McAfee VirusScan Enterprise for Linux Software

(1)

Configuration Guide

McAfee VirusScan Enterprise for Linux

1.7.0 Software

(2)

COPYRIGHT

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION License Agreement

(3)

Preface

This guide provides the information you need to configure, use and maintain McAfee VirusScan Enterprise for Linux using McAfee ePolicy Orchestrator software. This guide provides detailed information on how you can deploy VirusScan Enterprise for Linux on client computers and manage the product using ePolicy Orchestrator.

For instructions on how to install McAfee VirusScan Enterprise for Linux software version 1.7 on a stand-alone computer, see the McAfee VirusScan Enterprise for Linux 1.7 — Installation Guide. For detailed information all phases of product use from configuration to troubleshooting, see the McAfee

VirusScan Enterprise for Linux 1.7 — Product Guide.

Contents

About this guide

Finding product documentation

About this guide

This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized.

Audience

McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for:

• Administrators — People who implement and enforce the company's security program.

• Users — People who use the computer where the software is running and can access some or all of its features.

Conventions

This guide uses the following typographical conventions and icons.

Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis.

Bold Text that is strongly emphasized.

User input or Path Commands and other text that the user types; the path of a folder or program.

Code A code sample.

User interface Words in the user interface including options, menus, buttons, and dialog boxes.

Hypertext blue A live link to a topic or to a website.

(6)

Tip: Suggestions and recommendations.

Important/Caution: Valuable advice to protect your computer system,

software installation, network, business, or data.

Warning: Critical advice to prevent bodily harm when using a hardware

product.

What's in this guide

This guide is organized to help you find the information you need.

This guide provides you with an introduction to McAfee VirusScan Enterprise for Linux and how to integrate it with ePolicy Orchestrator.

Topics include:

• Deploying McAfee VirusScan Enterprise for Linux using ePolicy Orchestrator • Settings policies within ePolicy Orchestrator

• Scheduling tasks such as product update and on-demand scan • Configuring reports

• Removing the software

Finding product documentation

McAfee provides the information you need during each phase of product implementation, from

installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase.

Task

1 Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.

2 Under Self Service, access the type of information you need:

To access... Do this...

User documentation _{1 Click Product Documentation.}

2 Select a product, then select a version. 3 Select a product document.

KnowledgeBase _{• Click Search the KnowledgeBase for answers to your product questions.} • Click Browse the KnowledgeBase for articles listed by product and version.

Preface

(7)

1

Introducing McAfee VirusScan Enterprise

for Linux

McAfee VirusScan Enterprise for Linux (previously known as LinuxShield) detects and removes viruses and other potentially unwanted software on Linux-based systems.

This information is intended for network administrators who are responsible for their company’s anti-virus and security program.

Contents

Product Features

What’s new in this release

Product Features

This section describes the product features for the McAfee VirusScan Enterprise for Linux software. McAfee VirusScan Enterprise for Linux software has the following features:

• Support for 64-bit AMD64/Intel EM64T operating systems. • The latest version (5400) of the McAfee anti-virus engine. • Incremental Virus Signature (DAT) updates.

• Mod-versioning for automatic kernel support.

• Regular expression based exclusions for On-access scan and On-demand scan from the user interface. • Scanning

• Comprehensive on-access anti-virus scanning and cleaning using the McAfee scanning engine. • On-access scanning for local file systems, NFS and Samba/CIFS.

• Kernel-level scan cache for improved performance. • Scheduling of on-demand scans.

• Scheduling of updates for scanning engine and virus definition files. • Administration

• Remote administration using browser-based interface.

• Secure browser interface with authentication and HTTPS (SSL) support. • Remote administration and reporting using ePolicy Orchestrator 4.5 or 4.6.

(8)

• Reporting

• Real-time statistics.

• Detailed database for detected items and system events.

• Ability to query the database by date range or individual field values, for example, virus name. Results of query can be exported to a CSV file.

• Configurable email notification for detected items, out-of-date virus definition files, configuration changes, and system events.

• Diagnostic report for use when reporting a problem with the product.

What’s new in this release

This section describes the new enhancements in this release of VirusScan Enterprise for Linux. • Support for Novell Cluster Services.

• Support for Corosync OCFS2 File System Cluster. • Run-time Kernel Module Support

McAfee VirusScan Enterprise for Linux Kernel modules will be created dynamically in case of a mod-version failure. To manually compile the kernel module, refer to the Frequently asked

questions — Run-time Kernel Module Support section in the Product Guide.

(9)

2

Integrating with ePolicy Orchestrator

This chapter describes how to configure McAfee VirusScan Enterprise for Linux, version 1.7 using McAfee ePolicy Orchestrator management software.

To use this chapter effectively, you need to be familiar with ePolicy Orchestrator 4.5 or 4.6. McAfee ePolicy Orchestrator provides a scalable platform for centralized policy management and enforcement on your McAfee security products and systems on which they reside. It also provides comprehensive reporting and product deployment capabilities; all through a single point of control.

This guide does not provide detailed information about installing or using ePolicy Orchestrator software. See the McAfee ePolicy Orchestrator 4.5 or 4.6 — Installation/Product Guide.

Contents

Prerequisites

Installing McAfee VirusScan Enterprise for Linux using ePolicy Orchestrator

Upgrading to McAfee VirusScan Enterprise for Linux 1.7 using ePolicy Orchestrator Sending an agent wake-up call

Setting policies within ePolicy Orchestrator Scheduling tasks

Configuring reports Uninstallation

Prerequisites

Before deploying McAfee VirusScan Enterprise for Linux on Novel Open Enterprise Server 2.x:

1 From the Novell eDirectory server, use iManager and create a user called "nails" and a group called "nailsgroup".

2 Add the user "nails" a member of the "nailsgroup". Enable the user and group using the Linux User

Management.

3 _{Provide "nails" user with administrative privileges on all the NSS volumes. For example: rights -f /}

media/nss/<VOL-name> -r s trustee nails.<context>.<tree>

You need to provide administrative privileges to the "nails" user, every time a new NSS volume is created.

(10)

Installing McAfee VirusScan Enterprise for Linux using ePolicy

Orchestrator

Use this task to install McAfee VirusScan Enterprise for Linux on client computers using ePolicy Orchestrator.

Task

1 Log on to the ePolicy Orchestrator server as an administrator.

2 Create a temporary directory on your local drive.

3 Download the archive McAfeeVSEForLinux-1.7.0-<build>-release.noarch.tar.gz and extract the files to the temporary directory.

4 Click Menu | Software | Master Repository. The Packages in Master Repository page appears.

5 Click Actions | Check In Package. The Check In Package page appears.

6 Select the Package type as Product or Update (.ZIP) and browse in File path to locate the McAfee Agent for Linux package MSA-LNX_4.6.0_Package.ZIP extracted in the temporary directory.

7 Click Next. The Package Options page appears with the package information.

8 Select a Branch.

9 In Options, select the required option(s), then click Save.

12 Select the Package type as Product or Update (.ZIP) and browse in File path to locate McAfee VirusScan Enterprise for Linux product deployment package McAfeeVSEForLinux-1.7.0-<build>-EPO.ZIP extracted in the temporary directory.

16 Click Menu | Software | Extensions. The Extensions page appears.

17 Click Install Extension to install the McAfee Agent policy extension. The Install Extension dialog box appears.

18 Click Browse, select the extension file EPOAGENTMETA.ZIP, then click OK on the Install Extension page.

20 Click Install Extension to install the McAfee VirusScan Enterprise for Linux policy extension. The Install

Extension dialog box appears.

21 _{Click Browse, select the extension file LYNXSHLD1700.ZIP, then click OK on the Install Extension page.} 22 Click Menu | Software | Extensions. The Extensions page appears.

23 Click Install Extension to install the McAfee VirusScan Enterprise for Linux reports extension. The Install

2

Integrating with ePolicy Orchestrator

(11)

24 _{Click Browse, select the extension file LYNXSHLD1700PARSER.ZIP, then click OK on the Install Extension}

page.

Before installing the reports extension (LYNXSHLD1700PARSER.ZIP), ensure that you have removed the previous LinuxShield reports extension module (LYNXSHLDPARSER) from ePolicy Orchestrator. 25 Create and download the agent installation package by performing the following steps:

a From System Tree, click System Tree Actions | New Systems. The New Systems page appears.

b Under How to add systems select Create and download agent installation package, click Non-Windows, then select

McAfee Agent for Linux 4.6.0 (Current) and click OK.

c From Download file, right-click install and select Save Target As... to download the file on to your local system.

If you are deploying the product on a Ubuntu client system, download the installdeb.sh file on to your local system. In case of ePolicy Orchestrator 4.5, this file is not available for download, hence copy this file from C:\Program Files\McAfee\ePolicy Orchestrator\DB\Software \Current\EPOAGENT3700LYNX\Install\0409.

26 From the Linux terminal, execute the following command: sh install.sh –i

This will establish a connection between ePolicy Orchestrator and the Linux client computer.

27 Click Menu | Systems | System Tree. The System Tree page appears.

28 To install McAfee VirusScan Enterprise for Linux on the client Linux computer:

• On ePolicy Orchestrator 4.5 — Click Client Tasks | New Task. The Client Task Builder page appears. • On ePolicy Orchestrator 4.6 — Click Assisgned Client Tasks | Actions | New Client Task Assignment. The

Client Task Assignment Builder page appears. 29 To schedule a client task:

• On ePolicy Orchestrator 4.5 — Under Description, type a Name, Notes for the task and select the Type as Product Deployment and click Next.

• On ePolicy Orchestrator 4.6 — Under Task to schedule, select McAfee Agent as Product, select the Task

Type as Product Deployment, then click Create New Task under Task Name. 30 To configure the client task:

• On ePolicy Orchestrator 4.5 — Under Configuration, select the Target platforms as Linux and in Products

and components, select VirusScan Enterprise for Linux 1.7.0.<build number> from the drop-down list, then

select the Action as Install.

• On ePolicy Orchestrator 4.6 — Under Client Task Catalog, select Linux as Target Platforms, VirusScan

Enterprise for Linux 1.7.0.<build number> as Products and components, Install as Action and the appropriate Language, then click Save.

If you want to deploy McAfee VirusScan Enterprise for Linux with customized settings, then copy the nails.options file to the /root and / directory on your Linux client system. For more information on how to create the nails.options file, refer to the Silent installation section in the product's Installation Guide.

31 Click Next to schedule this task immediately or as required.

(12)

32 Click Next to view a summary of the task.

33 Click Save and send an agent wake-up call. Wait for the deployment task to complete.

Upgrading to McAfee VirusScan Enterprise for Linux 1.7 using

ePolicy Orchestrator

Use this task to upgrade your Linux client systems running on McAfee VirusScan Enterprise for Linux 1.6 or LinuxShield 1.5.1 to McAfee VirusScan Enterprise for Linux version 1.7 using the ePolicy Orchestrator software.

Task

2 Create a temporary directory on your local drive.

3 Download the archive McAfeeVSEForLinux-1.7.0-<build>-release.noarch.tar.gz and extract the files to the temporary directory.

6 Select the Package type as Product or Update (.ZIP) and browse in File path to locate the McAfee Agent for Linux package MSA-LNX_4.6.0_Package.ZIP extracted in the temporary directory.

12 Select the Package type as Product or Update (.ZIP) and browse in File path to locate McAfee VirusScan Enterprise for Linux product deployment package McAfeeVSEForLinux-1.7.0-<build>-EPO.ZIP extracted in the temporary directory.

17 Click Install Extension to install the McAfee Agent policy extension. The Install Extension dialog box appears.

18 Click Browse, select the extension file EPOAGENTMETA.ZIP, then click OK on the Install Extension page.

20 Click Install Extension to install the McAfee VirusScan Enterprise for Linux policy extension. The Install

2

(13)

23 Click Install Extension to install the McAfee VirusScan Enterprise for Linux reports extension. The Install

24 Click Browse, select the extension file LYNXSHLD1700PARSER.ZIP, then click OK on the Install Extension page.

Before installing the reports extension (LYNXSHLD1700PARSER.ZIP), ensure that you have removed the previous LinuxShield reports extension module (LYNXSHLDPARSER) from ePolicy Orchestrator. 25 Click Menu | Systems | System Tree. The System Tree page appears.

26 To install McAfee VirusScan Enterprise for Linux on the client Linux computer:

Client Task Assignment Builder page appears. 27 To schedule a client task:

select the Action as Install.

Enterprise for Linux 1.7.0.<build number> as Products and components, Install as Action and the appropriate Language, then click Save.

If you want to upgrade the McAfee Agent on the Linux client system to McAfee Agent 4.6, first add McAfee Agent for Linux 4.6.0.x, then click the + button to add VirusScan Enterprise for Linux 1.7.0.<build number> to upgrade both McAfee Agent and the product.

29 Click Next to schedule this task immediately or as required.

31 Click Save and send an agent wake-up call. Wait for the deployment task to complete.

Sending an agent wake-up call

Use this task to send an agent wake-up call to the client computer using ePolicy Orchestrator.

All systems in the network are managed in the Systems tab. The System Tree contains all systems that are managed by the ePolicy Orchestrator server. It is the primary interface for managing policies and tasks on these systems. You can organize or sort these systems into logical groups in the System Tree.

My Organization is the root of the System Tree. It includes a Lost&Found group that stores systems whose

locations cannot be determined by the server. Depending on the methods you use to create and maintain the System Tree segments (systems), the server uses different characteristics to place the systems in the System Tree.

(14)

Task

2 Click Menu | Systems | System Tree.

3 Select a group in the System Tree.

4 Select the Computer Name(s) of that group.

5 Click Actions | Agent | Wake Up Agents. The Wake Up McAfee Agent page appears.

6 Select the Wake-up call type as Agent Wake-Up Call and a Randomization period (0-60 minutes) by which the system(s) respond to the wake-up call sent by the ePolicy Orchestrator server.

7 Select Get full product properties for the agent(s) to send complete properties instead of sending only those that have changed since the last agent-to-server communication.

8 Click OK.

To see the status of the agent wake-up call, click Menu | Automation | Server Task Log.

Setting policies within ePolicy Orchestrator

The ePolicy Orchestrator console allows you to enforce policies across groups of computers or on a single computer.

These policies override configurations set on individual computers. For information regarding policies and how they are enforced, see the McAfee ePolicy Orchestrator 4.5 or 4.6 — Product Guide.

Before configuring any policies, select the group of computers for which you want to modify McAfee VirusScan Enterprise for Linux policies. You can modify McAfee VirusScan Enterprise for Linux policies from the pages and tabs that are available in the details pane of the ePolicy Orchestrator console. These pages are nearly identical to those you can access directly from the McAfee VirusScan Enterprise for Linux user interface.

After you have modified the appropriate policies and saved the changes for the intended computer or group of computers, you are ready to deploy new settings via the McAfee Agent.

Creating or editing policies

You can create, edit, delete, or assign a policy to a specific group in the System Tree. Task

3 Click Assigned Policies.

4 Select Product as VirusScan Enterprise for Linux 1.7.0. A list of policies managed by McAfee VirusScan Enterprise for Linux appears in the lower pane.

5 Locate the required policy, and click Edit Assignment next to the policy. The policy assignment for the chosen group page appears.

(15)

6 Click Edit Policy or New Policy as required.

If you click New Policy, the Create a new policy dialog box appears. Select the policy you want to duplicate from the Create a policy based on this existing policy drop-down list, type a name then click OK. The new policy wizard appears.

7 Edit the policy setting as required, then click Save.

Enforcing policies

You can enforce a policy to multiple managed systems within a group. Task

2 Click Menu | Systems | System Tree and select a required group or system(s).

3 Click Assigned Policies and from the Product drop-down menu, select VirusScan Enterprise for Linux 1.7.0.

4 Select the Category and click Edit Assignment.

5 Select the policy from the Assigned policy drop-down menu and click Save.

6 Select the systems again.

7 Send an agent wake-up call. For instructions on sending an agent wake-up call, please refer to

Sending an agent wake-up call section.

You can create and enforce McAfee VirusScan Enterprise for Linux policies and view reports only after adding the McAfee VirusScan Enterprise for Linux extension files.

Scheduling tasks

The ePolicy Orchestrator software allows you to create, schedule, and maintain client tasks that run on the managed systems. You can define client tasks for the entire System Tree, a specific group, or an individual system.

Creating a Product Update task

Use this task to schedule autoupdates on the Linux server using ePolicy Orchestrator.

Your software can only provide full protection if you keep it up-to-date with the latest anti-virus definitions (DATs), spam engine, and anti-virus scanning engine.

We recommend that you update DAT files daily and regularly check the McAfee AVERT (Anti-Virus Emergency Response Team) website for new DAT files.

Task

2 Click Menu | Systems | System Tree and select a required group or system(s) for which you want to create the Product Update task.

(16)

3 To create a client task:

Client Task Assignment Builder page appears. 4 To select the product update task:

• On ePolicy Orchestrator 4.5 — Under Description, type a Name, Notes for the task and select the Type as Product Update and click Next.

Type as Product Update, then click Create New Task under Task Name. 5 Click Next.

6 Schedule the task as desired and click Next to select the DAT, ExtraDAT and Linux Engine.

7 Schedule the task immediately or as required, then click Next to view the Summary of the product update task.

8 Click Save.

9 Send an agent wake-up call.

Click Edit to change the description or schedule of a product update task or Delete to remove it.

Creating an on-demand scan task

Use this task to schedule an on-demand scan on the Linux client computer using ePolicy Orchestrator. On-demand scan task involves a scheduled scanning of your Linux server(s) to find a threat,

vulnerability, or other potentially unwanted code. It can take place immediately, at a scheduled time in the future, or at regularly-scheduled intervals.

Task

2 Click Menu | Systems | System Tree and select a required group or system(s) for which you want to create the on-demand scan task.

Client Task Assignment Builder page appears. 4 To create the on-demand scan task:

• On ePolicy Orchestrator 4.5 — Under Description, type a Name, Notes for the on-demand scan task and select the Type as On Demand Scan (VirusScan Enterprise for Linux 1.7.0) and click Next.

• On ePolicy Orchestrator 4.6 — Under Task to schedule, select VirusScan Enterprise for Linux 1.7.0 as Product, select the Task Type as On Demand Scan, then click Create New Task under Task Name.

5 In Configuration, specify what you want this task to do, then click Next.

6 Schedule the task immediately or as required, then click Next to view the Summary of the on-demand scan task.

(17)

7 Click Save.

8 Send an agent wake-up call.

Click Edit to change the description/schedule of an on-demand scan task or Delete to remove it.

Configuring reports

Reports are pre-defined queries which query the ePolicy Orchestrator database and generate a graphical output.

McAfee ePolicy Orchestrator has its own querying and reporting capabilities. McAfee includes a set of default queries on the left pane. However, you can create a new query, edit, and manage all the queries related to McAfee VirusScan Enterprise for Linux.

Task

If the pre-defined queries on the left side does not serve your purpose, ePolicy Orchestrator enables you to create your own queries.

2 To view reports:

• On ePolicy Orchestrator 4.5 — Click Menu | Reporting | Queries. The Queries page appears. • On ePolicy Orchestrator 4.6 — Click Menu | Reporting | Queries & Reports. The Queries & Reports page

appears.

3 To create a new query:

• On ePolicy Orchestrator 4.5 — Click Actions | New Query. The Query Wizard page appears. • On ePolicy Orchestrator 4.6 — Click Actions | New. The Query Builder page appears.

4 On the left pane, select a Feature Group that the query should retrieve.

5 Select a Result Type and click Next. The Chart page appears.

6 Select and accordingly configure a display chart/table and click Next. The Columns page appears allowing you to select columns for the chart/table.

7 Select column(s) from the Available Columns pane and click Next.

8 The Filter page appears. Specify criteria by selecting properties and operators to limit the data retrieved by the query.

9 Click Run, then Save. The Save Query page appears.

10 Type a Name and Notes (if required) for the query, then click Save. Table 2-1 Option definitions

Option Definition

Delete Deletes a selected query.

Edit Launches the Query Builder page loaded with the details of the selected query, where you can edit the details of a selected query.

Duplicate Creates and saves a copy of the selected query.

(18)

Table 2-1 Option definitions (continued)

Option Definition

Export Data Exports the selected query to an XML file that can be imported to any ePolicy Orchestrator server.

Run Runs the selected query and displays its result.

Actions | View Query

SQL Takes you to the View Query SQL page, where you can view and copy the SQLscript of the selected query.

Import Query Launches a dialog box that allows you to browse to an exported query file. When you import a query file, the server adds it to My Queries list.

Running a default query

2 Click Menu | Reporting | Queries. A list of queries appear on the left pane.

3 Select VirusScan Enterprise for Linux under Shared Groups.

4 By default there are two VirusScan Enterprise for Linux queries:

Query Description

VSEL: VirusScan Enterprise for Linux

Compliance Shows a graphical display of the compliant and non-compliantlinux systems in the network.

VSEL: VirusScan Enterprise for Linux

Threats Shows a graphical display of the threat summary and actiontaken on all linux systems in the network.

5 Click Run. The graphical output is displayed.

Uninstallation

This section provides instructions to uninstall McAfee VirusScan Enterprise for Linux from the client computers and remove the extensions from the ePolicy Orchestrator server.

Removing McAfee VirusScan Enterprise for Linux from the

client computer

Use this task to remove McAfee VirusScan Enterprise for Linux from the client computer using ePolicy Orchestrator.

Task

Client Task Assignment Builder page appears.

(19)

4 To schedule a client task:

select the Action as Remove.

Enterprise for Linux 1.7.0.<build number> as Products and components, Remove as Action and the appropriate Language, then click Save.

6 Click Next to schedule the task immediately or as required.

8 Click Save and send an agent wake-up call.

Removing McAfee VirusScan Enterprise for Linux from ePolicy

Orchestrator

Use this task to remove McAfee VirusScan Enterprise for Linux from the ePolicy Orchestrator repository. Task

3 Click the Delete link of VirusScan Enterprise for Linux with Version as 1.7.0.

4 To remove the product and reports extension, click Menu | Software | Extensions. The Extensions page appears.

5 From the left pane, select VirusScan Enterprise for Linux.

6 For the report extension file McAfee VirusScan Enterprise for Linux Reports, then click Remove.

7 Select the option Force removal, bypassing any checks or errors, then click OK.

8 For the product extension file VirusScan Enterprise for Linux 1.7.0 and click Remove.

9 Select the option Force removal, bypassing any checks or errors, then click OK.

(20)

(21)

Index

A

about

McAfee VirusScan Enterprise for Linux 7 VirusScan Enterprise for Linux 7 about this guide 5

audience 7

C

conventions and icons used in this guide 5

D

documentation

audience for this guide 5 product-specific, finding 6

typographical conventions and icons 5

F

features

administration 7 reporting 7 scanning 7

VirusScan Enterprise for Linux 7

I

introduction

McAfee VirusScan Enterprise for Linux 7 VirusScan Enterprise for Linux 7

L

Linuxshield

previously known as 7

M

McAfee ServicePortal, accessing 6 McAfee VirusScan Enterprise for Linux

introduction 7

P

product features 7

S

ServicePortal, finding product documentation 6

T

Technical Support, finding product information 6

V

VirusScan Enterprise for Linux features 7

introduction 7

W

(22)