Tips and Tricks on Building Agentless Antivirus Scanners for Virtual Desktops

Size: px

Start display at page:

Download "Tips and Tricks on Building Agentless Antivirus Scanners for Virtual Desktops"

Kristina Stafford
6 years ago
Views:

1 July 2013 Tips and Tricks on Building Agentless Antivirus Scanners for Virtual Desktops Yury Magalif, MASE, VCP Principal Architect Cloud Computing

2 Agenda I. Design Decisions Current AV or Agentless II. How to Configure the Parent VM III. vshield Manager IV. Trend Micro Deep Security Manager V. Trend Micro - Deploy Filter Driver and Appliance VI. Trend Micro Protect VMs VII. Connect View Desktop VIII. Trend Deep Security Tips IX. McAfee MOVE Agentless Tips

3 I. Design Decisions Current AV or Agentless»Goal: Minimize I/O

4 Design current AV or Agentless?» ProjectVRC.com Whitepaper» MCAFEE VIRUSSCAN ENTERPRISE 8.8.0» Scan within the VM.» I/O overhead at 50%» MCAFEE MOVE MULTIPLATFORM 2.0» Offloading AV scanning to a separate VM.» I/O overhead at 16%

5 Design current AV or Agentless? Continued.» MCAFEE MOVE AGENTLESS 2.5» Scanning offloaded to VM, very light VMware agent inside» IO overhead at most 10%. -- all write, no read at all.»conclusion: Using Agentless makes sense.

6 II. Trend How to Configure the Parent VM»Goal: Make it easier

7 VMCI what VM uses to talk outside the bubble

8 Check the Enable VMCI between VMs box in your Parent VM, even though it is not mentioned in the manual.

9 Download Notifier installation file from the Trend Website and run install. Choose all defaults.

10 Once installed, the Notifier displays a bubble upon first login. Some admins don t like any popups in their Parent VM. You can opt not to install Notifier then.

11 Notifier has a right click menu, and by default will notify the user in case of malware or bad websites.

12 III. vshield Manager»Goal: Follow the Antivirus Manufacturer manual

19 Select host, then look for vshield tab to the right. Click the Install button next to vshield Endpoint.

20 Select vshield Endpoint checkbox and click Install. Do not select any other checkboxes.

21 On the vshield tab for the host, check that the button specifies Uninstall.

22 On the Networking configuration tab for the host, look for a new Standard Switch. Do NOT delete it.

23 IV. Trend Micro Deep Security Manager»Goal: Install management

24 Create a VM for Trend Micro Deep Security Manager with 8GB of RAM, 1 socket and 4 cores.

25 In SQL Server Management Studio, create a new database, and make sure to specify Recovery model as Simple no need for up to date logs here.

26 Download Manager installation file from Trend website, double click to install

27 Specify SQL database name. Use SA account or the one given by your SQL Admins.

28 For Antivirus, you only need to enter Anti-Malware and Web Reputation Activation Codes. No need to buy others.

29 Install a Co-located Relay by default

30 Go to URL of the to manage

32 Go to Computers, New, then Add VMware vcenter

33 Specify where your vshield Manager is located important!

34 V. Trend Micro - Deploy Filter Driver and Appliance»Goal: Install mechanics

35 Add Trend modules you downloaded previously. Go to Updates, Software Updates and click Import Software

36 Select the Filter driver and Appliance for ESX

37 Click View Imported Software button to check what you imported. The 2 agents and the relay would have been already installed by the Trend Manager installer.

38 Select the Cluster in the tree, then select each ESX host, choose Actions, then Prepare ESX to deploy the Filter Driver. You must do this on each host separately.

39 VMotion the VMs manually off the target ESX host, choose Yes and Finish to let Trend deploy the Filter driver automatically. Don t worry if the screen does not update for a long time wait. Monitor in vcenter.

40 Monitor Filter driver deployment in vcenter. Trend Manager will be sending commands for Maintenance mode and rebooting the ESX server automatically.

41 When Trend Manager is done, it will display ESX server Successfully prepared message. Select Deploy a Deep Security Appliance now and click next.

42 Provide appliance name, datastore, network. Make sure to create a separate Trend folder in vcenter inventory and place all Trend VMs there.

43 Provide FQDN and Static IP address.

44 Wait for Appliance Deployed message, then Activate.

45 Check on ESX host tab to Active status and in vcenter list

46 Ensure appliance is Disabled from DRS automatic VMotion

47 VI. Trend Micro Protect VMs»Goal: Protection

48 Activate all VMs on the host for protection. You can also activate them later through the Trend Manager interface.

49 If activation fails, you can reactivate the VM manually

50 If activation is successful, you can will see Managed (Online) status next to the VM

51 After activation is successful, go to ESX vshield tab & look for the name of the VM with the status of Thin agent enabled

52 Next, right click on VM in Trend Manager and Assign Policy. Choose Base>Windows>Windows Anti-Malware Protection

54 VII. Connect View Desktop»Goal: Test catching viruses

55 Connect to your Virtual Desktop, in this case VMware View 5.2

59 If you click to see the details of the caught virus, you will see that it was Quarantined

60 VIII. Trend Deep Security Tips» Before installing vshield service on each ESX host, make sure the vcenter VM is NOT on that host. Install, then move vcenter back. Same w/filter driver.» Do NOT assign a Security Profile to the Deep Security Manager VM itself (even though there IS one). Otherwise, you will get Anti-Malware Driver Offline» You CAN apply the DP Virtual Appliance Profile to each VA» Shut down Manager first, then SVAs. Start SVAs first, then manager.» vshield modifies the VMX file be aware if you move VM to non-vshield environment.

61 IX. McAfee MOVE Agentless Tips» First, install McAfee Public CA v1 certificate in the Intermediate Certification Authorities certificate store (with MMC) on the system running the vshield Client. Then deploy the OVF.» SVA deployment is manual with an OVF to each host, or scripted.» Manually disable VMotion on SVAs.» Install the McAfee MOVE AV Agentless extension in epolicy Orchestrator console.» From the epolicy Orchestrator console, deploy a policy with a category of SVA.

62 Thank you!»i would like to thank my colleagues Will Chin and Jose Restrepo for invaluable assistance.

Contact Info & Questions Please give feedback it helps me come back. Get the slides in on my work blog: www.cdillc.

63 Contact Info & Questions Please give feedback it helps me come back. Get the slides in on my work blog: YouTube: Connect with me on LinkedIn: Yury Magalif I would like to thank HP for VC whitepapers/cookbooks from which I borrowed some diagrams in this presentation. For questions after this presentation, to Personal Blog: cloud-zebra.com Questions:

Tips and Tricks on Building Agentless An4virus Scanners for VMware View Virtual Desktops

Tips and Tricks on Building Agentless An4virus Scanners for VMware View Virtual Desktops Yury Magalif, vexpert 2014, VCP Principal Architect Cloud CompuBng July 2014 Agenda I. Design Decisions Current