Contents
- Appendix 3. Configuration files and default application settings
- Rules for editing application task configuration files
- Preset configuration files
- Default settings for command line tasks
- Default settings for the File_Threat_Protection task (ID:1)
- Default settings for the Scan_My_Computer task (ID:2)
- Default settings for the Scan_File task (ID:3)
- Default settings for the Critical_Areas_Scan task (ID:4)
- Default settings for Update task (ID:6)
- Default settings for the Web_Threat_Protection task (ID:14)
- Default settings for the Removable_Drives_Scan task (ID:16)
- Default settings for the Behavior_Detection task (ID:20)
- General application settings
- Encrypted connections scan settings
- Tasks schedule settings
Appendix 3. Configuration files and default application settings
The following configuration files are used for managing the Kaspersky application:
- The configuration file that contains the initial configuration settings of the application and is used when installing the application on the command line.
- Preset configuration files generated automatically during the initial configuration of the application and containing the options set during the initial configuration. These settings are applied at run time.
- Configuration files that you can create with Kaspersky management commands. These configuration files may contain task settings and other application settings. You can modify these files and import into the application to modify the corresponding options.
Rules for editing application task configuration files
When editing a configuration file, adhere to the following rules:
- Specify all mandatory settings in the configuration file. You can specify individual task settings without a file using the command line.
- If a setting belongs to a certain section, specify it only in this section. You can specify the settings in any order within the one section.
- Enclose the names of sections in square brackets [ ].
- Enter the values of settings in the format
<
setting name
>=<
setting value
>
(spaces between the a setting name and its value are not processed).Example:
[ScanScope.item_0000]
AreaDesc=Home
AreaMask.item_0000=*doc
Path=/home
Space and tab characters are ignored before the first quotation mark and after the last quotation mark of a string value, and at the beginning and end of a string value that is not enclosed in quotation marks.
- If you need to specify several values for a setting, repeat the setting the same number of times as the number of values that you want to specify.
Example:
AreaMask.item_0000=*xml
AreaMask.item_0001=*doc
- Be case-sensitive when entering values for the following types of settings:
- Names (masks) of scanned objects and excluded objects.
- Names (masks) of threats.
The remaining setting values are not case-sensitive.
- Specify Boolean setting values as follows:
Yes
/No
. - Use quotation marks to enclose string values containing a space character (for example, names of files and directories and their paths, expressions containing the date and time in the format "YYYY-MM-DD HH:MM:SS").
You can enter the remaining values with or without quotation marks.
Example:
AreaDesc="
Scanning of email databases
"
A single quotation mark in the beginning or end of a string is considered an error.
Preset configuration files
After the initial configuration, the application creates the following configuration files:
- /var/opt/kaspersky/kfl/common/agreements.ini
The agreements.ini configuration file contains settings related to the End User License Agreement, Privacy Policy, and Kaspersky Security Network Statement.
- /var/opt/kaspersky/kfl/common/kfl.ini
The kfl.ini configuration file contains the settings described in the following table.
If necessary, you can edit the values of the settings in these files.
The default values in these files should be changed only under the supervision of Technical Support specialists and in accordance with their instructions.
Settings in the kfl.ini configuration file
Setting |
Description |
Values |
---|---|---|
The [General] section contains the following settings: |
||
|
The locale used for texts (events, notifications, task results, and others). The locale of the application interface and the command line interface depends on the value of the |
The locale in the format specified by RFC 3066. If the |
|
Format of the installed application package. This setting does not affect the operation of the application. The value of the setting is filled in automatically during initial application configuration. |
|
|
Indicates use of fanotify notifications. This setting does not affect the operation of the application. The value of the setting is filled in automatically during initial application configuration. |
|
|
Enables generation of trace files at application startup. |
|
|
Display information in trace files that may contain personal data (for example, passwords). |
|
|
Enables asynchronous tracing, in which information is logged to trace files in asynchronously. |
|
|
Enables the creation of a dump file when application failure occurs. |
|
|
Path to the directory where the dump files are stored. |
Default value: /var/opt/kaspersky/kfl/common/dumps. Root privileges are required to access the default dump file directory. |
|
The minimum amount of disk memory that will remain after writing a dump file, in megabytes. |
Default value: 300. |
|
Limit on the application's use of memory in megabytes. |
Default value: 8192. |
|
The user's unique device ID. |
The value of the setting is filled in automatically during installation of the application. |
|
Path to a socket for a remote connection used, for example, by the application interface and the kfl-control utility. |
Default value: /var/run/bl4control. |
|
Limit on the number of subscriptions to changes in files and directories (user watches) in /proc/sys/fs/inotify/max_user_watches. |
Default value: 300000. |
|
Limit on the number of subscriptions to changes in files and directories for a single user. |
Default value: 2048. |
|
The number of environment variables that the application captures from the command call. |
Default value: 50. |
|
Number of arguments that the application captures from the exec call. |
Default value: 20. |
|
Indicates use of a public DNS. If there are errors accessing servers through the system DNS, the application uses a public DNS. This is needed for updating application databases and maintaining device security. The application will use the following public DNSes in this order:
|
The application's requests may contain domain addresses and the user's external IP address, since the application establishes a TCP/UDP connection with the DNS server. This information is necessary, for example, to check the certificate of a web resource when interacting via HTTPS. If the application is using a public DNS server, data processing rules are governed by the Privacy Policy of the corresponding service. If you need to block the application from using a public DNS server, contact Technical Support for a private patch. |
The [Network] section contains the following settings: |
||
|
A mark in the iptables rules for forwarding traffic to the application for processing by Web Threat Protection component. You may need to change this mark if a device with the application runs other software that uses the ninth bit of the TCP packet mask, and a conflict occurs. |
A decimal value or hexadecimal number with the prefix 0x. Default value: 0x100. |
|
A mark used to indicate packets created or scanned by the application, so that the application does not scan them again. |
A decimal value or hexadecimal number with the prefix 0x. Default value: 0x400. |
|
A mark used to indicate packages created or scanned by the application to prevent them from being logged by the iptable utility. |
A decimal value or hexadecimal number with the prefix 0x. Default value: 0x800. |
|
Number of the routing table. |
Default value: 101. |
The [Watchdog] section contains the following settings: |
||
|
Maximum time to wait for the kfl process to finish from the moment the Watchdog server sends the HEADSHOT signal to the kfl process. |
Default value: 2 minutes.
|
|
Maximum time to wait for the application to start (in minutes), after which the kfl process is restarted. |
Default value: 3 minutes. |
|
Maximum time to wait for the controlled kfl process to complete from the moment the Watchdog server sends the SIGKILL signal to the kfl process. If the kfl process does not finish before this time elapses, the action specified by the --failed-kill setting is performed. |
Default value: 2 days. |
|
The interval with which the application attempts to send a PONG message to a server in response to a received PING message. |
Default value: 2000 ms. |
|
Maximum number of consecutive unsuccessful attempts to start the application. |
Default value: 5. |
|
Maximum time interval during which the application should send a message to the Watchdog server. If a message is not received from the application within this time interval, the Watchdog server begins the procedure to terminate the kfl process. |
Default value: 2 minutes. |
|
Maximum time from the start of the kfl process to the moment when a connection with the Watchdog server is established by the application. If the application does not establish a connection in this time interval, the Watchdog server begins the procedure to terminate the kfl process. |
Default value: 3 minutes. |
|
Maximum time from the moment the application connects to the Watchdog server to the moment the server receives a REGISTER message. |
Default value: 500 ms. |
|
Maximum time to wait for the kfl process to finish from the moment the Watchdog server sends the SHUTDOWN signal to the kfl process. |
Default value: 2 minutes. |
|
Limit on the use of resident memory by the kfl process. If the kfl process uses more resident memory than this limit, the Watchdog server begins the procedure to terminate the kfl process. |
Default value: |
|
Limit on the use of virtual memory by the kfl process. If the kfl process uses more virtual memory than this limit, the Watchdog server begins the procedure to terminate the kfl process. |
|
|
Limit on the size of the swap file of the kfl process. If the swap file of the kfl process exceeds this limit, the Watchdog server begins the procedure to terminate the kfl process. |
|
|
Enabling application stability monitoring. If application stability monitoring is enabled, the Watchdog server tracks the number of abnormal halts of the application. |
|
|
The path to the file used for application stability monitoring. |
Default value: /var/opt/kaspersky/kfl/private/kfl_health.log. |
|
Time interval (in seconds) in which the application must experience the specified number of abnormal halts before displaying a notification about unstable operation. |
Default value: 3600 seconds |
|
Number of abnormal halts of the application that are required before displaying a notification about unstable application operation. |
Default value: 10. If the value is 0, an unstable application notification is not displayed. |
|
Time interval (in seconds) after which the application's unstable status will be cleared. |
Default value: 86400 seconds. |
Default settings for command line tasks
This section contains the default options for all predefined tasks that are provided for managing the Kaspersky application on the command line.
The Rollback and License tasks have no settings.
Default settings for the File_Threat_Protection task (ID:1)
ScanArchived=No
ScanSfxArchived=No
ScanMailBases=No
ScanPlainMail=No
SkipPlainTextFiles=No
TimeLimit=60
SizeLimit=0
FirstAction=Recommended
SecondAction=Block
UseExcludeMasks=No
UseExcludeThreats=No
ReportCleanObjects=No
ReportPackedObjects=No
ReportUnprocessedObjects=No
UseAnalyzer=Yes
HeuristicLevel=Recommended
UseIChecker=Yes
ScanByAccessType=SmartCheck
[ScanScope.item_0000]
AreaDesc=All objects
UseScanArea=Yes
Path=/
AreaMask.item_0000=*
Default settings for the Scan_My_Computer task (ID:2)
ScanFiles=Yes
ScanBootSectors=Yes
ScanComputerMemory=Yes
ScanStartupObjects=Yes
ScanArchived=Yes
ScanSfxArchived=Yes
ScanMailBases=No
ScanPlainMail=No
TimeLimit=0
SizeLimit=0
FirstAction=Recommended
SecondAction=Skip
UseExcludeMasks=No
UseExcludeThreats=No
ReportCleanObjects=No
ReportPackedObjects=No
ReportUnprocessedObjects=No
UseAnalyzer=Yes
HeuristicLevel=Recommended
UseIChecker=Yes
UseGlobalExclusions=Yes
UseOASExclusions=Yes
DeviceNameMasks.item_0000=/**
[ScanScope.item_0000]
AreaDesc=All objects
UseScanArea=Yes
Path=/
AreaMask.item_0000=*
Default settings for the Scan_File task (ID:3)
ScanFiles=Yes
ScanBootSectors=No
ScanComputerMemory=No
ScanStartupObjects=No
ScanArchived=Yes
ScanSfxArchived=Yes
ScanMailBases=No
ScanPlainMail=No
TimeLimit=0
SizeLimit=0
FirstAction=Recommended
SecondAction=Skip
UseExcludeMasks=No
UseExcludeThreats=No
ReportCleanObjects=No
ReportPackedObjects=No
ReportUnprocessedObjects=No
UseAnalyzer=Yes
HeuristicLevel=Recommended
UseIChecker=Yes
UseGlobalExclusions=Yes
UseOASExclusions=Yes
DeviceNameMasks.item_0000=/**
[ScanScope.item_0000]
AreaDesc=All objects
UseScanArea=Yes
Path=/
AreaMask.item_0000=*
Default settings for the Critical_Areas_Scan task (ID:4)
ScanFiles=No
ScanBootSectors=Yes
ScanComputerMemory=Yes
ScanStartupObjects=Yes
ScanArchived=Yes
ScanSfxArchived=Yes
ScanMailBases=No
ScanPlainMail=No
TimeLimit=0
SizeLimit=0
FirstAction=Recommended
SecondAction=Skip
UseExcludeMasks=No
UseExcludeThreats=No
ReportCleanObjects=No
ReportPackedObjects=No
ReportUnprocessedObjects=No
UseAnalyzer=Yes
HeuristicLevel=Recommended
UseIChecker=Yes
UseGlobalExclusions=Yes
UseOASExclusions=Yes
DeviceNameMasks.item_0000=/**
[ScanScope.item_0000]
AreaDesc=All objects
UseScanArea=Yes
Path=/
AreaMask.item_0000=*
Default settings for Update task (ID:6)
SourceType=KLServers
UseKLServersWhenUnavailable=Yes
ApplicationUpdateMode=DownloadOnly
ConnectionTimeout=10
Default settings for the Web_Threat_Protection task (ID:14)
UseTrustedAddresses=Yes
ActionOnDetect=Block
CheckMalicious=Yes
CheckPhishing=Yes
UseHeuristicForPhishing=Yes
CheckAdware=No
CheckOther=No
Default settings for the Removable_Drives_Scan task (ID:16)
ScanRemovableDrives=NoScan
ScanOpticalDrives=NoScan
BlockDuringScan=No
Default settings for the Behavior_Detection task (ID:20)
UseTrustedPrograms=No
TaskMode=Block
General application settings
General application settings define the operation of the application as a whole and the operation of individual functions.
General application settings
Setting |
Description |
Values |
---|---|---|
|
Directory that stores the Samba configuration file. The Samba configuration file is required to ensure that the |
The standard directory of the SAMBA configuration file on the computer is specified by default. Default value: /etc/samba/smb.conf. The application must be restarted after this setting is changed. |
|
The directory where the NFS configuration file is stored. The NFS configuration file is required to ensure that the |
The standard directory of the NFS configuration file on the computer is specified by default. Default value: /etc/exports. The application must be restarted after this setting is changed. |
|
Enable application tracing and the level of detail in the trace files. |
|
|
The directory that stores the application trace files. |
Default value: /var/log/kaspersky/kfl. If you specify a different directory, make sure that the user under which the Kaspersky application is running has read/write permissions for this directory. Root privileges are required to access the default trace files directory. The application must be restarted after this setting is changed. |
|
Maximum number of application trace files. |
1–10000 Default value: 10. The application must be restarted after this setting is changed. |
|
Specifies the maximum size of an application trace file (in megabytes). |
1–1000 Default value: 500. The application must be restarted after this setting is changed. |
|
Blocks access to files for which the full path length exceeds the defined settings value specified in bytes. If the length of the full path to the scanned file exceeds the value of this setting, scan tasks skip this file during scanning. This setting is not available for operating systems that use the fanotify technology. |
4096–33554432 Default value: 16384. After changing the value of this setting, the File Threat Protection task needs to be restarted. |
|
Enable detection of legitimate applications that intruders can use to compromise devices or data. |
|
|
Enabling the file operation intercept mode with blocking access to files for the duration of the scan. The file operation interception mode affects the operation of the File Threat Protection component. |
|
|
Enabling Kaspersky Security Network usage: |
|
|
Enables use of a proxy server by components of the Kaspersky application. A proxy server can be used to communicate with Kaspersky Security Network, to activate the application, and when updating application databases and modules. |
|
|
Proxy server options in the format: [ When connecting via an HTTP proxy, we recommend to use a separate account that is not used to sign in to other systems. An HTTP proxy uses an insecure connection, and the account may be compromised. |
— |
|
The maximum number of events stored by the application. When the specified number of events is exceeded, the application deletes the oldest events. |
Default value: 500000. If 0 is specified, events are not saved. |
|
The maximum number of custom scan tasks that a non-privileged user can simultaneously start on the device. This setting does not limit the number of tasks that a user with root privileges can start. |
0–4294967295 Default value: 0. If 0 is specified, a non-privileged user cannot start custom scan tasks. If you installed the application interface package when installing the application, the |
|
Enable logging of information about events to syslog Root privileges are required to access syslog. |
|
|
The database directory where the application saves information about events. Root privileges are required to access the default event database. |
Default value: /var/opt/kaspersky/kfl/private/storage/events.db. |
|
The mount point to exclude from the scan scope. This exclusion applies to the File Threat Protection component and the Removable Drives Scan task, and is also configured for scan tasks (of the ODS type). You can specify several mount points to be excluded from scans. Mount points must be specified in the same way as they are displayed in the The |
|
|
Exclude process memory from scans. The application does not scan the memory of the indicated process. |
|
|
Enables a limit on CPU resource usage by scan tasks of the ODS type. |
|
|
The maximum utilization of all processor cores (as a percentage) when running tasks of the ODS type. |
10–100 Default value: 100. |
|
Time period for storing objects in the Backup storage (in days). After the specified time has elapsed, the application deletes the oldest backup copies of files. To remove the object retention limit, set 0. |
0–10000 0–unlimited retention. Default value: 30. |
|
Maximum Backup size in MB. When the maximum Backup storage size is reached, the application deletes the oldest backup copies of files. To remove the Backup size limit, set 0. |
0–999999 0–unlimited size. Default value: 0. |
|
Path to the Backup directory. You can specify a custom Backup storage directory that is different from the default directory. You can use directories on any device as the Backup storage. It is not recommended to assign directories that are located on remote devices, such as those mounted via the Samba and NFS protocols. If the specified directory does not exist or is unavailable, the application uses the default directory. |
Default value: /var/opt/kaspersky/kfl/common/objects-backup/ Root privileges are required to access the default Backup storage directory. |
Encrypted connections scan settings
Encrypted connections scan settings
Setting |
Description |
Values |
---|---|---|
|
Enables or disables encrypted traffic scan. For the FTP protocol, secure connections scan is disabled by default. |
|
|
Specifies the action to perform when a secure connection scan error occurs on a website. |
|
|
Specifies the way the Kaspersky application verifies certificates. If a certificate is self-signed, the application does not perform additional verification. |
|
|
The action to take when an unconfirmed certificate is detected. |
|
|
Using exclusions when scanning encrypted traffic. |
|
|
Specifies the way the Kaspersky application monitors network ports. |
Specifying this value may significantly increase an operating system load. |
The [Exclusions.item_#] section contains domains excluded from scans. The application does not scan secure connections established when visiting specified domains. |
||
|
Specifies the domain name. You can use masks to specify the domain. |
The default value is not defined. |
The [NetworkPorts.item_#] section contains the network ports monitored by the application. |
||
|
Network port description. |
The default value is not defined. |
|
Network port numbers to be monitored by the application. |
The default value is not defined. |
Tasks schedule settings
Task start schedule settings
Setting |
Description |
Values |
---|---|---|
|
Task launch schedule. |
|
|
Task start date and time. The |
|
|
A time interval from 0 to the specified value (in minutes), which will be added to the task start time to avoid starting tasks at the same time. |
|
|
Run a missed task after the application starts. |
|