Custom source location

By default, malware definitions are downloaded from the Internet. In xAgent 36 and higher, you can configure a custom download channel for deploying malware definition updates to your host endpoints (a custom source). The custom source can also be communicated with via proxy server. For general instructions on how to configure a proxy server, see HTTPS Proxy Server Overview and Configuration.

The instructions on this page demonstrate how to set up a custom content server using Ubuntu 19.04, and how to enable it in the Endpoint Security (HX) server WebUI.

Important

Custom content server setup instructions may vary, depending on your particular environment. You are responsible for setting up your own custom content server. Trellix cannot provide instructions or customer support for setting up a custom content server.

Note

The following example steps were executed on an Ubuntu 19.04 server OS.

Configuring the Custom Download Channel

Step 1 - Set Up the Content Web Server

Important

The following steps require root level privileges.

Note

Remove any default HTML pages. The web server must contain only content.

Note

A proxy environment for the content web server requires a forward proxy server. A reverse proxy server will not work (at all), or may cause problems over proxy.

To set up the content web server:

Install Apache 2 on an Ubuntu machine:

sudo apt-get update

sudo apt-get install apache2

Create a web server configuration file (such as mycustomsite.com.conf) in /etc/apache2/sites-available.
Create a top level web server folder (such as /var/www/mycustomsite.com/). Set server permissions to 705.
Add a server-specific directory configuration under /etc/apache2/apache2.conf, and grant required permissions.
Make sure the Indexes and MultiViews are forbidden for all the directories in the configuration file to prevent access via browser.
Add the web server domain entry to your DNS records, so it can be accessed by all host endpoints.
Enable the mycustomsite.com.conf configuration file and make sure no error occurs.

Note

Trellix recommends using a static IP address for the custom server.

Note

To check if the content update is ocurring via proxy or directly over the web server, use UpdateSampleC.exe in the Updater SDK. Follow the subsequent help instructions to verify that the content is downloading.

Step 2 - Set Up the Bitdefender Mirroring Application

Important

The following steps should be completed while using root level privileges.

Important

Bitdefender must already be installed on your endpoints before this setup procedure.

To set up the Bitdefender mirroring application:

Install PHP.
Create the /usr/local/bitdefender/ directory, and copy the mirror.cnf configuration file from the provided template.zip file to that directory.
Update the mirror.cnf file in /usr/local/bitdefender/mirroring/php with required configurations.
- Set WWW_VERSIONDIR to the top level within the web server folder.
- Specify the number of versions to store in VERSIONHISTORY.
- MIRRORPATCHES should be set to 1 to allow mirroring of update patches.
Run the update.php script with mirror.cnf as an argument:
php update.php mirror.cnf
- WWW_DIR is the folder path to download 32-bit Bitdefender content, and it must point to the top level within the web server folder. The directory name must be "av32bit" for this feature.
- WWW_DIR64 is the folder path to download 64-bit Bitdefender content, and it must point to the top level within the web server folder. The directory name must be "av64bit" for this feature.
Add a cron job to execute the update.php script every 20 minutes, so that the web server content is up-to-date. Since the update script requires the providers.conf file to be present in the same directory, Trellix recommends running the cron job using a script. A template of the cron job is in the provided template.zip file.
Note
Bitdefender downloads only the delta content in every update.
Important
If content download from the Bitdefender main server occurs over a proxy, then proxy authentication is required.

Important

Enable any other options required by your environment.

Step 3 - Test the Bitdefender Mirror Server

Test the custom server configuration to verify that the content is successfully downloaded from the web server that you set up in Step 1 - Set up Content Web Server. This test also ensures that correct folder permissions are set on the web server directory, so that the Agent software can fetch the web server content.

To test the Bitdefender mirror server:

Switch to a non-owner user of the mirroring folder.
Run the command:
```
php /path/to/update.php -u <update url/IP of custom server> -d <test directory>
```
Important
This test directory must be a valid directory for the command to execute successfully.

Sample test output:

Note

After this test, if the data from testing the mirror server is no longer needed, Trellix recommends deleting the test folder, to preserve server storage.