[Topic 251963]

Kaspersky Embedded Systems Security 3.3 for Linux

Kaspersky Embedded Systems Security 3.3 for Linux ("Kaspersky Embedded Systems Security", "Application") protects devices running Linux operating systems against various types of threats, including network and scam attacks.

The application is not intended for industrial processes that use automated control systems. To protect devices in these systems, we recommend using Kaspersky Industrial CyberSecurity for Linux Nodes.

The application is used to:

• Scan file system objects located on local disks of your device, as well as mounted and shared resources, which are accessed via SMB and NFS protocols.
• Scan objects in the file system both in real time using the File Threat Protection task and on demand using scan tasks.
• Scan startup objects, boot sectors, process memory, and kernel memory.
• Detect infected objects and neutralize threats detected in them.
• Automatically select an action to neutralize the threat.
• Save backup copies of files before disinfection or deletion and restore files from backups.
• Manage tasks and configure their settings.
• Add keys and activate the application using activation codes.
• Update the application with service packs.
• Update application databases from Kaspersky update servers, via the Administration Server, or from a user-specified source on schedule and on demand.
• Use application databases to detect and disinfect infected files. During the scan process, the application analyzes each file for the presence of a threat: it compares the file code with the code of a specific threat and looks for possible matches.
• Monitor the integrity of the system or specified files and report changes. System Integrity Monitoring can be performed in continuous monitoring mode and in on-demand scan mode.
• Manage the operating system firewall and restore the set of firewall rules if they were changed.
• Protect files in local directories with network access via SMB / NFS from remote malicious encryption.
• Analyze traffic sent to users' devices via HTTP / HTTPS and FTP and check if web addresses are malicious or phishing.
• Configure flexible restrictions on access to data storage devices (hard disks, removable disks, CD / DVD drives), data transfer equipment (modems), data conversion devices (printers) and interfaces for connecting devices (USB, FireWire).
• Check removable drives when connected to your device.
• Check incoming network traffic for activity typical of network attacks.
• Check containers, images and namespaces.
• Receive information about application actions on your device.
• Configure encrypted connections scan settings.
• Control the start of applications and restrict access to applications on user devices to help reduce the risk of client device infections.
• Get information about all executable files of the applications installed on client devices using the Inventory Scan task, which can be useful, for example, for creating Application Control rules.
• Use Kaspersky Security Network. The use of data from Kaspersky Security Network ensures faster responses by Kaspersky Embedded Systems Security to various threats, improves the performance of some protection components, and reduces the likelihood of false positives.
• Allow users without root permissions to manage the application functions.
• Notify the administrator about events that occurred while the application was running.
• Check the integrity of application components using the integrity check tool.

You can manage Kaspersky Embedded Systems Security using the following methods:

• Using control commands from the command line.
• Using Kaspersky Security Center Administration Console.
• Using Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console.
• Using a graphical user interface.

The update functionality (including anti-virus signature updates and code base updates), as well as the KSN functionality may not be available in the application in the territory of the USA.

In this Help section Distribution kit Hardware and software requirements

Page top

[Topic 250484]

Distribution kit

The distribution kit includes Kaspersky Embedded Systems Security installation package containing the following files:

• kess-3.3.0-<build number>.i386.rpm, kess_3.3.0-<build number>_i386.deb

  Contain the main application files. Packages can be installed to 32-bit operating systems based on the type of package manager.

• kess_3.3.0-<build number>.x86_64.rpm, kess_3.3.0-<build number>_amd64.deb

  Contain the main application files. Packages can be installed to 64-bit operating systems based on the type of package manager.

• kess-gui-3.3.0-<build number>.i386.rpm, kess-gui-3.3.0-<build number>_i386.deb

  Contain the files of the application graphical user interface. Packages can be installed to 32-bit operating systems based on the type of package manager.

• kess-gui-3.3.0-<build number>.x86_64.rpm, kess-gui-3.3.0-<build number>_amd64.deb

  Contain the files of the application graphical user interface. Packages can be installed to 64-bit operating systems based on the type of package manager.

• kess-3.3.0.<build number>.zip

  Contains the files used for remote application installation using Kaspersky Security Center, including license.<language ID> and ksn_license.<language ID> files.

• ksn_license. <language ID>

  Contains the text of the Statement on Kaspersky Security Network.

• license. <language ID>

  Contains the text of the License Agreement. The License Agreement specifies the terms for using the application.

Independently changing application files using means not described in the application documentation or not recommended by Technical Support specialists may lead to poor performance and failures in the application and operating system, reduced protection of your device, inaccessible and corrupted data, as well as enabling the sending of additional statistics to KSN.

Page top

[Topic 251994]

Hardware and software requirements

Kaspersky Embedded Systems Security has the following hardware and software requirements:

Minimum hardware requirements:

• Core 2 Duo 1.86 GHz or faster processor
• swap partition at least 1 GB
• 1 GB of RAM for 32-bit operating systems, 2 GB of RAM for 64-bit operating systems
• 4 GB of free hard disk space for installation of the application and storage of temporary and log files

Software requirements:

• Supported 32-bit operating systems:
  • Debian GNU/Linux 10.1 and later.
  • Debian GNU/Linux 11.0 and later.
  • Mageia 4.
  • ALT 8 SP Workstation.
  • ALT 8 SP Server.
  • ALT Education 10.
  • ALT Workstation 10.
• Supported 64-bit operating systems:
  • AlmaLinux OS 8 and later.
  • AlmaLinux OS 9 and later.
  • AlterOS 7.5 and later.
  • Amazon Linux 2.
  • Astra Linux Common Edition 2.12.
  • Astra Linux Special Edition RUSB.10015-01 (operational update 1.5).
  • Astra Linux Special Edition RUSB.10015-01 (operational update 1.6).
  • Astra Linux Special Edition RUSB.10015-01 (operational update 1.7).
  • Astra Linux Special Edition RUSB.10015-16 (release 1) (operational update 1.6).
  • CentOS 7.2 and later.
  • CentOS Stream 9.
  • Debian GNU/Linux 10.1 and later.
  • Debian GNU/Linux 11.0 and later.
  • EMIAS 1.0 and later.
  • EulerOS 2.0 SP5.
  • Linux Mint 20.3 and later.
  • Linux Mint 21.1.
  • openSUSE Leap 15.0 and later.
  • Oracle Linux 7.3 and later.
  • Oracle Linux 8.0 and later.
  • Oracle Linux 9.0 and later.
  • Red Hat Enterprise Linux 7.2 and later.
  • Red Hat Enterprise Linux 8.0 and later.
  • Red Hat Enterprise Linux 9.0 and later.
  • Rocky Linux 8.5 and later.
  • Rocky Linux 9.1.
  • SUSE Linux Enterprise Server 12.5 or later.
  • SUSE Linux Enterprise Server 15 or later.
  • Ubuntu 20.04 LTS.
  • Ubuntu 22.04 LTS.
  • ALT 8 SP Workstation.
  • ALT 8 SP Server.
  • ALT Education 10.
  • ALT Workstation 10.
  • ALT Server 10.
  • Atlant, Alcyone build, version 2022.02.
  • GosLinux 7.17.
  • GosLinux 7.2.
  • RED OS 7.3.
  • ROSA Cobalt 7.9.
  • ROSA Chrome 12.

Due to technical limitations of fanotify, the application does not support the following file systems: autofs, binfmt_misc, cgroup, configfs, debugfs, devpts, devtmpfs, fuse, fuse.gvfsd-fuse, gvfs, hugetlbfs, mqueue, nfsd, proc, parsecfs, pipefs, pstore, usbfs, rpc_pipefs, securityfs, selinuxfs, sysfs, tracefs.

Supported versions of Kaspersky Security Center

Kaspersky Embedded Systems Security is compatible with the following Kaspersky Security Center versions:

• Kaspersky Security Center 14. You can manage the Kaspersky Embedded Systems Security application in the Administration Console using the MMC administration plug-in and in the Kaspersky Security Center Web Console using the web administration plug-in.
• Kaspersky Security Center 14 Linux. The web administration plug-in can be used to administer Kaspersky Embedded Systems Security through Kaspersky Security Center Web Console.

  Kaspersky Security Center Linux includes a version of Administration Server intended for installation on a device running the Linux operating system. Kaspersky Security Center Linux interacts with Administration Server through Kaspersky Security Center Web Console. For more information about Kaspersky Security Center Linux, see its documentation.

  Some functionality of Kaspersky Security Center 14, e.g. features tied to Kaspersky Security Network, are unavailable in Kaspersky Security Center 14 Linux. You can manage Kaspersky Security Network usage through Kaspersky Security Center running on Windows.

• Kaspersky Security Center 14.2. You can manage the Kaspersky Embedded Systems Security application in the Administration Console using the MMC administration plug-in and in the Kaspersky Security Center Web Console using the web administration plug-in.
• Kaspersky Security Center 14.2 Linux. The web administration plug-in can be used to administer Kaspersky Embedded Systems Security through Kaspersky Security Center Web Console.
• Kaspersky Security Center 15 Linux. The web administration plug-in can be used to administer Kaspersky Embedded Systems Security through Kaspersky Security Center Web Console.

Page top

[Topic 248502]

Preparing to install the application

Before starting installation of Kaspersky Embedded Systems Security, you need to perform the following actions:

• Check that your device meets the hardware and software requirements of the application.
• Be sure third-party anti-virus software is not installed on your device.
• Be sure that Kaspersky Endpoint Agent for Linux is not installed on your device. If Kaspersky Endpoint Agent for Linux is installed, during the installation process you will see a message about the need to manually remote it.
• Be sure that an interpreter for Perl version 5.10 or higher is installed on your device.
• Be sure that packages for compiling programs and starting tasks (gcc, binutils, glibc, glibc-devel, make) are installed on your device on operating systems that do not support fanotify.
• Be sure that a package with the operating system kernel's header files for compiling Kaspersky Embedded Systems Security modules is installed on your device on operating systems that do not support fanotify.
• For the Kaspersky Embedded Systems Security administration plug-in to work, Microsoft Visual C++ 2015 Redistributable Update 3 RC (see https://www.microsoft.com/en-us/download/details.aspx?id=52685) must be installed on the Administration Server.
• The SUSE Linux Enterprise Server 15 operating system requires installation of the insserv-compat package.
• The Red Hat Enterprise Linux 9 operating system requires installation of the initscripts package.
• The Red Hat Enterprise Linux 8 and RED OS operating systems require installation of the perl-Getopt-Long package.
• The Read Hat Enterprise Linux and RED OS operating systems require installation of the perl-File-Copy package, which is missing by default but necessary for the application's post-installation configuration script to work.
• The RED OS operating system require installation of the perl-locale package.
• By default, Astra Linux operating systems block ptrace (Disable ptrace capability), which may affect the operation of Kaspersky Embedded Systems Security. For Kaspersky Embedded Systems Security to work correctly, unblock ptrace when installing Astra Linux. If Astra Linux is already installed, see the Astra Linux Help Center website for instructions on how to enable/disable this mode (Configuring protection and blocking mechanisms in the Blocking ptrace section).
• For the Firewall Management, Web Threat Protection and Network Threat Protection tasks to work, the iptables utility needs to be installed on your device.

Page top

[Topic 248501]

Installing the application

You need to prepare for installation before installing Kaspersky Embedded Systems Security.

This scenario describes how to install and perform post-installation configuration of Kaspersky Embedded Systems Security, how to install and configure Kaspersky Security Center Network Agent and how to install Kaspersky Embedded Systems Security administration plug-ins.

The installation and post-installation configuration of Kaspersky Embedded Systems Security and Kaspersky Security Center proceeds in stages:

1. Installation and post-installation configuration of the Network Agent

   If you plan to manage Kaspersky Embedded Systems Security using Kaspersky Security Center, install Kaspersky Security Center Network Agent and configure its settings.

2. Installing Kaspersky Embedded Systems Security administration plug-ins

   If you plan to manage Kaspersky Embedded Systems Security using Kaspersky Security Center, install the following Kaspersky Embedded Systems Security administration plug-ins depending on the administration console you want to use to interact with Kaspersky Security Center:

   • The Kaspersky Embedded Systems Security MMC administration plug-in lets you manage the application using Kaspersky Security Center Administration Console;
   • The Kaspersky Embedded Systems Security administration web plug-in lets you manage the application using Kaspersky Security Center Cloud Console and Kaspersky Security Center Web Console.
3. Installing application packages and graphical user interface

   Kaspersky Embedded Systems Security and the graphical user interface are distributed in DEB and RPM format packages. Install Kaspersky Embedded Systems Security and, if necessary, the graphical user interface from packages in the appropriate format.

   You can install the application using the command line or using Kaspersky Security Center by means of the Administration Console or Kaspersky Security Center Web Console.

4. Kaspersky Embedded Systems Security post-installation configuration

   The post-installation configuration must be performed to enable the protection of the client device.

   If you installed Kaspersky Embedded Systems Security using the command line, run the initial configuration script or perform the post-installation configuration in automatic mode.

   If you installed Kaspersky Embedded Systems Security using Kaspersky Security Center, go through the Getting started procedure and activate the application.

In this Help section Deploying the application using the command line Installing and configuring Kaspersky Security Center Network Agent Installing Kaspersky Embedded Systems Security administration plug-ins Deploying the application using Kaspersky Security Center Running the application on Astra Linux in closed software environment mode Configuring permissive rules in the SELinux system

Page top

[Topic 198107]

Deploying the application using the command line

Kaspersky Embedded Systems Security is distributed in the DEB and RPM packages. There are separate packages for the application and for the graphical user interface.

You can perform the following actions when installing the application:

• Install only the application package, without the graphical user interface.
• Install the graphical user interface package.

  It is not possible to install the graphical user interface package on a client device that does not have the application package installed.

If the version of the apt package manager is lower than 1.1.X, use the dpkg/rpm package manager (depending on the operating system) for installation.

After the application installation using the command line is completed, perform the post-installation configuration of the application by running the post-installation configuration script or in the automatic mode.

In this section Installing the application using the command line Post-installation configuration of the application in interactive mode Post-installation configuration of the application in automatic mode Settings in the configuration file for post-installation configuration

Page top

[Topic 233694]

Installing the application using the command line

Installing the application package without a graphical user interface

To install Kaspersky Embedded Systems Security from an RPM package on a 32-bit operating system, execute the following command:

# rpm -i kess-3.3.0-<build number>.i386.rpm

To install Kaspersky Embedded Systems Security from an RPM package on a 64-bit operating system, execute the following command:

# rpm -i kess-3.3.0-<build number>.x86_64.rpm

To install Kaspersky Embedded Systems Security from a DEB package on a 32-bit operating system, execute the following command:

# apt-get install ./kess_3.3.0-<build number>_i386.deb

To install Kaspersky Embedded Systems Security from a DEB package on a 64-bit operating system, execute the following command:

# apt-get install ./kess_3.3.0-<build number>_amd64.deb

Installing the graphical user interface package

To install the graphical user interface from the RPM package to a 32-bit operating system, execute the following command:

# rpm -i kess-gui-3.3.0-<build number>.i386.rpm

To install the graphical user interface from the RPM package to a 64-bit operating system, execute the following command:

# rpm -i kess-gui-3.3.0-<build number>.x86_64.rpm

To install the graphical user interface from the DEB package to a 32-bit operating system, execute the following command:

# apt-get install ./kess-gui_3.3.0-<build number>_i386.deb

To install the graphical user interface from the DEB package to a 64-bit operating system, execute the following command:

# apt-get install ./kess-gui_3.3.0-<build number>_amd64.deb

Page top

[Topic 197897]

Post-installation configuration of the application in interactive mode

After installing Kaspersky Embedded Systems Security using the command line, perform the post-installation configuration of the application by running the post-installation configuration script. The post-installation configuration script is included in the Kaspersky Embedded Systems Security distribution kit.

Performing the post-installation configuration after installing the application using the command line is required to enable the protection of the client device.

To run the Kaspersky Embedded Systems Security post-installation configuration script, execute the following command:

# /opt/kaspersky/kess/bin/kess-setup.pl

The post-installation configuration must be run with root privileges after the installation of Kaspersky Embedded Systems Security package is finished. The script requests the values of Kaspersky Embedded Systems Security settings step-by-step. The script finishing and the console being released indicate that the post-installation configuration is completed.

To check the return code, execute the following command:

echo $?

If the command returns code 0, the initial application setup is finished successfully.

Kaspersky Embedded Systems Security can protect the device only after the application databases are updated.

In this section Selecting the locale Viewing the End User License Agreement and the Privacy Policy Accepting the End User License Agreement Accepting the Privacy Policy Using Kaspersky Security Network Assigning the Administrator role to a user Determining the file operation interceptor type Enabling automatic configuration of SELinux Configuring the update source Configuring proxy server settings Downloading application databases Enabling automatic application database update Application activation

Page top

[Topic 197898]

Selecting the locale

At this step, the application displays the list of supported locale identifiers in RFC 3066 format.

Specify the locale in the format as identified in this list. This locale will be used for application events sent to Kaspersky Security Center, as well as for the texts of the License Agreement, Privacy Policy, and Kaspersky Security Network Statement.

The locale of the graphical interface and the application command line depends on the value of the LANG environment variable. If the locale that is not supported by Kaspersky Embedded Systems Security is specified as the value of the LANG environment variable, the graphical interface and the command line are displayed in English.

Page top

[Topic 199016]

Viewing the End User License Agreement and the Privacy Policy

At this step, read the End User License Agreement concluded between you and Kaspersky, and the Privacy Policy describing the handling and transmission of data.

Page top

[Topic 197899]

Accepting the End User License Agreement

At this step, you must either accept or decline the terms of the End User License Agreement.

After exiting viewing mode, enter one of the following values:

• yes (or y), if you accept the terms of the End User License Agreement.
• no (or n), if you do not accept the terms of the End User License Agreement.

If you do not accept the terms of the End User License Agreement, the application terminates Kaspersky Embedded Systems Security setup process.

Page top

[Topic 197900]

Accepting the Privacy Policy

At this step, you must either accept or decline the terms of the Privacy Policy.

After exiting viewing mode, enter one of the following values:

• yes (or y), if you accept the terms of the Privacy Policy.
• no (or n), if you do not accept the terms of the Privacy Policy.

If you do not accept the terms of the Privacy Policy, the application terminates Kaspersky Embedded Systems Security setup process.

Page top

[Topic 197901]

Using Kaspersky Security Network

At this step, you must either accept or decline the terms of use of the Kaspersky Security Network Statement. The file ksn_license.<language ID> containing the text of the Kaspersky Security Network Statement is located in the directory /opt/kaspersky/kess/doc/.

Enter one of the following values:

• yes (or y), if you accept the terms of the Kaspersky Security Network Statement. KSN with statistics sharing (extended KSN mode) will be enabled.
• no (or n), if you do not accept the terms of the Kaspersky Security Network Statement.

Refusing to use Kaspersky Security Network will not halt the Kaspersky Embedded Systems Security installation process. You can enable, disable, or change the Kaspersky Security Network mode at any time.

Page top

[Topic 206406]

Assigning the Administrator role to a user

At this step, you can grant the administrator (admin) role to the user.

Enter the name of the user to whom you want to grant the administrator role.

You can grant the administrator role to the user later at any time.

Page top

[Topic 197903]

Determining the file operation interceptor type

At this step, the file operation interceptor type for the utilized operating system is determined. For operating systems that do not support fanotify technology, kernel module compilation will begin.

If the necessary packages are not detected during the kernel module compilation process, Kaspersky Embedded Systems Security will prompt you to install them. If the package download fails, an error message will be displayed.

If all the required packages are available, the kernel module will be automatically compiled when the File Threat Protection task starts.

You can compile the kernel module later after completing the Kaspersky Embedded Systems Security post-installation configuration.

Page top

[Topic 237159]

Enabling automatic configuration of SELinux

This step is displayed only if SELinux is installed on your operating system.

At this step, you can enable automatic configuration of SELinux for working with Kaspersky Embedded Systems Security.

Enter yes to enable automatic configuration of SELinux. If SELinux cannot be configured automatically, the application displays an error message and prompts the user to configure SELinux manually.

Enter no if you do not want the application to automatically configure SELinux.

By default, the application suggests yes.

If necessary, you can manually configure SELinux to work with the application later, after the initial setup of Kaspersky Embedded Systems Security is complete.

Page top

[Topic 197904]

Configuring the update source

At this step, specify the update sources for databases and application modules.

Enter one of the following values:

• KLServers: the application receives updates from one of the Kaspersky update servers.
• SCServer: the application downloads updates to the protected device from Kaspersky Security Center Administration Server installed in your organization. You can select this update source if you use Kaspersky Security Center for centralized administration of device protection in your organization.
• <URL>: the application downloads updates from a custom source. You can specify the address of the custom source of updates in the local area network or on the Internet.
• <path> – the application receives updates from the specified directory.

Page top

[Topic 197905]

Configuring proxy server settings

At this step, you must specify the proxy server settings if you are using a proxy server to access the Internet. Internet connection is required to download the application databases from the update servers.

To configure proxy server settings, perform one of the following actions:

• If you use a proxy server to connect to the Internet, specify the address of the proxy server using one of the following formats:
  • <IP address of the proxy server>:<port number>, if the proxy server connection does not require authentication;
  • <user name>:<password>@<IP address of the proxy server>:<port number>, if the proxy server connection requires authentication.

    When connecting via an HTTP proxy, we recommend to use a separate account that is not used to sign in to other systems. An HTTP proxy uses an insecure connection, and the account may be compromised.

• If you do not use a proxy server to connect to the Internet, enter no as your answer.

By default, the application suggests no.

You can configure the proxy server settings later, without using the post-installation configuration script.

Page top

[Topic 197906]

Downloading application databases

At this step, you can download the application databases to the client device. The application databases contain descriptions of the threat signatures and methods of countering them. The application uses these records when searching and neutralizing threats. Kaspersky virus analysts regularly add new records about threats.

To download the application databases to the device, enter yes.

If you do not want to immediately download the application databases, enter no.

By default, the application suggests yes.

Kaspersky Embedded Systems Security protects the device only after the application databases are downloaded.

You can start the Update task without using the post-installation configuration script.

Page top

[Topic 197907]

Enabling automatic application database update

At this step, you can enable automatic update of the application databases.

Enter yes to enable automatic application database update. By default, the application checks for available database updates every 60 minutes. If updates are available, the application downloads the updated databases.

Enter no if you do not want the application to automatically update the databases.

You can enable automatic database update later without using the post-installation configuration by configuring the update task schedule.

Page top

[Topic 197908]

Application activation

At this step, you can activate the application using an activation code or a key file.

To activate the application using an activation code, enter the activation code.

To activate the application using a key file, specify the full path to the key file.

If no activation code or key file is specified, the application is activated using a trial key for one month.

You can activate the application without using the post-installation configuration script.

Page top

[Topic 197909]

Post-installation configuration of the application in automatic mode

You can perform post-installation configuration of the application in automatic mode.

To start the post-installation configuration of the application in automatic mode, run the following command:

# /opt/kaspersky/kess/bin/kess-setup.pl --autoinstall=<post-installation configuration file>

where <post-installation configuration file> is a path to the configuration file that contains post-installation configuration settings. You can create this file or copy the necessary structure from the autoinstall.ini configuration file used for remote installation of the application using Kaspersky Security Center.

When the post-installation configuration script is finished and releases the console, the post-installation configuration of the application is complete.

To check the return code, execute the following command:

echo $?

If the command returns code 0, the initial application setup is finished successfully.

Kaspersky Embedded Systems Security protects the device only after the application databases are updated.

To correctly update application modules after the script has finished, you may need to restart the application. Check the status of updates for the application using the kess-control --app-info command.

Page top

[Topic 236947]

Settings in the configuration file for post-installation configuration

The configuration file for the post-installation configuration must contain the settings listed in the table below.

Settings in the configuration file for post-installation configuration

If you want to change the settings in the configuration file for initial setup of the application, specify the values of settings in the following format: <setting name>=<setting value> (the application does not process spaces between the name of a setting and its value).

Page top

[Topic 198105]

Installing and configuring Kaspersky Security Center Network Agent

Network Agent must be installed in order to manage Kaspersky Embedded Systems Security via Kaspersky Security Center.

Network Agent facilitates the client device's connection with the Kaspersky Security Center Administration Server. It must be installed on every client device that will be connected to Kaspersky Security Center, the centralized remote management system.

You can perform installation and post-installation configuration of Network Agent using the command line. Network Agent can also be installed and configured remotely using Kaspersky Security Center (for details, refer to Kaspersky Security Center documentation).

In this section Installing Network Agent using the command line Post-installation configuration of the Network Agent using the command line

Page top

[Topic 237152]

Installing Network Agent using the command line

The Network Agent installation process must be started with root privileges.

To install Network Agent from an RPM package to a 32-bit operating system, execute the following command:

# rpm -i klnagent-<build number>.i386.rpm

To install Network Agent from an RPM package to a 64-bit operating system, execute the following command:

# rpm -i klnagent64-<build number>.x86_64.rpm

To install Network Agent from a DEB package to a 32-bit operating system, execute the following command:

# apt-get install ./klnagent_<build number>_i386.deb

To install Network Agent from a DEB package to a 64-bit operating system, execute the following command:

# apt-get install ./klnagent64_<build number>_amd64.deb

After installing the package, perform post-installation configuration of the Network Agent.

Page top

[Topic 197913]

Post-installation configuration of the Network Agent using the command line

To configure Network Agent settings:

1. Execute the command:
   • for a 32-bit operating system:

     # /opt/kaspersky/klnagent/lib/bin/setup/postinstall.pl

   • for a 64-bit operating system:

     # /opt/kaspersky/klnagent64/lib/bin/setup/postinstall.pl

2. Accept the End User License Agreement.
3. Specify the DNS name or IP address of the Administration Server.
4. Specify the port number of the Administration Server.

   Port 14000 is used by default.

5. If you want to use an SSL connection, specify the SSL port number of the Administration Server.

   Port 13000 is used by default.

6. Do one of the following:
   • Enter yes if you want to use an SSL connection.
   • Enter no if you do not want to use an SSL connection.

   By default, SSL connection is enabled.

7. If necessary, specify the connection gateway usage mode:
   • 1—Do not configure a connection gateway.
   • 2—Do not use a connection gateway.
   • 3—Connect to the Administration Server using a connection gateway.
   • 4—Use the Network Agent as a connection gateway.

   The default value is the first option.

For more detailed information about configuring Network Agent, please refer to the Kaspersky Security Center documentation.

Page top

[Topic 233554]

Installing Kaspersky Embedded Systems Security administration plug-ins

The following Kaspersky Embedded Systems Security administration plug-ins are used to manage Kaspersky Embedded Systems Security using Kaspersky Security Center:

• The Kaspersky Embedded Systems Security MMC administration plug-in lets you manage the application using the Kaspersky Security Center Administration Console.
• The Kaspersky Embedded Systems Security administration web plug-in lets you manage the application using the Kaspersky Security Center Cloud Console and the Kaspersky Security Center Web Console.

In this section About Kaspersky Embedded Systems Security MMC administration plug-in About Kaspersky Embedded Systems Security administration web plug-in

Page top

[Topic 198108]

About Kaspersky Embedded Systems Security MMC administration plug-in

The Kaspersky Embedded Systems Security MMC administration plug-in (hereinafter also referred to as the MMC plug-in) facilitates interaction between Kaspersky Embedded Systems Security and Kaspersky Security Center using the Administration Console. The MMC plug-in lets you manage Kaspersky Embedded Systems Security using policies and tasks.

The MMC plug-in must be installed on the same client device where Kaspersky Security Center Administration Console is installed.

Before installing Kaspersky Embedded Systems Security MMC administration plug-in, make sure that Kaspersky Security Center and Redist C++ 2015 (Microsoft Visual C++ 2015 Redistributable) are installed.

For more details about administration plug-ins, refer to Kaspersky Security Center documentation.

Page top

[Topic 202111]

About Kaspersky Embedded Systems Security administration web plug-in

Kaspersky Embedded Systems Security management web plug-in (hereinafter also referred to as web plug-in) facilitates interaction between Kaspersky Embedded Systems Security and Kaspersky Security Center using Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console. The web plug-in allows you to manage Kaspersky Embedded Systems Security using policies and tasks.

The web plug-in must be installed on the client device that has Kaspersky Security Center Web Console installed. The functionality of the web plug-in is available to all administrators who have access to Kaspersky Security Center Web Console in a browser.

You can view the list of installed web plug-ins in Kaspersky Security Center Web Console interface: Console settings → Web plug-ins. For more information about compatibility of the web plug-in and Kaspersky Security Center Web Console versions, refer to Kaspersky Security Center documentation.

If you select a language that is not included in Kaspersky Embedded Systems Security distribution package in the properties of Kaspersky Security Center Administration Server, the License Agreement and the entire Kaspersky Security Center Web Console interface will be displayed in English.

Installing the web plug-in

You can install the web plug-in as follows:

• Using the Quick Start Wizard for Kaspersky Security Center Web Console.

  Kaspersky Security Center Web Console automatically prompts you to run the Initial Setup Wizard when connecting Web Console to the Administration Server for the first time. You can also run the Initial Setup Wizard in the Web Console interface (Device discovery and deployment → Deployment and assignment → Initial Setup Wizard). The Initial Configuration Wizard can also check if the installed web plug-ins are up to date and download the necessary updates. For more information on the Initial Setup Wizard for Kaspersky Security Center Web Console, please refer to Kaspersky Security Center documentation.

• From the list of available distribution kits in Kaspersky Security Center Web Console.

  To install the web plug-in, select the web plug-in distribution kit in the Web Console interface: Console settings → Web plug-ins. The list of available distribution packages is updated automatically after new versions of Kaspersky applications are released.

• Download the distribution kit to Kaspersky Security Center Web Console from an external source.

  To install the web plug-in, add the ZIP-archive of the web plug-in distribution kit in the Web Console interface: Console settings → Web plug-ins. The distribution kit of the web plug-in can be downloaded on the Kaspersky website, for example. For a local version of the application, additionally upload a text file that contains a signature.

Updating the web plug-in

If a new version of the web plug-in becomes available, Kaspersky Security Center Web Console displays the Updates are available for utilized plug-ins notification. You can proceed to update the web plug-in version from this Web Console notification. You can also manually check for new web plug-in updates in the Web Console interface (Console settings → Web plug-ins). The previous version of the web plug-in will be automatically removed during the update.

When the web plug-in is updated, already existing components (for example, policies or tasks) are saved. The new settings of components implementing new functions of Kaspersky Embedded Systems Security will appear in existing components and will have the default values.

You can update the web plug-in as follows:

• In the list of web plug-ins in online mode.

  To update the web plug-in, select the distribution package of Kaspersky Embedded Systems Security web plug-in in the Kaspersky Security Center Web Console interface (Console settings → Web plug-ins) and run the update. Web Console checks for available updates on Kaspersky servers and downloads the relevant updates.

• From file.

  To update the web plug-in, select the ZIP-archive of the distribution package of Kaspersky Embedded Systems Security web plug-in in the Kaspersky Security Center Web Console interface: Console settings → Web plug-ins. The distribution kit of the web plug-in can be downloaded on the Kaspersky website, for example. For a local version of the application, additionally upload a text file that contains a signature.

  You can only update the web plug-in to a more recent version. The web plug-in cannot be updated to an older version.

If any component is opened (such as a policy or task), the web plug-in checks its compatibility information. If the version of the web plug-in is equal to or later than the version specified in the compatibility information, you can change the settings of this component. Otherwise, you cannot use the web plug-in to change the settings of the selected component. It is recommended to update the web plug-in.

Page top

[Topic 197922]

Deploying the application using Kaspersky Security Center

You can install Kaspersky Embedded Systems Security on a client device remotely from the administrator's workstation using Kaspersky Security Center, by means of the Administration Console or Kaspersky Security Center Web Console.

You can deploy Kaspersky Embedded Systems Security on the devices in the corporate network in the following ways:

• Using the Protection Deployment Wizard.

  This installation method is recommended if you are satisfied with the default application settings and your organization has a simple infrastructure that does not require special configuration.

• Using the remote installation task.

  The universal installation method allowing you to configure the application settings and flexibly manage the remote installation tasks.

For the remote installation, Kaspersky Embedded Systems Security installation package is used. An installation package is a set of files created for remote installation of Kaspersky applications using Kaspersky Security Center. The installation package contains the settings required to install the application and ensure its operation immediately after the installation. The values of the settings correspond to the default values of the application settings. The installation package is created using the .kud file included in the application distribution kit. Kaspersky Embedded Systems Security installation package is common for all supported operating systems and processor architecture types.

To manage the operation of Kaspersky Embedded Systems Security installed on the client devices using Kaspersky Security Center, assign these devices to the

. Before starting Kaspersky Embedded Systems Security installation, you can create Kaspersky Security Center administration groups to which you want to move the devices with the application installed, and configure the rules to automatically move the devices to these administration groups. If rules for moving devices to the administration groups are not configured, Kaspersky Security Center moves all the devices that have the Administration Agent installed and are connected to Administration Server to the Unassigned devices list. In this case, you need to manually move computers to the administration groups (refer to Kaspersky Security Center documentation for details).

In this section Installing Kaspersky Embedded Systems Security using the Administration Console Installing Kaspersky Embedded Systems Security using the Web Console Getting started using Kaspersky Security Center Activating the application using Kaspersky Security Center

Page top

[Topic 198115]

Installing Kaspersky Embedded Systems Security using the Administration Console

You can install Kaspersky Embedded Systems Security on a client device remotely from the administrator's workstation using Kaspersky Security Center Administration Console.

It is installed using the Remote Installation Wizard or using the remote installation task (for details refer to Kaspersky Security Center documentation).

Remote installation uses a

that contains the settings required to install the application. You can create an installation package manually.

In this section Creating an installation package Autoinstall.ini configuration file settings

Page top

[Topic 236944]

Creating an installation package

To create a Kaspersky Embedded Systems Security installation package:

1. Download the kess.zip archive from the application download page. It is located in the Kaspersky Embedded Systems Security for Linux -> Additional distribution section, in the Files for Product remote installation subsection.
2. Unpack the files from the kess.zip archive to a folder accessible by Kaspersky Security Center Administration Server. Place the distribution files, that correspond to the type of operating system where you want to install the application and the type of its package manager, to the same folder:
   • To install Kaspersky Embedded Systems Security:
     • kess-3.3.0-<build number>.i386.rpm (for 32-bit operating systems with rpm)
     • kess_3.3.0-<build number>_i386.deb (for 32-bit operating systems with dpkg)
     • kess-3.3.0-<build number>.x86_64.rpm (for 64-bit operating systems with rpm)
     • kess_3.3.0-<build number>_amd64.deb (for 64-bit operating systems with dpkg)
   • To install the graphical user interface:
     • kess-gui-3.3.0-<build number>.i386.rpm (for 32-bit operating systems with rpm)
     • kess-gui-3.3.0-<build number>_i386.deb (for 32-bit operating systems with dpkg)
     • kess-gui-3.3.0-<build number>.x86_64.rpm (for 64-bit operating systems with rpm)
     • kess-gui-3.3.0-<build number>_amd64.deb (for 64-bit operating systems with dpkg)

     If you do not want to install a graphical user interface, do not use these files; this will make the installation package smaller.

   If the graphical user interface will not be used, the next step requires you to set the parameter-value pair USE_GUI=No in the autoinstall.ini configuration file. Otherwise, the installation will fail.

   If you want to use the created installation package to install the application on several types of operating systems or package managers, place the files for all the required types of operating systems and package managers in the folder.

3. If necessary, configure the application installation settings using the autoinstall.ini configuration file.
4. Open the Administration Console of Kaspersky Security Center.
5. In the console tree, select Additional → Remote installation → Installation packages.
6. Click the Create installation package button.

   The wizard for creating an installation package will start.

7. In the wizard window that opens, click the Create installation package for a Kaspersky application button.
8. Enter the name of the new installation package and proceed to the next step.
9. Select Kaspersky Embedded Systems Security distribution package. To do this, open a standard browsing window using the Browse button and specify the path to the kess.kud file.

   The application name is displayed in the window.

   Proceed to the next step.

10. Read the License Agreement between you and Kaspersky and the Privacy Policy that describes the processing and transmission of data.

    To continue creating the installation package, you must confirm that you have read and accept the full terms of the End User License Agreement and the Privacy Policy. To confirm, in the window that opens, select both check boxes.

    Proceed to the next step.

11. The wizard downloads the files required to install the application to Kaspersky Security Center Administration Server. Wait for the download to finish.
12. Complete the wizard.

The created installation package is located in the tree of the Administration Console of Kaspersky Security Center in the Additional → Remote installation → Installation packages folder. You can use the same installation package many times.

Page top

[Topic 236945]

Autoinstall.ini configuration file settings

The autoinstall.ini configuration file contains the settings described in the following table.

Autoinstall.ini configuration file settings

If you want to change the settings in the autoinstall.ini configuration file, specify the values of settings in the following format: <setting name>=<setting value> (the application does not process spaces between the name of a setting and its value).

Page top

[Topic 202117]

Installing Kaspersky Embedded Systems Security using the Web Console

Kaspersky Security Center Web Console supports the following main deployment methods:

• Installing the application using the Protection Deployment Wizard.
• Installing the application using the remote installation task.

Installation process consists of the following steps:

1. Creating an installation package. The Protection Deployment Wizard creates the package automatically if it has not already been created. The installation package is located in the list of installation packages downloaded into the Kaspersky Security Center Web Console: Device discovery and deployment → Deployment and assignment → Installation packages. You can also create an installation package and configure its settings manually.
2. Creating a remote installation task. The Protection Deployment Wizard creates and runs the remote installation task automatically. You can also create and run the task manually.

In this section Creating an installation package Installation using the Protection Deployment Wizard Creating a remote installation task

Page top

[Topic 247278]

Creating an installation package

To create an installation package:

1. In Web Console main window, select Device discovery and deployment → Deployment and assignment → Installation packages.

   This opens a list of installation packages downloaded to Web Console.

2. Click Add.

   The wizard for creating an installation package will start. Follow the instructions of the Wizard.

3. At the first page of the Wizard, select Create installation package for Kaspersky application.

   The Wizard will create an installation package from the distribution kit residing on Kaspersky servers. The list is updated automatically as new versions of applications are released. It is recommended to select this option to install Kaspersky Embedded Systems Security.

   You can also create an installation package from a file.

   Kaspersky Security Center Cloud Console does not allow creation of installation packages from a file.

4. Select Kaspersky Embedded Systems Security distribution package. Information about the distribution kit will be displayed on the right.
5. Read the information and click the Download and create installation package button. The installation package creation process starts.
6. During creation of the installation package, accept the terms of the End User License Agreement and Privacy Policy. When prompted by the Wizard, read the License Agreement between you and Kaspersky and the Privacy Policy that describes the processing and transmission of data. To continue creating the installation package, you must confirm that you have read and accept the full terms of the End User License Agreement and the Privacy Policy.

The installation package will be created and added to the Web Console. Using the installation package, you can install the application on devices in the corporate network or update the application version.

In the installation package properties, you can also configure the application installation settings (see the table below) on the Settings tab.

An installation package for Kaspersky Embedded Systems Security cannot be configured in Kaspersky Security Center Web Console versions lower than 14.2. Use the autoinstall.ini configuration file to configure settings.

Installation package settings

Page top

[Topic 202118]

Installation using the Protection Deployment Wizard

The TCP ports 139 and 445, and the UDP ports 137 and 138 must be opened on a client device.

To deploy Kaspersky Embedded Systems Security:

1. In Web Console main window, select Device discovery and deployment → Deployment and assignment → Protection Deployment Wizard.

   The Protection Deployment Wizard starts.

2. Follow the instructions of the Protection Deployment Wizard.

Step 1. Selecting an installation package

At this step, select the Kaspersky Embedded Systems Security installation package from the list of installation packages. If the package is not available in the list, click Add and select the Kaspersky Embedded Systems Security distribution kit from the list. The installation package is created automatically.

You can configure the installation package settings using the Web Console.

Step 2. Application activation

At this step, you can add a license key to the installation package to activate the application. This step is optional. If the Administration Server contains a license key with automatic distribution functionality, the key will be automatically added later. You can also activate the application later using the Add Key task.

Step 3. Selecting a Network Agent

At this step, select the version of the Network Agent that will be installed together with Kaspersky Embedded Systems Security. The Network Agent facilitates interaction between the Administration Server and client devices. If the Network Agent is already installed on the device, it is not installed again.

Step 4. Selecting devices to install the application

At this step, select the devices to install the application. The following options are available:

• Specify an administration group. The task is assigned to the devices included in a previously created administration group.
• Specify a device selection. The task is assigned to devices included in the device selection. You can specify one of the existing device selections.

Step 5. Configuring advanced installation settings

At this step, configure the following advanced application installation settings:

• Force installation package download. Selecting the application installation method:
  • Using the Network Agent. If the Network Agent is not installed on the device, first the Network Agent is installed using the operating system tools. Then, Kaspersky Embedded Systems Security is installed by means of the Network Agent.
  • Using operating system resources through distribution points. The installation package is delivered to the client devices using the operating system tools via the distribution points. You can select this option if there is at least one distribution point in the network. A distribution point is a device with Network Agent installed that is used for update distribution, remote installation of applications, and retrieval of information about devices in the network. For more details about distribution points, refer to Kaspersky Security Center documentation.
  • Using operating system resources through Administration Server. Files are delivered to the client devices by means of the operating system tools using the Administration Server. You can select this option if the Network Agent is not installed on the client device, but this device belongs to the same network as the Administration Server.
• Do not re-install the application if it is already installed. Clear this check box if you want to install an earlier version of the application, for example.
• Assign package installation in the Active Directory group policies. Kaspersky Embedded Systems Security is installed by means of the Network Agent or manually by means of Active Directory. To install Network Agent, the remote installation task must be run with domain administrator privileges.

Step 6. Device restart management

At this step, you can select an action to be performed if the device restart is required. When installing the application, device restart is not required. Restart is required only if you have to remove incompatible applications before installation. Restart may also be required when updating the application version.

Step 7. Removing incompatible applications

This step is displayed if applications incompatible with Kaspersky Embedded Systems Security are installed on the client device.

At this step, carefully review the list of incompatible applications and allow the removal of these applications. If incompatible applications are installed on the client device, Kaspersky Embedded Systems Security installation finishes with an error.

Step 8. Assigning to an administration group

At this step, select an administration group where to move the client devices after the Network Agent installation. Moving devices to the administration group is necessary for applying policies and group tasks. If a device is already assigned to an administration group, it will not be re-assigned. If you do not select an administration group, the devices are added to the Unassigned devices group.

Step 9. Selecting an account for accessing the client devices

At this step, select the account used for installing Network Agent using the tools of the operating system. In this case, administrator rights are required for accessing the client device. You can add multiple accounts. If an account does not have sufficient rights, the Installation Wizard uses the next account. If you install Kaspersky Embedded Systems Security by means of the Network Agent, you do not have to select an account.

Step 10. Starting installation

Exiting the Wizard. The remote application installation task is started automatically. You can monitor the task execution progress in the task properties in the Results section.

Page top

[Topic 202124]

Creating a remote installation task

To create a remote installation task:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. Click Add.

   The Task Wizard starts.

3. Follow the Task wizard instructions.

Step 1. Configuring general task settings

At this step, configure the general settings of the task:

1. In the Application drop-down list, select Kaspersky Security Center.
2. In the Task type drop-down list, select Install application remotely.
3. In the Task name field, enter a short description.
4. In the Select devices to which the task will be assigned section, select the task scope.

Step 2. Selecting devices to install the application

At this step, select the devices where to install Kaspersky Embedded Systems Security according to the selected task scope.

Step 3. Configuring an installation package

At this step, configure the settings of the installation package:

1. Select Kaspersky Embedded Systems Security 3.3 for Linux installation package.
2. Select the Network Agent installation package.

   The selected version of the Network Agent will be installed together with Kaspersky Embedded Systems Security. The Network Agent facilitates interaction between the Administration Server and client devices. If the Network Agent is already installed on the device, it is not installed again.

3. In the Force installation package download section, select the application installation method:
   • Using the Network Agent. If the Network Agent is not installed on the device, first the Network Agent is installed using the operating system tools. Then Kaspersky Embedded Systems Security is installed by means of the Network Agent.
   • Using operating system resources through distribution points. The installation package is delivered to the client devices using the operating system tools via the distribution points. You can select this option if there is at least one distribution point in the network. For more details about distribution points, refer to Kaspersky Security Center documentation.
   • Using operating system resources through Administration Server. Files are delivered to the client devices by means of the operating system tools using the Administration Server. You can select this option if the Network Agent is not installed on the client device, but the client device belongs to the same network as the Administration Server.
4. In the Maximum number of concurrent downloads field, set a limit on the number of installation package download requests sent to the Administration Server. The limit on the number of requests allows avoiding network overload.
5. In the Maximum number of installation attempts field, specify the limit on the number of attempts to install the application. If the application installation finishes with an error, the task will automatically start installation again.
6. If necessary, clear the Do not install application if it is already installed check box. It allows, for example, to install one of the previous versions of the application.
7. If necessary, select the Assign package installation in Active Directory group policies check box. The application is installed by means of the Network Agent or manually by means of Active Directory. To install Network Agent, the remote installation task must be run with domain administrator privileges.
8. If necessary, select the Prompt users to close running applications check box. Application installation requires device resources. For the convenience of the user, the Installation Wizard prompts you to close running applications before starting the installation. This helps prevent disruptions in the operation of other applications and prevents possible malfunctions of the device.
9. In the Behavior of devices managed by other Administration Servers section, select Kaspersky Embedded Systems Security installation method. If the network has more than one Administration Server installed, these Administration Servers may see the same client devices. This may cause, for example, an application to be installed remotely on the same client device several times through different Administration Servers, or other conflicts.
10. If necessary, in the Device moving mode section, specify a group for moving unassigned devices.

Step 4. Device restart management

At this step, you can select an action to be performed if the device restart is required.

Step 5. Selecting an account to access the device

At this step, select the account used for installing Network Agent using the tools of the operating system. In this case, administrator rights are required for accessing the device. You can add multiple accounts. If an account does not have sufficient rights, the Installation Wizard uses the next account. If you install Kaspersky Embedded Systems Security by means of the Network Agent, you do not have to select an account.

Step 6. Completing task creation

Complete wizard operations by clicking the Create button. A new task will be displayed in the list of tasks. To run a task, select the check box next to the task and click the Start button. The application will be installed in silent mode.

Page top

[Topic 202127]

Getting started using Kaspersky Security Center

To work with Kaspersky Embedded Systems Security using Kaspersky Security Center, perform the following steps after deploying the application:

• Activate the application. You can create and execute an activation task using the Administration Console or Kaspersky Security Center Web Console, as well as distribute the license key to the devices from the Kaspersky Security Center key storage.
• Update application databases and modules using the Administration Console or Kaspersky Security Center Web Console.

  Kaspersky Embedded Systems Security protects the device only after the application databases are updated.

• Create and configure a
  policy

  A policy determines the application settings and manages the access to configuration of an application installed on devices within an administration group. An individual policy must be created for each application. You can create an unlimited number of various policies for applications installed on the devices in each administration group, but only one policy can be applied to each application at a time within an administration group.

  for centralized application management on client devices. You can use the Administration Console or the Web Console to work with policies.

  You can also configure the application management tasks using the Administration Console or the Web Console.

Page top

[Topic 202128]

Activating the application using Kaspersky Security Center

Activation is the process of activating an application under a license that allows you to use a fully functional version of the application until the license expires. The application activation process involves adding a license key.

You can activate the application remotely using Kaspersky Security Center in the following ways:

• Using the application activation task.

  This method allows you to add a license key to a specific device or the devices included in an administration group. You can create and run an activation task using the Administration Console or Kaspersky Security Center Web Console.

• By distributing a license key stored on Kaspersky Security Center Administration Server to the client devices.

  This method lets you automatically add a key to the client devices that are already connected to Kaspersky Security Center, and to new client devices. To use this method, first add the key to the key storage on Kaspersky Security Center Administration Server.

You can use Kaspersky Security Center Administration Console or Kaspersky Security Center Web Console to create the tasks for application activation, adding a key to the key storage, and distributing the key to the client devices.

Activation using Kaspersky Security Center Web Console

Before creating an activation task or a key distribution task, add the key to Kaspersky Security Center Administration Server key storage.

To add a key to Kaspersky Security Center key storage using the Web Console:

1. In the Web Console main window, select the Operations → Licensing → Kaspersky Licenses.
2. Click Add.
3. In the window that opens, select how to add the key to the repository:
   • Enter the activation code to add a key using an activation code.
   • Add a key file to add a key using a key file.
4. Depending on the key adding method you selected at the previous step, do one of the following:
   • Enter the activation code and click Submit.
   • Click the Select key file button and in the window that opens, select the file with the key extension.
5. Click Close.

The added key will appear in the list of keys.

To activate the application using the Web Console by means of the Add Key task:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. Click Add.

   The Task Wizard starts.

3. Configure the task settings:
   1. In the Application drop-down list, select the application name: Kaspersky Embedded Systems Security.
   2. In the Task type drop-down list, select Add Key.
   3. In the Task name field, enter a brief description, such as Activation of Kaspersky Embedded Systems Security.
   4. In the Select devices to which the task will be assigned section, select the task scope. Click Next.
4. Select devices according to the selected task scope option. Click Next.

   The Kaspersky Security Center key storage window opens.

5. If you have previously added a key to Kaspersky Security Center key storage, select the key from in the list and click Next.
6. If the required key cannot be found in the key storage, click the Add key button.
   1. In the window that opens, select how to add the key to the repository:
      • Enter the activation code to add a key using an activation code.
      • Add a key file to add a key using a key file.
   2. Depending on the key adding method you selected at the previous step, do one of the following:
      • Enter the activation code and click Submit.
      • Click the Select key file button and in the window that opens, select the file with the key extension.
   3. Read the information about the key and click Close.
   4. The added key will appear in the list of keys. Select it from the list and click Next.
7. Read the information about the license and click Next.
8. Finish the wizard by clicking the Finish button.

   A new task will be displayed in the list of tasks.

9. Select the check box next to the task. Click the Start button.

In the properties of the Add Key task, you can add a reserve key to the device. The reserve key becomes active when the license associated with the active key expires or when the active key is deleted. Availability of a reserve key allows you to avoid application functionality limitation when your license expires.

To activate the application using the Web Console by distributing a key stored on Kaspersky Security Center Administration Server to the devices:

1. In the Web Console main window, select the Operations → Licensing → Kaspersky Licenses.
2. Open the key properties using the link with the name of the application for that the key is intended to.
3. On the General tab, select the Automatically distribute a license key to managed devices check box.
4. Click Save.

The license key is automatically distributed to the appropriate client devices. During the automatic distribution of a key as an active or a reserve key, the licensing limit on the number of devices (set in the key properties) is taken into account. If the licensing limit is reached, distribution of this key to the devices stops automatically. You can view the number of devices to which the key has been added and other information in the key properties on the Devices tab.

You can control license usage using Web Console in the following ways:

• View the Key usage report for the organization infrastructure (Monitoring and reports → Reports).
• View the statuses of the managed devices (Devices → Managed devices). If the application is not activated, the device will have the status and the Protection disabled status description.
• View the key properties (Operations → Licensing → Kaspersky licenses).

Special considerations for the activation process in Kaspersky Security Center Cloud Console

A trial version is provided for the Kaspersky Security Center Cloud Console. The trial version is a special version of Kaspersky Security Center Cloud Console designed to familiarize a user with the features of the application. In this version, you can perform actions in a workspace for a period of 30 days. All managed applications, including Kaspersky Embedded Systems Security, are automatically activated under Kaspersky Security Center Cloud Console trial license. However, you cannot activate Kaspersky Embedded Systems Security using its own trial license when the trial license for the Kaspersky Security Center Cloud Console expires. For detailed information about Kaspersky Security Center Cloud Console, please refer to the Kaspersky Security Center Cloud Console documentation.

The trial version of Kaspersky Security Center Cloud Console does not allow you to subsequently switch to a commercial version. Any trial workspace will be automatically deleted with all its contents after the 30-day period expires.

Page top

[Topic 236566]

Running the application on Astra Linux in closed software environment mode

This section describes how to start the application in the Astra Linux Special Edition operating system.

For Astra Linux Special Edition (operational update 1.7) and Astra Linux Special Edition (operational update 1.6)

To start the application on the Astra Linux Special Edition (operational update 1.7) or Astra Linux Special Edition (operational update 1.6) operating system:

1. Specify the following setting in the /etc/digsig/digsig_initramfs.conf file:

   DIGSIG_ELF_MODE=1

2. Install the compatibility package:

   apt install astra-digsig-oldkeys

3. Create a directory for the application key:

   mkdir -p /etc/digsig/keys/legacy/kaspersky/

4. Locate the application key (/opt/kaspersky/kess/shared/kaspersky_astra_pub_key.gpg) in the directory created at the previous step:

   cp kaspersky_astra_pub_key.gpg /etc/digsig/keys/legacy/kaspersky/

5. Update the initramfs image:

   update-initramfs -u -k all

For Astra Linux Special Edition (operational update 1.5)

To run the application in the Astra Linux Special Edition (operational update 1.5) operating system:

1. Specify the following setting in the /etc/digsig/digsig_initramfs.conf file:

   DIGSIG_LOAD_KEYS=1

   DIGSIG_ENFORCE=1

2. Create a directory for the application key:

   mkdir -p /etc/digsig/keys/legacy/kaspersky/

3. Locate the application key (/opt/kaspersky/kess/shared/kaspersky_astra_pub_key.gpg) in the directory created at the previous step:

   cp kaspersky_astra_pub_key.gpg /etc/digsig/keys/legacy/kaspersky/

4. Update the initramfs image:

   sudo update-initramfs -u -k all

The application graphical user interface can be used during mandatory access control sessions.

Page top

[Topic 237162]

Configuring permissions in the SELinux system

If SELinux could not be configured automatically during the post-installation configuration of the application, or if you declined automatic configuration, you can manually configure SELinux to work with Kaspersky Embedded Systems Security.

To configure SELinux to work with the application:

1. Switch SELinux to permissive mode:
   • If SELinux has been activated, run the following command:

     # setenforce Permissive

   • If SELinux was disabled, set the SELINUX=permissive setting in the configuration file / etc / selinux / config and restart the operating system.
2. Make sure the semanage utility is installed on the system. If the utility is not installed, install the policycoreutils-python or policycoreutils-python-utils package, depending on the package manager.
3. If you use a custom SELinux policy rather than the default targeted policy, assign a label for the following Kaspersky Embedded Systems Security source executable files in accordance with the SELinux policy used:
   • /var/opt/kaspersky/kess/3.3.0.<build number>_<installation timestamp>/opt/kaspersky/kess/libexec/kess
   • /var/opt/kaspersky/kess/3.3.0.<build number>_<installation timestamp>/opt/kaspersky/kess/bin/kess-control
   • /var/opt/kaspersky/kess/3.3.0.<build number>_<installation timestamp>/opt/kaspersky/kess/libexec/kess-gui
   • /var/opt/kaspersky/kess/3.3.0.<build number>_<installation timestamp>/opt/kaspersky/kess/shared/kess
4. Run the following tasks:
   • File Threat Protection task:

     kess-control --start-task 1

   • Critical Areas Scan task:

     kess-control --start-task 4 -W

   It is recommended to run all the tasks that you plan to run while using Kaspersky Embedded Systems Security.

5. Start the graphical user interface if you plan to use it.
6. Ensure that there are no errors in the audit.log file:

   grep kess /var/log/audit/audit.log

7. If there are errors in the audit.log file, create and download a new rule module based on the blocking records in order to fix the errors, and then relaunch all the tasks that you plan to run while using Kaspersky Embedded Systems Security.

   If new audit messages related to Kaspersky Embedded Systems Security appear, the file with the rule module file must be updated.

8. Switch SELinux to blocking mode:

   # setenforce Enforcing

If you use a custom SELinux policy, manually assign a label to Kaspersky Embedded Systems Security source executable files after installing application updates (follow steps 1, 3–8).

For additional information, please refer to the documentation on the relevant operating system.

Page top

[Topic 197919]

Uninstalling the application

You can uninstall Kaspersky Embedded Systems Security locally or using Kaspersky Security Center by means of the Administration Console or Kaspersky Security Center Web Console.

While the application is being uninstalled, all Kaspersky Embedded Systems Security tasks are stopped.

You can perform the following actions when uninstalling the application:

• Uninstall the application package and the graphical user interface package at the same time.
• Uninstall only the application package if the graphical user interface package is not installed.

  It is not possible to uninstall only the application package if the graphical user interface package is installed.

• Remove only the graphical user interface package.

After uninstalling the application, all information saved by the application is deleted, except for the license database. Installed application certificates are also removed. The license database is saved, and you can use it to reinstall the application.

If the application was installed in a systemd, the systemd settings are restored to their initial state after the application uninstallation.

In this Help section Uninstalling the application using the command line Uninstalling the application using the Administration Console Uninstalling the application using Kaspersky Security Center Web Console

Page top

[Topic 236428]

Uninstalling the application using the command line

The application automatically performs the uninstallation procedure. After the uninstallation procedure is completed, the application displays a message about the uninstallation results.

Uninstalling the application package and the graphical user interface package

To uninstall the application and the graphical user interface installed from the RPM packages, carry out the following command:

# rpm -e kess kess-gui

To uninstall the application and the graphical user interface installed from the DEB packages, carry out the following command:

# apt-get purge kess kess-gui

Uninstalling the application package without the graphical user interface package

To uninstall the application installed from the RPM package without removing the graphical user interface, carry out the following command:

# rpm -e kess

To uninstall the application installed from the DEB package without removing the graphical user interface, carry out the following command:

# apt-get purge kess

Removing the graphical user interface package

To remove the graphical user interface that was installed from the RPM package, execute the following command:

# rpm -e kess-gui

To remove the graphical user interface that was installed from the DEB package, execute the following command:

# apt-get purge kess-gui

Removing Network Agent

To uninstall the Network Agent installed on a 32-bit operating system from an RPM package, carry out the following command:

# rpm -e klnagent

To uninstall the Network Agent installed on a 64-bit operating system from an RPM package, carry out the following command:

# rpm -e klnagent64

To uninstall the Network Agent installed on a 32-bit operating system from a DEB package, carry out the following command:

# apt-get purge klnagent

To uninstall the Network Agent installed on a 64-bit operating system from a DEB package, carry out the following command:

# apt-get purge klnagent64

Page top

[Topic 206318]

Uninstalling the application using the Administration Console

You can uninstall Kaspersky Embedded Systems Security using Kaspersky Security Center Administration Console. To do this, create and run the uninstall application remotely task in Kaspersky Security Center.

If you want to remove only the graphical user interface without removing the application, specify the USE_GUI=No setting value in the autoinstall.ini configuration file and start the remote application installation task.

For more details about creating and running remote application installation and uninstall tasks, refer to the Kaspersky Security Center help file.

Page top

[Topic 202130]

Uninstalling the application using Kaspersky Security Center Web Console

You can uninstall the application remotely using the Kaspersky Security Center Web Console by means of the uninstall application remotely task. When performing the task, Kaspersky Embedded Systems Security downloads the application uninstallation utility to the user device. After completing the application uninstallation, the utility is automatically removed.

To uninstall the application:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. Click Add.

   The Task Wizard starts.

3. Follow the Task wizard instructions.

Step 1. Configuring general task settings

At this step, configure the general settings of the task:

1. In the Application drop-down list, select Kaspersky Security Center <version number>.
2. In the Task type drop-down list, select Uninstall application remotely.
3. In the Task name field, enter a brief description, for example, Uninstall Kaspersky Embedded Systems Security from Technical Support devices.
4. In the Select devices to which the task will be assigned section, select the task scope.

Step 2. Selecting devices to uninstall the application

At this step, select the devices where to uninstall Kaspersky Embedded Systems Security according to the selected task scope.

Step 3. Configuring application uninstallation settings

At this step, configure the application uninstallation settings:

1. Select Uninstall managed application.
2. In the Application to be uninstalled drop-down list, select the Kaspersky Embedded Systems Security installation package.
3. In the Force download of the uninstallation utility section, select the utility delivery method:
   • Using the Network Agent. If the Network Agent is not installed on the device, first the Network Agent is installed using the operating system tools. Then Kaspersky Embedded Systems Security is uninstalled by means of the Network Agent.
   • Using operating system resources through Administration Server. The utility is delivered to the client devices by means of the operating system tools using the Administration Server. You can select this option if the Network Agent is not installed on the client device, but the client device belongs to the same network as the Administration Server.
   • Using operating system resources through distribution points. The utility is delivered to the client devices using the operating system tools via the distribution points. You can select this option if there is at least one distribution point in the network. For more details about distribution points, refer to Kaspersky Security Center documentation.
4. In the Maximum number of concurrent downloads field, set a limit on the number of requests sent to the Administration Server to download the application uninstallation utility. A limit on the number of requests will help prevent the network from being overload.
5. In the Maximum number of uninstallation attempts field, set a limit on the number of attempts to uninstall the application. If the application uninstallation finishes with an error, the task automatically starts the uninstallation again.
6. If necessary, clear the Verify operating system type before downloading check box. It allows you to avoid downloading the uninstallation utility if the operating system of the client device does not meet the software requirements. If you are sure that the device operating system meets the software requirements, you can skip the verification.

Step 4. Selecting the application action when the operating system restart is required

At this step, you can select the action to be performed by the application if uninstallation requires the operating system restart.

Step 5. Selecting an account for accessing the client devices

At this step, select the account used for uninstalling the application using the tools of the operating system. In this case, administrator rights are required for accessing the client device. You can add multiple accounts. If an account does not have sufficient rights, the Uninstallation Wizard uses the next account. If you uninstall Kaspersky Embedded Systems Security by means of the Network Agent, you do not have to select an account.

Step 6. Completing task creation

Complete the wizard. A new task will be displayed in the list of tasks.

To run a task, select the check box next to the task and click the Start button. The application will be uninstalled in silent mode. After the application uninstallation finishes, you will be prompted to restart the client device.

Page top

[Topic 69238]

Application licensing

This section provides Kaspersky Embedded Systems Security license information.

In this Help section About the End User License Agreement About the license About the license certificate About the license key About the activation code About the key file About subscription

Page top

[Topic 197923]

About the End User License Agreement

The End User License Agreement is a binding agreement between you and AO Kaspersky Lab, stipulating the terms on which you may use the application.

Read through the terms of the License Agreement carefully before you start using the application.

You can view the terms of the License Agreement:

• During Kaspersky Embedded Systems Security installation.
• By reading the text in the license.<language ID> file. This file is included in the application distribution kit.

By confirming that you accept the End User License Agreement during post-installation configuration of the application, you accept the terms and conditions of the End User License Agreement. If you do not accept the terms of the End User License Agreement, do not use the application.

Page top

[Topic 69240]

About the license

A license is a time-limited right to use Kaspersky Embedded Systems Security, granted under the End User License Agreement.

The list of available functions and the validity period of the application depend on the license under which the application is used.

The following license types are provided:

• Trial – a free license intended for trying out the application.

  Trial licenses have a short validity period. When the trial license expires, all Kaspersky Embedded Systems Security features become disabled. To continue using the application, you need to purchase a commercial license.

  You can use the application under a trial license for only one trial period.

• Commercial is a paid license.

  The main functions of the application stop working when a commercial license expires. To continue using Kaspersky Embedded Systems Security, you need to renew the commercial license. After the license expires, you can no longer use the application and must uninstall it from the device.

  It is recommended to renew the license before its expiration date to ensure continued protection of your device against security threats.

Page top

[Topic 73976]

About the license certificate

The License Certificate is a document provided together with the key file or activation code.

A license certificate contains the following information about the license provided:

• License key or order number
• Information about the license user
• Information about the application that can be activated under the provided license
• Restrictions on the number of licensing units (for example, devices on which the application can be used under the license)
• License validity start date
• License expiration date or validity period
• License type

Page top

[Topic 209867]

About the license key

The license key is a sequence of bits that can be used to activate the application for further usage in accordance with the terms of the End User License Agreement. License key is generated by Kaspersky experts.

You can add a license key to the application using one of the following methods: by applying a key file or by entering an activation code. After you add a key to the application, the license key is displayed in the application interface as a unique alphanumeric sequence.

The license key may be blocked by Kaspersky, if the terms of the End User License Agreement are violated. If the license key is blocked, add another license key for proper application operation.

A license key may be active or reserve.

Active license key is currently used to run the application. A license key for a trial or commercial license can be added as the active key. The application cannot have more than one active license key.

Reserve license key is a license key that entitles the user to use the application, but is not currently in use. The reserve license key automatically becomes active when the license associated with the current active license key expires. A reserve license key can be added only if an active license key is already added.

A trial license key can only be added as an active license key. A trial license key cannot be added as a reserve license key.

Page top

[Topic 69430]

About the activation code

An activation code is a unique sequence of twenty Latin letters and numbers. You have to enter an activation code in order to add a license key for activating Kaspersky Embedded Systems Security. You receive the activation code at the email address that you provided when you bought Kaspersky Embedded Systems Security or requested the trial version of Kaspersky Embedded Systems Security.

To activate the application with an activation code, you need Internet access in order to connect to Kaspersky activation servers.

If you lost your activation code after activating the application, contact the Kaspersky partner from whom you purchased the license.

Page top

[Topic 69431]

About the key file

A key file is a file with the .key extension that you receive from Kaspersky. Key files are intended to add a license key for activating the application.

You receive a key file at the email address that you provided when you bought Kaspersky Embedded Systems Security or ordered the trial version of Kaspersky Embedded Systems Security.

You do not need to connect to Kaspersky activation servers in order to activate the application with a key file.

You can restore a key file if it has been accidentally deleted. You may need a key file to register a Kaspersky CompanyAccount, for example.

To restore your key file, perform any of the following actions:

• Contact the license seller.
• Get the key file on the Kaspersky website when you have an activation code.

Page top

[Topic 201930]

About subscription

Subscription for Kaspersky Embedded Systems Security is a purchase order for the application with specific settings (subscription expiry date, number of devices protected). You can order a subscription for Kaspersky Embedded Systems Security from your service provider (such as your internet service provider). You can renew or cancel your subscription. You can manage your subscription on the website of the service provider.

Subscription can be limited (for one year, for example) or unlimited (without an expiry date). To continue using the application after the limited subscription expires, you need to renew your subscription. Unlimited subscription is renewed automatically if the vendor's services have been prepaid on time.

Upon a limited subscription's expiry, you may be offered a grace period to renew the subscription. During this period the application retains its functionality. The service provider decides whether or not to grant a grace period and, if so, determines the duration of the grace period.

The set of options for managing your subscription may vary depending on your service provider. The service provider might not provide a grace period for renewing the subscription where the application retains its functionality.

To use Kaspersky Embedded Systems Security under a subscription, you need to use the activation code received from the service provider. After you apply the activation code, an active key corresponding to the license to use the application under subscription is added to the application. A reserve key can only be added when you use an activation code and cannot be added for a key file or subscription.

Activation codes purchased under subscription may not be used to activate previous versions of Kaspersky Embedded Systems Security.

Page top

[Topic 250618]

Data provision

This section describes the information that Kaspersky Embedded Systems Security may store on the device and automatically send to Kaspersky during its operation.

Kaspersky protects any information thus received in accordance with law and the applicable rules of Kaspersky. Data is transmitted over encrypted channels.

For more detailed information about the processing, storage, and destruction of information obtained during the use of the application and transmitted to Kaspersky, please read the End User License Agreement, the KSN Statement, and refer to the Privacy Policy on the Kaspersky website. The license.<language ID> and ksn_license.<language ID> files containing the End User License Agreement and Kaspersky Security Network Statement are included in the application distribution package.

In this Help section Data provided when using an activation code Data provided when downloading updates from Kaspersky update servers Data sent to Kaspersky Security Center Data provided when following links in the application interface Data provided when using Kaspersky Security Network

Page top

[Topic 250619]

Data provided when using an activation code

If Kaspersky Embedded Systems Security is activated using an activation code, in order to verify if the application is legally used and to obtain statistical information on the distribution and use of the application, you agree to provide the following information in automatic mode:

• ID of a regional activation center
• List of agreements presented to the user by the application
• Data compression type
• Operating system family
• Checksum type for the object being processed
• Type of the license used to activate the application
• Application ID derived from the license
• Full version of the application
• unique device ID
• Application ID
• Application license expiration date and time
• Application license ID
• Application license key creation date and time
• Current status of the application license key
• Application license header
• ID of the information model used to provide the application license
• Set of IDs of the applications that can be activated on the user device
• Type of application license used
• Application locale
• Application installation ID (PCID)
• Application rebranding ID
• Size of the content of the request to Kaspersky infrastructure
• Format of the data in the request to Kaspersky infrastructure
• Type of legal agreement accepted by the user while using the application
• Version of the legal agreement accepted by the user while using the application
• Protocol ID
• Accessed IPv4 address of the web service

Page top

[Topic 250625]

Data provided when downloading updates from Kaspersky update servers

If you use Kaspersky update servers to download updates, in order to increase efficiency of the update procedure and to obtain statistical information on distribution and use of the application, you agree to provide the following information in automatic mode:

• Application ID derived from the license
• Full version of the application
• Application license ID
• Type of application license used
• Application installation ID (PCID)
• ID of the application update start
• Web address being processed

Page top

[Topic 250629]

Data sent to Kaspersky Security Center

During operation, Kaspersky Embedded Systems Security saves and submits to Kaspersky Security Center the following information, which may contain personal and confidential data:

• Information about the databases used by the application:
  • List of the database categories required by the application
  • Date and time when the databases were released and loaded into the application
  • Date when the downloaded application database updates were released
  • Time of the last application database update
• Application license information:
  • License serial number and type
  • License validity period in days
  • Number of devices covered by the license
  • Start and end dates of license term
  • License key status
  • Date and time of the last successful synchronization with activation servers if the application was activated using an activation code
  • Identifier of the application for which the license is intended
  • Functionality available under the license
  • Name of the organization for which the license is provided
  • Additional information if the application is used under subscription (subscription flag, subscription expiration date and the number of days available for renewing the subscription, subscription provider web address, current subscription status and the reason for this status), date and time when the application was activated on the device
  • Expiration date and time of the application license on the device
• Information about the application updates:
  • List of updates to be installed or removed
  • Update release date and the sign of the Critical status
  • Name, version, and short description of the update
  • Link to the detailed description of the update
  • Identifier and text of the End User License Agreement and the Privacy Policy for the application updates
  • Identifier and text of Kaspersky Security Network Statement for the application updates
  • Indicator showing if the update can be removed
  • Versions of the application policy and administration plug-in
  • Web address for downloading the application administration plug-in
  • Names, version, and installation dates of the installed application updates
  • Error code and description if the update installation or removal completed with an error
  • Sign and reason for the device or application restart necessity because of the application update
• User agreement or disagreement with the terms and conditions of Kaspersky Security Network Statement, End User License Agreement and Privacy Policy
• List of tags assigned to the device
• List of device statuses and reasons they are assigned.
• General application status and the status of all its components; policy compliance information, real-time protection status of the device.
• Date and time of the last device scan; number of scanned objects; number of detected malicious objects; number of blocked, deleted and disinfected objects; number of objects that cannot be disinfected; number of scan errors; number of detected network attacks
• Data on the currently applied values of the application settings
• The current status and execution results of the group and local tasks and the values of their settings
• Information about external devices connected to the client device (ID, name, class, manufacturer, description, serial number, VID/PID)
• Information about backup file copies in Storage (name, path, size and type of the object, description of the object, name of the detected threat, version of the application database which is used to detect the threat, date and time when the object was moved to Storage), actions on the objects in Storage (removed, restored), and the files by administrator request.
• Information about the operation of each application component and about the execution of each task represented as events:
  • Date and time of event
  • Name and type of event
  • Event severity level
  • Name of the task or the application component running when the event occurred
  • Information about the application that triggered the event: application name, path to the file on the disk, process identifier, setting values​ (if the application launch or settings modification event is triggered)
  • User ID
  • Name of the initiator (task scheduler, application, Kaspersky Security Center, or a user) whose actions triggered the event
  • Name and identifier of the user who initiated access to the file
  • Object or action processing result (description, type, name, threat level and accuracy, file name and type of operation on the device, application decision on the operation)
  • Information about the object (object name and type, path to the object on the disk, object version, size, information about the performed action, event trigger description, description of the reason for not processing and skipping the object)
  • Device information (manufacturer name, device name, path, device type, bus type, identifier, VID/PID, system device flag, name of the device access rule schedule)
  • Information about blocking and unblocking the device; information about blocked connections (name, description, device name, protocol, remote address and port, local address and port, packet rules, actions)
  • Information about requested web address
  • Information about detected objects
  • Detection type and method
  • Information about the performed action
  • Information about the application databases (date when the downloaded database updates are released, information on the database usage, database usage errors, information on canceling the installed database updates)
  • Information about encryption detection (ransomware name; name of the device where encryption was detected; information about blocking and unblocking the device)
  • Application settings and network settings
  • Information about the triggered Application Control rule (name and type) and the result of its application
  • Information about containers and container images (names of containers or container images, paths to containers or container images, repository URL)
  • Information about active and blocked connections (name, description, and type)
  • Information about blocking and unblocking access to untrusted devices
  • Information about the use of KSN (KSN state, KSN infrastructure, identifier of the KSN Statement in extended mode, acceptance of the KSN Statement in extended mode, identifier of the KSN Statement, acceptance of the KSN Statement)
  • Information about certificates (domain name, subject name, issuer name, expiration date, certificate status, certificate type, date certificate was added, issue date, serial number, SHA256 thumbprint)
  • Information about external systems that are part of corporate software solutions (integration server address)
• Information about operation of the system integrity scan task (name, type, path) and information about the system baseline
• Information about network activity, packet rules, and network attacks
• User role information:
  • Name and identifier of the user who initiated changing the user role
  • User role
  • Name of the user who has been assigned or revoked the role
• Information about executable files detected on the client device (name, path, type, and hash of the file; list of categories to which the application belongs; time of the first file launch; name, identifier, and version of the application; name of the application vendor; information about the certificate used to sign the application: serial number, thumbprint, issuer, subject, release date, expiration date, and public key).

Page top

[Topic 250630]

Data provided when following links in the application interface

When clicking the links in Kaspersky Embedded Systems Security interface, you agree to automatically provide the following information to Kaspersky:

• Full version of the application
• Application locale
• Application ID (PID)
• Link name

Page top

[Topic 250631]

Data provided when using Kaspersky Security Network

If you use Kaspersky Security Network in extended mode, you agree to automatically provide Kaspersky with all the data listed in the Kaspersky Security Network Statement. Additionally, files (or parts of files) that intruders may use to harm the device and the data stored in its operating system may be sent to Kaspersky for scanning.

The ksn_license.<language ID> file with the text of the Kaspersky Security Network Statement is included in the application distribution kit.

Page top

[Topic 201932]

Managing the application using the command line

You can manage Kaspersky Embedded Systems Security using the command line. All actions are available from the command line, including task management and configuring application settings.

In this Help section Starting and stopping the application Displaying Help on the commands Enabling automatic addition of kess-control commands (bash completion) Enabling the display of events Viewing information about the application Description of the application commands Using filters to limit query results Exporting and importing application settings Setting the application memory usage limit User roles General application settings Managing application tasks using the command line Encrypted connections scan

Page top

[Topic 197929]

Starting and stopping the application

By default, Kaspersky Embedded Systems Security starts automatically when the operating system is booted (at the default level of execution for each operating system). The application starts all service tasks as well as user tasks with starting mode set to PS in the schedule settings.

If you stop the application, all running tasks will be interrupted. After restarting the application, paused user tasks are not resumed automatically. Only user tasks with starting mode set to PS in the schedule settings are restarted.

To run the application, the root account must be the owner of the following directories and only the owner must have write access to them: /var, /var/opt, /var/opt/kaspersky, /var/log/kaspersky, /opt, /opt/kaspersky, /usr/bin, /usr/lib, /usr/lib64.

Starting, restarting, and stopping Kaspersky Embedded Systems Security

To start the application in systemd, execute the following command:

systemctl start kess

To stop the application in systemd, execute the following command:

systemctl stop kess

To restart the application in systemd, execute the following command:

systemctl restart kess

To start the application in the system without systemd, execute the following command:

/etc/init.d/kess start

To stop the application in the system without systemd, execute the following command:

/etc/init.d/kess stop

To restart the application in the system without systemd, execute the following command:

/etc/init.d/kess restart

Monitoring the status of Kaspersky Embedded Systems Security

The Kaspersky Embedded Systems Security status is monitored by the watchdog service. The watchdog service is automatically launched when the application starts.

In the event of an application crash, a dump file is generated and the application is restarted automatically.

To display the application status in systemd, execute the following command:

systemctl status kess

To display the application status in the system without systemd, execute the following command:

/etc/init.d/kess status

Page top

[Topic 245711]

Displaying Help on the commands

The kess-control --help <set of application commands> command displays help for the application commands.

Command syntax

kess-control --help [<set of application commands>]

<set of application commands>

Available values:

-T – Commands for managing tasks and general application settings.

-C – Commands for managing general container scan settings.

-N – Commands for managing encrypted connections scan settings.

-L – Commands for managing the Licensing task.

-E – Commands for managing application events.

-B – Commands for managing the Storage Management task.

-F – Commands for managing the Firewall Management task.

-H – Commands for managing the Anti-Cryptor task.

-D – Commands for managing the Device Control task.

-A – Commands for managing the Application Control task.

-U – Commands for managing users and user roles.

-S – Statistical commands.

-W – Display events.

Page top

[Topic 238601]

Enabling automatic addition of kess-control commands (bash completion)

Kess-control commands can be automatically added for the bash shell.

To enable automatic addition of kess-control commands in the current bash shell session, run the following command:

source /opt/kaspersky/kess/shared/bash_completion.sh

To enable automatic addition for all new bash shell sessions, run the following command:

echo "source /opt/kaspersky/kess/shared/bash_completion.sh" >> ~/.bashrc

Page top

[Topic 197937]

Enabling the display of events

The kess-control -W command enables display of the current application events. The command returns the name of the event and additional information about the event.

You can use this command either separately to display all current application events or together with the kess-control --start-task command to display only events related to the running task.

You can also use the kess-control -W command with the --query flag to specify filter conditions to display specific events.

Command syntax

kess-control -W

Page top

[Topic 246692]

Viewing information about the application

The kess-control --app-info command displays information about the application.

Command syntax

kess-control [-S] --app-info [--json]

Result of command execution:

• Name. Application names.
• Version. Current application version.
• Policy. Indicates whether the Kaspersky Security Center policy is applied.
• License information. License information or license key status.
• Subscription status. Subscription status. This field is displayed if the application is started under a subscription.
• License expiration date. Date and time when the license expires, in UTC.
• Storage status. Storage status.
• Storage space usage. Storage size.
• Last run date of the Scan_My_Computer task. Time of the last Malware Scan task.
• Date when the application databases were last released. Date and time the application databases were last released.
• Application databases. Displays whether the application databases have been downloaded.
• Kaspersky Security Network settings. Information about Kaspersky Security Network use.
• File Threat Protection. Status of the File Threat Protection task.
• Container monitoring. Displays information about container scan settings.
• System Integrity Monitoring. Status of the System Integrity Monitoring task.
• Firewall Management. Status of the Firewall Management task.
• Anti-Cryptor. Status of the Anti-Cryptor task.
• Web Threat Protection. Status of the Web Threat Protection task.
• Device Control. Status of the Device Control task.
• Removable Drives Scan. Status of the Removable Drives Scan task.
• Network Threat Protection. Status of the Network Threat Protection task.
• Behavior Detection. Status of the Behavior Detection task.
• Application Control. Status of the Application Control task.
• Application update status. Displays application update actions and the actions to be performed by the user.
• Unstable application operation. Information about application failure and dump file creation is displayed. This field is displayed if a failure occurred the last time the application was launched.

Page top

[Topic 245716]

Description of the application commands

Displaying Help on application commands

--help – displays Help on application commands.

Displaying application events

-W – enables the display of application events.

Statistics commands

-S is a prefix indicating that the command belongs to the statistics command group.

[-S] --app-info – displays information about the application.

[-S] --omsinfo --file <file name and path> – creates a JSON file for integration with Microsoft Operations Management Suite.

Commands for managing application tasks and settings

-T is a prefix indicating that the command belongs to the group of commands for managing application settings and tasks.

[-T] --get-app-settings --file <file name and path> – displays the general application settings.

[-T] --set-app-settings --file <file name and path> – sets the general application settings.

[-T] --export-settings --file <full path to the configuration file> – exports the application settings to the configuration file.

[-T] --import-settings --file <full path to the configuration file> – imports the application settings from the configuration file.

[-T] --update-application – updates the application.

[-T] --get-task-list – displays a list of existing application tasks.

[-T] --get-task-state <task ID>|<task name> – displays the status of the specified task.

[-T] --create-task <task name> --type <task type> --file <file name and path> – creates a task of the specified type and imports the settings from the specified configuration file into the task.

[-T] --delete-task <task ID>|<task name> – deletes the task.

[-T] --start-task <task ID>|<task name> [-W] [--progress] – starts the task.

[-T] --stop-task <task ID>|<task name> – stops the task.

[-T] --suspend-task <task ID>|<task name> – pauses the task. The Update task cannot be paused.

[-T] --resume-task <task ID>|<task name> – resumes the task. The Update task cannot be resumed.

[-T] --scan-file <path> [--action <action>] – creates and starts a temporary Custom scan task (task name: Scan_File, task ID – 3).

[-T] --scan-container <container|image[:tag]> – creates a temporary Custom Container Scan task (task name: Custom_Container_Scan, task ID – 19). After the scan is complete, the temporary task is automatically deleted.

[-T] --get-settings <task ID>|<task name> --file <file name and directory> – displays the task settings.

[-T] --set-settings <task ID>|<task name> [<parameters>] [--file <file name and directory>] [--add-path <path>] [--del-path <path>] [--add-exclusion <exclusion>] [--del-exclusion <exclusion>] – sets the task settings.

[-T] --set-settings [<task ID>|<task name>] --set-to-default – restores the task settings to their default values.

[-T] --set-schedule <task ID>|<task name> --file <file name and path> – sets the task schedule settings or imports them into the task from the configuration file.

[-T] --get-schedule <task ID>|<task name> --file <file name and path> – displays the task schedule settings or saves them to the configuration file.

Commands for managing container scan settings

-C is a prefix indicating that the command belongs to the group of commands for managing container scan settings.

[-C] --get-container-settings --file <file name and path> – displays the general container scan settings.

[-C] --set-container-settings --file <file name and path> – sets the general container scan settings.

Commands for managing encrypted connections scan settings

-N is a prefix indicating that the command belongs to the group of commands for managing encrypted connections scan settings.

-N --query user – displays a list of encrypted connections scan exclusions added by the user.

-N --query auto – displays a list of encrypted connections scan exclusions added by the application.

-N --query kl – displays a list of encrypted connections scan exclusions received from Kaspersky databases.

-N --clear-web-auto-excluded – clears the list of domains that the application automatically excluded from encrypted connections scan.

[-N] {--get-net-settings} [--file <file name and path>] – saves encrypted connection scan settings to an INI file.

[-N] {--set-net-settings} [--file <file name and path>] – sets encrypted connection scan settings.

[-N] --add-certificate --file <path to certificate file> – adds a certificate to the trusted certificate list.

[-N] --remove-certificate <certificate subject> – removes a certificate from the trusted certificate list.

[-N] --list-certificates – displays the trusted certificate list.

Commands for managing users and roles

-U is a prefix indicating that the command belongs to the group of commands for managing users and roles.

[-U] --get-user-list – displays a list of users and roles.

[-U] --grant-role <role> <user> – grants a role to a specified user.

[-U] --revoke-role <role> <user> – revokes a role from a specified user.

Licensing commands

-L is a prefix indicating that the command belongs to the group of commands used to manage license keys.

[-L] --add-active-key <activation code>|<key file> – adds an active key.

[-L] --add-reserve-key <activation code>|<key file> – adds a reserve key.

[-L] --remove-active-key – removes the active key.

[-L] --remove-reserve-key – removes the reserve key.

-L --query – displays information about the license key.

Commands for managing the Firewall Management task

-F is a prefix indicating that the command belongs to the group of commands for managing the Firewall Management task.

[-F] --add-rule [--name <string>] [--action <action>] [--protocol <protocol>] [--direction <directory>] [--remote <remote>] [--local <local>] [--at <index>] – adds a new rule.

[-F] --del-rule [--name <string>] [--index <index>] – deletes a rule.

[-F] --move-rule [--name <string>] [--index <index>] [--at <index>] – changes the rule priority.

[-F] --add-zone [--zone <zone>] [--address <address>] – adds an IP address to the zone.

[-F] --del-zone [--zone <zone>] [--address <address>] [--index <index>] – deletes an IP address from the zone.

-F --query – displays information about the task.

Commands for managing the Anti-Cryptor task

-H is a prefix indicating that the command belongs to the group of commands for managing the Anti-Cryptor task.

[-H] --get-blocked-hosts – displays a list of blocked computers.

[-H] --allow-hosts – unblocks untrusted devices.

Commands for managing Device Control tasks

-D is a prefix indicating that the command belongs to the Device Control group of commands.

[-D] --get-device-list – displays a list of devices connected to the computer.

Commands for managing the Application Control task

-A is a prefix indicating that the command belongs to the Application Control group of commands.

[-A] --get-app-list – displays the list of applications detected on the computer while executing the Inventory Scan task.

[-A] --get-categories – displays a list of created Application Control categories.

Commands for managing the Storage

-B is a prefix indicating that the command belongs to the group of commands used to manage the Storage.

[-B] --mass-remove --query – clears the Storage completely or selectively.

-B --query <filter> – displays information about the objects in the Storage that match the filter conditions.

[-B] --restore <object ID> --file <file name and path> – restores an object from Storage.

Commands used to manage the event log

-E is a prefix indicating that the command belongs to the group of commands used to manage the event log.

-E --query <filter> --db <database file> -n <number> --file <file name and path> [--json] – outputs information about events that match filter conditions from the event log database to the specified file.

Where:

<number> – number of the latest events of the selection (number of records from the end of the selection) to be displayed.

<filter> – filter conditions to limit the query results.

<file name and path> – name and path of the file where you want to save the events.

<database file> – name and path to the event log database file.

Page top

[Topic 201938]

Using filters to limit query results

You can use a filter to limit the query results for the following commands:

• Getting information about application events:

  kess-control -E --query "<logical expression>"

• Displaying information about the objects in the Storage:

  kess-control -B --query "<logical expression>"

• Removing the selected objects from the Storage:

  kess-control -B --mass-remove --query "<logical expression>"

You can use multiple logical expressions to specify a filter by combining them using the AND operator. Logical expressions must be enclosed in quotation marks.

Syntax

"<field> <comparison operator> '<value>'"

"<field> <comparison operator> '<value>' and <field> <comparison operator> '<value>'"

Comparison operator

Page top

[Topic 234826]

Exporting and importing application settings

Kaspersky Embedded Systems Security allows you to export and import all application settings for troubleshooting, verifying settings, or simplifying the application's configuration on other user devices.

When you export settings, all application and task settings are saved to a configuration file. This configuration file is used to import the application's configuration settings.

The application must be launched when settings are imported or exported. After the settings are imported, the application must be restarted.

When importing or exporting settings from an older application version, new settings are set to default values. Importing settings to an older application version is not supported.

Export settings

The kess-control --export-settings command is for exporting settings.

Command syntax

kess-control --export-settings --file <configuration file path> [--json]

Arguments and keys

--file <configuration file path> – full path to the configuration file where the application settings will be saved.

--json – format of the configuration file where the application settings will be saved. If a file format is not specified, the settings will be exported to an INI file.

Import settings

The kess-control --import-settings command is for importing settings.

If the application is managed via Kaspersky Security Center, importing settings is not supported.

Command syntax

kess-control --import-settings --file <configuration file path> [--json]

Arguments and keys

--file <configuration file path> – full path to the configuration file from which the application settings will be imported.

--json – format of the configuration file from which the application settings will be imported. If a file format is not specified, the application attempts to import settings from an INI file. If the import fails, an error is displayed.

When you import application settings, the UseKSN setting is set to No. To start or resume the Kaspersky Security Network usage, specify UseKSN=Basic or UseKSN=Extended.

After application settings are imported, internal task IDs may change. It is recommended to use task names to manage them.

Page top

[Topic 197939]

Setting the application memory usage limit

You can specify the memory usage limit for Kaspersky Embedded Systems Security during scan tasks (ODS and OAS), in megabytes.

This setting limits only the amount of memory used when scanning files. That means that the total amount of memory required by the application can be more than the value of this setting.

The minimum value is 2 MB. Default value is 8192 MB. If the specified value is less than 2 MB, then the application uses the minimum value (2 MB). If the specified value is greater than the amount of RAM, then the application will use only 25% of the RAM. This value cannot be changed.

To specify a limit on memory use when scanning files:

1. Stop Kaspersky Embedded Systems Security.
2. Open the /var/opt/kaspersky/kess/common/kess.ini file for editing.
3. Add the following setting to the [General] section:

   ScanMemoryLimit=<amount of memory in megabytes>

4. Start Kaspersky Embedded Systems Security.

The new memory usage limit for scanning files will be in effect after the application starts.

Page top

[Topic 197942]

User roles

Access to Kaspersky Embedded Systems Security functions is provided to users in accordance with their roles. A role is a set of rights and privileges for managing the application.

The four groups of system users are created in the operating system: kessadmin, kessuser, kessaudit, and nokess. When you assign an application role to a system user, the user is added to the corresponding group of roles (see the Roles table below). When you revoke a role from a user, this user is removed from the corresponding group of roles.

If no application role is assigned to a system user, that user belongs to a separate group of users without rights.

Thus, the roles correspond to the four groups of operating system users:

• kessadmin – the Administrator role
• kessuser – the User role
• kessaudit – the Auditor role
• nokess is assigned to a user if no other roles are assigned. In this case, the user belongs to a separate group of users without privileges

The table below describes the application roles and their permissions.

User roles

In this section Viewing a list of users and roles Assigning a role to a user Revoking a user role

Page top

[Topic 197944]

Viewing a list of users and roles

To view a list of users and their roles, execute the following command:

kess-control [-U] --get-user-list

Page top

[Topic 197945]

Assigning a role to a user

To assign a role to a specific user, execute the following command:

kess-control [-U] --grant-role <role> <user>

Page top

[Topic 197946]

Revoking a user role

To revoke a role from a specific user, execute the following command:

kess-control [-U] --revoke-role <role> <user>

Page top

[Topic 201954]

General application settings

This section contains information about commands for managing general application settings and container scan settings.

In this section Description of the general application settings Editing general application settings Description of general container scan settings Editing general container scan settings

Page top

[Topic 247312]

Description of the general application settings

This section describes the values of the general settings of the Kaspersky Embedded Systems Security configuration file (see the table below).

General application settings

Page top

[Topic 234832]

Editing general application settings

Root privileges are required to change application settings.

To edit the general application settings:

1. Save the general application settings to the configuration file using the --get-app-settings command:

   kess-control [-T] --get-app-settings --file <configuration file path>

2. Open the created configuration file, edit the necessary settings, and save the changes.
3. Import the settings from the configuration file into the application using the --set-app-settings command:

   kess-control [-T] --set-app-settings --file <configuration file path>

   To enable use of Kaspersky Security Network, run the kess-control --set-settings command with the --accept-ksn flag as follows: kess-control --set-app-settings UseKSN=Basic|Extended --accept-ksn.

Kaspersky Embedded Systems Security applies the new values of the settings after restart.

You can use the created configuration file to import the settings into the application installed on another device.

The kess-control --get-app-settings command

The kess-control --get-app-settings command displays the general application settings. You can also use this command to export the general application settings to a configuration file.

Command syntax

kess-control [-T] --get-app-settings [--file <configuration file path>] [--json]

Arguments and keys

--file <configuration file path> – path to the configuration file where the application settings will be saved. If you specify the name of a file without specifying its path, the file will be created in the current directory. If a file with the specified name already exists in the specified path, it will be overwritten. If the specified directory cannot be found on the disk, the configuration file will not be created. If you do not specify the --file option, the general application settings will be displayed on the console.

--json – format of the configuration file where the application settings will be saved. If a file format is not specified, the settings will be exported to an INI file.

The kess-control --set-app-settings command

The kess-control --set-app-settings command sets the general application settings using the command options or imports the general application settings from the specified configuration file.

Command syntax

kess-control [-T] --set-app-settings <setting name>=<setting value> <setting name>=<setting value>

kess-control [-T] --set-app-settings --file <configuration file path> [--json]

Arguments and keys

--file <configuration file path> – full path to the configuration file to import the settings into the application.

--json – format of the configuration file to import the settings into the application. If a file format is not specified, the application attempts to import settings from an INI file. If the import fails, an error is displayed.

Page top

[Topic 234889]

Description of general container scan settings

This section describes the values of the general container and namespace scan settings (see the table below). Integration with Docker container management system, CRI-O framework, and Podman and runc utilities is supported.

Namespace and container scans can be enabled using the NamespaceMonitoring setting described in the general application settings.

General container and namespace scan settings

Actions performed on a container when an infected object is detected may vary depending on the specified values of the FirstAction and SecondAction settings of the File Threat Protection task and on the value of the InterceptorProtectionMode setting, one of the general application settings (see the table below).

Dependence of actions performed on containers on the specified actions performed on infected objects

Page top

[Topic 207299]

Editing general container scan settings

Editing general container scan settings

Root privileges are required to change application settings.

To edit the general container scan settings:

1. Save the general container scan settings to the configuration file using the --get-container-settings command:

   kess-control [-C] --get-container-settings --file <configuration file name>

2. Open the created configuration file, edit the necessary container scan settings and save the changes.
3. Import the container scan settings from the configuration file into the application using the command --set-container-settings:

   kess-control [-C] --set-container-settings --file <configuration file name>

Kaspersky Embedded Systems Security will apply the new values of the settings after you restart it.

The kess-control --get-container-settings command

The kess-control --get-container-settings command displays the general container scan settings. You can also use this command to export the general container scan setting to the configuration file.

Command syntax

kess-control [-C] --get-container-settings [--file <configuration file name>]

Arguments and keys

--file <configuration file name> – name of the configuration file where the container scan settings are saved.

If you specify the name of a file without specifying its path, the file will be created in the current directory. If a file with the specified name already exists in the specified path, it will be overwritten. If the specified directory cannot be found on the disk, the configuration file will not be created.

The kess-control --set-container-settings command

The kess-control --set-container-settings command sets the general container scan settings using the command keys, or imports the general container scan settings from the specified configuration file.

Command syntax

kess-control [-C] --set-container-settings --file <configuration file name>

kess-control [-C] --set-container-settings <setting name>=<setting value> <setting name>=<setting value>

Arguments and keys

--file <configuration file name> – name of the configuration file, including the full path to the file; the container scan settings from this file will be imported into the application.

Page top

[Topic 245737]

Managing application tasks using the command line

You can manage the application operation using tasks locally on the device (using the command line or configuration files), as well as using Administration Console or Kaspersky Security Center Web Console.

There are two types of tasks for working with the application:

• Predefined task — a task created during installation of the application. Predefined tasks cannot be created or deleted, but you can modify the settings of these tasks.
• A user task that you can create or delete on your own. You can create the following types of user tasks: ODS, Update, Rollback, ODFIM, ContainerScan, and InventoryScan.

Task ID is an identifier that the application assigns to the task at creation. IDs for user tasks are starting from 100. All tasks (including deleted tasks) have unique IDs. The application does not reuse the identifiers of the deleted tasks. The identifier of a new task is the next successive number to the identifier of the latest created task.

Task names are not case-sensitive.

The application's predefined tasks are listed in the table.

Application tasks

You can perform the following actions with tasks:

• start and stop tasks.
• create and delete user tasks.
• Edit task settings.

In this section View the list of tasks Creating a new task Editing task settings using a configuration file Editing task settings using the command line Resetting task settings to their default values Starting and stopping a task Viewing a task state Scheduling a task Managing scan scopes from the command line Managing exclusion scopes from the command line Deleting a task

Page top

[Topic 236014]

View the list of tasks

To view the list of application tasks, execute the following command:

kess-control [-T] --get-task-list [--json]

where:

--json – output format for the list of application tasks. If a file format is not specified, the output will be an INI file.

The list of Kaspersky Embedded Systems Security tasks will be displayed.

The following information will be displayed for each task:

• Name. Task name.
• ID. Task ID.
• Type. Task type.
• State. Current task status.

If Kaspersky Security Center policy prohibits users from viewing and editing tasks locally, information will only be displayed about the Scan_File, Backup, License, File_Threat_Protection, System_Integrity_Monitoring, and Anti_Cryptor tasks. Information about other tasks is not available.

Page top

[Topic 197949]

Creating a new task

You can create tasks with default settings or with settings specified in a configuration file.

You can create only the following types of user tasks: ODS, Update, Rollback, ODFIM, ContainerScan, and InventoryScan.

To create a task with default settings, execute the following command:

kess-control [-T] --create-task <task name> --type <task type>

where:

• <task name> is the name you assign to the new task;
• <task type> is the type of task.

A task of the specified type is created with default settings.

To create a task with the settings specified in the configuration file, execute the following command:

kess-control [-T] --create-task <task name> --type <task type> --file <file path> [--json]

where:

• <task name> is the name you assign to the new task;
• <task type> is the type of task;
• <path to file> is the full path to the configuration file.

A task of the specified type is created with settings specified in a configuration file.

Page top

[Topic 197950]

Editing task settings using a configuration file

To edit task settings by changing a configuration file:

1. Save task settings to the configuration file:

   kess-control --get-settings <task ID>|<task name> --file <full path to the file> [--json]

2. Open the created configuration file for editing.
3. Edit the required settings in the configuration file.
4. Save the changes in the configuration file.
5. Import the settings from the configuration file into the task:

   kess-control --set-settings <task ID>|<task name> --file <full path to the file> [--json]

Task settings will be updated.

If you change the allowlist, or prohibit launch of all applications or applications that affect the operation of Kaspersky Embedded Systems Security in the Application Control task settings, run the --set-settings command with the --accept flag.

Page top

[Topic 246838]

Editing task settings using command line

To edit task settings using the command line:

1. Specify the required setting value:

   kess-control --set-settings <task ID>|<task name> <setting=value> [<setting=value>]

   The application changes the specified setting.

   If you change the allowlist, or prohibit launch of all applications or applications that affect the operation of Kaspersky Embedded Systems Security in the Application Control task settings, run the --set-settings command with the --accept flag.

2. Make sure the setting value is changed in the task configuration file:

   kess-control --get-settings <task ID>|<task name>

If you add a new scan scope or exclusion scope not specifying all settings, a scope with default settings is added to the configuration file.

Page top

[Topic 197952]

Resetting task settings to their default values

Kaspersky Embedded Systems Security allows you to reset task settings to default values from command line.

Restoring default settings is not available for the License and Rollback tasks.

To reset task settings to their default values from the command line:

1. Execute the following command:

   kess-control --set-settings <task ID>|<task name> --set-to-default

   The application changes the setting values to their defaults.

2. Make sure the settings' values are changed in the task configuration file:

   kess-control --get-settings <task ID>|<task name> --file <configuration file name>

   The task configuration file contains default values for all settings.

Page top

[Topic 197953]

Starting and stopping a task

By default, the following tasks are automatically started when the application starts: File Threat Protection, Device Control, and Behavior Detection. The remaining tasks are stopped (their status is Stopped).

You can start a task at any time.

The Backup and License tasks cannot be started or stopped.

To start a task, execute the following command:

kess-control --start-task <task ID>|<task name>

To stop a task, execute the following command:

kess-control --stop-task <task ID>|<task name>

Page top

[Topic 246851]

Viewing a task state

To view a task state, execute the following command:

kess-control --get-task-state <task ID>|<task name>

where:

• <task ID> is the task ID that the application assigned to the task when it was created.

The application tasks can have one of the following states:

• Started—Task is running.
• Starting—Task is being launched.
• Stopped—Task has been stopped.
• Stopping—Task is stopping.

The ODS, ODFIM, and InventoryScan tasks can also have one of the following states:

• Pausing — Task is pausing.
• Suspended — Task is suspended.
• Resuming — Task is resuming.

The Backup and License tasks cannot be started, suspended, or stopped. They can have only the Started state.

Page top

[Topic 236381]

Scheduling a task

You can view and configure the schedule settings for the following task types: ODS, Update, Rollback, ODFIM, ContainerScan and InventoryScan.

Editing task schedule settings

To configure task schedule settings:

1. Save task schedule settings to a configuration file by executing the following command:

   kess-control --get-schedule <task ID>|<task name> --file <configuration file name> [--json]

2. Open the configuration file for editing.
3. Specify the schedule settings.
4. Save the changes in the configuration file.
5. Import the schedule settings from the configuration file to the task using the following command:

   kess-control --set-schedule <task ID>|<task name> --file <configuration file name> [--json]

The application will apply the new values of the schedule settings immediately.

Task schedule settings

The application provides the following settings for configuring the task launch schedule:

RuleType=Once|Monthly|Weekly|Daily|Hourly|Minutely|Manual|PS|BR

where:

Manual – start the task manually.

PS – start the task after starting the application.

BR – start the task after the application databases have been updated.

StartTime=[<year>/<month>/<day of the month>] [hh]:[mm]:[ss]; [<day of the month>|<day of the week>]; [<start periodicity>] – task start time. The StartTime setting is required if RuleType=Once|Monthly|Weekly|Daily|Hourly|Minutely.

RandomInterval=<minutes> – a time interval from 0 to the specified value (in minutes), which will be added to the task start time to avoid starting tasks at the same time.

RunMissedStartRules – enables launch of the missed task after the application starts.

The kess-control --get-schedule command

The kess-control --get-schedule command displays the task schedule settings or saves them to the specified configuration file.

Command syntax

kess-control [-T] --get-schedule <task ID>|<task name> [--file <configuration file name>] [--json]

Arguments and keys

<task ID> is the task identification number in the application.

<task name> is a name of a task.

--file <configuration file name> is the name of the configuration file where the schedule settings will be saved. If you specify the name of a file without specifying its path, the file will be created in the current directory. If a file with the specified name already exists in the specified path, it will be overwritten. If the specified directory cannot be found on the disk, the configuration file will not be created.

The kess-control --set-schedule command

The kess-control --set-schedule command sets the task schedule settings using the command keys or imports the task schedule settings from the specified configuration file.

Command syntax

kess-control --set-schedule <task ID>|<task name> --file <configuration file name> [--json]

kess-control --set-schedule <task ID>|<task name> <setting name>=<setting value> <setting name>=<setting value>

Arguments and keys

<task ID> is the task identification number in the application.

<task name> is a name of a task.

--file <configuration file name> is the name of the configuration file; the schedule settings from this file will be imported into the task; includes the full path to the file.

Page top

[Topic 197954]

Managing scan scopes from the command line

You can add or delete a scan scope with a specified Path for OAS, ODS, OAFIM, ODFIM, and AntiCryptor tasks from the command line.

To add a new scan scope, execute the following command:

kess-control --set-settings <task ID>|<task name> --add-path <path>

A new [ScanScope.item_#] section will be added to the configuration file. The application scans the objects in the directory specified by the Path setting.

If a [ScanScope.item_#] section already exists for the specified Path setting, a duplicate section will not be added to the configuration file. If the UseScanArea setting is set to No its value will change to Yes after this command is executed and the objects located in this directory will be scanned.

To delete a scan scope, execute the following command:

kess-control --set-settings <task ID>|<task name> --del-path <path>

The [ScanScope.item_#] section that contains the specified path will be deleted from the task configuration file. The application will not scan the objects in the directory specified by the Path setting.

Page top

[Topic 197955]

Managing exclusion scopes from the command line

You can add or delete an exclusion scope with a specified Path for OAS, ODS, OAFIM, ODFIM, and AntiCryptor tasks from the command line.

To add a new exclusion scope, execute the following command:

kess-control --set-settings <task ID>|<task name> --add-exclusion <path>

In order to optimize the operation of scan tasks, it is recommended to add the path with snapshots mounted by the system in the read-only mode to the exclusions for the systems with the btrfs file system and enabled active snapshots. For example, for the systems based on SUSE/OpenSUSE, you can add the following exclusion for the path: /.snapshots/*/snapshot/.

A new [ExcludedFromScanScope.item_#] section will be added to the configuration file. The application will exclude objects in the directory specified by the Path setting from scans.

If an [ExcludedFromScanScope.item_#] section already exists for the specified Path setting, a duplicate section will not be added to the configuration file. If the UseScanArea setting is set to No its value will change to Yes after this command is executed and the objects located in this directory will be excluded from scans.

To delete an exclusion scope, execute the following command:

kess-control --set-settings <task ID>|<task name> --del-exclusion <path>

The [ExcludedFromScanScope.item_#] section that contains the specified path is deleted from the task configuration file. The application will not exclude objects in the directory specified by the Path setting from scans.

Page top

[Topic 197960]

Deleting a task

You can only delete tasks that you have created. You cannot delete predefined tasks.

To delete a task, execute the following command:

kess-control --delete-task <task ID>|<task name>

Page top

[Topic 236580]

Encrypted connections scan

You can configure settings for scanning the encrypted connections used in the Web Threat Protection task.

You can also configure the list of trusted certificates, which is used when scanning encrypted connections.

In this section Encrypted connections scan settings Managing encrypted connections scan settings Managing trusted certificates

Page top

[Topic 198037]

Encrypted connections scan settings

All available values and default values for each setting are described in the table below.

When the encrypted connection scan settings are changed, the application records a NetworkSettingsChanged event in the log file.

Encrypted connections scan settings

Page top

[Topic 198038]

Managing encrypted connections scan settings

You can manage encrypted connections scan settings from the command line.

To view the list of encrypted connection scan exclusions added by a user, execute the following command:

kess-control -N --query user

To view the list of encrypted connection scan exclusions added by a user, execute the following command:

kess-control -N --query auto

To view the list of encrypted connection scan exclusions received from the application databases, execute the following command:

kess-control -N --query kl

To clear a list of domains that the application automatically excluded from scan, execute the following command:

kess-control -N --clear-web-auto-excluded

To view encrypted connection scan settings, execute the following command:

kess-control [-N] --get-net-settings [--file <file path and name>]

The output format is INI.

To set encrypted connection scan settings, execute the following command:

kess-control [-N] --set-net-settings [--file <file path and name>]

Page top

[Topic 236555]

Managing trusted certificates

You can set the list of certificates that will be trusted by the application. The list of trusted certificates is used when scanning encrypted connections.

You can manage the trusted certificate list from the command line.

To add a certificate to the trusted certificate list, run the following command:

kess-control [-N] --add-certificate <path to certificate>

where:

<path to certificate> is the path to the certificate file that you want to add (PEM or DER format).

To remove a certificate from the trusted certificate list, run the following command:

kess-control [-N] --remove-certificate <certificate subject>

To view the list of trusted certificates, execute the following command:

kess-control [-N] --list-certificates

The following information is displayed for each certificate:

• certificate subject
• serial number
• certificate issuer
• certificate start date
• certificate expiration date
• SHA-256 certificate thumbprint

Page top

[Topic 197961]

File Threat Protection task (File_Threat_Protection, ID:1)

File Threat Protection prevents infection of the device's file system. The File Threat Protection task is created automatically with default settings when you install Kaspersky Embedded Systems Security application on your device. By default, the File Threat Protection task starts automatically when the application starts. The task resides in the device's RAM and scans all opened, saved, and active files.

Administrator role privileges are required to start and stop the File Threat Protection task from the command line.

Upon detecting malware, Kaspersky Embedded Systems Security may remove the infected file and terminate the malware process started from this file.

When the File Threat Protection task is running, the application scans all namespaces and containers in all supported operating systems if NamespaceMonitoring is set to Yes in the general application settings. Additionally, for Astra Linux, a custom virus scan task (Scan_File) allows files from other namespaces to be scanned (as part of a mandatory scan). You can separately configure general scan settings for containers and namespaces.

The application does not scan namespaces and containers unless components for working with containers and namespaces are installed in the operating system. Moreover, when viewing application information in the Container monitoring row, "The task is available and not running" is displayed.

File Threat Protection user tasks cannot be created. You can modify the settings of the default File Threat Protection task.

If InterceptorProtectionMode is set to Notify in the general application settings, then when infected objects are detected, the application does not perform the actions specified in the FirstAction and SecondAction settings of the File Threat Protection task.

In this Help section Special considerations for scanning symbolic links and hard links File Threat Protection task settings Specifying an exclusion scope Optimizing network directory scanning

Page top

[Topic 197963]

Special considerations for scanning symbolic links and hard links

Kaspersky Embedded Systems Security lets you scan symbolic links and hard links to files.

Scanning symbolic links

The application scans symbolic links only if the file referenced by the symbolic link is within the protection scope of the File Threat Protection task.

If the file referenced by the symbolic link is not within the File Threat Protection task, the application does not scan this file. However, if the file contains malicious code, the security of the device is at risk.

Scanning hard links

When processing a file with more than one hard link, the application chooses an action depending on the specified action on objects:

• If the Perform recommended action option is selected, the application automatically selects and performs an action on an object based on data about the danger level of the threat detected in the object and the possibility of disinfecting it.
• If the Remove action is selected, the application removes the hard link being processed. The remaining hard links to this file will not be processed.
• If the Disinfect action is selected, the application disinfects the source file. If disinfection fails, the application deletes the hard link and creates in its place a copy of the source file with the name of the deleted hard link.

When you restore a file with a hard link from the Storage, the application creates a copy of the source file with the name of the hard link that was moved to the Storage. Connections with the remaining hard links to the source file will not be restored.

Page top

[Topic 234812]

File Threat Protection task settings

The table describes all available values and default values of all the settings that you can specify for the File Threat Protection task.

File Threat Protection task settings

Page top

[Topic 197965]

Specifying an exclusion scope

You can specify an exclusion scope for the File Threat Protection task. Files in the exclusion scope are excluded from protection scopes.

To create an exclusion scope:

1. Save the File Threat Protection task settings to a file using the following command:

   kess-control --get-settings 1 --file <full path to the configuration file>

2. Add the [ExcludedFromScanScope.item_#] section to the created file. This section contains the following settings:
   • AreaDesc – a description of the exclusion scope, which contains additional information about the exclusion scope.
   • Path – the path to the files or directories to be excluded from the protection scope.
   • AreaMask.item_# – file name mask for the files to be excluded from the protection scope.

     Example: [ExcludedFromScanScope.item_0000] AreaDesc= UseScanArea=Yes Path=/tmp/notchecked AreaMask.item_0000=*

3. Import settings from the configuration file to the File Threat Protection task by using the following command:

   kess-control --set-settings 1 --file <full path to the configuration file>

You can also manage exclusion scopes from the command line.

Page top

[Topic 235226]

Optimizing network directory scanning

To optimize the File Threat Protection task, you can exclude from scans any files being copied from network directories. Files are scanned only after the process of copying to a local directory is finished. To exclude files located in network directories from scans, configure scan exclusion for the utility used to copy files from network directories (for example, for the cp utility).

To configure exclusion of network directories from scans:

1. Save the File Threat Protection task settings to a file using the following command:

   kess-control --get-settings 1 --file <full path to the configuration file>

2. Add the [ExcludedForProgram.item_#] section to the created file. This section contains the following settings:
   • ProgramPath – path to the process to be excluded or to the directory with the processes to be excluded.
   • ApplyToDescendants parameter indicates whether the scan should exclude child processes of the excluded process specified by the ProgramPath parameter (possible values: Yes or No).
   • AreaDesc – a description of the process exclusion scope, which contains additional information about the exclusion scope.
   • UseExcludedForProgram parameter indicates whether the scan task should exclude the specified scope (possible values: Yes or No).
   • Path – path to the files or directory with files modified by the process.
   • AreaMask.item_# is the file name mask for the files to be excluded from the scan. You can also specify the full path to the file.

     Example: [ExcludedForProgram.item_0000] ProgramPath=/usr/bin/cp ApplyToDescendants=No AreaDesc= UseExcludedForProgram=Yes Path=AllRemoteMounted AreaMask.item_0000=*

3. Import settings from the configuration file to the File Threat Protection task by using the following command:

   kess-control --set-settings 1 --file <full path to the configuration file>

The application does not scan the files in network directories, but the cp command itself (for the example given above) and local files are scanned.

Page top

[Topic 246880]

Malware Scan task (Scan_My_Computer, ID:2)

Malware scan is a one-time full or custom scan of files on the device by Kaspersky Embedded Systems Security. The application can carry out multiple malware scanning tasks at the same time. You can also create custom malware scan tasks.

By default, a pre-installed malware scan task is created in the application — full scan. During a full scan, the application scans all objects located on the device's local drives, as well as all mounted and shared objects that are accessed via Samba or NFS protocols with the recommended security settings.

Upon detecting malware, Kaspersky Embedded Systems Security may remove the infected file and terminate the malware process started from this file.

If during execution of the malware scan task the application was restarted by a control service or manually by the user, the task will be stopped. The application logs the OnDemandTaskInterrupted event.

The table describes all available values and the default values of all the settings that you can specify for the Malware Scan task.

Malware Scan task settings

Page top