Kaspersky Anti-Virus 5.6 for Sendmail with Milter API Critical Fix 2 (5.6.20.2) - RELEASE NOTES 
================================================================================
Released on: (2006-09-15) 

Contents:
  * Fixed Problems
  * Product Overview
  * System Requirements
  * Product Installation & Upgrade
  * Known Issues & Workarounds
  * Troubleshooting & Support
  * SNMP Additional Notes



Fixed Problems
--------------------------------------------------------------------------------
 * (12767) On certain Sendmail versions, the header replacement done by
   libmilter to add x-headers additional info was erroneous because of kavmilter
   providing a full CRLF sequence, whereas libmilter requires only LF and adds
   CRs automatically. When x-headers feature was on, this behavior broke the
   header format. 

 * (14166) the SNMP MIB files were including 'REVISION' and 'DESCRIPTION' from
   SNMPv2-SMI, which produced errors upon import on some systems. These two
   items where removed from the import list.

 * (11456) %HEADERS% mail message template macro is not processed


Product Overview
-------------------------------------------------------------------------------
Kaspersky Anti-Virus for Sendmail with Milter API (KAVMilter) is an anti-virus 
and content filtering milter. As a Sendmail milter, it connects directly 
into the incoming and outgoing mail traffic, scanning all messages as they 
pass.

Unlike the other KAV products for mail-servers, KAVMilter is a stand-alone 
program that doesn't use a separate scanning service. Everything is run & 
supervised by a single program.

Please note that KAVMilter configuration differs slightly from the other KAV
for mail-servers product, so if you want to migrate, read the Administration 
Guide carefully.



System Requirements
-------------------------------------------------------------------------------
For smooth operation of Kaspersky Anti-Virus for Sendmail with Milter API, your
mail server must meet the following hardware and software requirements:

Minimum hardware requirements for program operation:
  * Intel Pentium 133 MHz processor or higher
  * 32 MB RAM
  * 100 MB available space on your hard drive (this amount does not include
    space necessary for storing backup message copies).

Minimum hardware requirements for a mail server with about 800 MB of traffic
per day (250-300 mail accounts (addresses)):
  * Celeron (Mendocino) 400 MHz processor
  * 512 MB RAM
  * 8 GB available space on your hard drive (this amount does not include
    space necessary for storing backup message copies).

Optimal hardware requirements:
  * For a mail server with about 800 MB of traffic per day (250-300 mail 
    accounts/addresses):
      + 2xPentium Xeon 1,8 GHz processor
      + 1 GB RAM
      + 100 MB available space on your hard drive (for Kaspersky Anti-
        Virus operation).

  * For a mail server with about 400 MB of traffic per day2 (100-150 mail 
    accounts/addresses):
      + Pentium III 900 MHz processor
      + 512 MB RAM.

Software requirements:
  1. One of the following operating systems:
      * Red Hat Enterprise Linux Advanced Server 4
      * Red Hat Linux 9.0
      * Fedora Core 3
      * SuSE Linux Enterprise Server 9.0
      * SuSE Linux Professional 9.3
      * Debian 3.1
      * Mandrakelinux 10.1
      * FreeBSD 4.10, 5.4
      * OpenBSD 3.6
  2. Sendmail version 8.11.x or higher with Milter API (installed)
  3. [optional] Webmin program (www.webmin.com) (installed) to manage Kaspersky
     Anti-Virus from a remote location.
  4. [optional] If you want to use SNMP functionality with NET-SNMP then you 
     should install net-snmp 5.2.1.2 or later.



Product Installation & Upgrade
-------------------------------------------------------------------------------
To install the product use the system specific command:
  on Linux/RPM:       rpm  -i <package>.rpm
  on Linux/Debian:    dpkg -i <package>.deb
  on FreeBSD/OpenBSD: pkg_add <distro-specific-name>.tgz

To upgrade the product to a newer version use:
  on Linux/RPM:       rpm -U  <package>.rpm
  on Linux/Debian:    dpkg -i <package>.deb
  on FreeBSD/OpenBSD: pkg_add <distro-specific-name>.tgz
  
If you don't have Sendmail installed from a package, because it might be 
required as dependency, you should use:
  rpm -i  --nodeps         <package> (for RPM based)
  rpm -i  --nodeps --force <package> (for other conflicts, RPM based)
  pkg_add -f               <package> (on BSDs)
to override dependencies checking. 

If you want to install from a tarball, you might convert the package into
a tar archive using "alien" or "rpm2tgz" tools. For proper installation and
operation, we still recommend using the specific packages.

The product should configure everything upon installation, namely:
  * create "kav" user if it does not exist;
  * add product update information;
  * add trial keys (if any);
  * detect local domain and sub-domains and add them to configuration;
  * register "kavmilterd" as a service (to be launched upon start-up);
  * modify Sendmail configuration file(s) to add "KAVMilter" filter;
  * register backup(quarantine) cleanup script to "kav" user's cron;
  * register updater script to "kav" user's cron;
  * install kavmilter webmin module (if webmin is present.)

All these changes should be made automatically without your intervention.
If you do not want the auto configuration executed at install time, you can
skip it by using
  on Linux/RPM:       rpm -i --noscripts <package>.rpm
  on Linux/Debian:    dpkg --unpack <package>.deb
  on FreeBSD/OpenBSD: pkg_add -I <distro-package>.tgz

And configure the product later, using kavmilter-setup.sh.

To check that setup modifications were made, you can use the setup script:
  kavmilter-setup.sh -check-<option>



Known Issues & Workarounds
--------------------------------------------------------------------------------
Notes & Known Issues:

  * (14865) The troubleshooter.sh may report "ERROR: bad configuration file" on
  valid configuration - this happens because it runs "kavmilter -t" which may
  create some predefined run-time files (e.g. statistics.data) with the rights
  of the superuser, but then fail the test because those files are not readable
  by the kav user (configured as RunAsUid/RunAsGid).

  * The snmp agentx registration may fail on some setups. Be sure to have snmpd
  properly configured and started before kavmilter is started. Also if you are
  using local Unix socket, ensure that 'kav' user can access it.
  
  * The license may appear as expired one hour earlier than the actual moment.

  * If you use a local Unix socket for KAVMilter filter, Sendmail may refuse to 
  start if the path has group/world writable directories.

  * When a message is found infected by analyzing it as a whole, but the part
  scanning found it clean, it is considered to be a malformed/MIME exploit and
  "warn" action is taken (future releases will allow customization of this
  action too.) 

  * The backup-sweeper.sh utility will report backup size only when reaching
  warning or critical limits.

  * If installed Webmin is older than 1.150 version, or uses the extra_root for 
  installing other modules, you might get some warning at install time (or when
  kavmilter-setup.sh is called with -add-webmin-module.) You can safely ignore 
  them, as the setup script attempts a workaround, but you should check 
  afterwards if the module was correctly installed.


Problems & Workarounds:

  * (14865) Configuration error on statistics.data - when running kavmilter -t
  (test mode) or the troubleshooter.sh, this file may be created with root
  ownership, but later when kavmilter is started, may give an error about access
  rights. To overcome this, simply delete statistics.data and try again to start
  the service.

  * (11161) Wrong permissions on kavmilter.log makes kavmilter exit with error.
  To avoid this problem, please do one of the following:
  - add "umask 0002" right before starting kavmilter in "kavmilter.sh" or
   "kavmilterd" service init scripts. This way the file fill be created group
    writeable.
  - do a "touch <log-file> && chown kav:kav <log-file>" right before start

  * (Re)Installation - when you remove the KAVMilter package, its configuration
  and log files are kept, but because previously they were owned by kav user, 
  they may end up with no proper owner. If you later reinstall the product, 
  depending on your system, it may preserve the latest existing configuration, 
  so you need to manually adjust it, and also set proper rights on files.
  
  * When AlertThreshold is checked, the product counts the weight of infected 
  messages in all scanned messages, and to avoid exploits the product also 
  scans all notifications. 
  That may have the undesired side effect of lowering the weight, because extra
  clean messages are counted besides the real traffic. If you have notifications
  enabled and want to use the outbreak trap feature we recommend lowering the 
  threshold accordingly for each active type of additional notification 
  (i.e. recipients and admin.)
  
  * The disclaimer is not shown in-line with some MUAs (such as Outlook 
  2000/2003).  Please see, for example: 
  http://support.microsoft.com/default.aspx?scid=kb;en-us;814111

  * Webmin / No reload after editing config - after changing the configuration 
  setting in Webmin (either "Config edit" or settings), KAVMilter is NOT 
  reloaded. This is for administration convenience so protection is not 
  interrupted. To apply new changes go to "AV Run" screen and restart.

  * Webmin / Failed installation on Debian - use one of the following methods:
    ~ Install an original webmin version from the sources available at 
      www.webmin.com.
    ~ Upgrade webmin to version >= 1.210a-2 unstable and
        cp /usr/local/share/webmin/kavmilter/config to /etc/webmin/kavmilter/config 
      after the product is installed.
    ~ Execute the following commands after product installation:
        cp /usr/local/share/webmin/kavmilter/config to /etc/webmin/kavmilter/config 
        ln -s /usr/share/webmin/web-lib.pl /usr/local/share/webmin/web-lib.pl  

  * Webmin / Broken installer warning - on some systems you may get a broken
  webmin installer warning upon product install. You can safely ignore it, and
  also check via Webmin interface that the module installed corectly.


Other Known Problems:

  * (09391) If you configure NotifyAdmin to have 'update' option, then you 
  may get a duplicate notification if you do 'reload' instead of 'bases' 
  when new bases are downloaded and loaded (see PostUpdateCmd option.)



Troubleshooting & Support
--------------------------------------------------------------------------------
To check that setup modifications were made, you can use the setup script:
  kavmilter-setup.sh -check-<option>

To further troubleshoot the sanity of kavmilter you can use:
  troubleshooter.sh -check

To send a problem report to Kaspersky Lab Support for further investigations
you can use:
  troubleshooter.sh         (interactive)
  troubleshooter.sh -report (non-interactive)

For other issues please contact <support@kaspersky.com>. You are encouraged
to use "troubleshooter.sh" to compose an interactive report (that will gather
relevant information from your system.)



SNMP Additional Notes
--------------------------------------------------------------------------------
Since 5.6 versions, KAVMilter comes with SNMP support. That is, read only 
requests for product configuration, statistics counters and update status, 
and SNMP traps on specific events.

When activated, the product becomes a sub-agent for an agent you need to 
configure. It will talk to its master agent using AgentX protocol. The master 
agent can be any SNMP product supporting sub-agents, but we recommend NET-SNMP 
5.2.1.2 or newer.

For NET-SNMP, to enable sub-agent support you need to add in snmpd.conf:
  "master agentx"

And configure properly the listening socket, e.g.:
  "AgentXSocket 127.0.0.1:705"

Note that by default NET-SNMP listens on a UNIX domain socket with restrictive 
permissions, and you might need to allow access by kav user, e.g.:
  "AgentXPerms 770 770 root kav"

If you want to receive product traps, you need to configure a trap sink, e.g.:
  "trapsink localhost"

Remember you must start snmpd and snmptrapd services *before* kavmilter, so
the sub-agent can register with snmpd.