Critical System Protection HOW TO SETUP AN UNMANAGED SCSP AGENT

Size: px

Start display at page:

Download "Critical System Protection HOW TO SETUP AN UNMANAGED SCSP AGENT"

Laureen Lyons
5 years ago
Views:

1 Critical System Protection HOW TO SETUP AN UNMANAGED SCSP AGENT

2 CONTENTS Introduction Overview Assumptions Use Cases... 3 How to Setup An Unmanaged SCSP Agent Basic Methodology Logging On To The Managed Test System Creating Policies On The Managed Test System Creating Prevention Policy On The Managed Test System Creating Detection Policies On The Managed Test System Creating Configurations On The Managed Test System Creating Prevention Configurations On The Managed Test System Creating Common Configurations On The Managed Test System Creating Detection Configurations On The Managed Test System Applying Policies On The Managed Test System Applying Prevention Policies On The Managed Test System Applying Detection Policies On The Managed Test System Applying Configurations On The Managed Test System Applying Prevention Configurations On The Managed Test System Applying Common Configurations On The Managed Test System Preparing the Unmanaged Package On The Managed Test System Deploying The Unmanaged Package On The Unmanaged System Performing Policy Updates on the Unmanaged System How To Setup An Unmanaged SCSP Agent Page 2 11 April 2013

3 INTRODUCTION 1.1 OVERVIEW 1. Definition of unmanaged agent: An agent that does not communicate with the management server. 2. Symantec provides support for an unmanaged SCSP (Symantec Critical System Protection) agent if configured correctly. This guide provides Symantec recommended configuration steps for deploying and setting up an unmanaged agent in your environment. 3. The steps in this guide provide basic protection using the Symantec out of the box policies. This guide does not cover configuration of policies in order to perform a total lockdown of the unmanaged agent system 1.2 ASSUMPTIONS 1. It is assumed that the reader of this document has a fair understanding on SCSP architecture and how SCSP server, console and agent are deployed. 2. It is also assumed that the reader of this document has access to an installable kit and a version of SCSP Management Server, Console and Agent equivalent or greater than USE CASES 1. This guide covers the following use cases. a. Setting up a brand new unmanaged agent in a lab/factory and protecting it with SCSP in an unmanaged mode. b. Performing updates/maintenance operations on unmanaged agent. HOW TO SETUP AN UNMANAGED SCSP AGENT 2.1 BASIC METHODOLOGY 1. The SCSP Management Server, Console and Agent must be deployed on a managed test system before being deployed on the unmanaged system. 2. It is recommended that you setup this managed test system on two virtual machines A and B. 3. Deploy the Management Server, Console on virtual machine A and the agent on virtual machine B with default installation steps as listed out in the installation guide. The installation guide SCSP_Installation_Guide.pdf can be found in the CDImage\Docs folder. 4. Virtual machine A can be any window server based operating system. E.g. Windows Server Virtual machine B should be a windows operating system that resembles your unmanaged system operating system. E.g. Windows We will be preparing a package consisting of policy files and configuration settings that will be used to deploy the unmanaged agent. This will be referred to as the unmanaged package. How To Setup An Unmanaged SCSP Agent Page 3 11 April 2013

3.1 LOGGING ON TO THE MANAGED TEST SYSTEM 1. Login to the Symantec Management Console as the user symadmin. For first time login to the console, password does not need to be entered.

4 3.1 LOGGING ON TO THE MANAGED TEST SYSTEM 1. Login to the Symantec Management Console as the user symadmin. For first time login to the console, password does not need to be entered. The login dialogue will prompt to create a password for first time users. 2. The agent installed on the managed system should be displayed in the Assets screen of the console. How To Setup An Unmanaged SCSP Agent Page 4 11 April 2013

5 4.1 CREATING POLICIES ON THE MANAGED TEST SYSTEM CREATING PREVENTION POLICY ON THE MANAGED TEST SYSTEM 1. Begin preparing the package with the following recommended policy settings. 2. Create a new policy in the Policy > Prevention screen by clicking on the (+) green icon to start the policy creation wizard. How To Setup An Unmanaged SCSP Agent Page 5 11 April 2013

6 3. Set the policy name as you wish. In the example shown, the policy has been named Unmanaged_Agent_Policy. Select Windows as the OS and use the sym_win_protection_strict_sbp base policy as shown below 4. Press finish. The new policy will now be displayed in the list of Prevention Policies. How To Setup An Unmanaged SCSP Agent Page 6 11 April 2013

7 5. Right click on this policy and click on edit policy option. This will open the policy editor screen. How To Setup An Unmanaged SCSP Agent Page 7 11 April 2013

8 How To Setup An Unmanaged SCSP Agent Page 8 11 April 2013

9 6. Click on the Agent Tools Options 7. Specify a user below from the administrator group who will be performing updates on unmanaged system. We have specified Administrator itself as the user here who would be updating the policies on the unmanaged system as described in section Failure to have this option set in the policy will not allow you to make future changes on the unmanaged system 9. Press OK How To Setup An Unmanaged SCSP Agent Page 9 11 April 2013

10. On the policy editor home screen, click apply and save the policy with an updated revision number (see below) 11. The prevention policy is now created for the unmanaged system.

10 10. On the policy editor home screen, click apply and save the policy with an updated revision number (see below) 11. The prevention policy is now created for the unmanaged system. We will also refer to this policy as the base unmanaged prevention policy CREATING DETECTION POLICIES ON THE MANAGED TEST SYSTEM 1. The out of the box detection policies are ready to use as per Symantec standards and can be deployed without any edits on an unmanaged system. How To Setup An Unmanaged SCSP Agent Page April 2013

11 5.1 CREATING CONFIGURATIONS ON THE MANAGED TEST SYSTEM 1. By default as part of the agent installation, the installer lays down default configuration settings (see below) 2. We will be editing these default configurations to prepare your unmanaged package. How To Setup An Unmanaged SCSP Agent Page April 2013

12 5.1.1 CREATING PREVENTION CONFIGURATIONS ON THE MANAGED TEST SYSTEM 1. In the Configs > Prevention Screen, Right click on Default Common & Prevention Parameters and save a copy of the configs as Unmanaged Default Prevention Parameters and Unmanaged Common Parameters. (see below) 2. Double click on Unmanaged Default Prevention Parameters How To Setup An Unmanaged SCSP Agent Page April 2013

13 a. In the General tab Set Revision to 2 b. In the Log Rules tab Press Remove Rule Button and Delete all log rules as shown below. This ensures that no events are transferred up to the Management Server. c. Press Apply and Save the Config CREATING COMMON CONFIGURATIONS ON THE MANAGED TEST SYSTEM 1. Under Configs > Prevention Screen, Double click on Unmanaged Common Parameters How To Setup An Unmanaged SCSP Agent Page April 2013

14 a. In the General tab Set Revision to 2 b. In the Logging tab Check mark Enable Log Rotation c. In the Logging tab size set to 10 MB. This is the default size and can be changed to something else based on your preference/system specification. d. In the Logging tab uncheck Enable Bulk Log Transfer. e. In the Logging tab uncheck Delete Log Files After Processing f. In the Logging Tab Set % values to Stop Logging and Restart Logging Disk Usage Settings to something that fits the unmanaged system specification. This is something to consider as the logs will be stored on the system and not unloaded to the server. 2. Press Apply and Save the Config How To Setup An Unmanaged SCSP Agent Page April 2013

15 5.1.3 CREATING DETECTION CONFIGURATIONS ON THE MANAGED TEST SYSTEM 1. In the Configs > Detection Screen, Right click on Default Detection Parameters and save a copy of the config as UnManaged Default Detection Parameters. (see below) 2. Double click on Unmanaged Default Detection Parameters How To Setup An Unmanaged SCSP Agent Page April 2013

16 a. In the General tab Set Revision to 2 b. In the Log Rules tab Press Remove Rule Button and Delete all log rules as shown below. This ensures that no events are transferred up to the Management Server. 3. Press Apply and Save the Config. 4. All the policies and configs have now been created on the managed test system. It is recommended to save the current state as a Base Snapshot on both virtual machines. How To Setup An Unmanaged SCSP Agent Page April 2013

6.1 APPLYING POLICIES ON THE MANAGED TEST SYSTEM 6.1.1 APPLYING PREVENTION POLICIES ON THE MANAGED TEST SYSTEM 1.

17 6.1 APPLYING POLICIES ON THE MANAGED TEST SYSTEM APPLYING PREVENTION POLICIES ON THE MANAGED TEST SYSTEM 1. In the management console, under the asset > prevention screen, Right click on the managed agent and select > Apply Policy 2. Select Unmanaged_Agent_Policy. 3. Press Finish. How To Setup An Unmanaged SCSP Agent Page April 2013

18 6.1.2 APPLYING DETECTION POLICIES ON THE MANAGED TEST SYSTEM 1. In the management console, under the asset > detection screen, Right click on the managed agent and select > Apply Policy. 2. Select CSP_Agent_Status and Windows_Baseline_Detection policy (see below) 3. Press Finish How To Setup An Unmanaged SCSP Agent Page April 2013

19 7.1 APPLYING CONFIGURATIONS ON THE MANAGED TEST SYSTEM APPLYING PREVENTION CONFIGURATIONS ON THE MANAGED TEST SYSTEM 1. Right Click the Agent in the Asset > Prevention > Configuration Screen (see below) and click on apply config. How To Setup An Unmanaged SCSP Agent Page April 2013

20 2. Select the Unmanaged Default Prevention Paramaters r2 (see below) 3. Press Finish. How To Setup An Unmanaged SCSP Agent Page April 2013

21 7.1.1 APPLYING COMMON CONFIGURATIONS ON THE MANAGED TEST SYSTEM 1. Right click the Agent in the Asset > Prevention > Common Configuration Screen (see below) and click on apply config. How To Setup An Unmanaged SCSP Agent Page April 2013

22 2. Select the unmanaged common parameters r2 (see below) 3. Press Finish How To Setup An Unmanaged SCSP Agent Page April 2013

23 4. Similarly, Right click the Agent in the Asset > Detection > Configuration Screen (see below) and click on apply config. How To Setup An Unmanaged SCSP Agent Page April 2013

24 5. Select the unmanaged default detection parameters r2 (see below) 6. Press Finish. 7. Create another snapshot on Virtual Machine B (Managed Agent VM) as Applied Unmanaged Policies and Configs. How To Setup An Unmanaged SCSP Agent Page April 2013

$Now that all the policies and configurations have been deployed, we will finally prepare a package called c:\unmanaged_package on Virtual Machine B (Managed Agent VM) where agent is installed. 2.$

25 8.1 PREPARING THE UNMANAGED PACKAGE ON THE MANAGED TEST SYSTEM 1. Now that all the policies and configurations have been deployed, we will finally prepare a package called c:\unmanaged_package on Virtual Machine B (Managed Agent VM) where agent is installed. 2. Create a folder c:\unmananged_package on the test system. 3. Manually create following sub directories c:\unmanaged_package\ids\system 4. Manually create following sub directories c:\unmanaged_package\ips\driver 5. Manually create following sub directories c:\unmanaged_package\ips\bin 6. Go to IPS\driver\ and copy SCSPnnnnnnn.sbp.zip files to unmanaged_package\ips\driver folder 7. The Prevention policy file is the one whose number matches the.trans and.conf files (note -copy the.zip, not the.trans or.conf files). 8. Rename the copied prevention policy file (SCSP sbp.zip in the example above) to unmanaged_prevention_policy.sbp.zip in the unmanaged package. 9. The Detection policy file is the one without matching.trans and.conf files 10. Rename the copied detection policy file (SCSP sbp.zip in the example above) to unmanaged_detection_policy.sbp.zip in the unmanaged package. How To Setup An Unmanaged SCSP Agent Page April 2013

26 11. Go back to the management console (Virtual Machine A) and under the asset > prevention screen, right click on the agent and press apply policy (see below) How To Setup An Unmanaged SCSP Agent Page April 2013

27 12. Select the Null Policy (sym_win_null_sbp) for Windows (see below) 13. The current Unmanaged_Agent_Policy has self-protection turned on. It will not let you copy and edit the current policy and config files needed to build the unmanaged package. Hence it s necessary to apply the null policy at this stage. How To Setup An Unmanaged SCSP Agent Page April 2013

28 14. In the management console, under the asset > detection screen, Right click on the managed agent and select > Clear Policy. 15. Select CSP_Agent_Diagnostics, CSP_Agent_Status and Windows_Baseline_Detection policy (see below) 16. Press OK. 17. Go back to Virtual Machine B (Managed Agent VM) where the agent is installed. 18. On the command prompt type, a. net stop sisipsservice. This will stop the IPS Service b. net stop sisidsservice. This will stop the IDS Service c. net stop sisipsutil. This will stop the Utility Service 19. Open Windows Explorer and go to the folder where agent is installed on test system. The default install location is C:\Program Files Symantec\Critical System Protection\Agent for a 32 bit system. For a 64 bit system, the default install location is C:\Program Files(x86)\Symantec\Critical System Protection\Agent 20. Copy all files from IDS\system\ to unmanaged_package\ids\system. 21. Copy IPS\agent.ini and fallback.ini to unmanaged_package\ips 22. Edit the copied unmanaged_package\ips\agent.ini and unmanaged_package\ips\fallback.ini with the following entries a. Under [Agent] section set agent.http.url= server.list= b. Under [Polling] section set polling.enabled=false polling.interval= c. Under [TCP] section set How To Setup An Unmanaged SCSP Agent Page April 2013

29 tcp.enabled=false tcp.port=2222 d. Under [Driver] section set plus.policy.file= <InstalledLocation>/Agent/IPS/driver/unmanaged_prevention_policy.sbp.zip policy.name= policy.id= policy.path= e. Under [IDS] section set ids.plus.policy.file=<installedlocation>agent/ips/driver/ unmanaged_detection_policy.sbp.zip f. In the [Checksum] section set "agentini.checksum=not Computed" (without quotes). 23. Copy agent.exe from the CDImage to C:\unmanaged_package\agent.exe a. Copy C:\<InstalledLocation>\Symantec\Critical System Protection\Server\agent-cert.ssl file to C:\unmanaged_package\agent.cert.ssl b. Copy the unmanaged package to a USB stick (say D:\) 24. The package has now been created on the Managed Agent VM. It is recommended to save the current state as a Base Snapshot Created Package on Virtual Machine B (Managed Agent VM) How To Setup An Unmanaged SCSP Agent Page April 2013

30 9.1 DEPLOYING THE UNMANAGED PACKAGE ON THE UNMANAGED SYSTEM. 1. Install the agent with default installation settings and values on the unmanaged system. You would need a certificate to install the agent. This can be obtained from the unmanaged package. Please make sure the management server IP during agent installation is set to Once the installation is complete, you will be prompted to reboot the machine as IPS is enabled by default during agent installation. Say Yes. 3. After reboot, Right click on the command prompt and select Run as Administrator, then type, a. net stop sisipsservice. This will stop the IPS Service b. net stop sisidsservice This will stop the IDS Service c. net stop sisipsutil This will stop the Utility Service 4. Copy all files \unmanaged_package\ IDS\system to <InstalledLocation>\Agent\IDS\system 5. Copy all files \unmanaged_package\ips\driver to <InstalledLocation>\Agent\IPS\driver 6. Copy all files \unmanaged_package\ips to <InstalledLocation>\Agent\IPS 7. To translate the new IDS policies, type translate.exe ids c:\<installedlocation>\agent\ips\driver\unmanaged_detection_policy.sbp.zip c:\<installedlocation>\agent\ids\system a. The translate command will create new/replace existing Windows_Baseline_Detection.pol and CSP_Agent_Status.pol files in the Agent\IDS\system directory. Please ensure that they are created with a timestamp that closely matches the translated time. b. When the IDS service starts, it will pick up the new IDS policies. 8. On the command prompt type, a. net start sisipsservice. This will start the IPS Service b. net start sisidsservice This will start the IDS Service c. net start sisipsutil This will start the Utility Service How To Setup An Unmanaged SCSP Agent Page April 2013

$conf files in <InstalledLocation>\Agent\IPS\driver directory (see below) 10. The unmanaged agent has been successfully deployed. 11. Please open agent.ini file under c:\<installedlocation>\agent\ips.$

31 9. SISIPSService upon startup will translate unmanaged_prevention_policy.sbp.zip files and create unmanaged_prevention_policy.trans and unmanaged_prevention_policy.conf files in <InstalledLocation>\Agent\IPS\driver directory (see below) 10. The unmanaged agent has been successfully deployed. 11. Please open agent.ini file under c:\<installedlocation>\agent\ips. You should get Access Denied message. This ensures that prevention policy is in place and protection has been enforced. How To Setup An Unmanaged SCSP Agent Page April 2013

32 10.1 PERFORMING POLICY UPDATES ON THE UNMANAGED SYSTEM 1. In this section, we will guide you on how to apply a new IPS and IDS policy to the unmanaged agent 2. To prepare your new prevention policies, it is mandatory that you start with the base unmanaged policy as described in section On Page 9 of this document, we have a granted a user from the administrators group in this policy to run the sisipsconfig tool. If you don t specify a user you will not be allowed to perform changes/updates to the unmanaged system. 3. On the unmanaged system, Right click on the command prompt and select Run as Administrator, then type, a. sisipsconfig r without quotes. This will load the null policy, disable protection and allow you to update to newer policies b. Check <InstalledLocation>Agent\scsplog\SISIDSEvents.csv log file for events such as i. MSTP,322, :23: Z-0700,I,,,BUILTIN,,0,,,,Driver,,S,,,,,,,Reloaded the BUILTIN policy ii. MSTP,323, :23: Z-0700,I,,,BUILTIN,,0,,,,Driver,,S,,,,,,,"Policy pl_builtin&sep1;version 1.0" iii. MSTA,0, :23: Z- 0700,C,80,IS,abf8a19eb46d695c03e31ed55e814f4c,10303,,,,,AgentConfigTool,,S,,,,,,,Succes sfully reset policy to builtin. 4. Replace the older policy files (*.sbp.zip) in <InstalledLocation>\Agent\IPS\driver with the newer ones from the unmanaged package\ips\driver keeping the newer policy names as mentioned below. a. If your new prevention policy file name is SCSP sbp.zip, rename it to unmanaged_prevention_policy.sbp.zip and copy it in <InstalledLocation>\Agent\IPS\driver. b. If your new detection policy file name is SCSP sbp.zip, rename it to unmanaged_detection_policy.sbp.zip and copy it in <InstalledLocation>\Agent\IPS\driver. c. Do not delete the existing trans and conf files. 5. On the command prompt, type net stop sisidsservice without quotes. 6. To translate the new IDS policies, On the command prompt, type translate.exe ids c:\ <InstalledLocation>\Agent\IPS\driver\unmanaged_detection_policy.sbp.zip c:\<installedlocation>\agent\ids\system How To Setup An Unmanaged SCSP Agent Page April 2013

$a. The translate command will create new/replace existing Windows_Baseline_Detection.pol and CSP_Agent_Status.pol files in the Agent\IDS\system directory.$

33 a. The translate command will create new/replace existing Windows_Baseline_Detection.pol and CSP_Agent_Status.pol files in the Agent\IDS\system directory. Please ensure that they are created with a timestamp that closely matches the translated time. b. When the IDS service starts, it will pick up the new IDS policies. 7. On the command prompt, type net start sisidsservice without quotes. This will load the new IDS policies in memory. 8. Type sisipsconfig s without quotes. If you get an error Could not set policy to most recent policy, you probably deleted the existing trans and conf files. 9. Type sisipsconfig n without quotes. This command will retranslate the newer IPS policies. a. Check <InstalledLocation>Agent\scsplog\SISIDSEvents.csv log file for events such as How To Setup An Unmanaged SCSP Agent Page April 2013

i. MSTP,98,2013-03-19 20:46:40.406 Z- 0700,I,,,abf8a19eb46d695c03e31ed55e814f4c,,0,,,,Driver,,S,,,,,,,"Policy Unmanaged_prevention_policy&sep1;version 471" ii. MSTA,9,2013-03-19 20:46:40.

34 i. MSTP,98, :46: Z- 0700,I,,,abf8a19eb46d695c03e31ed55e814f4c,,0,,,,Driver,,S,,,,,,,"Policy Unmanaged_prevention_policy&sep1;version 471" ii. MSTA,9, :46: Z- 0700,I,19,IS,abf8a19eb46d695c03e31ed55e814f4c,10125,,,,,UpdateThread,,S,,Configuration Update,,,,,Successfully updated the policy to Unmanaged_prevention_policy 471 iii. If you don t get the above two events then on the command prompt re-execute sisipsconfig r, sisipsconfig s and sisipsconfig n in a sequence (see below) 10. Please note that all of the above steps need to be executed in a sequence as listed. 11. Once done, you have successfully applied new IPS and IDS policies on the unmanaged system. An alternative way to deploy an IPS policy 1. Assuming that the agent is running with prevention enabled and you have created a Full Privilege user on the system and have given this user account Full Privileges in the policy. 2. Open a command window as the Full Privilege user (on XP: Start, right click on Command Prompt, and choose Run as...) 3. Copy the policy file to the IPS\Driver folder and rename it to unmanaged_prevention_policy.sbp.zip. You will be prompted to overwrite the existing unmanaged_prevention_policy.sbp.zip. Please say yes. 4. Run sisipsconfig n 5. You can verify that the policy was applied by looking at the SISIDSEvents.csv file. You should see an event similar to the one below, containing your specific policy name: 6. MSTP,132, :46: Z- 700,I,,,7d2f0353bcad693fb479a0e811b7e87e,,0,,,,Driver,,S,,,,,,,"Policy unmanaged_prevention_policy &sep1;version 483" How To Setup An Unmanaged SCSP Agent Page April 2013

Any technical information that is made available by Symantec Corporation is the copyrighted work of Symantec Corporation and is owned by Symantec Corporation. NO WARRANTY.

35 Any technical information that is made available by Symantec Corporation is the copyrighted work of Symantec Corporation and is owned by Symantec Corporation. NO WARRANTY. The technical information is being delivered to you as is and Symantec Corporation makes no warranty as to its accuracy or use. Any use of the technical documentation or the information contained herein is at the risk of the user. Documentation may include technical or other inaccuracies or typographical This document may include information about pre-release software. Any unreleased update to the product or other planned modification is subject to ongoing evaluation by Symantec and therefore subject to change. This information is provided without warranty of any kind, express or implied. Customers who purchase Symantec products should make their purchase decision based upon features that are currently available. How To Setup An Unmanaged SCSP Agent Page April 2013

Configure Windows Server 2003 Release 2 Server Network File Share (NFS) as an authenticated storage repository for XenServer

Summary This document outlines the process to perform the following tasks. 1. Configure Windows Server 2003 Release 2 Server Network File Share (NFS) as an authenticated storage repository for XenServer.