McAfee Change Control and McAfee Application Control 6.1.4

Transcription

1 Installation Guide McAfee Change Control and McAfee Application Control For use with epolicy Orchestrator Software

2 COPYRIGHT Copyright 2014 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundscore, Foundstone, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. Product and feature names and descriptions are subject to change without notice. Please visit mcafee.com for the most current products and features. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Change Control and McAfee Application Control Installation Guide

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Installing the software 7 Prerequisites Install the Solidcore extension Specify licenses Install the Solidcore client Add the package to the repository Install the Solidcore client on the endpoints Verify the Solidcore client installation Enable the Solidcore client Upgrading the software 15 Upgrade the Solidcore extension Upgrade the Solidcore client Add the Solidcore client package to the repository Upgrade the Solidcore client on the endpoints Verify the Solidcore client upgrade Place the endpoints in Enabled mode Uninstalling the software 21 Remove the Solidcore client Remove the Solidcore extension Remove the Solidcore client package A Create builds for unsupported Linux kernels 25 B Frequently Asked Questions 31 Index 35 McAfee Change Control and McAfee Application Control Installation Guide 3

4 Contents 4 McAfee Change Control and McAfee Application Control Installation Guide

5 Preface This guide provides the information you need to work with your McAfee product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Users People who use the computer where the software is running and can access some or all of its features. Conventions This guide uses these typographical conventions and icons. Book title, term, emphasis Bold User input, code, message Interface text Hypertext blue Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. McAfee Change Control and McAfee Application Control Installation Guide 5

6 Preface Find product documentation Find product documentation After a product is released, information about the product is entered into the McAfee online Knowledge Center. Task 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 6 McAfee Change Control and McAfee Application Control Installation Guide

7 1 Installing 1 the software Install Change Control or Application Control in the McAfee epolicy Orchestrator (McAfee epo ) environment. Contents Prerequisites Install the Solidcore extension Specify licenses Install the Solidcore client Prerequisites Before installing Change Control or Application Control, make sure that your environment conforms to these requirements. Verify that the McAfee epo server and database are installed and configured. McAfee epo is a management tool that installs software and deploys policies on the managed endpoints. It also allows you to monitor client activity, create reports, and store and distribute content and software updates. For instructions, see the epolicy Orchestrator Installation Guide and epolicy Orchestrator Product Guide. Make sure that the McAfee Agent is installed on each endpoint where you want to install Change Control or Application Control. McAfee Agent acts as the intermediary between the Solidcore client and McAfee epo server. It sends data to the client from the McAfee epo server and vice versa. Download the Solidcore extension package from the McAfee Downloads site. The Solidcore extension file is typically named Solidcore_epo_extn_<ver>.<build>.zip. Download the Solidcore client package from the McAfee Downloads site. Here are the available Solidcore client packages. Operating system Microsoft Windows Linux AIX Package name SOLIDCOR<version>-<build>_WIN.zip SOLIDCOR<version>-<build>_LNX.zip SOLIDCOR<version>-<build>_AIX.zip In the file name, <version> and <build> represent the version and build number associated with the product. For example, the SOLIDCOR _WIN.zip file includes the Solidcore client (version and build number 211) for the Windows platform. Make sure that the target platforms where you need to install the Solidcore client are supported. See KB76459 (for Change Control) and KB73341 (for Application Control). McAfee Change Control and McAfee Application Control Installation Guide 7

8 1 Installing the software Install the Solidcore extension Review KB82066 for information about the supported kernels for the Linux operating system. If the target kernel is not mentioned in this article, there are two ways to get support: Compile the kernel module in your test environment and deploy immediately to production endpoints using McAfee epo Endpoint Deployment Kit (EEDK) or manually. For more information, see Create builds for unsupported Linux kernels. Request for kernel support through the McAfee Accept portal by filing a Product Enhancement Request (PER). For information about how to submit a PER, see KB Determine the database sizing requirements for your setup (see KB72753). Review the minimum system requirements for Change Control and Application Control (see KB76579). Review the release notes to acquaint yourself with the known issues and identify dependencies you need to consider. Install the Solidcore extension The Solidcore extension integrates with the McAfee epo console and provides Change Control and Application Control features. The Solidcore extension installs on versions 4.6, 5.0, and 5.1 of the McAfee epo server. Task For option definitions, click? in the interface. 1 Make sure that the extension file is stored at an accessible location. 2 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 3 Click Install Extension. 4 Browse and select the Solidcore_epo_extn_<ver>.<build>.zip file, then click OK. 5 Verify the information on the Install Extension page, then click OK. 6 Verify that the Solidcore product name appears in the Extensions list. Specify licenses Licenses determine the product features available to you. You can enable one or all features. Add licenses to enable the required features. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Configuration Server Settings to open the Setting Categories page. 2 Select Solidcore, then click Edit to open the Edit Solidcore page. 3 Enter the license keys, then click Save. Evaluation licenses valid for 30 days and available only for the Windows platform. 8 McAfee Change Control and McAfee Application Control Installation Guide

9 Installing the software Install the Solidcore client 1 Install the Solidcore client The Solidcore client provides change monitoring, change prevention, and whitelisting features on the endpoints where it is installed. You can install and deploy the Solidcore client on Windows, Linux, and AIX platforms. For all supported platforms, the Solidcore client works well on both physical and virtual machines (VM). Tasks Add the package to the repository on page 9 Before you install the Solidcore client, add the Solidcore client package to the McAfee epo repository. Install the Solidcore client on the endpoints on page 9 Install the Solidcore client on endpoints. Verify the Solidcore client installation on page 10 Verify that the Solidcore client was installed successfully on an endpoint. Enable the Solidcore client on page 11 Place the Solidcore client in Enabled mode to activate the software. Add the package to the repository Before you install the Solidcore client, add the Solidcore client package to the McAfee epo repository. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Software Master Repository. 2 From the Packages in the Master Repository page, select Actions Check In Package. 3 Set the package type to Product or Update (.ZIP). 4 Browse and select the package zip file and click Next to open the Package Options page. 5 Confirm the information. Package Info: Verify the package details. Branch: Select the desired branch. Set to Current for new products. Options: (Optional) Select Move the existing package to the Previous branch to move an existing package to the previous branch. Package signing: Indicates if the package is signed by McAfee or is a third-party package. 6 Click Save to add the package. The new package appears in Packages in Master Repository list. Install the Solidcore client on the endpoints Install the Solidcore client on endpoints. Before you begin Before installing on the Linux operating system, review KB82066 for information about the supported kernels. We add support for new kernels through kernel release cycles. Therefore, we recommend that you review the kernel list before installing. If the target kernel is not mentioned in KB82066, there are two ways to get support: McAfee Change Control and McAfee Application Control Installation Guide 9

10 1 Installing the software Install the Solidcore client Compile the kernel module in your test environment and deploy immediately to production endpoints using McAfee epo Endpoint Deployment Kit (EEDK) or manually. For more information, see Create builds for unsupported Linux kernels. Request for kernel support through the McAfee Accept portal by filing a Product Enhancement Request (PER). For information about how to submit a PER, see KB Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client Tasks tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify Tasks on a Single System. 3 Click Actions New Client Task Assignment to open the Client Task Assignment Builder page. 4 Select the McAfee Agent product and Product Deployment task type, then click Create New Task. 5 Specify the task name and add any descriptive information. 6 Select the target platform. For example, when installing the Solidcore client package on the Windows operating system, select Windows as the target platform. 7 Specify the component and action. a Select the appropriate package from the Products and components list. b c d Select the Install action. Select the language of the package. Specify the branch where to add the package. 8 Click Save, then click Next to open the Schedule page. 9 Specify scheduling details, then click Next. 10 Review and verify the task details, then click Save. 11 (Optional) Wake up the agent to send your client task to the endpoint immediately. On all UNIX platforms, if you are using McAfee Agent 4.5 (earlier than patch 1), restart the McAfee Agent service after you install, uninstall, or upgrade the Solidcore client. Verify the Solidcore client installation Verify that the Solidcore client was installed successfully on an endpoint. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Select a group or endpoint from the list to view details for the selected node in the Systems tab. 10 McAfee Change Control and McAfee Application Control Installation Guide

11 Installing the software Install the Solidcore client 1 3 Review logs from the McAfee epo console. a Select a system on the Systems page. b Select Actions Agent Show Agent Log to view the agent log for the endpoint. By default, agent logs are not enabled on the McAfee epo console. For information about how to enable agent logs, see epolicy Orchestrator Product Guide. c Check the log to verify if the software was successfully installed at the endpoint. 4 Review the properties for the system. a Wake up the agent to fetch properties immediately. Typically, information is exchanged between the agent and server after the agent-server communication interval (ASCI) lapses. Default ASCI value is 60 minutes. Send an agent wake-up call to make sure immediate communication and data exchange between the server and the agent, without waiting for the ASCI to expire. b c Click a system on the Systems page to view details for the selected endpoint. Click the Products tab and review the Solidcore version. Click the row to review additional information, including the product version and installation path. Enable the Solidcore client Place the Solidcore client in Enabled mode to activate the software. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client Tasks tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify Tasks on a Single System. 3 Click Actions New Client Task Assignment to open the Client Task Assignment Builder page. 4 Select the Solidcore product and SC: Enable task type, then click Create New Task. 5 On the Client Task Catalog page, specify the task name and add any descriptive information. 6 Select these fields. a Select the platform. b c d Select the subplatform (only for the Windows and Unix platforms). Select the version (only for the All except NT/2000 subplatform). Indicate whether to enable Change Control, Application Control, or both. 7 Complete these steps to enable Change Control. McAfee Change Control and McAfee Application Control Installation Guide 11

12 1 Installing the software Install the Solidcore client Solidcore client version On Solidcore client version: or earlier (Windows) or earlier (UNIX) On Solidcore client version or later (Windows) On Solidcore client version or later (UNIX) Steps Select Force Reboot with the task to restart the endpoint. Restarting the system is necessary to enable the software. On the Windows platforms, a pop-up message is displayed at the endpoint 5 minutes before the endpoint is restarted. This allows the user to save work and data on the endpoint. On UNIX platforms, the endpoint is restarted as soon as the task is applied. No configuration is needed. Deselect Force Reboot with the task. When using Solidcore client version or later, restarting the system is not necessary to enable the software. 8 Complete these steps to enable Application Control. Solidcore client version On Solidcore client version: or earlier (UNIX) or earlier (Windows) Steps 1 Select Perform Initial Scan to create whitelist to create the whitelist when enabling Application Control. Application Control requires the creation of a list of all trusted executable files present on the endpoint system (known as the whitelist). The one-time activity of creating the whitelist is known as whitelisting or solidification. You can choose to create the inventory while enabling the Solidcore client or defer to create it later. If you defer the scan, run the SC: Initial Scan to create whitelist client task after the SC: Enable task is applied and system is restarted. 2 Select Force Reboot with the task to restart the endpoint after solidification is complete. Restarting the system is necessary to enable the software. A pop-up message is displayed at the endpoint 5 minutes before the endpoint is restarted. This allows the user to save work and data on the endpoint. On Solidcore client version or later (UNIX) On Solidcore client version or later (Windows) Solidcore client version 6.1 is not available for the Windows NT, Windows 2000, Solaris, AIX, and WindRiver Linux platforms. Deselect Force Reboot with the task. When using Solidcore client version or later, restarting the system is not necessary to enable the software. 1. Specify the scan priority. The set scan priority determines the priority of the thread that is run to create the whitelist on the endpoints. We recommend you set the scan priority to Low. This make sure that Application Control causes minimal performance impact on the endpoints but might take longer (than when you set the priority to High) to create the whitelist. 2. Specify the activation option. Limited Feature Activation The endpoints are not restarted and limited features of Application Control (memory protection features are unavailable) are activated. Memory Protection features are available only after the endpoint is restarted. 12 McAfee Change Control and McAfee Application Control Installation Guide

13 Installing the software Install the Solidcore client 1 Solidcore client version Steps Full Feature Activation The endpoints are restarted, whitelist created, and all features of Application Control including Memory Protection are active. Restarting the endpoints is necessary to enable the memory protection features. The endpoint is restarted 5 minutes after the client task is received at the endpoint. A pop-up message is displayed on the endpoint before the endpoint is restarted. 3. Select Start Observe Mode to place the endpoints in Observe mode. The Observation mode feature is available only on the Windows operating system. 4. (Optional) Select Pull Inventory. If you select this option, the software fetches the inventory details for the endpoints (after the whitelist is created) and makes the details available on the McAfee epo console when the ASCI lapses. We recommend you select this option if you wish to manage the inventory using the McAfee epo console. 9 Click Save, then click Next to open the Schedule page. 10 Specify scheduling details, then click Next. 11 Review and verify the task details, then click Save. 12 (Optional) Wake up the agent to send your client task to the endpoint immediately. 13 Verify that the software is enabled. a Wake up the agent to fetch properties immediately. b c Click a system on the Systems page. The details for the selected system are displayed. Select the Products tab and review the Solidcore version. Click the row to review the license status. McAfee Change Control and McAfee Application Control Installation Guide 13

14 1 Installing the software Install the Solidcore client 14 McAfee Change Control and McAfee Application Control Installation Guide

15 2 Upgrading the software Upgrade Change Control or Application Control to access features available in recent releases. Contents Upgrade the Solidcore extension Upgrade the Solidcore client Upgrade the Solidcore extension Upgrade the Solidcore extension to access the new features in a release. Task For option definitions, click? in the interface. 1 Back up the relevant files before you upgrade the Solidcore extension. a Stop the McAfee epo Event Parser service. 1 Select Control Panel Administrative Tools Services. 2 Right-click the McAfee epolicy Orchestrator <version> Event Parser service and click Stop. b Back up these. McAfee epo database <McAfee epo install dir>\server\extensions\installed\solidcore directory <McAfee epo install dir>\server\conf\catalina\localhost\solidcore_meta.xml file 2 Make sure that the extension file is stored at an accessible location. 3 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 4 Click Install Extension, then browse and select the Solidcore_epo_extn_<ver>.<build>.zip file. A warning message states that the existing extension will be replaced. 5 Click OK. 6 Verify the information on the Install Extension page, then click OK. 7 Verify that the Solidcore product name appears in the Extensions list. After you upgrade the Solidcore extension, the domain netbiosname for existing users imported directly from an Active Directory to rule groups and policies will not be populated. To make sure the domain netbiosname is available for such users, delete and reimport users from the Active Directory. After the upgrade, any users that you import from the Active Directory and add to new or existing rule groups and policies will automatically include the domain netbiosname. McAfee Change Control and McAfee Application Control Installation Guide 15

16 2 Upgrading the software Upgrade the Solidcore client 8 Start the McAfee epo Event Parser service. a Select Control Panel Administrative Tools Services. b Right-click the McAfee epolicy Orchestrator <version> Event Parser service and click Start. 9 Verify that migration of data was successful. a On the McAfee epo console, select Menu Automation Server Task Log. b c Check if the Solidcore: Migration server task was completed. This server task completes upgrade-related activities. If the migration fails, review the server task log, resolve any issues, and run the Solidcore: Migration server task manually to complete the migration. When you upgrade the Solidcore extension (from the or earlier version), existing inventory and image deviation data is not migrated. After you upgrade, you must fetch inventory details, as needed. Also, during upgrade one of these occurs for dashboards and reports: If you did not edit a default dashboard or report, the upgrade operation overwrites the dashboard or report. If you edited a default dashboard or report, the upgrade operation retains the edited dashboard or report and adds the corresponding new dashboard or report with a suffix. 10 (Optional) Run the Rule Group Sanity Check server task from the McAfee epo console to fix the inconsistencies in the rule groups. This server task reports and corrects (if possible) discrepancies and inconsistencies in the Solidcore rule groups and policies. a b c d e f g On the McAfee epo console, select Menu Automation Server Tasks. Click New Task to open the Server Task Builder wizard. Type the task name and click Next. Select Solidcore: Rule Group Sanity Check from the Actions drop-down list, then click Next. Specify the schedule for the task, then click Next to open the Summary page. Review the task summary and click Save. Review the logs generated by the server task (on the Server Task Log page) to view the warnings, if any. Upgrade the Solidcore client You can upgrade the Solidcore client on Windows, Linux, and AIX platforms. For all supported platforms, the Solidcore client works well on both physical and virtual machines (VM). Before you begin Before upgrading on the Linux operating system, review KB82066 for information about the supported kernels. We add support for new kernels through kernel release cycles. Therefore, we recommend that you review the kernel list before upgrading. If the target kernel is not mentioned in KB82066, there are two ways to get support: 16 McAfee Change Control and McAfee Application Control Installation Guide

17 Upgrading the software Upgrade the Solidcore client 2 Compile the kernel module in your test environment and deploy immediately to production endpoints using McAfee epo Endpoint Deployment Kit (EEDK) or manually. For more information, see Create builds for unsupported Linux kernels. Request for kernel support through the McAfee Accept portal by filing a Product Enhancement Request (PER). For information about how to submit a PER, see KB For information about the supported operating systems, see KB76459 (for Change Control) and KB73341 (for Application Control). If you cannot upgrade the Solidcore clients on your critical endpoints, the endpoints work well with the upgraded Solidcore extension. However, the new features available in the version are not available on the endpoints until you upgrade the Solidcore client version. Tasks Add the Solidcore client package to the repository on page 17 Before you can upgrade, you must add the Solidcore client package to the McAfee epo repository. Upgrade the Solidcore client on the endpoints on page 18 Upgrade the Solidcore client on the endpoints to access new features available in the recent version. Verify the Solidcore client upgrade on page 19 Verify that the Solidcore client was upgraded successfully on an endpoint. Place the endpoints in Enabled mode on page 19 If you did not upgrade in Enabled mode, you must place the endpoints in Enabled mode after you upgrade the Solidcore client. Add the Solidcore client package to the repository Before you can upgrade, you must add the Solidcore client package to the McAfee epo repository. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Software Master Repository to open the Packages in the Master Repository page. 2 Select Actions Check In Package. 3 Set the package type to Product or Update (.ZIP). 4 Browse and select the package zip file, then click Next to open the Package Options page. 5 Confirm the information. Package Info: Verify the package details. Branch: Select the desired branch. Set to Current for new products. Options: (Optional) Select the Move the existing package to the Previous branch option to move an existing package to the previous branch. Package signing: Indicates if the package is signed by McAfee or is a third-party package. 6 Click Save to check in the package. The new package appears in Packages in Master Repository list. McAfee Change Control and McAfee Application Control Installation Guide 17

18 2 Upgrading the software Upgrade the Solidcore client Upgrade the Solidcore client on the endpoints Upgrade the Solidcore client on the endpoints to access new features available in the recent version. You can upgrade the Solidcore client in various modes. Before upgrading, review this information to place the endpoints in the suitable mode. Enabled mode Update mode Observe mode In Enabled mode, you can upgrade the Solidcore client on all supported Windows platforms except Windows NT and Windows Upgrade in Enabled mode is not available on the UNIX platforms. By default, the McAfee default policy that includes the McAfee publishers rule group is applied to the endpoints. If you choose to upgrade in Enabled mode and have changed the default policies, verify that the McAfee publishers rule group is assigned to policies that are applied on the endpoints. For the Linux and AIX operating systems, we recommend that you upgrade using the Update mode. Observe mode is available on all supported Windows platforms except Windows NT and Windows Observe mode is not available on the UNIX platforms. If you are upgrading from the release, we recommend that you upgrade in Enabled or Update mode. If you choose to upgrade in Observe mode, review KB79517 before upgrading. Disabled mode If your endpoint is currently in Disabled mode, you can upgrade in the Disabled mode. If you are upgrading a Linux system in Disabled mode from to a later release, restart the endpoint before upgrading. For information about how to place the endpoints in Update, Disabled, or Observe mode, see the McAfee Change Control and McAfee Application Control Product Guide. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client Tasks tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify Tasks on a Single System. 3 Click Actions New Client Task Assignment to open the Client Task Assignment Builder page. 4 Select the McAfee Agent product, Product Deployment task type, then click Create New Task to open the Client Task Catalog page. 5 Specify the task name and add any descriptive information. 6 Select the target platform. For example, when installing the Solidcore client package on the Windows operating system, select Windows as the target platform. 7 Specify the component and action. a Select the appropriate package from the Products and components list. b Select the Install action. 18 McAfee Change Control and McAfee Application Control Installation Guide

19 Upgrading the software Upgrade the Solidcore client 2 c d Select the language of the package. Set branch to Current for new packages. 8 Click Save, then click Next to open the Schedule page. 9 Specify scheduling details and click Next. 10 Review and verify the task details and click Save. 11 (Optional) Wake up the agent to send your client task to the endpoint immediately. On all UNIX platforms, if you are using McAfee Agent 4.5 (earlier than patch 1), restart the McAfee Agent service after you install, uninstall, or upgrade the Solidcore agent. 12 Restart the endpoints. Verify the Solidcore client upgrade Verify that the Solidcore client was upgraded successfully on an endpoint. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Select a group or endpoint from the list to view details for the selected node in the Systems tab. 3 Review logs from the McAfee epo console. a Select an endpoint on the Systems page. b Select Actions Agent Show Agent Log to view the agent log for the endpoint. By default, agent logs are not enabled on the McAfee epo console. For information about how to enable agent logs, see the epolicy Orchestrator Product Guide. c Check the log to verify if the software was successfully upgraded at the endpoint. 4 Review the properties for the endpoint. a Wake up the agent to fetch properties immediately. Typically, information is exchanged between the agent and server after the agent-server communication interval (ASCI) lapses. The default ASCI value is 60 minutes. Send an agent wake-up call to ensure immediate communication and data exchange between the server and the agent, without waiting for the ASCI to expire. b c Click an endpoint on the Systems page to view details for the selected endpoint. Select the Products tab and review the Solidcore version. Click the row to review additional information, including the product version and installation path. Place the endpoints in Enabled mode If you did not upgrade in Enabled mode, you must place the endpoints in Enabled mode after you upgrade the Solidcore client. If you upgraded in Update mode, exit Update mode to place the endpoints back in Enabled mode. If you upgraded in Disabled mode, enable the Solidcore client. If you upgraded in Observe mode, exit Observe mode and place the endpoints in Enabled mode. McAfee Change Control and McAfee Application Control Installation Guide 19

20 2 Upgrading the software Upgrade the Solidcore client For information about how to exit Update, Disabled, or Observe mode, see the McAfee Change Control and McAfee Application Control Product Guide. 20 McAfee Change Control and McAfee Application Control Installation Guide

21 3 Uninstalling 3 the software If you are no longer using the software, uninstall Change Control or Application Control. Contents Remove the Solidcore client Remove the Solidcore extension Remove the Solidcore client package Remove the Solidcore client To discontinue use of the software, remove the Solidcore client from the endpoints. Task For option definitions, click? in the interface. 1 Place the endpoints in Disabled mode. For detailed information, see McAfee Change Control and McAfee Application Control Product Guide. 2 Restart the endpoints. 3 On the McAfee epo console, select Menu Systems System Tree. 4 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client Tasks tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify Tasks on a Single System. 5 Click Actions New Client Task Assignment to open the Client Task Assignment Builder page. 6 Select the McAfee Agent product, Product Deployment task type, and click Create New Task to open the Client Task Catalog page. 7 Specify the task name and add any descriptive information. 8 Select the target platform. 9 Specify the component and action. a Select the appropriate package from the Products and components list. b c d Select Remove. Select the language of the package. Set branch to Current for new packages. McAfee Change Control and McAfee Application Control Installation Guide 21

22 3 Uninstalling the software Remove the Solidcore extension 10 Click Save, then click Next to open the Schedule page. 11 Specify scheduling details and click Next. 12 Review and verify the task details and click Save. 13 (Optional) Wake up the agent to send your client task to the endpoint immediately. 14 Verify the Solidcore client removal. a Wake up the agent to fetch properties immediately. Typically, information is exchanged between the agent and server after the agent to server communication interval (ASCI) lapses. Default ASCI value is 60 minutes. Send an agent wake up call to make sure immediate communication and data exchange between the server and the agent, without waiting for the ASCI to expire. b c Click an endpoint on the Systems page to view details for the selected endpoint. Click the Products tab and make sure Solidcore is not listed. Remove the Solidcore extension To discontinue use of the software, remove the Solidcore extension from the McAfee epo server. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 2 Select Solidcore from the Extensions list. 3 Click Remove. When you remove the Solidcore extension, all product-specific tables (SCOR tables) are removed from the database. However, all default and user-defined dashboards and reports are retained in the database. Remove all Solidcore dashboards. 1 On the McAfee epo console, select Menu Reporting Dashboards to open the Dashboards page. 2 Review the items in the Dashboard list. 3 Delete these dashboards. Solidcore: Application Control Solidcore: Change Control Solidcore: Integrity Monitor Solidcore: Inventory 22 McAfee Change Control and McAfee Application Control Installation Guide

23 Uninstalling the software Remove the Solidcore client package 3 Remove the Solidcore queries. 1 On the McAfee epo console, select Menu Reporting Queries & Reports. 2 Expand the Shared Groups category and delete these folders. Application Control Change Control When you remove queries, the Application Control and Change Control folders are deleted including all the queries contained in the folders. If you wish to save a query, save the specific query in a different folder. Remove the Solidcore client package After you uninstall the software, remove the Solidcore client package from the McAfee epo server. Task For option definitions, click? in the interface. 1 On the McAfee epo console, select Menu Software Master Repository to open the Packages in Master Repository page. 2 Select Delete for a package. McAfee Change Control and McAfee Application Control Installation Guide 23

24 3 Uninstalling the software Remove the Solidcore client package 24 McAfee Change Control and McAfee Application Control Installation Guide

25 A Create builds for unsupported Linux kernels Here is information about how to create builds for unsupported Linux kernels. In the release, we have added support for numerous kernels. This allows you to directly install the software on kernels listed in KB If you need to install on a kernel that is not listed in KB82066, you can perform one of these tasks: Create a build file for the target kernel (on a testbed) and deploy the build to other production endpoints using McAfee epo Endpoint Deployment Kit (EEDK) or manually. Request for kernel support through the McAfee Accept portal by filing a Product Enhancement Request (PER). The Product Management team will accommodate the kernel in upcoming kernel release cycles. For information about how to submit a PER, see KB What are the possible deployment scenarios? The installation workflow on the Linux operating system varies based on whether the target kernel is supported. Review KB82066 to verify whether support is available for the target kernel. McAfee Change Control and McAfee Application Control Installation Guide 25

26 A Create builds for unsupported Linux kernels How do I install when the target kernel is supported? Query Has anything changed for me since the previous release? Do I need to take care of any prerequisites? How do I install? Response No. If the target kernel is supported, direct installation occurs on the kernel. None. Perform the steps listed in Install the Solidcore client on the endpoints. How do I install on an unsupported target kernel? Starting with the release, we have included capability to create kernel modules for target kernels. You can automatically create build on a testbed and deploy the kernel module to production endpoints running the same kernel using EEDK or manually. 26 McAfee Change Control and McAfee Application Control Installation Guide

27 Create builds for unsupported Linux kernels A Component Prerequisites How do I install? Testbed Make sure these tools are installed on the testbed. Any non-conformance to the listed build environment will result in build and installation failures. Build and packaging tools gmake (provided by package make) gcc (provided by package gcc) ld (provided by package binutils) ar (provided by package binutils) rpmbuild (provided by package rpm-build on Red Hat and package rpm on SUSE) cpio (provided by package cpio) Package versions should be the same as the versions that are packaged with the distribution ISO. Make sure the testbed meets the prerequisites and then follow the instructions listed in Install the Solidcore client on the endpoints. The needed build is placed in the <install directory>/dks directory of the testbed and the software is installed on the testbed. Kbuild framework Make sure framework is installed under /lib/modules /<kernelversion>/build/ (provided by package kernel-source on SUSE 10, linux-headers on Ubuntu distributions, and package kernel-devel on other distributions). McAfee Change Control and McAfee Application Control Installation Guide 27

28 A Create builds for unsupported Linux kernels Component Prerequisites How do I install? Production endpoints Kernel source package If you are running a 3.5.x or later kernel, make sure that you download the kernel source package and place it in the /usr/src directory. No build or package tools are needed on production endpoints. Make sure that you create the /opt/ solidcore directory on each production endpoint. This directory does not exist by default and needs to be manually created. 1 Create the /opt/solidcore directory on each production endpoint. 2 Fetch the created build from the <install directory>/dks directory of the testbed. The file name includes kernel details. The naming convention followed for the builds is solidifier kmod <rel> <build>.<distro>.<kernel>.<arch>.<ext>. <distro> the available distributions. LEL5 represents Red Hat Enterprise Linux 5, LEL6 represents Red Hat Enterprise Linux 6, LSES10 represents SuSE Enterprise Linux 10, LSES11 represents SuSE Enterprise Linux 11, and LUBT12 represents Ubuntu 12. <kernel> the kernel for which the build was created. <arch> i386 for 32-bit architecture and x86_64 for AMD 64-bit architecture. <ext>.deb for Ubuntu and.rpm for other distributions. Here is an example of a build created for the Red Hat Enterprise Linux 6 version: solidifier kmod LEL el6.i686.i386.rpm 3 Distribute the created build to production endpoints (to the /opt/ solidcore directory) running the same kernel using EEDK or manually. For more information, see How do I distribute builds to endpoints using McAfee EEDK. 4 Follow the instructions listed in Install the Solidcore client on the endpoints. 28 McAfee Change Control and McAfee Application Control Installation Guide

29 Create builds for unsupported Linux kernels A How do I distribute builds to endpoints using McAfee EEDK? McAfee epo Endpoint Deployment Kit (EEDK) integrates with McAfee epo versions 4.5, 4.6, 5.0, and 5.1 to provide a packaging tool for creating McAfee epo deployable packages. Use the McAfee EEDK tool to create a package of the compiled kernel modules and the EEDK script. Compiled kernel modules EEDK script Represent one or more kernel modules (kmod rpm packages) built for various target kernel versions. Allows you to distribute the compiled kernel modules to production endpoints running Application Control and Change Control (version and later). Download the EEDK script from the patches section of the McAfee Downloads website. When you deploy the package created by EEDK on the target endpoints, the EEDK script copies the kernel module files specific to the platform and architecture of the target endpoints. These files are then reused by the Solidcore client on all endpoints that are running the same kernel. 1 Download the EEDK tool. For more information about the tool, see the documents available with the EEDK tool package. 2 Identify all kernels where kmod rpm distribution is required using the EEDK script. 3 Create the kernel modules (kmod rpm packages) for all identified kernels by executing builds on corresponding testbeds. 4 Place these files in a single directory on a Windows system: EEDK script One or more kernel modules (kmod rpm packages built for various target kernels) 5 Click EEDK.exe to run the EEDK tool. 6 Specify these values: Path to folder containing needed kernel modules and EEDK script. Name to identify the package. For example, you can specify the Product Name as MACEEDK. ID to distinguish the package from the previously-created packages. For example, you can specify the Product ID as Version to indicate the package version. Description text that represents the product name listed in the McAfee epo master repository. Use this field to distinguish the EEDK package from other packages in the master repository. Command to execute using the./<eedk_script> [MAC/MCC Version] syntax. Here <eedk _script> is the name of the EEDK script. The Application Control or Change Control (MAC/MCC) version argument is optional, and you must specify it in the form of <Major>.<Minor>.<Patch>-<Build>, for example, If you provide the version information, the script will copy the kmod packages only for the specified Application Control or Change Control version to the /opt/solidcore directory. However, if the script doesn't find the rpm file for the specified version in the package, it considers that no version information is provided and tries to copy the kmod packages for all Application Control or Change Control version to the /opt/solidcore directory. 7 Select the Linux checkbox in the OS Support field. For all other fields, do not change the default values. 8 Navigate to Tools Options and specify the folder to store the created package in the Build Folder field. 9 Click Save to return to the main screen. McAfee Change Control and McAfee Application Control Installation Guide 29

30 A Create builds for unsupported Linux kernels 10 Click Build Package. 11 Check in the created package to the McAfee epo master repository. 12 Verify that the name specified in the Product Description field is listed in the master repository. 13 Create a product deployment task for this EEDK package using McAfee epo and push the package to the target endpoints. Pushing the product deployment task creates the /opt/solidcore directory and copies the respective kmod rpm packages to the endpoints. 14 Perform one of these steps: For Solidcore client installation or upgrade Push product deployment task for Solidcore client from McAfee epo to the target endpoints. For kernel upgrade (Solidcore client is already installed on endpoints) Restart endpoints in the new kernel. How does installation occur? When you run the Product Deployment task, the software executes the installation script to perform installation. The installation script performs these checks and tasks. 30 McAfee Change Control and McAfee Application Control Installation Guide

31 B Frequently Asked Questions Here are answers to frequently asked questions. Can the same Solidcore client be used for Change Control and Application Control? The license key determines the features available for use; any or all features can be used at a time. At any time, you can add and enable a new stock-keeping unit (SKU) on an endpoint where the Solidcore client is enabled. For example, if you are currently using Change Control and want to add and use Application Control, complete these steps. 1 Disable the Solidcore client on the endpoint. For more information, see McAfee Change Control and McAfee Application Control Product Guide. 2 Enter the license. For more information, see Specify licenses. 3 Enable the Solidcore client on the endpoint. For more information, see Enable the Solidcore client. Can the Solidcore client be deployed on a virtual machine? The Solidcore client works on a virtual machine if the operating system installed on the virtual machine is supported by the Solidcore client. For a list of the supported platforms, see KB76459 (for Change Control) and KB73341 (for Application Control). Can I use third-party software to distribute and deploy this software? You can install, upgrade, or uninstall the Change Control and Application Control software using third-party tools, such as Microsoft System Center Configuration Manager. For more information about software distribution, see the documentation for your third-party tool. Before using a software distribution tool, assign updater privileges to relevant binary files of the tool. For more information about how to add updaters, see the McAfee Change Control and McAfee Application Control Product Guide. How can I upgrade the kernel on my Linux system where Change Control or Application Control is installed? 1 Place Change Control or Application Control in Update mode. For information about how to place the system in Update mode, see the McAfee Change Control and McAfee Application Control Product Guide. 2 Install the new kernel. 3 Exit Update mode and place Change Control or Application Control in Enabled mode. For information about how to exit Update mode, see the McAfee Change Control and McAfee Application Control Product Guide. McAfee Change Control and McAfee Application Control Installation Guide 31

32 B Frequently Asked Questions 4 Review KB82066 to verify whether the target kernel is supported. 5 Perform one of these steps. If the target kernel is supported, boot with the new kernel to upgrade the software. If the target kernel is not supported, create a build on a testbed and then install on the endpoint using the created build. 1 Make sure that the testbed meets the needed prerequisites. For detailed information, see Create builds for unsupported Linux kernels. If the target kernel is not supported and you have filed a PER to get support, upgrade the software before booting with the new kernel. 2 Perform one of these tasks: If Change Control or Application Control was already installed on the testbed, boot with the new kernel to upgrade the software. If Change Control or Application Control is not installed on the testbed, install the software on the testbed by following the instructions listed in Install the Solidcore client on the endpoints. 3 Create the /opt/solidcore directory on the endpoint. 4 Fetch the created build from the <install directory>/dks directory of the testbed and place it in the /opt/solidcore directory of the production endpoints. You can deploy the build to production endpoints using EEDK or manually. For detailed information about using EEDK, see Create builds for unsupported Linux kernels. 5 Boot with the new kernel to upgrade the software. Regardless of the mode in which the Change Control or Application Control is running, the software automatically detects the new kernel. I installed Change Control or Application Control on kernel EL6.x86_64. Will my existing setup work accurately if I upgrade to EL6.x86_64, EL6.x86_64, or any other similar kernel? While it seems like only minor differences exist between the kernels, EL6.x86_64 and EL6.x86_64 are different from the installed kernel EL6.x86_64. Because these are different, you must follow the workflow that you would follow when you upgrade the kernel. To verify if two kernels are the same, check the output of the uname -r for both kernels. If the outputs for both commands match, the kernels are that same. A few accepted exceptions exist for SuSE 11. For example, if kernel is installed, output for the uname -r command kernel is I installed Change Control or Application Control and am now unable to place my Linux endpoint in Enabled mode. Alternatively, I am unable to place my Linux endpoint in Enabled or Update mode from Disabled mode. What could be the cause? If your target kernel is not supported, the software automatically creates the required build for the installed kernel (if all prerequisites are available). After installation is complete, the software runs the sanity suite to validate the installation. You might be unable to place the endpoint in Enabled mode if the sanity suite fails. Review the properties for your Linux system to verify the status of the sanity suite. 32 McAfee Change Control and McAfee Application Control Installation Guide