# e2guardian filter group config file for version 5.4.4 # This file is re-read on gentle restart and any changes actioned ### Filtergroup config is now split into sections as follows ### ### QUICK_START - Items to check to get you started ### MITM - SSL MITM settings ### URL_FILTERING - URL filtering settings ### URL_MAIN_LISTS - URL/SITE lists - for downloaded lists(?) ### URL_LOCAL_LISTS - URL/SITE lists - local ### FILE_TYPES - Lists that control download filetype access ### TIMES - Time based lists ### APPS - Lists to control apps/browsers ### REFERER - Lists to allow exceptions based on referer site/url ### URL_MOD - Lists to modify url and ssl site target ### REDIRECT - Redirection list ### LOG_ONLY - Categorise and log but do not filter lists ### POST - Post filtering - not implimented yet in v5 ### PHRASES - Content phrase settings and lists ### SEARCH - Search term filtering settings and lists ### AV_SCANNERS - AV scanner settings and lists ### HEADER - HTTP Header handling ### BLOCK_PAGE - Block Page formats and handling ### BYPASS - Bypass settings and lists ### EMAILER - Emailer settings (experimental) ### OBSOLETE - Obsolete settings ### INFO - Info on new features etc ### ### QUICK_START section ### ### e2guardian will work using examplef1.story ### and the example.group sub-directory of the lists directory ### without you making any changes to this file. ### ### The items you are likely to need to change in production are ### in this section. ### ### To set up for production:- ### ### In config directory:- ### Copy examplef1.story to group1.story ### In list directory:- ### Create a group1 directory ### Copy the lists in lists/example.group into this directory ### and edit them to your requirements ### Comment out .define.., and storyboard = lines below. ### ### To add group two:- ### ### Copy this file to e2guardianf2.conf ### and repeat above steps, but for group2.story, lists/group2 directory etc ### ### Repeat for any further groups ### ### Remember to adjust the 'filtergroups' setting in e2guardian.conf ### to the number of groups you now have. #groupname = 'my_name_for_group' # # Filter group name # Used to fill in the -FILTERGROUP -placeholder in the HTML template file, and to # name the group in the access logs # Default 'group1' where 1 is the group number storyboard = '/etc/e2guardian/examplef1.story' # comment out for production # # Storyboard logic for this group # # defaults to '/etc/e2guardian/group1.story' where 1 is the group number .Define LISTDIR # comment out for production # The directory path for list files for this group # This path replaces __LISTDIR__ wherever it occurs below or in included files. # See INFO section for full details # defaults (initialized) as where 1 is the group number #naughtynesslimit = 60 # # Naughtiness limit # This the limit over which the page will be blocked. Each weighted phrase is given # a value either positive or negative and the values added up. Phrases to do with # good subjects will have negative values, and bad subjects will have positive # values. See the weightedphraselist file for examples. # As a guide: # 60 is for young children, 100 for old children, 160 for young adults. # default 60 ### ### END of QUICK_START section ### MITM section ### # NOTE to enable SSL MITM # enablessl must be defined as 'on' in e2guardian.conf #sslmitm = on # #SSL man in the middle # Forge ssl certificates for all non-exception sites, decrypt the data then re encrypt it # using a different private key. Used to filter ssl sites #default off # mitmcheckcert = on # # Enable MITM site certificate checking # ignored if sslmitm is off # default (recommended) is 'on' #Do not check ssl certificates for sites listed # Can be used to allow sites with self-signed or invalid certificates # or to reduced CPU load by not checking certs on heavily used sites (e.g. Google, Bing) # Use with caution! # Ignored if mitmcheckcert is 'off' # sitelist = 'name=nocheckcert,path=__LISTDIR__/nocheckcertsitelist' ipsitelist = 'name=nocheckcert,path=__LISTDIR__/nocheckcertsiteiplist' # # automitm = on # # Auto switch to MITM with upstream connection error or to deliver block page # ignored if sslmitm is off # To revert to v4 type behavour switch this off # Default is 'on' # greyssl lists only used in onlymitmsslgrey mode to define sites that # will be MITM sitelist = 'name=greyssl,path=__LISTDIR__/greysslsitelist' ipsitelist = 'name=greyssl,path=__LISTDIR__/greysslsiteiplist' sitelist = 'name=localgreyssl,path=__LISTDIR__/localgreysslsitelist' #ipsitelist = 'name=localgreyssl,path=__LISTDIR__/localgreysslsiteiplist' ### ### END of MITM section ### URL_FILTERING section ### #deepurlanalysis = off # Enable Deep URL Analysis # When enabled, E2 looks for URLs within URLs, checking against the bannedsitelist and # bannedurllist. This can be used, for example, to block images originating from banned # sites from appearing in Google Images search results, as the original URLs are # embedded in the thumbnail GET requests. # (on|off) default = off ### ### END of URL_FILTERING section ### URL_MAINLISTS section ### ### Most of the site/ipsite/url lists in this section are used for ### switching on/off standard list categories ### ### It is best to use the LOCAL lists for your own lists of sites/urls ### As these override the main ones. ## For info on the format of list definitions see notes/V5_list_definition ## Order of checking is broadly as follows:- ## ## 1. If in Local Exception lists - allow with no further checking ## 2. If in Local Grey lists - retrieve page and content-check ## 3. If in Local Banned lists - block with no further checking ## 4. If in Main Exception lists - allow with no further checking ## 5. If in Main Grey lists - retrieve page and content-check ## 6. If in Main Banned lists (or blanket blocked) - block with no further checking ## 7. If gets here - retrieve page and content-check ## 8. Check blocked/exception file/mime types. ## 9. Content-check page ## Exception lists sitelist = 'name=exception,messageno=602,path=__LISTDIR__/exceptionsitelist' ipsitelist = 'name=exception,messageno=602,path=__LISTDIR__/exceptionsiteiplist' urllist = 'name=exception,messageno=603,path=__LISTDIR__/exceptionurllist' regexpboollist = 'name=exception,messageno=609,path=__LISTDIR__/exceptionregexpurllist' ## Grey (i.e. content check) lists sitelist = 'name=grey,path=__LISTDIR__/greysitelist' ipsitelist = 'name=grey,path=__LISTDIR__/greysiteiplist' urllist = 'name=grey,path=__LISTDIR__/greyurllist' ## Banned sites/urls sitelist = 'name=banned,messageno=500,path=__LISTDIR__/bannedsitelist' ipsitelist = 'name=banned,messageno=510,path=__LISTDIR__/bannedsiteiplist' urllist = 'name=banned,messageno=501,path=__LISTDIR__/bannedurllist' regexpboollist = 'name=banned,messageno=503,path=__LISTDIR__/bannedregexpurllist' # 'bannedssl' lists are not currently used #sitelist = 'name=bannedssl,messageno=520,path=__LISTDIR__/bannedsslsitelist' #ipsitelist = 'name=bannedssl,messageno=520,path=__LISTDIR__/bannedsslsiteiplist' ### ### END of URL_MAINLISTS section ### URL_LOCAL_LISTS section ### ### if you do not want to use local lists ### then comment out (or remove) all the list entries in this section and ### make adjustments to site.story ### ## Local Exception lists sitelist = 'name=localexception,messageno=662,path=__LISTDIR__/localexceptionsitelist' ipsitelist = 'name=localexception,messageno=662,path=__LISTDIR__/localexceptionsiteiplist' urllist = 'name=localexception,messageno=663,path=__LISTDIR__/localexceptionurllist' ## Local Grey lists sitelist = 'name=localgrey,path=__LISTDIR__/localgreysitelist' ipsitelist = 'name=localgrey,path=__LISTDIR__/localgreysiteiplist' urllist = 'name=localgrey,path=__LISTDIR__/localgreyurllist' ## Local Banned lists sitelist = 'name=localbanned,messageno=560,path=__LISTDIR__/localbannedsitelist' ipsitelist = 'name=localbanned,messageno=560,path=__LISTDIR__/localbannedsiteiplist' urllist = 'name=localbanned,messageno=561,path=__LISTDIR__/localbannedurllist' ## Bannedssl lists are not currently used #sitelist = 'name=localbannedssl,messageno=580,path=__LISTDIR__/localbannedsslsitelist' #ipsitelist = 'name=localbannedssl,messageno=580,path=__LISTDIR__/localbannedsslsiteiplist' ### ### END of URL_LOCAL_LISTS section ### FILE_TYPES section ### # Uncomment the two lines below if want to ONLY allow extentions/mime types in these lists # You will also need to uncomment the checkfiletype function in site.story to enable this #fileextlist = 'name=exceptionextension,path=__LISTDIR__/exceptionextensionlist' #mimelist = 'name=exceptionmime,path=__LISTDIR__/exceptionmimetypelist' # Use the following lists to block specific kinds of file downloads. # fileextlist = 'name=bannedextension,messageno=900,path=__LISTDIR__/bannedextensionlist' mimelist = 'name=bannedmime,messageno=800,path=__LISTDIR__/bannedmimetypelist' # # In either file filtering mode, the following lists can be used to override # MIME type & extension blocks for particular domains & URLs (trusted download sites). # sitelist = 'name=exceptionfile,path=__LISTDIR__/exceptionfilesitelist' ipsitelist = 'name=exceptionfile,path=__LISTDIR__/exceptionfilesiteiplist' urllist = 'name=exceptionfile,path=__LISTDIR__/exceptionfileurllist' ### ### END of FILE_TYPES section ### TIMES section ### # NEW in v5.4 bannedtimelist - times when no access is allowed # To activate a storyboard change is required - see examplef1.story #timelist = 'name=bannedtimes,messageno=122,path=__LISTDIR__/bannedtimelist' # NEW in v5.4 blankettimelist - times when blanket block is applied # To activate a storyboard change is required - see examplef1.story #timelist = 'name=blankettimes,messageno=122,path=__LISTDIR__/blankettimelist' ### ### END of TIMES section ### APPS section ### ### These lists are useful for allowing/blocking apps or browsers based ### on the user-agent regexpboollist = 'name=banneduseragent,messageno=522,path=__LISTDIR__/bannedregexpuseragentlist' regexpboollist = 'name=exceptionuseragent,messageno=610,path=__LISTDIR__/exceptionregexpuseragentlist' ### ### END of APPS section ### REFERER section ### # refererexception lists are used to make a request an exception based on the # Referer header. sitelist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionsitelist' ipsitelist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionsiteiplist' urllist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionurllist' # Some sites have the referering url in their url. Put these url in these # lists and e2g will extract the embeded url and then check this againist # the refererexception lists. # For best results be as specific as possible sitelist = 'name=embededreferer,path=__LISTDIR__/../common/embededreferersitelist' ipsitelist = 'name=embededreferer,path=__LISTDIR__/../common/embededreferersiteiplist' urllist = 'name=embededreferer,path=__LISTDIR__/../common/embededrefererurllist' ### ### END of REFERER section ### URL_MOD section ### # change list is used to modify url on the fly # use to enforce safe search etc. # Do not try and change target site - use redirect for this. regexpreplacelist = 'name=change,path=__LISTDIR__/urlregexplist' # Replace target connection site for a ssl connection request # Note: this does not change the url in any way. It just changes # where the request is sent upstream and the new target must accept # the original url. regexpreplacelist = 'name=sslreplace,path=__LISTDIR__/sslsiteregexplist' ### ### END of URL_MOD section ### REDIRECT section ### # Used to redirect browser to different site and or url regexpreplacelist = 'name=redirect,path=__LISTDIR__/urlredirectregexplist' ### ### END of REDIRECT section ### LOG_ONLY section ### # Categorise without blocking: # Supply categorised lists here and the category string shall be logged against # matching requests, but matching these lists does not perform any filtering # action. #sitelist = 'name=log,path=__LISTDIR__/logsitelist' #ipsitelist = 'name=log,path=__LISTDIR__/logsiteiplist' #urllist = 'name=log,path=__LISTDIR__/logurllist' #regexpboollist = 'name=log,path=__LISTDIR__/logregexpurllist' ### ### END of LOG_ONLY section ### POST section ### #maxuploadsize = -1 # # POST protection (web upload and forms) # does not block forms without any file upload, i.e. this is just for # blocking or limiting uploads # measured in kibibytes after MIME encoding and header bumph # use 0 for a complete block # use higher (e.g. 512 = 512Kbytes) for limiting # use -1 for no blocking # NOTE: POST PROTECTION IS NOT YET IMPLIMENTED IN V5 #maxuploadsize = 512 #maxuploadsize = 0 # default -1 ### ### END of POST section ### ACCESS_LOG section ### # Do not log sites/urls/ext # Useful to prevent requests not made by user directly being logged # Makes logs more readable sitelist = 'name=nolog,path=__LISTDIR__//../common/nologsitelist' ipsitelist = 'name=nolog,path=__LISTDIR__//../common/nologsiteiplist' urllist = 'name=nolog,path=__LISTDIR__//../common/nologurllist' regexpboollist = 'name=nolog,path=__LISTDIR__//../common/nologregexpurllist' fileextlist = 'name=nolog,path=__LISTDIR__//../common/nologextensionlist' ### ### END of ACCESS_LOG section ### PHRASES section ### #weightedphrasemode = 0 # Weighted phrase mode # Optional; overrides the weightedphrasemode option in e2guardian.conf # for this particular group. See documentation for supported values in # that file. # textmimetypes = 'application/xhtml+xml,application/xml,application/json,application/javascript,application/x-javascript' # # Phrase filter additional mime types (by default just text/*) categorydisplaythreshold = 0 # # Category display threshold # This option only applies to pages blocked by weighted phrase filtering. # Defines the minimum score that must be accumulated within a particular # category in order for it to show up on the block pages' category list. # All categories under which the page scores positively will be logged; those # that were not displayed to the user appear in brackets. # # -1 = display only the highest scoring category # 0 = display all categories (default) # > 0 = minimum score for a category to be displayed bannedphraselist = '__LISTDIR__/bannedphraselist' weightedphraselist = '__LISTDIR__/weightedphraselist' exceptionphraselist = '__LISTDIR__/exceptionphraselist' ## To use oldphraselists comment out last 3 lines and ## uncomment the follwing 3 lines #bannedphraselist = '__LISTDIR__/oldbannedphraselist' #weightedphraselist = '__LISTDIR__/oldweightedphraselist' #exceptionphraselist = '__LISTDIR__/oldexceptionphraselist' ### ### END of PHRASES section ### SEARCH section ### # Search term blocking # Search terms can be extracted from search URLs and filtered using one or # both of two different methods. # Method 1 is that developed by Protex where specific # search terms are contained in a bannedsearchlist. # (localbannedsearchlist and bannedsearchoveridelist can be used to suppliment # and overide this list as required.) # These lists contain banned search words combinations on each line. # Words are separated by '+' and must be in sorted order within a line. # so to block 'sexy girl' then the list must contain the line # girl+sexy # and this will block both 'sexy girl' and 'girl sexy' # To use this method, the searchregexplist must be enabled and the bannedsearchlist(s) defined # Method 2 is uses the # bannedphraselist, weightedphraselist and exceptionphraselist, with a separate # threshold for blocking than that used for normal page content. # To do this, the searchregexplist must be enabled and searchtermlimit # must be greater than 0. # Search engine regular expression list (need for both options) # List of regular expressions for matching search engine URLs. It is assumed # that the search terms themselves will be contained in the # of output of each expression. regexpreplacelist = 'name=searchterms,path=__LISTDIR__/../common/searchregexplist' # search engine regexp exception (overide) list # Used to prevent urls such os completetion suggestion requests from being detected # as search requests regexpboollist = 'name=searchtermexceptions, path=__LISTDIR__/../common/searchexceptionregexplist' # Search Term list(s) for option 1 searchlist = 'name=banned,path=__LISTDIR__/bannedsearchlist' searchlist = 'name=override,path=__LISTDIR__/bannedsearchoveridelist' searchlist = 'name=localbanned,messageno=581,path=__LISTDIR__/localbannedsearchlist' #searchtermlimit = 0 # # Search term limit (for Option 2) # The limit over which requests will be blocked for containing search terms # which match the weightedphraselist. This should usually be lower than the # 'naughtynesslimit' value above, because the amount of text being filtered # is only a few words, rather than a whole page. # This option must be uncommented if searchregexplist is uncommented. # A value of 0 here indicates that search terms should be extracted, # but no phrase filtering should be performed on the resulting text. # Search term phrase lists (for Option 2) # If the three lines below are uncommented, search term blocking will use # the banned, weighted & exception phrases from these lists, instead of using # the same phrase lists as for page content. This is optional but recommended, # as weights for individual phrases in the "normal" lists may not be # appropriate for blocking when those phrases appear in a much smaller block # of text. # Please note that all or none of the below should be uncommented, not a # mixture. # NOTE: these are phrase lists and still use the old style defines #bannedsearchtermlist = '__LISTDIR__/bannedsearchtermlist' #weightedsearchtermlist = '__LISTDIR__/weightedsearchtermlist' #exceptionsearchtermlist = '__LISTDIR__/exceptionsearchtermlist' ### ### END of SEARCH section ### AV_SCANNERS section ### #disablecontentscan = off # # Disable content scanning # If you enable this option you will disable content scanning for this group. # Content scanning primarily is AV scanning (if enabled) but could include # other types. # (on|off) default = off. #disablecontentscanerror = off # # Disable content scanning with error (timeout, AV crash, etc) # If you enable this option you will allow object with an unexpected result # Content scanning primarily is AV scanning (if enabled) but could include # other types. # With "on" you can allow INFECTED objects # (on|off) default = off. (default and highly recommended) #contentscanexceptions = off # # If 'on' exception sites, urls, users etc will be scanned # This is probably not desirable behavour as exceptions are # supposed to be trusted and will increase load. # Correct use of grey lists are a better idea. # (on|off) default = off #Virus checking exceptions - matched urls will not be virus checked #Note that you also need to amend site.story in order for this to work. #mimelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusmimetypelist' #fileextlist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusextensionlist' #sitelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirussitelist' #ipsitelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirussiteiplist' #urllist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusurllist' ### ### END of AV_SCANNERS section ### HEADER section ### # Outgoing HTTP request header rules: # Lists for blocking based on, and modification of, outgoing HTTP # request headers. Format for headerregexplist is one modification rule per # line, similar to content/URL modifications. Format for # bannedregexpheaderlist is one regular expression per line, with matching # headers causing a request to be blocked. # Headers are matched/replaced on a line-by-line basis, not as a contiguous # block. # Use for example, to remove cookies or prevent certain user-agents. regexpreplacelist = 'name=headermods,path=__LISTDIR__/headerregexplist' regexpboollist = 'name=bannedheader,path=__LISTDIR__/bannedregexpheaderlist' regexpboollist = 'name=exceptionheader,path=__LISTDIR__/exceptionregexpheaderlist' # add cookies etc regexpreplacelist = 'name=addheader,path=__LISTDIR__/addheaderregexplist' # Response HTTP header rules: # Lists for modification or removal of HTTP response headers. # Format for reponseheaderregexplist is one rule per line, similar to # content/URL modifications. # Headers are matched/replaced on a line-by-line basis, not as a contiguous # block. # Use for example, to remove protocol upgrade requests. regexpreplacelist = 'name=reponseheadermods,path=__LISTDIR__/responseheaderregexplist' ### ### END of HEADER section ### BLOCK_PAGE section ### #reportinglevel = 3 # # # -1 = log, but do not block - Stealth mode # 0 = just say 'Access Denied' # 1 = report why but not what denied phrase # 2 = report fully # 3 = use HTML template file (accessdeniedaddress ignored) - recommended # # If defined, this overrides the global setting in e2guardian.conf for # members of this filter group. #accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/e2guardian.pl' # # accessdeniedaddress is the address of your web server to which the cgi # e2guardian reporting script was copied. Only used in reporting levels # 1 and 2. # # This webserver must be either: # 1. Non-proxied. Either a machine on the local network, or listed as an # exception in your browser's proxy configuration. # 2. Added to the exceptionsitelist. Option 1 is preferable; this option is # only for users using both transparent proxying and a non-local server # to host this script. # #nonstandarddelimiter = off # # Non standard delimiter (only used with accessdeniedaddress) # To help preserve the full banned URL, including parameters, the variables # passed into the access denied CGI are separated using non-standard # delimiters. This can be useful to ensure correct operation of the filter # bypass modes. Parameters are split using "::" in place of "&", and "==" in # place of "=". # Default is enabled, but to go back to the standard mode, disable it. #htmltemplate = 'custom.html' # # HTML Template override # If defined, this specifies a custom HTML template file for members of this # filter group, overriding the global setting in e2guardian.conf. This is # only used in reporting level 3. # # The default template file path is //template.html # e.g. /usr/share/e2guardian/languages/ukenglish/template.html when using 'ukenglish' # language. # # This option generates a file path of the form: # // # e.g. /usr/share/e2guardian/languages/ukenglish/custom.html #neterrtemplate = 'custom_neterr_template.html' # #Template for use to report network issues and sites which are not responding # The default template file path is //neterr_template.html # e.g. /usr/share/e2guardian/languages/ukenglish/neterr_template.html when using # 'ukenglish' language. ### ### END of BLOCK_PAGE section ### BYPASS section ### #bypass = 0 # # Temporary Denied Page Bypass # This provides a link on the denied page to bypass the ban for a few minutes. To be # secure it uses a random hashed secret generated at daemon startup. You define the # number of seconds the bypass will function for before the deny will appear again. # To allow the link on the denied page to appear you will need to edit the template.html # or e2guardian.pl file for your language. # 300 = enable for 5 minutes # 0 = disable ( defaults to 0 ) # -1 - depreciated - for backward compatability enables cgibypass with bypassversion 1 bypassversion = 2 # # Byapss version 2 provides a secure cgi communication (see notes/cgi_bypass documentation) # # Bypass version # can be 1 or 2 # Always use v2 unless you have old style cgi hash generation in use # Default is 1 # cgibypass = 'off' # # cgibypass - Use a separate program/CGI to (in v1 generate) or (in v2 validate) link # 'on' or 'off' (default) #bypasskey = '' # # Temporary Denied Page Bypass Secret Key # Rather than generating a random key you can specify one. It must be more than 8 chars. # '' = generate a random one (recommended and default) # 'Mary had a little lamb.' = an example # '76b42abc1cd0fdcaf6e943dcbc93b826' = an example cgikey = 'you must change this text in order to be secure' # magic key for cgi bypass v2 - used to sign communications between e2g and cgi # default is blank # Users will not be able to bypass sites/urls in these lists sitelist = 'name=bannedbypass,messageno=500,path=__LISTDIR__/domainsnobypass' #ipsitelist = 'name=bannedbypass,messageno=500,path=__LISTDIR__/ipnobypass' #urllist = 'name=bannedbypass,messageno=501,path=__LISTDIR__/urlnobypass' #infectionbypass = 0 # # Infection/Scan Error Bypass # Similar to the 'bypass' setting, but specifically for bypassing files scanned and found # to be infected, or files that trigger scanner errors - for example, archive types with # recognised but unsupported compression schemes, or corrupt archives. # The option specifies the number of seconds for which the bypass link will be valid. # 300 = enable for 5 minutes # 0 = disable (default) # -1 - depreciated - for backward compatability enables cgiinfectionbypass with bypassversion 1 # cgiinfectionbypass = 'off' # # cgiinfectionbypass - Use a separate program/CGI to (v1 generate) or (v2 validate) link # 'on' or 'off' (default) #infectionbypasskey = '' # # Infection/Scan Error Bypass Secret Key # Same as the 'bypasskey' option, but used for infection bypass mode. #infectionbypasserrorsonly = on # # Infection/Scan Error Bypass on Scan Errors Only # Enable this option to allow infectionbypass links only when virus scanning fails, # not when a file is found to contain a virus. # on = enable (default and highly recommended) # off = disable ### ### END of BYPASS section ### EMAILER section ### ### Note this is experimental in v5 - not supported by maintainers # Email reporting - original patch by J. Gauthier #usesmtp = off #NOT YET TESTED # # If on, will enable system wide events to be reported by email. # need to configure mail program (see 'mailer' in global config) # and email recipients # default usesmtp = off #mailfrom = '' # # who the email would come from # example: mailfrom = 'e2guardian@mycompany.com' #avadmin = '' # # who the virus emails go to (if notify av is on) # example: avadmin = 'admin@mycompany.com' #contentadmin = '' # # who the content emails go to (when thresholds are exceeded) # and contentnotify is on # example: contentadmin = 'admin@mycompany.com' #avsubject = 'e2guardian virus block' # # Subject of the email sent when a virus is caught. # only applicable if notifyav is on # default avsubject = 'e2guardian virus block' #contentsubject = 'e2guardian violation' # # Subject of the email sent when violation thresholds are exceeded # default contentsubject = 'e2guardian violation' #notifyav = off # # This will send a notification, if usesmtp/notifyav is on, any time an # infection is found. # Important: If this option is off, viruses will still be recorded like a # content infraction. #notifycontent = off # # This will send a notification, if usesmtp is on, based on thresholds # below #thresholdbyuser = off # # results are only predictable with user authenticated configs # if enabled the violation/threshold count is kept track of by the user #violations = 0 # # number of violations before notification # setting to 0 will never trigger a notification #threshold = 0 # # this is in seconds. If 'violations' occur in 'threshold' seconds, then # a notification is made. # if this is set to 0, then whenever the set number of violations are made a # notifaction will be sent. ### ### END of EMAILER section ### OBSOLETE section ### # groupmode = 1 #DISABLED # Filter group mode IS NOT LONGER SUPPORTED # Unauthenticated users are treated as being in the default filter group. # ssllegacylogic = off # Enable legacy (E2) ssl logic # The option is replaced by storyboard logic #sslcertcheck = off - NOT implimented in V5 yet #SSL certificate checking # Check that ssl certificates for servers on https connections are valid # and signed by a ca in the configured path # ONLY for connections that are NOT MITM # bannedregexwithblanketblock = off # option is replaced by storyboard logic #blockdownloads = off # option is replaced by storyboard logic #embeddedurlweight = 0 # - NOT implimented in v5 # Embedded URL weighting # When set to something greater than zero, this option causes URLs embedded within a # page's HTML (from links, image tags, etc.) to be extracted and checked against the # bannedsitelist and bannedurllist. Each link to a banned page causes the amount set # here to be added to the page's weighting. # The behaviour of this option with regards to multiple occurrences of a site/URL is # affected by the weightedphrasemode setting. # # NB: Currently, this feature uses regular expressions that require the PCRE library. # As such, it is only available if you compiled e2guardian with '--enable-pcre=yes'. # You can check compile-time options by running 'e2guardian -v'. # # Set to 0 to disable. # Defaults to 0. # WARNING: This option is highly CPU intensive! #onlymitmsslgrey = off - ignored in V5 #Limit SSL MITM to sites in greysslsitelist(s) # ignored if sslmitm is off # SSL sites not matching greysslsitelist will be treat as if sslmitm is off. # The option is replaced by storyboard logic #contentregexplist = '__LISTDIR__/contentregexplist' # # not yet implemented in v5 ### ### END of OBSOLETE section ### INFO section ### ### No settings just info on new features etc # New in v5.4.2:- relative paths # Relative paths can used in .Include<> and list files. # The directory of current file will be insert where the file name # does not start with '/' # Also NEW in v5.4.2 - LISTDIR 'variable' definition # LISTDIR can be defined in .conf files. # This allows for more readable configuration and for templating. # This works similarly to a shell environment variable # The text between <> will replace occurances of __LISTDIR__ in .conf and # list files. # Note: Currently only LISTDIR may be defined. # # The mapping is actioned as the file is read and is valid until another LISTDIR # is defined later in the file, or in an included .conf file. # # The scope of LISTDIR is in the rest of file it is defined in and all # .Include<> files or list files in that portion of the file. ### ### END of INFO section