ESET Cloud Scanner

1. The container is preconfigured to use SSL. To run the container, you must configure the following options:

   • grpc_scan_certificate_chain_file
   • grpc_scan_private_key_file

2. The product requires a license file to be present at /etc/esets/license/license.lf in order to function.

   You can change the listening port using the grpc_scan_bind_port option, for example: -o grpc_scan_bind_port=51541

   You can turn off ssl communication by setting the grpc_scan_enable_ssl option to false: -o grpc_scan_enable_ssl=false

3. Usage in Amazon ECS:

   Prerequisites:

   • ECS cluster created
   • EFS file system created, with SSL certificates uploaded
   • Execution and task roles created (with permissions for AWS License Manager)
   • IAM policy for License Manager

   Key points:

   • EFS volumes containing the SSL certificates are mounted into the container.
   • The license file must be present at /etc/esets/license/license.lf.
   • Additional configuration options can be set in the command section using -o options
   • After creating the task, you can launch it.

4. Usage in Amazon EKS

   Prerequisites:

   • EKS cluster created
   • Kubernetes secrets for SSL certificates created
   • IAM policy and role for License Manager permissions set up

   Key points:

   • Secrets containing SSL certificates are mounted as files into the deployment.
   • The license file must be present at /etc/esets/license/license.lf.
   • Additional configuration options can be set in the args section using -o options
   • IAM policy for License Manager

5. Usage in Amazon EC2

   Prerequisities:

   • License file and SSL certificates are present on the EC2 instancee

   Key points:

   • LSSL certificates are mounted into the container.
   • The license file must be present at /etc/esets/license/license.lf.
   • Additional configuration options can be set using -o options.

6. Passing configuration options examples:

   ECS: "containerDefinitions": [ .... "command": [ "-o", "default_log_type=fifo", "-o", "grpc_scan_certificate_chain_file=/app/data/cert.pem", "-o", "grpc_scan_private_key_file=/app/data/key.pem" ] .... ]

   EKS ..... containers: - name: eset image: <IMAGE> ports: - containerPort: 50051 args: [ "-o", "default_log_type=fifo", "-o", "grpc_scan_certificate_chain_file=/app/data/cert.pem", "-o", "grpc_scan_private_key_file=/app/data/key.pem" ] ....

   EC2 docker run -d -p 50051:50051 \ -v /path_to_cert/:/app/data/
   <IMAGE>
   -o default_log_type=auto
   -o grpc_scan_certificate_chain_file=/app/data/cert.pem
   -o grpc_scan_private_key_file=/app/data/key.pem

   Required IAM policy for License Manager:

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "license-manager:CheckoutLicense", "license-manager:ListReceivedLicenses", "license-manager:CreateToken", "license-manager:CheckInLicense" ], "Resource": "*" }] }

Notes: Make sure all files are present in the correct locations and with appropriate permissions before starting the container.