McAfee Change Control and McAfee Application Control 8.0.0

Transcription

1 Installation Guide McAfee Change Control and McAfee Application Control For use with McAfee epolicy Orchestrator

2 COPYRIGHT 2016 Intel Corporation TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Change Control and McAfee Application Control Installation Guide

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Installing the software 7 Prerequisites Supported McAfee epo versions Install the Solidcore extension Install manually Install using Software Manager Specify licenses Install the Solidcore client Add the package to the repository Install the Solidcore client on the endpoints Verify the Solidcore client installation Enable the Solidcore client Upgrading the software 15 Upgrade the Solidcore extension Upgrade manually Upgrade using Software Manager Verify the Solidcore extension upgrade Upgrade the Solidcore client Add the Solidcore client package to the repository Upgrade the Solidcore client on the endpoints Verify the Solidcore client upgrade Place the endpoints in Enabled mode Uninstalling the software 23 Remove the Solidcore client Remove the Solidcore extension Remove the Solidcore client package A Creating builds for unsupported Linux kernels 25 Distribute builds to endpoints using McAfee EEDK B Frequently asked questions 33 Index 37 McAfee Change Control and McAfee Application Control Installation Guide 3

4 Contents 4 McAfee Change Control and McAfee Application Control Installation Guide

5 Preface This guide provides the information you need to work with your McAfee product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Users People who use the computer where the software is running and can access some or all of its features. Conventions This guide uses these typographical conventions and icons. Italic Bold Monospace Narrow Bold Title of a book, chapter, or topic; a new term; emphasis Text that is emphasized Commands and other text that the user types; a code sample; a displayed message Words from the product interface like options, menus, buttons, and dialog boxes Hypertext blue A link to a topic or to an external website Note: Extra information to emphasize a point, remind the reader of something, or provide an alternative method Tip: Best practice information Caution: Important advice to protect your computer system, software installation, network, business, or data Warning: Critical advice to prevent bodily harm when using a hardware product McAfee Change Control and McAfee Application Control Installation Guide 5

6 Preface Find product documentation Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. 6 McAfee Change Control and McAfee Application Control Installation Guide

7 1 Installing 1 the software Install Change Control or Application Control in the McAfee epolicy Orchestrator (McAfee epo ) environment. Contents Prerequisites Supported McAfee epo versions Install the Solidcore extension Specify licenses Install the Solidcore client Prerequisites Before installing Change Control or Application Control, make sure that your environment conforms to these requirements. Verify that the McAfee epo server and database are installed and configured. McAfee epo is a management tool that installs software and deploys policies on the managed endpoints. It also allows you to monitor client activity, create reports, and store and distribute content and software updates. Make sure that the McAfee Agent is installed on each endpoint where you want to install Change Control or Application Control. McAfee Agent acts as the intermediary between the Solidcore client and McAfee epo server. It sends data between the client and the McAfee epo server. Download the Solidcore extension package from the McAfee Downloads site. The Solidcore extension file is typically named Solidcore_epo_extn_<ver>.<build>.zip. Download the Solidcore client package from the McAfee Downloads site. Here are the available Solidcore client packages. Operating system Microsoft Windows Linux Package name SOLIDCOR<version>-<build>_WIN.zip SOLIDCOR<version>-<build>_LNX.zip In the file name, <version> and <build> represent the version and build number associated with the product. For example, the SOLIDCOR _WIN.zip file includes the Solidcore client (version and build number 211) for the Windows platform. Make sure that the target platforms where you want to install the Solidcore client are supported. See KB76459 (for Change Control) and KB73341 (for Application Control). McAfee Change Control and McAfee Application Control Installation Guide 7

8 1 Installing the software Supported McAfee epo versions Review KB84289 for information about the supported kernels for the Linux operating system. If the target kernel is not mentioned in this article, there are two ways to get support: Compile the kernel module in your test environment and deploy immediately to production endpoints using McAfee epo (EEDK) or manually. For more information, see Create builds for unsupported Linux kernels. Request kernel support by filing a Product Enhancement Request (PER). For information about how to submit a PER, see KB Determine the database sizing requirements for your setup (see KB72753 for Change Control and Application Control). Review the minimum system requirements for Change Control and Application Control (see KB73341). Review the release notes to acquaint yourself with the known issues and identify dependencies. Supported McAfee epo versions This release of McAfee Application Control and McAfee Change Control is compatible with these McAfee epolicy Orchestrator (McAfee epo ) versions. McAfee epo McAfee epo We don't guarantee that Change Control and Application Control works with other versions of McAfee epo. Install the Solidcore extension The Solidcore extension integrates with the McAfee epo console and provides Change Control and Application Control features. The Solidcore extension installs on versions 5.1, 5.3, and 5.9 of the McAfee epo server. s Install manually on page 8 Install the Solidcore extension to McAfee epo manually. Install using Software Manager on page 9 Install the Solidcore extension to McAfee epo automatically using Software Manager. Install manually Install the Solidcore extension to McAfee epo manually. For details about product features, usage, and best practices, click? or Help. 1 Make sure that the extension file is stored at an accessible location. 2 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 3 Click Install Extension. 4 Browse to and select the Solidcore_epo_extn_<ver>.<build>.zip file, then click OK. 8 McAfee Change Control and McAfee Application Control Installation Guide

9 Installing the software Specify licenses 1 5 Verify the information on the Install Extension page, then click OK. 6 Verify that the Solidcore product name appears in the Extensions list. If the product name is not listed or you encounter errors during installation, review the Orion.log file in the <install directory>\server\logs directory to analyze failure cause. Install using Software Manager Install the Solidcore extension to McAfee epo automatically using Software Manager. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Software Software Manager. 2 From the Product Categories list, select Software (by Label) Endpoint Security. 3 Select McAfee Application Control 8.0 or McAfee Change Control Click Check In for the epo Management Extension. 5 On the Check In Software Summary page, select the I accept the terms in the license agreement checkbox and click OK. Specify licenses Licenses determine the product features available to you. When you install the Solidcore extension, a default evaluation license for Integrity Control lasting 90 days is provided. You can extend this evaluation license for another 90 days or add a full license. The license key determines the features that are enabled. Any or all features can be enabled and used at the same time. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Configuration Server Settings to open the Setting Categories page. 2 Select Solidcore, then click Edit to open the Edit Solidcore page. 3 Enter the license keys, then click Save. Install the Solidcore client The Solidcore client provides change monitoring, change prevention, and whitelisting features on the endpoints where it is installed. You can install and deploy the Solidcore client on Windows and Linux McAfee Change Control and McAfee Application Control Installation Guide 9

10 1 Installing the software Install the Solidcore client platforms. For all supported platforms, the Solidcore client works well on both physical and virtual machines (VM). s Add the package to the repository on page 10 Before you install the Solidcore client, add the Solidcore client package to the McAfee epo repository. Install the Solidcore client on the endpoints on page 11 Install the Solidcore client on endpoints. Verify the Solidcore client installation on page 12 Verify that the Solidcore client was installed successfully on an endpoint. Enable the Solidcore client on page 12 To activate the software, place the Solidcore client in Enabled mode. Add the package to the repository Before you install the Solidcore client, add the Solidcore client package to the McAfee epo repository. s Add manually on page 10 Add the Solidcore client package to the McAfee epo repository manually. Add using Software Manager on page 10 Add the Solidcore client package to the McAfee epo repository automatically using Software Manager. Add manually Add the Solidcore client package to the McAfee epo repository manually. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Software Master Repository. 2 From the Packages in Master Repository page, click Check In Package. 3 Set the package type to Product or Update (.ZIP). 4 Browse to and select the package (.zip) file and click Next to open the Package Options page. 5 Confirm the information. Package info: Verify the package details. Branch: Select the desired branch. Set to Current for new products. Options: (Optional) Select Move the existing package to the Previous branch to move an existing package to the previous branch. Package signing: Indicates if the package is signed by McAfee or is a third-party package. Conflicting Packages that will be removed: Displays a list of packages, if any, that will be deleted. 6 Click Save to add the package. The new package appears in Packages in Master Repository list. Add using Software Manager Add the Solidcore client package to the McAfee epo repository automatically using Software Manager. 10 McAfee Change Control and McAfee Application Control Installation Guide

11 Installing the software Install the Solidcore client 1 For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Software Software Manager. 2 From the Product Categories list, select Software (by Label) Endpoint Security. 3 Select McAfee Application Control 8.0 or McAfee Change Control Click Check In for the Solidcore Client for Windows package. 5 On the Check In Software Summary page, select the I accept the terms in the license agreement checkbox and click OK. 6 Repeat steps 4 and 5 for the Install - Linux package. Install the Solidcore client on the endpoints Install the Solidcore client on endpoints. Before you begin Review KB82066 for information about the supported kernels. We add support for new kernels through kernel release cycles. We recommend that you review the kernel list before installing. If the target kernel is not mentioned in KB82066, there are two ways to get support: Compile the kernel module in your test environment and deploy immediately to production endpoints using McAfee epo Endpoint Deployment Kit (EEDK) or manually. For more information, see Create builds for unsupported Linux kernels. Request kernel support by filing a Product Enhancement Request (PER). For information about how to submit a PER, see KB For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client s tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. 3 Click Actions New Client Assignment to open the Client Assignment Builder page. 4 Select the McAfee Agent product and Product Deployment task type, then click Create New. 5 Specify the task name and add any descriptive information. 6 Select the target platform. For example, when installing the Solidcore client package on the Windows operating system, select Windows as the target platform. McAfee Change Control and McAfee Application Control Installation Guide 11

12 1 Installing the software Install the Solidcore client 7 Specify the component and action. a Select the appropriate package from the Products and components list. b c d Select the Install action. Select the language of the package. Specify the branch where to add the package. 8 Click Save, then click Next to open the Schedule page. 9 Specify scheduling details, then click Next. 10 Review and verify the task details, then click Save. 11 (Optional) Click Wake Up Agents to send your client task to the endpoint immediately. Verify the Solidcore client installation Verify that the Solidcore client was installed successfully on an endpoint. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Select a group or endpoint from the list to view details for the selected node in the Systems tab. 3 Review logs from the McAfee epo console. a Select a system on the Systems page. b Select Actions Agent Show Agent Log to view the agent log for the endpoint. By default, agent logs are not enabled on the McAfee epo console. For information about how to enable agent logs, see McAfee epolicy Orchestrator Product Guide. c Check the log to verify that the software was successfully installed on the endpoint. 4 Review the properties for the system. a Click Wake Up Agents to fetch properties immediately. Typically, information is exchanged between the agent and server after agent-server communication interval (ASCI). Default ASCI value is 60 minutes. Send an agent wake-up call to make sure immediate communication and data exchange between the server and the agent, without waiting for the ASCI to expire. b c Click a system on the Systems page to view details for the selected endpoint. Click the Products tab and review the Solidcore version. Click the row to review additional information, including the product version and installation path. If the Solidcore information is not listed, check the log files on the endpoint to verify that the software was successfully installed on the endpoint. If the Solidcore client installation fails, the log files provide information about the cause for failure. Enable the Solidcore client To activate the software, place the Solidcore client in Enabled mode. 12 McAfee Change Control and McAfee Application Control Installation Guide

13 Installing the software Install the Solidcore client 1 For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client s tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. 3 Click Actions New Client Assignment to open the Client Assignment Builder page. 4 Select the Solidcore product and SC: Enable task type, then click Create New. 5 On the Client Catalog page, specify the task name and add any descriptive information. 6 Select these fields. a Select the platform. b c Select the subplatform. Indicate whether to enable Change Control, Application Control, or both. 7 To enable Change Control, complete these steps. Solidcore clients running Windows all Windows NT and Windows 2000 Linux Steps No configuration is needed. Select Reboot endpoint checkbox to restart the endpoint. On the Windows platforms, a pop-up message is displayed at the endpoint 5 minutes before the endpoint is restarted. This allows the user to save work and data on the endpoint. Using version or later Deselect Reboot endpoint checkbox. Using version or earlier Select Reboot endpoint checkbox to restart the endpoint. Restarting the system is needed to enable the software. The endpoint is restarted when the task is applied. 8 To enable Application Control, complete these steps. McAfee Change Control and McAfee Application Control Installation Guide 13

14 1 Installing the software Install the Solidcore client Solidcore clients running Windows all Steps 1 Specify the scan priority. The set scan priority determines the priority of the thread that is run to create the whitelist on the endpoints. Set the scan priority to Low. This makes sure that Application Control causes minimal performance impact on the endpoints but might take longer (than when you set the priority to High) to create the whitelist. 2 Specify the activation option. Limited Feature Activation The endpoints are not restarted and limited features of Application Control (memory protection features are unavailable) are activated. Memory Protection features are available only after the endpoint is restarted. Full Feature Activation The endpoints are restarted, whitelist created, and all features of Application Control including Memory Protection are active. Restarting the endpoints is needed to enable the memory protection features. The endpoint is restarted 5 minutes after the client task is received at the endpoint. A pop-up message is displayed on the endpoint before the endpoint is restarted. 3 Select Start Observe Mode to place the endpoints in Observe mode. The Observation mode feature is available only on the Windows operating system. 4 (Optional) Select Pull Inventory. If you select this option, the software fetches the inventory details for the endpoints (after the whitelist is created) and makes the details available on the McAfee epo console after ASCI. Select this option if you want to manage the inventory using the McAfee epo console. Windows NT or Windows 2000 Linux Select Reboot endpoint checkbox to restart the endpoint after solidification is complete. Restarting the system is needed to enable the software. A pop-up message is displayed at the endpoint 5 minutes before the endpoint is restarted. This allows the user to save work and data on the endpoint. Deselect Reboot endpoint checkbox. When using Solidcore client version or later, restarting the system is not needed to enable the software. 9 Click Save, then click Next to open the Schedule page. 10 Specify scheduling details, then click Next. 11 Review and verify the task details, then click Save. 12 (Optional) Click Wake Up Agents to send your client task to the endpoint immediately. 13 Verify that the software is enabled. a Click Wake Up Agents to fetch properties immediately. b c Click a system on the Systems page. The details for the selected system are displayed. Select the Products tab and review the Solidcore version. Click the row to review the license status. 14 McAfee Change Control and McAfee Application Control Installation Guide

15 2 Upgrading 2 the software Upgrade Change Control or Application Control to access features available in recent releases. Contents Upgrade the Solidcore extension Verify the Solidcore extension upgrade Upgrade the Solidcore client Upgrade the Solidcore extension Upgrade the Solidcore extension to access the new features in a release. When you upgrade the Solidcore extension, you should not make any changes to existing rules and configuration until the Solidcore: Migration server task completes. s Upgrade manually on page 15 Upgrade the Solidcore extension manually. Upgrade using Software Manager on page 16 Upgrade the Solidcore extension using Software Manager. Upgrade manually Upgrade the Solidcore extension manually. Before you begin Stop the McAfee epo Event Parser service and back up the relevant files before you upgrade the Solidcore extension. 1 Select Control Panel Administrative Tools Services. 2 Right-click the McAfee epolicy Orchestrator <version> Event Parser service and click Stop. 3 Back up these items. McAfee epo database <McAfee epo install dir>\server\extensions\installed\solidcore directory <McAfee epo install dir>\server\conf\catalina\localhost\solidcore_meta.xml file McAfee Change Control and McAfee Application Control Installation Guide 15

16 2 Upgrading the software Verify the Solidcore extension upgrade For details about product features, usage, and best practices, click? or Help. 1 Make sure that the extension file is stored at an accessible location. 2 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 3 Click Install Extension, then browse to and select the Solidcore_epo_extn_<ver>.<build>.zip file. A warning message states that the existing extension will be replaced. 4 Click OK. 5 Verify the information on the Install Extension page, then click OK. Upgrade using Software Manager Upgrade the Solidcore extension using Software Manager. For details about product features, usage, and best practices, click? or Help. 1 Stop the McAfee epo Event Parser service and back up the relevant files before you upgrade the Solidcore extension. a Select Control Panel Administrative Tools Services. b c Right-click the McAfee epolicy Orchestrator <version> Event Parser service and click Stop. Back up these items. McAfee epo database <McAfee epo install dir>\server\extensions\installed\solidcore directory <McAfee epo install dir>\server\conf\catalina\localhost\solidcore_meta.xml file 2 On the McAfee epo console, select Menu Software Software Manager. 3 From the Product Categories list, select Software (by Label) Endpoint Security. 4 Select McAfee Application Control 8.0 or McAfee Change Control Click Update for the epo Management Extension. 6 On the Update Software Summary page, click OK. Verify the Solidcore extension upgrade Verify that the Solidcore extension was upgraded successfully. 16 McAfee Change Control and McAfee Application Control Installation Guide

17 Upgrading the software Verify the Solidcore extension upgrade 2 For details about product features, usage, and best practices, click? or Help. 1 Verify that the Solidcore product name appears in the Extensions list. If the product name is not listed or you encounter errors during upgrade, review the Orion.log file in the <install directory>\server\logs directory to analyze failure cause. After you upgrade the Solidcore extension, the domain netbiosname for existing users imported directly from an Active Directory to rule groups and policies is not be populated. To make sure the domain netbiosname is available for such users, delete and reimport users from the Active Directory. After the upgrade, any users that you import from the Active Directory and add to new or existing rule groups and policies automatically include the domain netbiosname. 2 Start the McAfee epo Event Parser service. a Select Control Panel Administrative Tools Services. b Right-click the McAfee epolicy Orchestrator <version> Event Parser service and click Start. 3 Verify that migration of data was successful. a On the McAfee epo console, select Menu Automation Server Log. b c Check if the Solidcore: Migration server task was completed. This server task completes upgrade-related activities. If the task is in progress, wait until the task completes. Make sure you do not edit any existing settings while this task is in progress. If the migration fails, review the server task log, resolve any issues, and run the Solidcore: Migration server task manually to complete the migration. 4 (Optional) Run the Rule Group Sanity Check server task from the McAfee epo console to fix the inconsistencies in the rule groups. This server task reports and corrects (if possible) discrepancies and inconsistencies in the Solidcore rule groups and policies. a b c d e f g On the McAfee epo console, select Menu Automation Server s. Click New to open the Server Builder wizard. Type the task name and click Next. Select Solidcore: Rule Group Sanity Check from the Actions drop-down list, then click Next. Specify the schedule for the task, then click Next to open the Summary page. Review the task summary and click Save. Review the logs generated by the server task (on the Server Log page) to view the warnings, if any. McAfee Change Control and McAfee Application Control Installation Guide 17

18 2 Upgrading the software Upgrade the Solidcore client Upgrade the Solidcore client You can upgrade the Solidcore client on Windows and Linux platforms. For all supported platforms, the Solidcore client works well on both physical and virtual machines (VM). Before you begin Review KB82066 for information about the supported kernels. We add support for new kernels through kernel release cycles. We recommend that you review the kernel list before upgrading. If the target kernel is not mentioned in KB82066, get support one of these ways: Compile the kernel module in your test environment and deploy immediately to production endpoints using McAfee epo Endpoint Deployment Kit (EEDK) or manually. For more information, see Create builds for unsupported Linux kernels. Request kernel support by filing a Product Enhancement Request (PER). For information about how to submit a PER, see KB For information about the supported operating systems, see KB76459 (for Change Control) and KB73341 (for Application Control). If you cannot upgrade the Solidcore clients on your critical endpoints, the endpoints work well with the upgraded Solidcore extension. However, the new features available in the version are not available on the endpoints until you upgrade the Solidcore client version. s Add the Solidcore client package to the repository on page 18 Before you can upgrade, you must add the Solidcore client package to the McAfee epo repository. Upgrade the Solidcore client on the endpoints on page 19 Upgrade the Solidcore client on the endpoints to access new features available in the recent version. Verify the Solidcore client upgrade on page 21 Verify that the Solidcore client was upgraded successfully on an endpoint. Place the endpoints in Enabled mode on page 21 If you did not upgrade in Enabled mode, you must place the endpoints in Enabled mode after you upgrade the Solidcore client. Add the Solidcore client package to the repository Before you can upgrade, you must add the Solidcore client package to the McAfee epo repository. s Add package manually on page 18 Add the Solidcore client package to the McAfee epo repository manually. Add package using Software Manager on page 19 Add the Solidcore client package to the McAfee epo repository automatically using Software Manager. Add package manually Add the Solidcore client package to the McAfee epo repository manually. 18 McAfee Change Control and McAfee Application Control Installation Guide

19 Upgrading the software Upgrade the Solidcore client 2 For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Software Master Repository to open the Packages in Master Repository page. 2 Click Check In Package. 3 Set the package type to Product or Update (.ZIP). 4 Browse to and select the package (.zip) file, then click Next to open the Package Options page. 5 Confirm the information. Package info: Verify the package details. Branch: Select the desired branch. Set to Current for new products. Options: (Optional) Select the Move the existing package to the Previous branch option to move an existing package to the previous branch. Package signing: Indicates if the package is signed by McAfee or is a third-party package. Conflicting Packages that will be removed: Displays a list of packages, if any, that will be deleted. 6 Click Save to check in the package. The new package appears in Packages in Master Repository list. Add package using Software Manager Add the Solidcore client package to the McAfee epo repository automatically using Software Manager. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Software Software Manager. 2 From the Product Categories list, select Software (by Label) Endpoint Security. 3 Select McAfee Application Control 8.0 or McAfee Change Control Click Update for the Solidcore Client for Windows package. 5 On the Update Software Summary page, click OK. 6 Repeat steps 4 and 5 for the Install - Linux package. Upgrade the Solidcore client on the endpoints Upgrade the Solidcore client on the endpoints to access new features available in the recent version. You can upgrade the Solidcore client in various modes. Before upgrading, review this information to place the endpoints in the suitable mode. McAfee Change Control and McAfee Application Control Installation Guide 19

20 2 Upgrading the software Upgrade the Solidcore client Enabled mode Update mode Observe mode In Enabled mode, you can upgrade the Solidcore client on all supported Windows platforms except Windows NT and Windows By default, the McAfee default policy that includes the McAfee publishers rule group is applied to the endpoints. If you choose to upgrade in Enabled mode and have changed the default policies, verify that the McAfee publishers rule group is assigned to policies that are applied on the endpoints. For the Linux operating system, upgrade using the Update mode. Observe mode is available on all supported Windows platforms except Windows NT and Windows If you are upgrading from the release, upgrade in Enabled or Update mode. If you choose to upgrade in Observe mode, review KB79517 before upgrading. Disabled mode If your endpoint is in Disabled mode, you can upgrade in the Disabled mode. If you are upgrading a Linux system in Disabled mode from to a later release, restart the endpoint before upgrading. For information about how to place the endpoints in Update, Disabled, or Observe mode, see McAfee Change Control and McAfee Application Control Product Guide. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client s tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. 3 Click Actions New Client Assignment to open the Client Assignment Builder page. 4 Select the McAfee Agent product, Product Deployment task type, then click Create New to open the Client Catalog page. 5 Specify the task name and add any descriptive information. 6 Select the target platform. For example, when installing the Solidcore client package on the Windows operating system, select Windows as the target platform. 7 Specify the component and action. a Select the appropriate package from the Products and components list. b c d Select the Install action. Select the language of the package. Set branch to Current for new packages. 8 Click Save, then click Next to open the Schedule page. 9 Specify scheduling details and click Next. 10 Review and verify the task details and click Save. 20 McAfee Change Control and McAfee Application Control Installation Guide

21 Upgrading the software Upgrade the Solidcore client 2 11 (Optional) Click Wake Up Agents to send your client task to the endpoint immediately. 12 Restart the endpoints. Verify the Solidcore client upgrade Verify that the Solidcore client was upgraded successfully on an endpoint. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Select a group or endpoint from the list to view details for the selected node in the Systems tab. 3 Review logs from the McAfee epo console. a Select an endpoint on the Systems page. b Select Actions Agent Show Agent Log to view the agent log for the endpoint. By default, agent logs are not enabled on the McAfee epo console. For information about how to enable agent logs, see McAfee epolicy Orchestrator Product Guide. c Check the log to verify that the software was successfully upgraded on the endpoint. 4 Review the properties for the endpoint. a Click Wake Up Agents to fetch properties immediately. Typically, information is exchanged between the agent and server after agent-server communication interval (ASCI). The default ASCI value is 60 minutes. Send an agent wake-up call to ensure immediate communication and data exchange between the server and the agent, without waiting for the ASCI to expire. b c Click an endpoint on the Systems page to view details for the selected endpoint. Select the Products tab and review the Solidcore version. Click the row to review additional information, including the product version and installation path. If the Solidcore information is not listed or is incorrect, check the log files on the endpoint to verify that the software was successfully upgraded on the endpoint. If the Solidcore client upgrade fails, the log files provide information about the cause for failure. Place the endpoints in Enabled mode If you did not upgrade in Enabled mode, you must place the endpoints in Enabled mode after you upgrade the Solidcore client. If you upgraded in Update mode, exit Update mode to place the endpoints back in Enabled mode. If you upgraded in Disabled mode, enable the Solidcore client, then perform re-solidification for the endpoint. If you upgraded in Observe mode, exit Observe mode and place the endpoints in Enabled mode. For information about how to exit Update, Disabled, or Observe mode, see McAfee Change Control and McAfee Application Control Product Guide. McAfee Change Control and McAfee Application Control Installation Guide 21

22 2 Upgrading the software Upgrade the Solidcore client 22 McAfee Change Control and McAfee Application Control Installation Guide

23 3 Uninstalling 3 the software If you are no longer using the software, uninstall Change Control or Application Control. Contents Remove the Solidcore client Remove the Solidcore extension Remove the Solidcore client package Remove the Solidcore client To discontinue use of the software, remove the Solidcore client from the endpoints. For details about product features, usage, and best practices, click? or Help. 1 Place the endpoints in Disabled mode. For detailed information, see McAfee Change Control and McAfee Application Control Product Guide. 2 Restart the endpoints. 3 On the McAfee epo console, select Menu Systems System Tree. 4 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client s tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. 5 Click Actions New Client Assignment to open the Client Assignment Builder page. 6 Select the McAfee Agent product, Product Deployment task type, and click Create New to open the Client Catalog page. 7 Specify the task name and add any descriptive information. 8 Select the target platform. 9 Specify the component and action. a Select the appropriate package from the Products and components list. b c d Select Remove. Select the language of the package. Set branch to Current for new packages. McAfee Change Control and McAfee Application Control Installation Guide 23

24 3 Uninstalling the software Remove the Solidcore extension 10 Click Save, then click Next to open the Schedule page. 11 Specify scheduling details and click Next. 12 Review and verify the task details and click Save. 13 Click Wake Up Agents to send your client task to the endpoint immediately. 14 Verify the Solidcore client removal. a Click Wake Up Agents to fetch properties immediately. Typically, information is exchanged between the agent and server after agent-server communication interval (ASCI). Default ASCI value is 60 minutes. Send an agent wake up call to verify immediate communication and data exchange between the server and the agent, without waiting for the ASCI to expire. b c Click an endpoint on the Systems page to view details for the selected endpoint. Click the Products tab and make sure that Solidcore is not listed. Remove the Solidcore extension To discontinue use of the software, remove the Solidcore extension from the McAfee epo server. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 2 Select Solidcore from the Extensions list. 3 Click Remove. 4 Verify that the Solidcore product name no longer appears in the Extensions list. If the product name is not removed or you encounter errors when you uninstall, review the Orion.log file in the <install directory>\server\logs directory to analyze the cause of the failure. Remove the Solidcore client package After you uninstall the software, remove the Solidcore client package from the McAfee epo server. For details about product features, usage, and best practices, click? or Help. 1 On the McAfee epo console, select Menu Software Master Repository to open the Packages in Master Repository page. 2 Select Delete for a package. 24 McAfee Change Control and McAfee Application Control Installation Guide

25 A Creating builds for unsupported Linux kernels Here is information about how to create builds for unsupported Linux kernels. We have added support for numerous kernels. This allows you to directly install the software on kernels listed in KB If you want to install on a kernel that is not listed in KB82066, you can perform one of these tasks: Create a build file for the target kernel (on a testbed) and deploy the build to other production endpoints using McAfee epo Endpoint Deployment Kit (EEDK) or manually. Request for kernel support by filing a Product Enhancement Request (PER). The Product Management team will accommodate the kernel in upcoming kernel release cycles. For information about how to submit a PER, see KB Deployment scenarios The installation workflow on the Linux operating system varies based on whether the target kernel is supported. Review KB82066 to verify support for the target kernel. McAfee Change Control and McAfee Application Control Installation Guide 25

26 A Creating builds for unsupported Linux kernels Installing when the target kernel is supported Query Has anything changed for me since the previous release? Do I need to take care of any prerequisites? How do I install? Response No. If the target kernel is supported, direct installation occurs on the kernel. None. Perform the steps listed in Install the Solidcore client on the endpoints. Installing on an unsupported target kernel We have included capability to create kernel modules for target kernels. You can automatically create build on a testbed and deploy the kernel module to production endpoints running the same kernel using EEDK or manually. 26 McAfee Change Control and McAfee Application Control Installation Guide

27 Creating builds for unsupported Linux kernels A Component Prerequisites How do I install? Testbed Make sure that these tools are installed on the testbed. Any non-conformance to the listed build environment results in build and installation failures. Build and packaging tools gmake (provided by package make) gcc (provided by package gcc) ld (provided by package binutils) ar (provided by package binutils) rpmbuild (provided by package rpm-build on Red Hat and package rpm on SUSE) cpio (provided by package cpio) Package versions should be the same as the versions that are packaged with the distribution ISO. Make sure that the testbed meets the prerequisites and then follow the instructions listed in Install the Solidcore client on the endpoints. The needed build is placed in the <install directory>/dks directory of the testbed and the software is installed on the testbed. Kbuild framework Make sure that framework is installed under /lib/modules /<kernelversion>/build/ (provided by package kernel-source on SUSE 10, linux-headers on Ubuntu distributions, and package kernel-devel on other distributions). McAfee Change Control and McAfee Application Control Installation Guide 27

28 A Creating builds for unsupported Linux kernels Component Prerequisites How do I install? Production endpoints Kernel source package If you are running a 3.5.x or later kernel, make sure that you download the kernel source package and place it in the /usr/src directory. No build or package tools are needed on production endpoints. Make sure that you create the /opt/ solidcore directory on each production endpoint. This directory does not exist by default and must be manually created. 1 Create the /opt/solidcore directory on each production endpoint. 2 Fetch the created build from the <install directory>/dks directory of the testbed. The file name includes kernel details. The naming convention followed for the builds is solidifier kmod <rel> <build>.<distro>.<kernel>.<arch>.<ext>. <distro> the available distributions. LEL5 represents Red Hat Enterprise Linux 5, LEL6 represents Red Hat Enterprise Linux 6, LSES10 represents SuSE Enterprise Linux 10, LSES11 represents SuSE Enterprise Linux 11, and LUBT12 represents Ubuntu 12. <kernel> the kernel for which the build was created. <arch> i386 for 32-bit architecture and x86_64 for AMD 64-bit architecture. <ext>.deb for Ubuntu and.rpm for other distributions. Here is an example of a build created for the Red Hat Enterprise Linux 6 version: solidifier kmod LEL el6.i686.i386.rpm 3 Distribute the created build to production endpoints (to the /opt/ solidcore directory) running the same kernel using EEDK or manually. For more information, see How do I distribute builds to endpoints using McAfee EEDK. 4 Follow the instructions listed in Install the Solidcore client on the endpoints. 28 McAfee Change Control and McAfee Application Control Installation Guide

29 Creating builds for unsupported Linux kernels Distribute builds to endpoints using McAfee EEDK A Installation process When you run the Product Deployment task, the software executes the installation script. The installation script performs these checks and tasks. Distribute builds to endpoints using McAfee EEDK McAfee epo Endpoint Deployment Kit (EEDK) integrates with multiple McAfee epo versions to provide a packaging tool for creating McAfee epo deployable packages. Use the McAfee EEDK tool to create a package of the compiled kernel modules and the EEDK script. McAfee Change Control and McAfee Application Control Installation Guide 29

30 A Creating builds for unsupported Linux kernels Distribute builds to endpoints using McAfee EEDK Compiled kernel modules EEDK script Represent one or more kernel modules (kmod rpm packages) built for various target kernel versions. Allows you to distribute the compiled kernel modules to production endpoints running Application Control and Change Control (version and later). Download the EEDK script from the patches section of the McAfee Downloads website. When you deploy the package created by EEDK on the target endpoints, the EEDK script copies the kernel module files specific to the platform and architecture of the target endpoints. These files are then reused by the Solidcore client on all endpoints that are running the same kernel. For details about product features, usage, and best practices, click? or Help. 1 Download the EEDK tool. For more information about the tool, see the documents available with the EEDK tool package. 2 Identify all kernels where kmod rpm distribution is required using the EEDK script and create the kernel modules (kmod rpm packages) for all identified kernels by executing builds on corresponding testbeds. 3 Place these files in one directory on a Windows system: EEDK script One or more kernel modules (kmod rpm packages built for various target kernels) 4 Click EEDK.exe to run the EEDK tool and specify these values: Path to folder with needed kernel modules and EEDK script. Name to identify the package. For example, you can specify the Product Name as MACEEDK. ID to distinguish the package from the previously created packages. For example, you can specify the Product ID as Version to indicate the package version. Description text that represents the product name listed in the McAfee epo master repository. Use this field to distinguish the EEDK package from other packages in the master repository. Command to execute using the./<eedk_script> [MAC/MCC Version] syntax. Here <eedk _script> is the name of the EEDK script. The Application Control or Change Control (MAC/MCC) version argument is optional, and you must specify it in the form of <Major>.<Minor>.<Patch>-<Build>, for example, If you provide the version information, the script copies the kmod packages only for the specified Application Control or Change Control version to the /opt/solidcore directory. But, if the script doesn't find the rpm file for the specified version in the package, it considers that no version information is provided and tries to copy the kmod packages for all Application Control or Change Control versions to the /opt/solidcore directory. 5 Select the Linux checkbox in the OS Support field. For all other fields, do not change the default values. 6 Navigate to Tools Options and specify the folder to store the created package in the Build Folder field. 7 Click Save to return to the main screen and then clickbuild Package 8 Check in the created package to the McAfee epo master repository. Verify that the name specified in the Product Description field is listed in the master repository. 30 McAfee Change Control and McAfee Application Control Installation Guide

31 Creating builds for unsupported Linux kernels Distribute builds to endpoints using McAfee EEDK A 9 Create a product deployment task for this EEDK package using McAfee epo and push the package to the target endpoints. Pushing the product deployment task creates the /opt/solidcore directory and copies the respective kmod rpm packages to the endpoints. If the /opt/solidcore directory does not exist or is empty, review the macc_eedk.log_<timestamp> file in the /tmp directory to analyze the failure cause. 10 Perform one of these steps: For Solidcore client installation or upgrade Push product deployment task for Solidcore client from McAfee epo to the target endpoints. For kernel upgrade (Solidcore client is already installed on endpoints) Restart endpoints in the new kernel. McAfee Change Control and McAfee Application Control Installation Guide 31

32 A Creating builds for unsupported Linux kernels Distribute builds to endpoints using McAfee EEDK 32 McAfee Change Control and McAfee Application Control Installation Guide

33 B Frequently asked questions Here are answers to frequently asked questions. Can the same Solidcore client be used for Change Control and Application Control? The license key determines the features available for use; any or all features can be used at a time. At any time, you can add and enable a new stock-keeping unit (SKU) on an endpoint where the Solidcore client is enabled. For example, if you are currently using Change Control and want to add and use Application Control, complete these steps. 1 Disable the Solidcore client on the endpoint. For more information, see McAfee Change Control and McAfee Application Control Product Guide. 2 Enter the license. For more information, see Specify licenses. 3 Enable the Solidcore client on the endpoint. For more information, see Enable the Solidcore client. Can the Solidcore client be deployed on a virtual machine? The Solidcore client works on a virtual machine if the operating system installed on the virtual machine is supported by the Solidcore client. For a list of the supported platforms, see KB76459 (for Change Control) and KB73341 (for Application Control). Can I use third-party software to distribute and deploy this software? You can install, upgrade, or uninstall the Change Control and Application Control software using third-party tools, such as Microsoft System Center Configuration Manager. For more information about software distribution, see the documentation for your third-party tool. Before using a software distribution tool, assign updater privileges to relevant binary files of the tool. For more information about how to add updaters, see McAfee Change Control and McAfee Application Control Product Guide. How can I upgrade the kernel on my Linux system where Change Control or Application Control is installed? 1 Place Change Control or Application Control in Update mode. For information about how to place the system in Update mode, see McAfee Change Control and McAfee Application Control Product Guide. 2 Install the new kernel. 3 Exit Update mode and place Change Control or Application Control in Enabled mode. For information about how to exit Update mode, see McAfee Change Control and McAfee Application Control Product Guide. McAfee Change Control and McAfee Application Control Installation Guide 33

34 B Frequently asked questions 4 Review KB82066 to verify whether the target kernel is supported. 5 Perform one of these steps. If the target kernel is supported, boot with the new kernel to upgrade the software. If the target kernel is not supported, create a build on a testbed and then install on the endpoint using the created build. 1 Make sure that the testbed meets the prerequisites. For detailed information, see Create builds for unsupported Linux kernels. If the target kernel is not supported and you have filed a PER to get support, upgrade the software before booting with the new kernel. 2 Perform one of these tasks: If Change Control or Application Control was already installed on the testbed, boot with the new kernel to upgrade the software. If Change Control or Application Control is not installed on the testbed, install the software on the testbed by following the instructions listed in Install the Solidcore client on the endpoints. 3 Create the /opt/solidcore directory on the endpoint. 4 Fetch the created build from the <install directory>/dks directory of the testbed and place it in the /opt/solidcore directory of the production endpoints. You can deploy the build to production endpoints using EEDK or manually. For detailed information about using EEDK, see Create builds for unsupported Linux kernels. 5 Boot with the new kernel to upgrade the software. Regardless of the mode in which the Change Control or Application Control is running, the software automatically detects the new kernel. I installed Change Control or Application Control on kernel EL6.x86_64. Will my existing setup work accurately if I upgrade to EL6.x86_64, EL6.x86_64, or any other similar kernel? While it seems like only minor differences exist between the kernels, EL6.x86_64 and EL6.x86_64 are different from the installed kernel EL6.x86_64. Because these kernels are different, you must follow the workflow that you would follow when you upgrade the kernel. To verify if two kernels are the same, check the output of the uname -r for both kernels. If the outputs for both commands match, the kernels are that same. A few accepted exceptions exist for SuSE 11. For example, if kernel is installed, output for the uname -r command kernel is I installed Change Control or Application Control and am now unable to place my Linux endpoint in Enabled mode. Alternatively, I am unable to place my Linux endpoint in Enabled or Update mode from Disabled mode. What could be the cause? If your target kernel is not supported, the software automatically creates the required build for the installed kernel (if all prerequisites are available). After installation is complete, the software runs the sanity suite to validate the installation. You might be unable to place the endpoint in Enabled mode if the sanity suite fails. Review the properties for your Linux system to verify the status of the sanity suite. 34 McAfee Change Control and McAfee Application Control Installation Guide