Boot Attestation Service 3.0.0

Transcription

1 Product Guide Boot Attestation Service For use with epolicy Orchestrator 4.6.0, Software

2 COPYRIGHT Copyright 2013 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee CleanBoot, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundscore, Foundstone, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. Product and feature names and descriptions are subject to change without notice. Please visit mcafee.com for the most current products and features. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 Boot Attestation Service Product Guide

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Introduction 7 Boot attestation made easy Components and what they do Installation and configuration 9 Overview of the installation and configuration process Requirements Download the software packages Set up the Boot Attestation server Deploy using ESXi Whitelist ESXi host Install the extension Register the Boot Attestation server with McAfee epo Register a VMware vcenter account Viewing account details and boot status Edit or delete Boot Attestation host mapping Dashboard 21 Boot Attestation Service dashboard Index 23 Boot Attestation Service Product Guide 3

4 Contents 4 Boot Attestation Service Product Guide

5 Preface Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Conventions This guide uses these typographical conventions and icons. Book title, term, emphasis Bold User input, code, message Interface text Hypertext blue Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. Boot Attestation Service Product Guide 5

6 Preface Find product documentation Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 6 Boot Attestation Service Product Guide

7 1 Introduction 1 McAfee Boot Attestation Service provides a secure mechanism to verify the boot trust of VMWare ESXi on host servers in a Data Center. It is targeted for Intel servers built with Intel Trusted Execution Technology (Intel TXT). This mechanism verifies that only trusted and certified applications figure in the OS boot up sequence. For details on how Intel TXT works and related use cases, see Contents Boot attestation made easy Components and what they do Boot attestation made easy Boot Attestation Service verifies the launch time measurements of the platform with VMWare ESXi hypervisors. The purpose of this attestation is: Boot verification Reporting Compliance This activity takes place in VMware environments. The cloud/virtualization resource schedulers, SIEMs, and policy engines can use the attestation solution. Components and what they do Each component performs specific functions to verify the trust of VMWare ESXi hypervisors. epolicy Orchestrator Allows you configure Boot Attestation Service, perform host mapping, and display the boot attestation status of the virtual environment. Boot Attestation Service Provides a secure mechanism to whitelist an ESXi host and to retrieve the boot attestation status of the virtual machines and report it to the McAfee epo server. Data Center Connector for vsphere Integrates the management and automation feature of McAfee epo to discover and manage your guest VMs. Hypervisor (ESXi) Allows multiple operating systems to run concurrently on a hosted system. The hypervisor is a virtual operating platform that manages the execution of the guest operating systems. ESXi are embedded hypervisors for servers that run directly on server hardware without requiring an additional underlying operating system. Boot Attestation Service Product Guide 7

8 1 Introduction Components and what they do VMware vcenter Console that manages the ESXi servers, which host the guest VMs that require protection. Virtual Machines (VMs) Completely isolated guest operating system installation within a normal host operating system that supports both virtual desktops and virtual servers. 8 Boot Attestation Service Product Guide

9 2 2 Installation and configuration Before you set up your environment for Boot Attestation Service, you must first configure your VMware vcenter console, which manages the ESXi servers. Contents Overview of the installation and configuration process Requirements Download the software packages Set up the Boot Attestation server Install the extension Register the Boot Attestation server with McAfee epo Register a VMware vcenter account Viewing account details and boot status Edit or delete Boot Attestation host mapping Overview of the installation and configuration process The Data Center Connector for vsphere extension is installed on the McAfee epolicy Orchestrator server (McAfee epo ) for the virtual machine discovery functionality. This is necessary before registering the Boot Attestation server and configuring the host mapping. The overall Boot Attestation Service installation and ESXi deployment process can be simplified into these steps, assuming that the user already McAfee epo. 1 Set up and configure Boot Attestation Server. a Import the OVA package. b c Register and trust the McAfee epo server. Create a whitelist for Known Good Host. 2 Install the Data Center Connector for the vsphere extension on McAfee epo. 3 Register the Boot Attestation server on McAfee epo. 4 Register a VMware vcenter account on McAfee epo. As as a result, McAfee epo discovers, imports, and displays the guest VMs under System Tree. Boot Attestation Service Product Guide 9

10 2 Installation and configuration Requirements 5 Retrieve and view the boot status of the host. You can view the boot status, like Trusted, Untrusted, Unknown, or Error. If your trust status is Unknown, check whether the host is whitelisted as a Good Known Host. If your trust status is Error, the McAfee epo server is unable to get the boot attestation status from the Boot Attestation server. You must now perform the Boot Attestation host mapping, so that the corrected boot status of the host is verified and displayed. 6 You can view the boot attestation status details in the McAfee epo dashboard. Requirements Make sure that your environment includes these components, and that they meet the requirements. Software requirements epolicy Orchestrator 4.6 Patch 2 and later vcenter Server/ESXi 5.1.0b ( and later) VMware vsphere Client 5.1 MySQL Connector Download the latest version available. The minimum supported version is Connector/J For details on system requirements and instructions for setting up the epolicy Orchestrator environment, see McAfee epolicy Orchestrator Installation Guide. For Intel TXT and TPM hardware requirement details, see trusted execution technology server platforms matrix.pdf. Download the software packages You must download the Data Center Connector for vsphere and the open virtual appliance (OVF) package before they can be installed on epolicy Orchestrator. Task From the McAfee download site ( download these packages. vsphere_ext_3.0.0.<bldnumber>.zip Boot_Attestation_Server_<version number>.zip If you installed the epolicy Orchestrator server 4.6.x using McAfee Endpoint Advanced Suite Installer (McAfee EASI), the Data Center Connector for vsphere extension is already installed and ready for use in McAfee epo. 10 Boot Attestation Service Product Guide

11 Installation and configuration Set up the Boot Attestation server 2 Set up the Boot Attestation server You must deploy the open virtual appliance (OVA) package and set up the Boot Attestation server before you can configure the Boot Attestation server on McAfee epo. Tasks Deploy using ESXi on page 11 Deploy the OVF, which is included with the product, from the vsphere client to a hypervisor. The vsphere Client must be connected to the vcenter server, not directly to a hypervisor. Whitelist ESXi host on page 13 To retrieve the boot status of an ESXi host, add this host as a Good Known Host. This process is known as whitelisting the ESXi host. Deploy using ESXi Deploy the OVF, which is included with the product, from the vsphere client to a hypervisor. The vsphere Client must be connected to the vcenter server, not directly to a hypervisor. Before you begin From the McAfee download site, download and extract the contents of Boot_Attestation_Server_<version number>.zip. Make sure that your ESXi host, where you import the OVA, has Internet connection. Make sure that you follow these steps to download the latest MySQL Connector and have it ready to be used when deploying the OVF. Go to From Select Platform, select Platform Independent. Click Download in Platform Independent (Architecture Independent), Compressed TAR Archive to open the Begin Your Download page. From this page you can click Login or Signup, or No thanks, just start my download, and download the MySQL connector. Copy the download link and provide it in the MySQL Connector URL field in the Properties page. Download link example: J/ mysql connector java tar.gz. Task 1 From the vsphere client, select the resource pool on the hypervisor where you want to deploy the OVA, then click File Deploy OVF Template to open the OVF wizard. The vsphere Client must be connected to a vcenter server to successfully deploy the OVA. 2 Apply these settings to deploy the OVF: For this option... Source OVF Template Details Name and Location Disk Format Do this... Browse to and select the Boot_Attestation_Server_<version number>.ova file. Review details about the OVA. Specify the name of the hypervisor and the inventory location. Select the format for disk provisioning. Boot Attestation Service Product Guide 11

12 2 Installation and configuration Set up the Boot Attestation server For this option... Properties Do this... Specify these Boot Attestation server details on the Properties page: McAfee epolicy Orchestrator IP IP address of the epolicy Orchestrator server, which is to be trusted from the Boot Attestation server. You can add multiple IP addresses separated by commas. MySQL Connector URL The download link for MySQL Connector. MySQL Password Password for the MySQL root user on the Boot Attestation server. Create a password for the database with only alphanumeric characters; no special characters are permitted. Boot Attestation Server User Password Password for the Boot Attestation server account. If you do not provide a password, the default password is taken as password. Boot Attestation Server User Name User name for the Boot Attestation server account. If you do not provide a user name, the default user name is taken as admin. Specify these networking details on the Properties page: DNS IP address of the DNS server for the Boot Attestation server. You can add multiple IP addresses separated by a blank space. Gateway IP address of the gateway for the Boot Attestation server. Interface Interface on which the Boot Attestation server IP needs to be configured. If you do not provide interface details, the default value is taken as eth0. Boot Attestation Server IP Address The static IP address of the Boot Attestation server. Netmask The netmask details of the Boot Attestation server. Hostname Host name of the Boot Attestation server. If you do not provide the host name, the default name is taken as BootAttestationServer. On specifying the correct configuration information on the Properties page, the Boot Attestation server is configured and ready during the initial start. If you do not specify the correct configuration information and continue with the deployment, the Boot Attestation server might not be configured correctly. If so, you might have to repeat the entire configuration. Ready to Complete Review the options you selected. You can select to turn on the virtual machine after the import or you must manually turn it on. 3 Click Finish. When you log on to the Boot Attestation server VM for the first time, make sure that you change the default password P@ssw0rd to a new password. 12 Boot Attestation Service Product Guide

13 Installation and configuration Set up the Boot Attestation server 2 4 When the deployment is complete, verify that all Boot Attestation services report as running. Log on to the Boot Attestation server VM as root with your new password and run this command: mtwilson status 5 (Optional) Restart the Boot Attestation server VM. If any service reports as Not Running, or if the command fails to run, check for: The correct property details on the OVF Template details page. Successful download of the MySQL server and connector. If you see the error again, report to McAfee Support and share the log file: /root/ McAfee_BootAttestation_Install_Logs.tar.gz. The Boot Attestation server is now ready to be configured and to communicate with the registered McAfee epo server. 6 (Optional) Configure the Boot Attestation server with additional McAfee epo server: a From the vsphere client console or ssh, log on to the Boot Attestation server. b Run these commands: cd /root bash trusthost.sh <epoip> Whitelist ESXi host To retrieve the boot status of an ESXi host, add this host as a Good Known Host. This process is known as whitelisting the ESXi host. Before you begin Make sure that you have appropriate permissions to perform this task. Make sure that you have activated the Intel TXT and TPM settings in the ESXi host BIOS settings. Boot Attestation Service Product Guide 13

14 2 Installation and configuration Install the extension Task For option definitions, click? in the interface. 1 Connect to the Management console portal, Attestation Server IP address>:8181/ ManagementConsole/login.htm, and click Automation White List configuration. 2 From Host type, select VMware ESXi. 3 From Configure White List For, select BIOS and Hypervisor (VMM). 4 From White List Applicable For: BIOS Select OEM. Hypervisor (VMM) Select OEM or Global. 5 Change the Platform Configuration Registers (PCR) values, as needed. For details on PCR values, click? in the interface. 6 In the Good Known Host field, enter the IP address of the Good Known Host as it is in vcenter. 7 In the vcenter Server field, type the IP address or host name of the vcenter server. 8 Type the login ID and Password for an account with administrator rights, then click Upload White List. A dialog box displays the option to register the host that is whitelisted. Yes The Measured Launch Environments (MLE) are added and the host is registered. No The MLEs are added to the whitelist, but the host is not registered. However, it is registered when the epolicy Orchestrator server retrieves the boot attestation status. Install the extension You must install the Data Center Connector for vsphere extension on the McAfee epo server, which then can discover and import your ESXi servers that host the guest VMs. Before you begin Make sure that the extension file is in an accessible location on the network. Task For option definitions, click? in the interface. 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Software Extensions Install Extension. 3 Browse to and select the extension file vsphere_ext_3.0.0.<bldnumber>.zip, then click OK. The Install Extension page displays the extension name and version details. 4 Click OK. 14 Boot Attestation Service Product Guide

15 Installation and configuration Register the Boot Attestation server with McAfee epo 2 Register the Boot Attestation server with McAfee epo It is necessary to register the Boot Attestation server with McAfee epo in order to perform the host mapping. Before you begin Make sure that you installed the extension for Data Center Connector for vsphere on McAfee epo. Task For option definitions, click? in the interface. 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Configuration Registered Servers, then click New Server to open the Registered Server Builder wizard. 3 From the Server type drop down list on the Description page, select Boot attestation server, specify a unique user friendly name and any details, then click Next. 4 On the Details page, type the IP address or the DNS name of the host. 5 Click Test Connection to verify that the connection to the server works, then click Save. You can register only one Boot Attestation Server on a single McAfee epo server. Register a VMware vcenter account It is necessary to register a VMware vcenter account with McAfee epo, so that McAfee epo establishes a connection with VMware vcenter, which manages the ESXi servers, discovers the guest VMs, and displays them in McAfee epo. Before you begin Make sure that you have configured your VMware vcenter server that manages the ESXi servers, which host the guest VMs. The Registered Cloud Accounts option is available only after installing the Data Center Connector for vsphere extension. Task For option definitions, click? in the interface. 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Configuration Registered Cloud Accounts, then click Add Cloud Account to open the Add Cloud Account page. Boot Attestation Service Product Guide 15

16 2 Installation and configuration Register a VMware vcenter account 3 From the Choose Connector drop down list on the Description page, select vsphere, then click OK. 4 On the vcenter Account Details page, type these details: Account name A name for the VMware vcenter account in McAfee epo. Account names can include characters a z, A Z, 0 9, and [_. ], without space. Server Address IP address or the host name of the available VMware vcenter. (Required) vcenter Username User name of the available VMware vcenter account. (Required) This user's minimum role can be read only. This user can be a domain account. This user can also be a Single Sign On (SSO) user. The default user name of the SSO user is admin@system domain. vcenter Password Password of the available VMware vcenter account. (Required) Connection protocol The protocol required to establish the connection with the VMware vcenter. Sync Interval (In Minutes) Specify the time interval for running subsequent vcenter discovery. Port No The port required to establish the connection with the available VMware vcenter. Tag This is given by the admin to identify the VMs. Tag name can include characters a z, A Z, 0 9, and [_. ], with space. 5 Click Test Connection to validate VMware vcenter account details and verify that the connection to the VMware vcenter works, then click Next to open the Validate Certificate page. 6 Click Accept to validate the certificate, then click Finish. 16 Boot Attestation Service Product Guide

17 Installation and configuration Viewing account details and boot status 2 7 When prompted to confirm, click OK to register the vcenter account. This registers the VMware vcenter and imports all discovered virtual machines, which are unmanaged, into the McAfee epo System Tree. The instances are imported with the similar structure and hierarchy present in VMware vcenter. The virtual machines that are already added and managed by McAfee epo are retained with the existing policy settings, but the virtualization properties for these machines are added. 8 To view the imported virtual machines, click Menu Systems System Tree in McAfee epo. After the discovery, you can find your vcenter account under the group vsphere. The clusters and hosts from vcenter are logically grouped under each Data Center group in McAfee epo. Viewing account details and boot status When you register the host, it appears in the System Tree in McAfee epo, and displays boot attestation details. You can also view account details of the registered vcenter. Property Name Type Last Successful Sync Last Sync Status Total VMs Running VMs Managed VMs Auto Deploy MA Actions Description Name of the vcenter that you registered in McAfee epo. Type of the Data Center Connector. Displays the date and time when the last synchronization between McAfee epo and VCenter occurred. Displays the synchronization status such as Synch Scheduled, Success, In Progress, and Failed. Displays the number of VMs that are available under the registered vcenter. Displays the number of VMs that are up and running under the registered vcenter. Displays the number of VMs that are managed by McAfee epo. Specifies if the administrator enabled the Auto deploy McAfee Agent task for the registered vcenter account. Not available in this version. You can edit, delete, and synchronize the Vcenter account using McAfee epo. By default, the Firmware Trust Status and VMM Trust Status columns don't appear under System Tree. You must select and add them using the Choose Columns option under System Tree Actions. Boot Attestation Service Product Guide 17

18 2 Installation and configuration Edit or delete Boot Attestation host mapping The boot status of the host's BIOS and VMM versions are: Trusted Both VMM and BIOS versions of the registered ESXi host are trusted. Untrusted Either VMM or BIOS version of the registered host is not trusted. Unknown The ESXi host is not registered or whitelisted, or the hardware used is not supported by Intel TXT. Error The McAfee epo server is not able to retrieve the boot attestation details. You can view the boot attestation details of a host by double clicking the host name listed under System Tree. The boot attestation details are on the Virtualization tab. Edit or delete Boot Attestation host mapping It is necessary to map the host to the Boot Attestation server, so that the correct boot trust status of the host is verified and displayed. It is more important when there is any issue with the automatic mapping, or an already mapped ESXi server is upgraded. Before you begin Make sure you have configured your VMware vcenter console that manages the ESXi servers, which host the guest VMs. Task For option definitions, click? in the interface. 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Configuration Boot Attestation Host Mapping. The Boot Attestation Host Mapping page displays the host name, configuration, and ESXi details. 18 Boot Attestation Service Product Guide

19 Installation and configuration Edit or delete Boot Attestation host mapping 2 3 Select a host, then click Actions Edit Mapping to open the Edit Mapping page. 4 Select the required Firmware Configuration and VMM Configuration to be mapped, then click OK. We recommend that you select a target host and delete its mapping, instead of editing the mapping, with the Boot Attestation server. You can delete the mapping by navigating through Actions Delete Mapping. The available host and its details appear in the Boot Attestation Host Mapping page after the next synchronization with the server. Boot Attestation Service Product Guide 19

20 2 Installation and configuration Edit or delete Boot Attestation host mapping 20 Boot Attestation Service Product Guide

21 3 3 Dashboard Dashboards, which are comprised of monitors, help you track the key metric boot attestation status of launch time measurements of the platform with VMWare ESXi hypervisors. McAfee epo 4.6 Dashboards are grouped under Private Dashboards. McAfee epo 5.0 Reports are grouped under McAfee Dashboards. Boot Attestation Service dashboard The Boot Attestation Service dashboard is added to your McAfee epo server when you install the Data Center Connector for vsphere extension. The dashboard displays a collection of monitors based on the results of the default Boot Attestation Service query. This is the default monitor for Boot Attestation Service, which appears under the Data Center dashboard. Boot Attestation Status Displays the Boot Attestation status of vcenter hypervisors. Boot Attestation Service Product Guide 21

22 3 Dashboard Boot Attestation Service dashboard 22 Boot Attestation Service Product Guide

23 Index A about this guide 5 accounts, registering 15 B BIOS and hypervisor, configuring 13 boot attestation server components 7 configuring 11 mapping 18 registering 9, 15 setting up 9, 11 verifying boot status 7 boot attestation service about 7 boot verification 7 installing 9 boot status retrieving 13 retrieving and displaying 17 boot status, displaying 21 C connector, choosing 15 conventions and icons used in this guide 5 D dashboard boot status 21 dashboard, viewing 21 documentation audience for this guide 5 product-specific, finding 6 typographical conventions and icons 5 E epolicy Orchestrator components 7 install extension 14 ESXi host deploying 11 whitelisting 13 extension downloading 10 installing 9, 14 G good known host, adding 13 H host mapping 18 hypervisors 15 I installation requirements 10 summary 9 M McAfee ServicePortal, accessing 6 O open virtual appliance, importing 11 S ServicePortal, finding product documentation 6 T tags, defining 15 Technical Support, finding product information 6 V vcenter, defining 9 verification, boot 7 virtual machines boot status 15 discovering 15 virtual properties, displaying 15 VMware vcenter account defining 15 registering 9, 15 viewing details 17 Boot Attestation Service Product Guide 23

24 00