Topic 201432]

File Threat Protection task configuration file

ScanArchived=No

ScanSfxArchived=No

ScanMailBases=No

ScanPlainMail=No

SkipPlainTextFiles=No

TimeLimit=60

SizeLimit=0

FirstAction=Recommended

SecondAction=Block

UseExcludeMasks=No

UseExcludeThreats=No

ReportCleanObjects=No

ReportPackedObjects=No

ReportUnprocessedObjects=No

UseAnalyzer=Yes

HeuristicLevel=Recommended

UseIChecker=Yes

ScanByAccessType=SmartCheck

[ScanScope.item_0000]

AreaDesc=All objects

UseScanArea=Yes

Path=/

AreaMask.item_0000=*

Page top
[Topic 201430]

Configuration file for the Malware Scan task

ScanFiles=Yes

ScanBootSectors=Yes

ScanComputerMemory=Yes

ScanStartupObjects=Yes

ScanArchived=Yes

ScanSfxArchived=Yes

ScanMailBases=No

ScanPlainMail=No

TimeLimit=0

SizeLimit=0

FirstAction=Recommended

SecondAction=Skip

UseExcludeMasks=No

UseExcludeThreats=No

ReportCleanObjects=No

ReportPackedObjects=No

ReportUnprocessedObjects=No

UseAnalyzer=Yes

HeuristicLevel=Recommended

UseIChecker=Yes

ScanPriority=Normal

DeviceNameMasks.item_0000=/**

[ScanScope.item_0000]

AreaDesc=All objects

UseScanArea=Yes

Path=/

AreaMask.item_0000=*

Page top
[Topic 246946]

Custom Scan task configuration file

ScanFiles=Yes

ScanBootSectors=No

ScanComputerMemory=No

ScanStartupObjects=No

ScanArchived=Yes

ScanSfxArchived=Yes

ScanMailBases=No

ScanPlainMail=No

TimeLimit=0

SizeLimit=0

FirstAction=Recommended

SecondAction=Skip

UseExcludeMasks=No

UseExcludeThreats=No

ReportCleanObjects=No

ReportPackedObjects=No

ReportUnprocessedObjects=No

UseAnalyzer=Yes

HeuristicLevel=Recommended

UseIChecker=Yes

ScanPriority=High

DeviceNameMasks.item_0000=/**

[ScanScope.item_0000]

AreaDesc=All objects

UseScanArea=Yes

Path=/

AreaMask.item_0000=*

Page top
[Topic 198085]

Critical Areas Scan task configuration file

ScanFiles=No

ScanBootSectors=Yes

ScanComputerMemory=Yes

ScanStartupObjects=Yes

ScanArchived=Yes

ScanSfxArchived=Yes

ScanMailBases=No

ScanPlainMail=No

TimeLimit=0

SizeLimit=0

FirstAction=Recommended

SecondAction=Skip

UseExcludeMasks=No

UseExcludeThreats=No

ReportCleanObjects=No

ReportPackedObjects=No

ReportUnprocessedObjects=No

UseAnalyzer=Yes

HeuristicLevel=Recommended

UseIChecker=Yes

ScanPriority=Normal

DeviceNameMasks.item_0000=/**

[ScanScope.item_0000]

AreaDesc=All objects

UseScanArea=Yes

Path=/

AreaMask.item_0000=*

Page top
[Topic 198086]

Update task configuration file

SourceType="KLServers"

UseKLServersWhenUnavailable=Yes

ApplicationUpdateMode=DownloadOnly

ConnectionTimeout=10

Page top
[Topic 198088]

Storage management task configuration file

DaysToLive=90

BackupSizeLimit=0

BackupFolder=/var/opt/kaspersky/kess/common/objects-backup/

Page top
[Topic 198089]

System Integrity Monitoring task configuration file

UseExcludeMasks=No

[ScanScope.item_0000]

AreaDesc=Kaspersky internal objects

UseScanArea=Yes

Path=/opt/kaspersky/kess/

AreaMask.item_0000=*

Page top
[Topic 198091]

Firewall Management task configuration file

DefaultIncomingAction=Allow

DefaultIncomingPacketAction=Allow

OpenNagentPorts=Yes

[NetworkZonesTrusted]

[NetworkZonesLocal]

[NetworkZonesPublic]

Page top
[Topic 198090]

Anti-Cryptor task configuration file

UseHostBlocker=Yes

BlockTime=30

UseExcludeMasks=No

[ScanScope.item_0000]

AreaDesc=All shared directories

UseScanArea=Yes

Path=AllShared

AreaMask.item_0000=*

Page top
[Topic 198092]

Web Threat Protection task configuration file

UseTrustedAddresses=Yes

ActionOnDetect=Block

CheckMalicious=Yes

CheckPhishing=Yes

UseHeuristicForPhishing=Yes

CheckAdware=No

CheckOther=No

Page top
[Topic 198093]

Device Control task configuration file

RulesAction=ApplyRules

[DeviceClass]

HardDrive=DependsOnBus

RemovableDrive=DependsOnBus

Printer=DependsOnBus

FloppyDrive=DependsOnBus

OpticalDrive=DependsOnBus

Modem=DependsOnBus

TapeDrive=DependsOnBus

MultifuncDevice=DependsOnBus

SmartCardReader=DependsOnBus

PortableDevice=DependsOnBus

WiFiAdapter=DependsOnBus

NetworkAdapter=DependsOnBus

BluetoothDevice=DependsOnBus

ImagingDevice=DependsOnBus

SerialPortDevice=DependsOnBus

ParallelPortDevice=DependsOnBus

InputDevice=DependsOnBus

SoundAdapter=DependsOnBus

[DeviceBus]

USB=Allow

FireWire=Allow

[Schedules.item_0000]

ScheduleName=Default

DaysHours=All

[HardDrivePrincipals.item_0000]

Principal=\Everyone

[HardDrivePrincipals.item_0000.AccessRules.item_0000]

UseRule=Yes

ScheduleName=Default

Access=Allow

[RemovableDrivePrincipals.item_0000]

Principal=\Everyone

[RemovableDrivePrincipals.item_0000.AccessRules.item_0000]

UseRule=Yes

ScheduleName=Default

Access=Allow

[FloppyDrivePrincipals.item_0000]

Principal=\Everyone

[FloppyDrivePrincipals.item_0000.AccessRules.item_0000]

UseRule=Yes

ScheduleName=Default

Access=Allow

[OpticalDrivePrincipals.item_0000]

Principal=\Everyone

[OpticalDrivePrincipals.item_0000.AccessRules.item_0000]

UseRule=Yes

ScheduleName=Default

Access=Allow

Page top
[Topic 233812]

Removable Drives Scan task configuration file

ScanRemovableDrives=NoScan

ScanOpticalDrives=NoScan

BlockDuringScan=No

Page top
[Topic 198095]

Network Threat Protection task configuration file

ActionOnDetect=Block

BlockAttackingHosts=Yes

BlockDurationMinutes=60

UseExcludeIPs=No

Page top
[Topic 198119]

Container Scan task configuration file

ScanArchived=Yes

ScanSfxArchived=Yes

ScanMailBases=No

ScanPlainMail=No

TimeLimit=0

SizeLimit=0

FirstAction=Recommended

SecondAction=Skip

UseExcludeMasks=No

UseExcludeThreats=No

ReportCleanObjects=No

ReportPackedObjects=No

ReportUnprocessedObjects=No

UseAnalyzer=Yes

HeuristicLevel=Recommended

UseIChecker=Yes

ScanContainers=Yes

ContainerNameMask=*

ScanImages=Yes

ImageNameMask=*

DeepScan=No

ScanPriority=Normal

ContainerScanAction=StopContainerIfFailed

ImageAction=Skip

You can also use the settings in this configuration file for the Custom Container Scan task, except for the ScanPriority=Normal setting. For the Custom scan task, set the value of this setting to ScanPriority=High.

Page top
[Topic 198097]

Behavior Detection task configuration file

UseTrustedPrograms=No

TaskMode=Block

Page top
[Topic 234862]

Application Control task configuration file

AppControlMode=DenyList

AppControlRulesAction=ApplyRules

Page top
[Topic 246944]

Inventory task configuration file

ScanScripts=Yes

ScanBinaries=Yes

ScanAllExecutable=Yes

ScanPriority=Normal

CreateGoldenImage=No

[ScanScope.item_0000]

AreaDesc=All objects

UseScanArea=Yes

Path=/usr/bin

AreaMask.item_0000=*

Page top
[Topic 198087]