Image or Clone a Computer with FireAMP Connector Installed

Transcription

1 Image or Clone a Computer with FireAMP Connector Installed Contents Introduction Prerequisites Requirements Components Used Pre-Installation - Versions and higher Post-Installation - Versions and higher Pre-Installation - Versions lower than 4.1 Post-Installation - Versions lower than 4.1 Introduction This document describes the processes to prevent multiple computers to attempt the use of same Globally Unique Identifier (GUID), which prevents duplicate computer objects to appear in FireAMP cloud dashboard. This process allows FireAMP to work properly on a cloned machine. As a System Administrator, you may want to include the FireAMP connector on your master Windows PC images. FireAMP, however, requires that systems can be uniquely identified. The general steps for cloning a machine for Linux is at the bottom of this article. Note: The first set of instructions applies to FireAMP version or higher. Further you find the original steps for machines running earlier versions. Prerequisites Requirements There are no specific requirements for this document. Components Used This document is not restricted to specific software and hardware versions. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command. Pre-Installation - Versions and higher

2 Perform these steps to prepare a computer for imaging: Step 1. Install FireAMP on your master image. FireAMPSetup.exe /S Step 2. Stop the FireAMP service. wmic service where "name like '%%i%%m%%.%%.%%'" call stopservice Use the following command if you have connector protection enabled. The password will be visible in the command prompt. 4.2 and Lower: Not Available 4.3 to 5.0: "%PROGRAMFILES%\Sourcefire\fireAMP\X.X.X\sfc.exe" -k protectionpassword 5.1 and Above: "%PROGRAMFILES%\Cisco\AMP\X.X.X\sfc.exe" -k protectionpassword

3 Note: If the FireAMP service is started again, master image regenerates local.xml. You need to repeat these steps to neutralize the master image again. Be sure to include these steps in your master image preparation process. Step 3. Delete local.xml. 5.0 and Lower: del "%PROGRAMFILES%\Sourcefire\fireAMP\local.xml" 5.1 and Above: del "%PROGRAMFILES%\Cisco\AMP\local.xml" Step 4. Create a blank local.xml file. 5.0 and Lower: echo ^<config^>^</config^> > "%PROGRAMFILES%\Sourcefire\fireAMP\local.xml" 5.1 and Above: echo ^<config^>^</config^> > "%PROGRAMFILES%\Cisco\AMP\local.xml"

4 Post-Installation - Versions and higher FireAMP and higher automatically generates a new regisration and Universal Unique Identifier (UUID) when the connector service detects a blank local.xml file. No more steps need to be performed on the machine itself. Note: It is expected that machines that register with a blank local.xml file is placed into your organizations' default group. You must decide whether you want to move these machines manually or change your default group to be the desired group for those machines. At this point the FireAMP client should be up and running. You can use the user interface to verify the connectivity and that the service is running. If your user interface is not set to start, it can be manually started with these command. Be sure to update the version number for your currently installed version. 5.0 and Lower: "%PROGRAMFILES%\Sourcefire\fireAMP\X.X.X\iptray.exe" -f 5.1 and Above: "%PROGRAMFILES%\Cisco\AMP\X.X.X\iptray.exe" -f

5 Pre-Installation - Versions lower than 4.1 Perform these steps to prepare a computer for imaging: Step 1. Install FireAMP on your master image. FireAMPSetup.exe /S Step 2. Stop the FireAMP service. Note: If you use a connector protection password, this needs to be done from the user interface.

6 wmic service where "name like '%%i%%m%%.%%.%%'" call stopservice Step 3. Determine the location of the fireamp product. The default is %PROGRAMFILES%\Sourcefire\fireAMP Step 4. Uninstall the FireAMP Connector Service from the Control Panel by running sfc.exe -u from the version folder. Be sure to update the command with your currently installed version number. %PROGRAMFILES%\Sourcefire\fireAMP\4.X.X\sfc.exe -u Step 5. If you want to reuse the existing computer object, you must backup the existing local.xml file. The local.xml is found in this directory: %PROGRAMFILES%\Sourcefire\fireAMP\ Note: This is ideal for individual reimage but may not be practical for one-to-many imaging practices as it stores unique information, such as GUID of a single computer. Step 6. After you back up local.xml or if you do not need to reuse the computer object in your dashboard, delete local.xml, as shown in the image: del local.xml Post-Installation - Versions lower than 4.1 Perform these steps after deploying your image: Note: If you start the FireAMP service with the generic local.xml file, it creates a new computer object. If you have the original local.xml file, you can restore them per computer to have the object reused. Step 1. Restore the local.xml file to this directory at this time if you backed it up prior to

7 reimaging. If you do not restore a local.xml file, you must still create a generic one for the connector to register correctly. echo ^<config^>^</config^> > "%PROGRAMFILES%\Sourcefire\fireAMP\local.xml" Step 2. Register the Connector with the service by running sfc -r from the version folder. This step completes the local.xml file for a computer. Be sure to update the below commands with your currently installed version number. %PROGRAMFILES%\Sourcefire\fireAMP\4.X.X\sfc.exe -r Install the Connector to the Services Control Panel by running sfc.exe -i from the version folder.

8 %PROGRAMFILES%\Sourcefire\fireAMP\4.X.X\sfc.exe -i Start the Connector by running the command: wmic service where "name like '%%i%%m%%.%%.%%'" call startservice Note: It is expected that the machines which are manually registered in this way are placed into your organizations' default group. You must decide whether you want to move these machines manually or change your default group to be the desired group for those machines. At this point the FireAMP client should be up and running. You can use the user interface to verify the connectivity and that the service is running. If your user interface is not set to start, it can be manually started with the below command. Be sure to update the version number for your currently installed version. "%PROGRAMFILES%\Sourcefire\fireAMP\4.X.X\iptray.exe" -f

9 Linux The general steps for cloning a machine for Linux and have a new identity is similar to Windows. Here are the steps and commands: Install AMP on your master image $ (sudo) yum install filename.rpm Stop the AMP service $ (sudo) initctl stop cisco-amp Delete local.xml $ (sudo) rm /opt/cisco/amp/etc/local.xml When a different machine boots up with the cloned image, the AMP service will automatically start up and generate a new identity. It must be unique across all communicating connectors in a group in the cloud [whether public, or private].