McAfee Change Control Linux Product Guide. (McAfee epolicy Orchestrator)

Transcription

1 McAfee Change Control Linux Product Guide (McAfee epolicy Orchestrator)

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Change Control Linux Product Guide

3 Contents 1 Product Overview 5 Overview of Change Control Key features of Change Control How Change Control works Change Control components Using Change Control 9 Change Control modes Enable Change Control Using Rule Groups 11 What are rule groups? Permissions for rule configuration Managing rule groups Create rule groups Change rule group ownership Manage permissions for rule group tabs Delete or rename rule groups Import or export a rule group View assignments for a rule group Monitoring the file system and registry 17 How monitoring rules work Defining monitoring rules Review predefined monitoring rules Create monitoring policies Settings for tracking content change Configure settings for tracking content changes Track content changes Manage file versions Compare files Protecting your system 25 How protection rules work Define protection rules Path considerations Apply protection rules Protection rules Create a protection policy Enable read protection Monitoring your system 31 Monitoring and reporting Manage events View content changes McAfee Change Control Linux Product Guide 3

4 Contents Exclude events Managing dashboards Managing queries View queries Maintaining your systems 37 Monitor enterprise health Review congestion status and trend Configure notifications Make emergency changes Place the endpoints in Update mode Place the endpoints in Enabled mode Configure CLI breach notifications Change the CLI password Place the endpoints in Disabled mode Purge reporting data Fine-tune your configuration 43 Configure a syslog server Solidcore permission sets Customize end-user notifications A Feature availability 49 4 McAfee Change Control Linux Product Guide

5 1 Product 1 Overview Contents Overview of Change Control How Change Control works Change Control components Overview of Change Control McAfee Change Control allows you to monitor and prevent changes to the file system, and user accounts. You can write-protect and read-protect critical files from unauthorized tampering. You can also define trusted programs or users to allow updates to protected files. A change is allowed only if it's applied according to the software policies. With Change Control, you can perform these actions. Detect, track, and validate changes in real time. Gain visibility into these changes. Eliminate changes using protection rules. Enforce approved change policies and compliance. Provide efficient policy enforcement to block unwanted changes. Key features of Change Control Change Control software can block change activities in server environments to prevent security breaches, data loss, and to lower the impact of outages. Real-time monitoring The software provides real-time monitoring for file changes. This eliminates the need to perform multiple scans on endpoints and identifies change violations. The software monitors: When the change was made Who made it McAfee Change Control Linux Product Guide 5

6 1 Product Overview How Change Control works What program was used to make it Whether it was made manually or by an authorized program Content change tracking Change Control tracks content and attribute changes for files. The software includes special alerting mechanisms to instantly notify you of critical changes. Customizable filters You can use filters to choose what changes are registered in the database. You can match the file name, directory name, process name, file extension, and user name. You can define two types of filters: Include filters to receive information about events matching the specified filtering criteria. Exclude filters to ignore information about events matching the specified filtering criteria. Read protection Read protection rules prevent users from reading the content of specified files, directories, and volumes. If a directory or volume is read-protected, all files in the directory or volume are also read-protected. Subdirectories inherit read protection rules. By default, read protection is disabled. Write protection Use write protection rules to prevent users from creating and changing files and directories. and protects it from unanticipated updates. Write-protecting a file makes it read-only. These actions are prevented: Delete a file. Change content. Rename it. Change attributes. Create hard links. How Change Control works Change Control prevents unauthorized changes in your environment. It blocks unauthorized changes to critical system files, directories, and configurations while implementing new policies and compliance measures. It continuously tracks changes to files keys and identifies who made changes to which files. This graphic shows an overview of how Change Control Works. 6 McAfee Change Control Linux Product Guide

7 Product Overview Change Control components 1 1 A system user tries to change a file or registry on a managed system where Change Control and McAfee Agent are installed. 2 The Change Control software on the managed system recognizes the attempted change and uses the McAfee Agent to send a Change Control event to McAfee epo. 3 Change Control analyzes the rules and policies enforced on the endpoint, and allows or blocks the change. The administrator manages these rules and policies through McAfee epo. 4 Read protection or write protection is enforced and the user s change attempt is approved or denied. 5 The Change Control database logs the file or registry change attempt and local user account information. Change Control components Change Control prevents unauthorized changes in your system. Change Control client Change Control client runs on endpoints, such as fixed function devices, desktops, and servers. In the managed version, it works with McAfee epo and McAfee Agent. McAfee Agent is installed in every endpoint and it acts as the intermediary between the Change Control client and McAfee epo server. McAfee Change Control Linux Product Guide 7

8 1 Product Overview Change Control components McAfee epo and Solidcore extension McAfee epo is the management platform for all McAfee products. Application Control and Change Control have one extension known as Solidcore extension. With McAfee epo and the Solidcore extension, you can: Install software and deploy policies on managed endpoints. Monitor and prevent changes to the file system and user accounts. View details of who made changes, which files were changed, what changes were made to the files, and when and how the changes were made. Change Control database On McAfee epo, Change Control maintains a comprehensive and up-to-date database that logs all attempts to change files and local user accounts. 8 McAfee Change Control Linux Product Guide

9 2 2 Using Change Control Contents Change Control modes Enable Change Control Change Control modes At any time, Change Control can operate in one of these modes. Enabled Update Indicates that the software is in effect and changes are monitored and controlled on the endpoints according to the defined policies. In Enabled mode, Change Control monitors and protects files and registry keys as defined by the configured policies. Enabled mode is the recommended mode of operation. From Enabled mode, you can switch to Disabled or Update mode. Indicates that the software is in effect, allows ad-hoc changes to the endpoints, and tracks the changes made to the endpoints. Use Update mode to perform scheduled or emergency changes, such as software and patch installations. In Enabled mode, you cannot read the read-protected files or change any write-protected files (according to the defined policies). But, in Update mode, all read and write protection that is in effect is overridden. Use Update mode to define a change window during which you can make changes to endpoints and authorize the changes. From Update mode, you can switch to Enabled or Disabled mode. Switch to Enabled mode when the changes are complete. Disabled Indicates that the software is not in effect. Although the software is installed, the associated features are not active. When you place the endpoints in Disabled mode, the application restarts the endpoints. From Disabled mode, you can switch to Enabled or Update mode. Enable Change Control Enable the Change Control software to monitor and control the changes on the endpoints according to the defined policies. McAfee Change Control Linux Product Guide 9

10 2 Using Change Control Enable Change Control 1 On the McAfee epo console, select Menu Systems System Tree. 2 Select a group or an endpoint in the System Tree : Group Select the group and click the Assigned Client s tab. Endpoint Select the endpoint and click Actions Agent Modify s on a Single System. 3 Click Actions New Client Assignment to open the Client Assignment Builder page. 4 Select Solidcore SC: Enable, then click Create New to open the Client Catalog page. Specify the task name and add any descriptive information. Select the platform and subplatform, then make sure that Change Control is selected. 5 Click Save, click Next to open the Schedule page. Specify scheduling details, then click Next. 6 Review and verify the task details, then click Save. 7 (Optional) Wake up the agent to send your client task to the endpoint immediately. 10 McAfee Change Control Linux Product Guide

11 3 Using 3 Rule Groups Contents What are rule groups? Permissions for rule configuration Managing rule groups What are rule groups? A rule group is a collection of rules. Although you can directly add rules to any McAfee epo-based policy, the rules defined in a policy are specific to that policy. In contrast, a rule group is an independent unit that collates a set of similar or related rules. After you define a rule group, you can reuse the rules by associating the group with different policies. Also, when you change or update a rule group, the change is automatically introduced into all associated policies. Rule groups can drastically reduce the effort required to define similar rules across policies. If you have a large setup and you are deploying the software across numerous endpoints, use rule groups to minimize the deployment time and effort. Rule group ownership Users can edit and delete only the rule groups that they own. A user who creates a rule group, is automatically set as the owner of the rule group. Only the owner and McAfee epo administrator can edit and delete the rule group. Also, the administrator can assign ownership to other users or revoke ownership from the owner. In this case, the ownership is automatically granted to the McAfee epo administrator. Users who don't own a rule group can only view the rule group and its policy assignments, duplicate the rule group, and add the rule group to policies. But, if the owner or the McAfee epo administrator updates a rule in the rule group, the change cascades across all associated McAfee epopolicies. Permissions for rule configuration The McAfee epo administrator can configure permissions for Solidcore configuration. If you have multiple administrators working in your enterprise, you can review and manage permissions for each administrator. Permissions for the Rule Groups page You can configure permissions for the Rule Groups page that appears on the Menu Configuration Solidcore Rules page. The permissions determine the actions you can take from the Rule Groups page and control whether the page is visible from other Solidcore pages. You can assign one of these permissions for the Rule Groups page. By default, the McAfee epo administrator has edit permissions for all pages. McAfee Change Control Linux Product Guide 11

12 3 Using Rule Groups Managing rule groups Permission No permissions View permissions Edit permissions Details Indicates that the page is not visible to the user. For example, if no permissions are granted to a user for the Rule Groups page, the tab isn't visible from the Solidcore Rules and Policy Catalog (rule group assignments) pages. Also, the user inherits no permissions on the Updater Processes, Users, and Filters tabs. Indicates that the page is visible to the user. But, the user can't perform changes. For example, if view permissions are granted to a user for the Rule Groups page, the tab is visible from the Solidcore Rules and Policy Catalog (rule group assignments) pages. While the user can view rule group information and check assignments, the user is not allowed to edit, duplicate, or add rule groups. Indicates that the tab is visible and the user can perform all actions available on the page. For example, if edit permissions are granted to a user on the Rule Groups page, the page is visible from the Solidcore Rules and Policy Catalog (rule group assignments) pages and the user is allowed to perform all operations. Permissions for tabs contained in rule group and policy pages User permissions for the Rule Groups page control the permissions for the Updater Processes, Users, and Filters tabs. The permissions available for the Rule Groups page indicate the permissions for the contained tabs. The McAfee epo administrator can selectively change the permissions for individual tabs. When No Permissions or View Permissions are granted to a user, certain actions might not be available. Blocked actions Impacted pages Permissions required for... Exclude Events action is blocked. Import action is unsuccessful because tab-specific rules are not imported. Solidcore Events page Filters tab Rule Groups page Contained tab on the Rule Groups page Managing rule groups Contents Create rule groups Change rule group ownership Manage permissions for rule group tabs Delete or rename rule groups Import or export a rule group View assignments for a rule group Create rule groups You can create a rule group to specify the required rules. 1 On the McAfee epo console, select Menu Configuration Solidcore Rules. 2 Perform one of these steps from the Rule Groups tab. Select Integrity Monitor to view or define a rule group for monitoring changes performed on critical resources. Select Change Control to view or define a rule group for preventing unauthorized changes on critical resources. 12 McAfee Change Control Linux Product Guide

13 Using Rule Groups Managing rule groups 3 3 Create a rule group based on an existing rule group. a b Click Duplicate for an existing rule group. The Duplicate Rule Group dialog box appears. Specify the rule group name, then click OK. The rule group is created and listed on the Rule Groups page. 4 Define a new rule group. a b c d Click Add Rule Group to open the Add Rule Group dialog box. Specify the rule group name. Select the rule group type and platform. Click OK. The rule group is created and listed on the Rule Groups page. 5 Click Edit for the rule group. 6 Specify the required rules. 7 Click Save Rule Group. Change rule group ownership You can assign or remove rule group ownership to one or more users. Before you begin You must be a global administrator to perform this task. 1 On the McAfee epo console, select Menu Configuration Solidcore Rules. 2 On the Rule Groups tab in the Owners column, click the owner for a rule group to open the Rule Group Ownership page. 3 Change the default ownership by selecting or deselecting users listed on the page. 4 Click Save. Changes made to owners are reflected in the Owners column for the selected rule group. Manage permissions for rule group tabs You can manage permissions for the Rule Groups page, and the tabs contained in rule group and policy pages. Before you begin You must be a McAfee epo administrator to use this task. 1 On the McAfee epo console, select Menu User Management Permission Sets. 2 Click New to create a permission set. 3 Provide a name for the permission set. McAfee Change Control Linux Product Guide 13

14 3 Using Rule Groups Managing rule groups 4 Select the users you want to assign the permission set to. The level of permissions that you specify in the permission set is granted to the user. When multiple permission sets are applied to a user account, they aggregate. Consider this as you plan your strategy for granting permissions to the users in your environment. 5 Click Save. 6 Click Edit on the Solidcore General permissions category. 7 Grant permissions for Rule Groups, as needed. 8 Grant permissions selectively for the tabs (Updater Processes, Users, and Filters) contained in rule group and policy pages, as needed. This is based on the permissions the user has on the Rule Groups page. For information, see Permissions for rule configuration. 9 Click Save. Delete or rename rule groups You can delete or rename a rule group, as needed. Before you begin You must be the global administrator or owner of the rule group to perform this task. 1 On the McAfee epo console, select Menu Configuration Solidcore Rules. 2 Complete one of these actions from the Rule Groups tab. To rename a rule group, click Rename, specify a new name, and click OK to close the Rename Rule Group dialog box. To delete a rule group, click Delete and click Yes to close the Delete Rule Group dialog box. Import or export a rule group To replicate a rule group configuration from one McAfee epo server to another, export the rule group configuration from the source McAfee epo server to an XML file and import the XML file to the target McAfee epo server. If you are the owner of the rule group or the global administrator, you can import the rule group XML file to the target McAfee epo server. But, if you are a non-global administrator, you can import rules only for the tabs where you have permissions. All other rules are not imported and details are available on the Server Log page. Also, when you import rule groups to a (target) McAfee epo server, the user logged on to the McAfee epo server becomes the owner of the imported rule group. When you export rule groups from a source McAfee epo server, the owner information is not exported. When importing or exporting rule groups with Trusted Groups, make sure that the Active Directory server on the source and destination McAfee epo servers is configured using the same domain name, server name, or IP address. You can import or export rule groups using the McAfee epo console or web service APIs. 14 McAfee Change Control Linux Product Guide

15 Using Rule Groups Managing rule groups 3 s Use the McAfee epo console on page 15 Based on your setup, you can import or export rule groups using the McAfee epo console. Use web service APIs on page 15 Based on your setup, you can import or export rule groups using web service APIs provided by Application Control and Change Control. Use the McAfee epo console Based on your setup, you can import or export rule groups using the McAfee epo console. You can also export rule groups to an XML file, edit the XML file to make the required changes to rule groups, and import the file to the McAfee epo server to use the changed rule groups. 1 On the McAfee epo console, select Menu Configuration Solidcore Rules. 2 Complete one of these steps from the Rule Groups tab. To import rule groups, click Import, browse to and select the rule groups file, and click OK. While importing, you can specify whether to override rule groups (if you are importing a rule group with the same name as an existing rule group). To export selected rule groups to an XML file, select the rule groups, click Export, and save the file. Use web service APIs Based on your setup, you can import or export rule groups using web service APIs provided by Application Control and Change Control. 1 Open the command prompt, then navigate to this directory. <epo installation directory>\remote Client\ For example, C:\Program Files\McAfee\ePolicy Orchestrator\Remote Client\ 2 Run this command to connect to the McAfee epo shell client. shell-client.bat <eposerverip:epoport> <epouserid> <epopassword> https post For example, shell-client.bat <xxx.xx.xx.xxx:xxxx> admin testp@ssword https post 3 Use these web service APIs, as needed. Web service APIs scor.rulegroup.find (rulegroupos, rulegrouptype, rulegroupname) scor.rulegroup.export (rulegroupos, rulegrouptype, Description This service searches for the required rule group in the list of all Solidcore rule groups and it takes these parameters. rulegroupos rulegrouptype rulegroupname (Required) Operating system associated with the rule group. Possible values are WIN and UNIX. (Required) Product associated with the rule group. Possible values are APPLICATION_CONTROL, CHANGE_CONTROL, and INTEGRITY_MONITOR. (Optional) Name of the rule group. This service exports the rule group information from the (source) McAfee epo server. Optionally, you can export the rule group information to an XML file on the McAfee epo server. This service takes these parameters. McAfee Change Control Linux Product Guide 15

16 3 Using Rule Groups Managing rule groups Web service APIs rulegroupname, exportfilename) Description rulegroupos rulegrouptype rulegroupname (Required) Operating system associated with the rule group. Possible values are WIN and UNIX. (Required) Product associated with the rule group. Possible values are APPLICATION_CONTROL, CHANGE_CONTROL, and INTEGRITY_MONITOR. (Optional) Name of the rule group. If you do not provide a rule group name, all editable rules are exported for the specified operating system and rule group type. scor.rulegroup.import (file, override) exportfilename (Optional) Name of the XML file, such as c:\foo.xml, c:\foo\foo.xml, where you want to store the exported rule group information. The location of the XML file must be on the McAfee epo server. Make sure that you provide the absolute path to the location and not the relative path as the value. It imports the rule group information from an XML file to the (target) McAfee epo server. This service takes these parameters. file (Required) Path to the XML file. Follow these considerations based on the location of the XML file. If the XML file is on the McAfee epo server, specify the fully qualified name as the value for this parameter. For example, scor.rulegroup.import c:\abc.xml. If the XML file is on a local system, specify the value for this parameter as file:/// followed by the location on the local system. For example, scor.rulegroup.import file=file:///c:/ abc.xml. override (Optional) Overwrites an existing matching rule group on the target McAfee epo server. By default, the value for this parameter is set to false, so that the parameter does not overwrite an existing matching rule group on the target McAfee epo server. View assignments for a rule group Instead of navigating through all created policies, you can directly view all policies in which a rule group is being used. This feature provides a convenient way to verify if each rule group is assigned to the relevant policies. 1 On the McAfee epo console, select Menu Configuration Solidcore Rules. 2 On the Rule Groups tab, click Assignments to view the policies to which the selected rule group is assigned. 16 McAfee Change Control Linux Product Guide

17 4 Monitoring 4 the file system and registry Contents How monitoring rules work Defining monitoring rules Review predefined monitoring rules Create monitoring policies Settings for tracking content change Configure settings for tracking content changes Track content changes Manage file versions Compare files How monitoring rules work You can monitor files, directories, file types (based on file extension), and programs. What can you monitor? Element File Process Tracked operations File creation File change (file contents and attributes, such as permissions, owner, or group) File deletion File rename Process start Process stop Which attributes are monitored for files? Hidden Read-only Not Content Indexed System Offline Are any predefined rules available? Yes, Change Control includes predefined monitoring rules. McAfee Change Control Linux Product Guide 17

18 4 Monitoring the file system and registry Defining monitoring rules Order of precedence for monitoring rules This is the order of precedence applied (highest to lowest) when processing monitoring rules. 1 Advanced exclusion filters (AEF) rules 4 Rules based on program name 2 Exclude rules 5 Rules based on file extension 3 Rules based on user name 6 Rules based on file names or paths Defining monitoring rules Regardless of whether you create a monitoring policy or define a monitoring rule group, the framework available to define monitoring rules is the same. Path considerations These considerations apply to path-based rules. Paths must be absolute when specifying rules to monitor files and directories. Paths are not required to be absolute when specifying rules to monitor program activity. You can specify the partial path or fully qualified path. If you specify the partial path, all programs with names that match the specified string are monitored. If you specify the fully qualified path, activity is monitored for only the specified program. Paths can contain white spaces. Paths can include the wildcard character (*). But, it can only represent one complete path component. Here are a few examples. Using /abc/*/def is allowed while /abc/*.sh, /abc/*.*, or /abc/doc.* is not supported. You cannot use the wildcard character while defining a rule to track content and attribute changes for a file. Monitoring rules You can perform these actions when creating or changing a monitoring policy or rule group. Action Monitor files and directories Steps 1 Click Add on the File tab. The Add File dialog box appears. 2 Specify the file or directory name. 3 Indicate whether to include for or exclude from monitoring. 4 (Optional) To track content and attribute changes for a file, select Enable Content Change Tracking and specify the other options. For more information, see Track content changes. 5 Click OK. Monitor specific file types 1 Click Add on the Extension tab to open the Add Extension dialog box. 2 Type the file extension. Don't include the period (dot) in the extension. For example, log. 3 Indicate whether to include for or exclude from monitoring and click OK. 18 McAfee Change Control Linux Product Guide

19 Monitoring the file system and registry Review predefined monitoring rules 4 Action Monitor program activity (in effect choose to track or not track all file changes made by a program) Specify the users to exclude from monitoring (in effect all changes made by the specified user are not tracked) Specify advanced exclusion filters for events Steps 1 Click Add on the Program tab to open the Add Program dialog box. 2 Enter the name or full path of the program. 3 Indicate whether to include for or exclude from monitoring and click OK. 1 Click Add on the User tab to open the Add User dialog box. 2 Specify the user name. 3 Click OK. 1 Click Add Rule on the Filters tab to add a new filter row. 2 Edit the settings to specify the filter. 3 Click + or Add Rule to specify additional AND or OR conditions. Review predefined monitoring rules Change Control provides multiple predefined filters suitable for monitoring relevant files on various operating systems. By default, these filters are applied to the global root in the System Tree and hence are inherited by all McAfee epo-managed endpoints where Change Control is installed. When an endpoint connects to the McAfee epo server, the Minimal System Monitoring policy applicable to the endpoint's operating system comes into play. You can review the predefined filters included in the Minimal System Monitoring policy (applicable to your operating system). 1 On the McAfee epo console, select Menu Policy Policy Catalog. 2 Select the Solidcore 8.1.0: Integrity Monitor product. Policies for all categories are listed. A Minimal System Monitoring policy exists for each supported operating system. 3 Open the relevant Minimal System Monitoring policy. By default, the My Rules rule group is open (which is blank). 4 Select a rule group in the Rule Groups pane to review the filters included in the rule group. To override any rules included in the Minimal System Monitoring policy, you can duplicate the relevant rule group (in which the required rules are present), edit the rule group to add the new rules, and add the rule group to a policy. For most other purposes, make sure that the Minimal System Monitoring policy is applied on the endpoints and extra rules are applied by using a separate policy. 5 Click Cancel. McAfee Change Control Linux Product Guide 19

20 4 Monitoring the file system and registry Create monitoring policies Create monitoring policies You can monitor changes or exclude from monitoring various units of a file system. You can control monitoring of files, directories, file types (based on file extension), programs, and users. These are multi-slot policies; you can assign multiple policies to one node in the System Tree. To create a monitoring policy, you can define rules in a rule group (to allow reuse of rules) and add the rule group to a policy. You can also define the rules directly in a policy. 1 On the McAfee epo console, select Menu Policy Policy Catalog. 2 Select the Solidcore 8.1.0: Integrity Monitor product. 3 Click New Policy to open the Create a new policy dialog box and select the category. 4 Select Blank Template from Create a policy based on this existing policy list to define a policy from scratch, specify the policy name, then click OK. 5 Click the policy name to open the Policy Settings page. 6 Add a rule group to the policy. a Click Add in the Rule Groups pane to open the Select Rule Groups dialog box. b c d e Select the rule group to add. Click OK. Select the rule group in the Rule Groups pane. The rules included in the rule group are displayed in the various tabs. Review the rules. 7 Add the monitoring rules to the policy, then save the policy. Settings for tracking content change You can track content and attribute changes by configuring these settings. Setting Maximum file size Description By default, you can track changes for any file with a size of 1000 KB or lower. You can also configure the maximum file size for tracking content changes. Changing the maximum file size affects the McAfee epo database sizing requirements and might have an impact on performance. File extensions for which to track only attribute changes For executable files, the content change tracking feature tracks only attributes (content changes are not tracked). By default, only attribute changes are tracked for these extensions. 20 McAfee Change Control Linux Product Guide

21 Monitoring the file system and registry Configure settings for tracking content changes 4 Setting Description zip tar bz2 tiff bmp gz jpg sys 7z bz exe png pdf tgz gif jar rar dll You can edit the list to specify file extensions specific to your setup for which to track only attribute changes. Configure settings for tracking content changes Specify the maximum file size for tracking content changes, file extensions for which to track only attributes, and maximum number of files to fetch per rule. 1 On the McAfee epo console, select Menu Policy Policy Catalog. 2 Select the Solidcore 8.1.0: General product. The McAfee Default policy includes customizable configuration settings. 3 In the Configuration (Client) category, click Duplicate for the McAfee Default policy. 4 Specify the policy name, then click OK. The policy is created and listed on the Policy Catalog page. 5 Click the new policy. 6 Switch to the Miscellaneous tab. 7 Specify values for the settings. 8 Save the policy and apply it to the relevant endpoints. Track content changes When you create or change a monitoring (Integrity Monitor) policy or rule group, you can specify the files for which to track content changes. 1 Navigate to the File tab. 2 Perform one of these steps. Click Add to monitor and track changes for a new file. Select an existing rule and click Edit. McAfee Change Control Linux Product Guide 21

22 4 Monitoring the file system and registry Manage file versions 3 Review or add the file information. You cannot track changes for network files (files placed on network paths). 4 Select Enable Content Change Tracking. 5 Select the file encoding. You can choose Auto Detect, ASCII, UTF-8, and UTF-16. Auto Detect works for most files. If you are aware of the file encoding, select ASCII, UTF-8, or UTF-16 (as appropriate). If needed, you can add new file encoding values. Contact McAfee Support for assistance in adding a file encoding value. 6 Click OK. Manage file versions You can review all versions available for a file, compare file versions, reset the base version, and delete versions. The base version identifies the starting point or initial document to use for comparison or control. Typically, the oldest version of a file is set as the base version. In effect, when you start tracking changes for a file, the initial file content and attributes are stored on the McAfee epo database and set as the base version. 1 On the McAfee epo console, select Menu Reporting Content Change Tracking. All files for which content change tracking is enabled are listed. 2 Identify the file for which you want to review versions. In the Quick find text box, specify the endpoint or file name, then click Apply. The list is updated based on the specified search string. Sort the list based on the system name, file path, or status. 3 Perform file operations. To do this... Review the file status. Review version. Compare the file versions. Do this... The File Status column denotes the status of content change tracking. Click View versions. The File Versions page displays all versions for the file. From this page you can compare file versions, specify the base version, and delete file versions from the McAfee epo database. 1 Specify what to compare. Click Compare with previous for a version to compare that version with the previous version of the file available on the McAfee epo console. Click Compare with base for a version to compare that version with the base version. Select any two versions (by clicking the associated checkboxes), then select Actions Compare Files to compare the selected versions. The versions are compared and differences between the file content and file attributes are displayed. 2 Click Close. 22 McAfee Change Control Linux Product Guide

23 Monitoring the file system and registry Compare files 4 To do this... Reset the base version. Do this... 1 Select a file version to set as the base version by clicking the associated checkbox. 2 Select Actions Set as base version to open the Set as base version dialog box. 3 Click OK. This resets the base version and deletes all previous versions (older than the new base version) of the file. The software can track up to 200 versions for a file. If the number of versions exceeds 200, the application deletes the oldest versions to bring the version count to 200. Then, it automatically sets the oldest version as the base version. If needed, you can configure the number of versions to maintain for a file. Contact McAfee Support for assistance in configuring the number of versions to maintain for a file. Delete file versions. Deleting file versions removes the selected file versions from the McAfee epo database. It does not change or remove the actual file present on the endpoint. 1 Select one or more file versions by clicking the associated checkboxes. 2 Select Actions Delete, then click OK. 4 Click Close. Compare files You can compare two files or two versions of a single file. You can compare files or versions on the same endpoint or on different endpoints. 1 On the McAfee epo console, select Menu Reporting Content Change Tracking. 2 Click Advanced File Comparison. 3 Specify information for the first file. a Select the group from the list. b c d Enter the host name. Enter the name and path of the file. Select the version to compare. 4 Specify information for the second file. 5 Click Show Comparison. The attributes and content of the files are compared and differences are displayed. 6 Review the results. 7 Click Close. McAfee Change Control Linux Product Guide 23

24 4 Monitoring the file system and registry Compare files 24 McAfee Change Control Linux Product Guide

25 5 Protecting 5 your system Contents How protection rules work Define protection rules Create a protection policy Enable read protection How protection rules work To prevent unauthorized access and changes, you can define read protection and write protection rules. Read protection rules Write protection rules Prevent users from reading the content of specified files, directories, and volumes. When a directory is read-protected, all files in the directory are read-protected. Any unauthorized attempt to read data from protected files is prevented and an event is generated. Writing to read-protected files is allowed. Prevent users from creating files (including directories and registry keys) and changing existing files, and directories. Define write protection rules for files and directories to protect them from unauthorized changes. Only protect critical files. When a directory is included for write protection, all files in that directory and its subdirectories are write protected. Can I override defined rules? While you can define rules to protect, you can also define additional rules to selectively override the read or write protection that is in effect. Specify programs that are permitted to selectively override the read or write protection. Specify users who can selectively override the read or write protection. Order of precedence for protection rules These considerations are used when protection rules are applied at the endpoint. Exclude rules are given precedence over include rules. For example, if you erroneously define an include and exclude rule for the same file, the exclude rule applies. Longer paths are given precedence. McAfee Change Control Linux Product Guide 25

26 5 Protecting your system Define protection rules Define protection rules Contents Path considerations Apply protection rules Protection rules Path considerations These considerations apply to path-based rules. Paths must be absolute when specifying rules to read-protect or write-protect files and directories. Paths need not be absolute when specifying rules to add a trusted program or updater. If you specify the partial path, all programs with names that match the specified string are added as trusted programs. If you specify the fully qualified path, only the specified program is added as a trusted program. Paths can contain white spaces. Paths can include the wildcard characters to specify file paths and file names. When using wildcards, ensure that specified string matches a limited set of file paths or file names. If the specified string matches many files, we recommend you revise the string. Paths can include the * wildcard character. Using /abc/*/def is allowed while /abc/*.sh, /abc/*.*, or /abc/doc.* isn't supported. Apply protection rules You can define protection rules when changing or creating a protection policy or rule group. Before you begin 1 Read-protect files and directories: a Click Add on the Read-Protect tab. The Add File dialog box appears. b c Specify the file or directory name and indicate whether to include or exclude from read protection. Click OK. By default, the read protection feature is disabled at the endpoints. 2 Write-protect files and directories: a Click Add on the Write-Protect File tab. The Add File dialog box appears. b c Specify the file or directory name and indicate whether to include or exclude from write protection. Click OK. 3 Specify trusted programs permitted to override the read and write protection rules: a Click Add on the Updater Processes tab. The Add Updater dialog box appears. b c Enter the location of the file. Enter a unique identification label for the executable file. 26 McAfee Change Control Linux Product Guide

27 Protecting your system Define protection rules 5 d Specify conditions that the file must meet to run as an updater: Select None to allow the file to run as an updater without any conditions. Select Parent to allow the file to run as an updater only if it is started by the specified parent. For example, when configuring updater.sh as an updater to allow changes to Mozilla Firefox, specify firefox as the parent. Although updater.exe is a generic name that can be part of any installed application, using the parent makes sure that only the correct program is allowed to run as an updater. e f g Indicate whether to disable inheritance for the updater. For example, if Process A (that is set as an updater) starts Process B, disabling inheritance for Process A makes sure that Process B does not become an updater. Indicate whether to suppress events generated for the actions performed by the updater. Typically, when an updater changes a protected file, a File Modified event is generated for the file. If you select this option, no events are generated for changes made by the updater. Click OK. Protection rules You can define protection rules when changing or creating a protection policy or rule group. Action Read-protect files and directories Steps 1 Click Add on the Read-Protect tab. The Add File dialog box appears. 2 Specify the file or directory name. 3 Indicate whether to include or exclude from read protection. 4 Click OK. By default, the read protection feature is disabled at the endpoints. Write-protect files and directories 1 Click Add on the Write-Protect File tab. The Add File dialog box appears. 2 Specify the file or directory name. 3 Indicate whether to include or exclude from write protection. 4 Click OK. McAfee Change Control Linux Product Guide 27

28 5 Protecting your system Define protection rules Action Specify trusted programs permitted to override the read and write protection rules Steps 1 Click Add on the Updater Processes tab. The Add Updater dialog box appears. 2 Enter the location of the file. 3 Enter a unique identification label for the executable file. 4 Specify conditions that the file must meet to run as an updater. Select None to allow the file to run as an updater without any conditions. Select Parent to allow the file to run as an updater only if it is started by the specified parent. For example, when configuring updater.sh as an updater to allow changes to Mozilla Firefox, specify firefox as the parent. Although updater.exe is a generic name that can be part of any installed application, using the parent makes sure that only the correct program is allowed to run as an updater. 5 Indicate whether to disable inheritance for the updater. For example, if Process A (that is set as an updater) starts Process B, disabling inheritance for Process A makes sure that Process B does not become an updater. 6 Indicate whether to suppress events generated for the actions performed by the updater. Typically, when an updater changes a protected file, a File Modified event is generated for the file. If you select this option, no events are generated for changes made by the updater. 7 Click OK. Import user details from an Active Directory. 1 Click AD Import on the Users tab. The Import from Active Directory dialog box appears. 2 Select the server. 3 Select Global Catalog Search to search for users in the catalog (only if the selected Active Directory is a Global Catalog server). 4 Specify whether to search for users based on the UPN (User Principal Name) or SAM account name. Your search criteria determines the authorized user. Make sure that you use the trusted account to log on to the endpoint. If you use the UPN name while adding a user, make sure that the user logs on with the 28 McAfee Change Control Linux Product Guide

29 Protecting your system Create a protection policy 5 Action Steps UPN name at the endpoint to enjoy trusted user rights. 5 Enter the user name. The Contains search criteria is applied for the specified user name. 6 Specify a group name to search for users in a group. You cannot directly add a group present in the Active Directory to a policy. To authorize all users in a group, add the user group to a rule group and include the rule group in a policy. When you include a user group in a rule group, the following actions occur. a Application Control runs a task in the background to query the configured Active Directory server and fetch user details. b Active Directory server sends list of users and associated attributes, such as netbiosname and user name, for all users in the specified user group. These details are saved to the rule group. c Application Control adds each user in the user group as a trusted user. These users are not listed as individual users on the user interface but the user list is available when you export the rule group information to an XML file. Adding user groups makes sure that all changes to a user group automatically cascade across all rule groups and associated policies. 7 Click Find. The search results are displayed. 8 Select the users to add in the search results, then click OK. Create a protection policy Protection policies are multi-slot policies; you can assign multiple policies to one node in the System Tree. 1 On the McAfee epo console, select Menu Policy Policy Catalog. 2 Select the Solidcore 8.1.0: Change Control product. McAfee Change Control Linux Product Guide 29

30 5 Protecting your system Enable read protection 3 Click New Policy to open the Create a new policy dialog box. 4 Select the category. 5 Select Blank Template from Create a policy based on this existing policy list to define a policy from scratch. 6 Specify the policy name, then click OK to save the policy. 7 Click the policy and specify protection rules. The read-protect feature is disabled by default. To use read protection rules, enable the read-protect feature for the endpoints. Enable read protection By default, the read-protect feature is disabled for optimal system performance. Run a command on the endpoint to enable read protection. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions. Group Select a group in the System Tree and switch to the Assigned Client s tab. Endpoint Select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. a b c Click Actions New Client Assignment. The Client Assignment Builder page appears. Select the Solidcore product, SC: Run Commands task type, and click Create New. The Client Catalog page appears. Specify the task name and add any descriptive information. 3 Type this command. features enable deny-read 4 Select Requires Response if you want to view the status of the commands in Menu Automation Solidcore Client Log tab. 5 Click Save. 6 Click Next to open the Schedule page. 7 Specify scheduling details, then click Next. 8 Review and verify the task details, then click Save. 9 (Optional) Wake up the agent to send your client task to the endpoint immediately. 30 McAfee Change Control Linux Product Guide