Configuring MetaDefender Core
NetBackup 11.3 onwards provides support for malware scanning using MetaDefender Core. The scan host submits the files to be scanned to a MetaDefender Core server by using the MetaDefender Core command-line client, mdcli.
A MetaDefender Core server that is reachable from the scan host.
The mdcli package. Get the mdcli package from the MetaDefender team.
The operating system of the scan host must be a version that NetBackup supports for a scan host. .
(Applicable only if MetaDefender Core is deployed with HTTPS) The scan host must trust the MetaDefender Core certificate, on both Windows and Linux scan hosts.
To verify that the scan host trusts the certificate, run the following command:
curl -v https://<metadefender_server>
On a Windows scan host, add the MetaDefender Core certificate to the certificates that the computer trusts. For instructions, see the Microsoft documentation.
On a Linux scan host, perform the following:
- Copy the public certificate of the MetaDefender Core server to the scan host, for example to
/tmp/mdcore.crt. Copy only the public certificate. Never copy the.keyfile. - Run the following commands:
sudo cp /tmp/mdcore.crt /etc/pki/ca-trust/source/anchors/ sudo update-ca-trust extract
To install mdcli on a Windows computer
- Copy the mdcli executable file to a folder, for example
C:\Program Files\mdcli\. You can rename the file tomdcli.exe. - Add the folder to the PATH environment variable.
- Run the following command and ensure that it displays the version number:
mdcli.exe --version
- After you create the mdcli configuration file, run the following command to check the connectivity between the scan host and the MetaDefender Core server:
mdcli.exe --file <file_name> --config <config_file_path>
To install mdcli on a Linux computer
- Copy the mdcli executable file to the scan host.
- Place the file in a directory in the PATH and make it executable. For example:
sudo install -m 0755 <mdcli_file> /usr/local/bin/mdcli
- Run the following command and ensure that it displays the version number:
mdcli --version
- After you create the mdcli configuration file, run the following command to check the connectivity between the scan host and the MetaDefender Core server:
mdcli --file <file_name> --config <config_file_path>
The configuration file is a JSON file that holds the settings that mdcli uses for every scan. Specify the URL of the MetaDefender Core server. For example:
{
"url": "https://mdcore.example.com:8008"
}Note:
For additional configuration parameters for mdcli, refer to the MetaDefender Core documentation.
Set the following environment variables so that NetBackup can find mdcli and its configuration file:
METADEFENDER_CORE_SCANNER_PATH=<absolute_path_to_mdcli_executable> METADEFENDER_CORE_CONFIG_PATH=<absolute_path_to_mdcli_config_file>
Windows scan host (NetBackup client as the scan host or agentless scan host): Add the variables to the environment variables of the scan host.
Linux scan host, NetBackup client as the scan host: Add the variables to the
bp.conffile, or use the bpsetconfig command.Linux scan host, agentless scan host: Add the variables to the environment variables of the scan user.
More Information