McAfee. Deployment and User Guide. epo 4 / Endpoint Encryption

Transcription

1 McAfee Deployment and User Guide epo 4 / Endpoint Encryption 1

2 McAfee, Inc. McAfee, Inc Freedom Circle, Santa Clara, CA 95054, USA Tel: (+1) For more information regarding local McAfee representatives please contact your local McAfee office, or visit: COPYRIGHT Copyright 2008 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FLASHBOX, FOUNDSTONE, GROUPSHIELD, HERCULES, INTRUSHIELD, INTRUSION INTELLIGENCE, LINUXSHIELD, MANAGED MAIL PROTECTION, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, MCAFEE.COM, NETSHIELD, PORTALSHIELD, PREVENTSYS, PROTECTION-IN-DEPTH STRATEGY, PROTECTIONPILOT, SECURE MESSAGING SERVICE, SECURITYALLIANCE, SITEADVISOR, THREATSCAN, TOTAL PROTECTION, VIREX, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. Attributions Refer to the product Release Notes.

3 Contents Preface... 4 About This Guide... 4 Audience... 4 Conventions... 4 Contact information... 4 epo Endpoint Encryption Deployment and Reporting... 6 Endpoint Encryption Integration to epolicy Orchestrator... 6 The Endpoint Encryption Reports... 6 Setting up Deployment and Reporting in epolicy Orchestrator... 7 Location of the files on the CD... 7 Endpoint Encryption Install Sets... 8 Summary... 8 Gather the files to prepare the Pkgcatalog.z file... 9 Edit the Pkgcatalog.xml file... 9 Create the pkgcatalog.z file using eposign.exe Create the deployment zip file and check it in Create the deployment task Running Reports Endpoint Encryption for Files and Folders Reports Endpoint Encryption for PC Adding the reports to the Dashboard... 14

4 Preface Preface About This Guide This guide provides information on configuring Endpoint Encryption deployment and reporting through the epolicy Orchestrator. Audience This information is intended primarily for network administrators who are responsible for their company s security program, and assumes the customer has used epolicy Orchestrator. Conventions This guide uses the following conventions: Bold Condensed All words from the interface, including options, menus, buttons, and dialog box names. Courier The path of a folder or program; text that represents something the user types exactly (for example, a command at the system prompt). Italic Emphasis or introduction of a new term; names of product manuals. Blue A web address (URL); a live link. Note Supplemental information; for example, an alternate method of executing the same command. Caution Important advice to protect your computer system, enterprise, software installation, or data. Contact information Download Site Product Upgrades (Valid grant number required) Security Updates (DATs, engine) HotFix and Patch Releases For Security Vulnerabilities (Available to the public) For Products (ServicePortal account and valid grant number required) Product Evaluation McAfee Beta Program Technical Support KnowledgeBase Search McAfee Technical Support ServicePortal (Logon credentials required) Customer Service Web 4

5 Preface Phone US, Canada, and Latin America toll-free: VIRUS NOor Monday Friday, 8 a.m. 8 p.m., Central Time Professional Services Enterprise Small and Medium Business 5

6 epo Endpoint Encryption Deployment and Reporting Endpoint Encryption Integration to epolicy Orchestrator Version 4 of epolicy Orchestrator allows the administrator to deploy Endpoint Encryption for Files and Folders and Endpoint Encryption for PC. It also includes the ability to report the encryption status of machines that have Endpoint Encryption installed. WARNING: The epolicy Orchestrator is not compatible with versions 4.x of Endpoint Encryption (formerly SafeBoot). The Endpoint Encryption Reports Endpoint Encryption for Files and Folders (EEFF) Version Check This report will check each machine and report on whether or not Endpoint Encryption for Files and Folders is installed. The report also displays which version is running. Endpoint Encryption for PC (EEPC) Installed Version This report will check each machine and report on whether or not Endpoint Encryption for PC is installed. The report also displays the Endpoint Encryption for PC version and whether or not the client is active (running). Summary This report checks all machines and their encryption status, e.g. is the machine fully encrypted (i.e. are all drives fully encrypted). It also displays the number of drives in an each encrypted state, e.g. full encryption, partially encrypted, in progress and not encrypted. * NOTE: The In Progress status indicates a machine that is in the process of either decrypting, or, encrypting. 6

7 Drive Check This report lists all machines that have Endpoint Encryption for PC installed including the encryption status of each drive. It also reports on machines that do not have EEPC installed by placing Unknown in the Drive and Encryption columns. Setting up Deployment and Reporting in epolicy Orchestrator This section explains how to configure deployment and reporting of Endpoint Encryption on the epolicy Orchestrator. Follow these steps whether you are deploying or reporting on either Endpoint Encryption for Files and Folders or Endpoint Encryption for PC. Location of the files on the CD The reporting configuration files The sbde5.zip and sbce3.zip files contain the report configuration for Endpoint Encryption for PC (sbde5) and Endpoint Encryption for Files and Folders (sbce3) respectively. They are located on the CD at the following locations: EPO\Endpoint Encryption for Files and Folders\EPO4\Sbce3.zip EPO\Endpoint Encryption for PC\EPO4\Sbde5.zip Installing the extensions To run the Endpoint Encryption reports you must first install the extensions (the reporting zip files). 1. From the epolicy Orchestrator Console, click the Configuration button. 2. Click the Extensions button on the toolbar. 3. Click the Install Extension option at the bottom left of the console. 4. Click the Browse button and locate the zip file. 5. Select the file and click Open. 6. Click the Ok button to install the extension. Files required to build the pkgcatalog.z file The paths below contain the files on the CD required to build the pkgcatalog.z file. 7

8 Endpoint Encryption for Files and Folders Files Use these files to configure deployment and reporting for Endpoint Encryption for Files and Folders: \epo\endpoint Encryption for Files and Folders\Package folder contains the ce-detect.mcs, the pkgcatalog.xml and the eposign.exe files. Endpoint Encryption for PC Files Use these files to configure deployment and reporting for Endpoint Encryption for PC: \epo\endpoint Encryption for PC\Package folder contains the dedetect.mcs, the pkgcatalog.xml and the eposign.exe files. Endpoint Encryption Install Sets Before completing your Endpoint Encryption install set you must ensure that the Perform installation silently and Automatically restart machine options are checked. If they are not then the install to the client machine will fail. See the Create Installation Set screenshot below. Figure 1 The Endpoint Encryption Create Installation Set screenshot Summary 1. Ensure the report configuration files have been installed. 2. Prepare the Endpoint Encryption install set. 3. Gather the files to prepare the pkgcatalog.z file. 4. Edit the pkgcatalog.xml file. 5. Create the pkgcatalog.z file using eposign.exe. 6. Create the deployment zip file and check it in. 8

9 7. Verify the Endpoint Encryption deployment zip file has been checked in. 8. Create the deployment task. Gather the files to prepare the Pkgcatalog.z file Follow these steps to consolidate the necessary files into the epolicy Orchestrator deployment format. You will require the following files: Eposign.exe pkgcatalog.xml Detection scripts (ce-detect.mcs - Endpoint Encryption for Files and Folders or de-detect.mcs Endpoint Encryption for PC) Endpoint Encryption Install set, e.g. SBDE.exe (Filename determined by Administrator) 1. Create the install set from the Endpoint Encryption Manager. Refer to the Endpoint Encryption for Files and Folders Administration Guide or the Endpoint Encryption for PC Administration Guide for further details. 2. Create a folder on the server c:\ drive and call it Deployment. The Deployment folder becomes a working directory and contains subsequent Endpoint Encryption packages that you create. You may create this directory in a location of your choice and name it as you wish. This guide uses the example of the c:\deployment. NOTE: Each package created should be unique and must not overwrite the existing version. The Deployment folder should therefore contain a uniquely named sub folder for each package, e.g. 0001, 0002, Package1 or Package2, etc. The example used here is Copy the eposign.exe file from the CD, to the Deployment folder on the c:\ drive. 4. Create a new subfolder within the Deployment folder, e.g Copy the pkgcatalog.xml and detection scripts from the CD, to the Deployment subfolder, e.g. \Deployment\ Copy the Endpoint Encryption install set to the \Deployment\0001 subfolder. Edit the Pkgcatalog.xml file Follow these steps to edit the pkgcatalog.xml file: NOTE: You must add the unique code to the <ProductID> </ProductID> line in the file. In this example, it is 0001; however, you could name it anything within the four character limit. See the Endpoint Encryption for Files and Folders pkgcatalog.xml example below. 9

10 Finally, keep the product names <ProductName> </ProductName> in the XML file a minimal length. If they are too long they will push out the tables in the epolicy Orchestrator. See the example below, highlighted in yellow. You must also ensure you edit the <InstallCommand> </InstallCommand> line with the correct Endpoint Encryption install filename and include the /silent command. See the example below, highlighted in yellow. - <PkgCatalog> - <ProductPackage> <ProductID>SBCE </ProductID> <ProductName>EEFF</ProductName> <ProductDescription>0</ProductDescription> - <ProductDetection> - <DetectionScript> <Name>ce-detect.mcs</Name> </DetectionScript> <ProductVersion>3.0.0</ProductVersion> <PlatformID>WNTW:4:0:4 WNTS W2KW W2KS WXPHE WXPW WXPS WVST</PlatformID> </ProductDetection> <ConflictSoftwareList /> - <LangPackage> <Priority>1</Priority> <PackageType>Install</PackageType> <LangID>0000</LangID> <InstallType>command</InstallType> <InstallCommand>SbCe.exe /silent</installcommand> <MaxReboot>1</MaxReboot> <RebootReturnCode>0</RebootReturnCode> </LangPackage> - <Translation> <TranslationID /> - <TranslationItem> <LangID /> <TranslationString /> </TranslationItem> </Translation> </ProductPackage> </PkgCatalog> 1. Open the pkgcatalog.xml in the c:\deployment\0001 file using Notepad. 2. Edit the Product ID and add the unique number to the name, for example, if the product ID is <ProductID>SBCE 3000</ProductID> then change this to include the unique number for the package, for example, <ProductID>SBCE </ProductID>. Follow these steps with a new four-character code each time you create a package. This ensures that all future packages are unique. WARNING: You must not change the Product ID other than add the four character unique ID at the end, otherwise, reporting will fail. See the example above. 10

11 3. Edit the <InstallCommand> </InstallCommand> line with the file name of the Endpoint Encryption install set and include the /silent command, otherwise the install will fail. NOTE: you can also edit the product name from Endpoint Encryption for Files and Folders to EEFF for Sales depending on who the deployment is targeted at, for example. This name will appear on the epolicy Orchestrator and will help identify the deployment package. 4. Save the pkgcatalog.xml file. Create the pkgcatalog.z file using eposign.exe Follow these steps to create the epolicy Orchestrator deployment format, i.e. the pkgcatalog.z file. You must run this command from a Command prompt. 1. Click on the Start option followed by Run. 2. Enter Cmd in the Open dialog box and click the Ok button. 3. Type cd \deployment at the command prompt. 4. From the c:\deployment directory enter the following Eposign command: eposign c:\deployment\0001\pkgcatalog.xml.mcs /a 5. This will take the files from the c:\deployment\0001 folder and roll them into the pkgcatalog.z file. Create the deployment zip file and check it in The deployment zip file contains the detection scripts, the pkgcatalog.xml, the Endpoint Encryption install file and the pkgcatalog.z file. 1. Create a zip file from the detection scripts, the pkgcatalog.xml, the Endpoint Encryption install file and the pkgcatalog.z file stored in the c:\deployment\0001 folder. 2. From the epolicy Orchestrator Console, click the Software button. 3. Click the Check In Package button. 4. Click the Browse button and locate the deployment zip file created at step Select the zip file and click the Open button. 6. Click the Next button. 7. Click the Save button to save check in the zip file. 11

12 Check the Endpoint Encryption files has been checked in Follow these steps to verify the Endpoint Encryption file appears in the epo Repository. 1. From the epolicy Orchestrator Console click on the Software button. This will display the contents of the master repository. 2. Scroll down the list to verify the Endpoint Encryption file is there. Create the deployment task 1. From the epolicy Orchestrator Console, click the Systems button. 2. Click the Client Tasks option. 3. Click New Task. This will start the Client Task Builder screen. 4. Enter a name and description (optional) for the task. 5. Select the Product Deployment (McAfee Agent) as the Type. 6. Click Next to continue. 7. From the Configuration window select the target platform and product to be deployed. 8. Click Next to continue. 9. Set your required schedule options for this deployment. 10. Ensure the Enable option is checked. NOTE: this task will run at the next agent server communication for the relevant agents. If you wish to run the task sooner, then click the Schedule type and select Run immediately. WARNING: To complete the installation, all Endpoint Encryption products require a reboot when deployed. If CE and DE are deployed simultaneously, when one product reboots, the CMA may forget what it was doing; this will result in the second product not being deployed until the deployment task runs again. Therefore, all deployment tasks involving Endpoint Encryption products should be set to run on a regular basis. 11. Click the Next button to continue. 12. Click the Save button to save this deployment task or choose the Back button to change the Schedule, Configuration or Description. 12

13 Running Reports epo Endpoint Encryption Deployment and Reporting Endpoint Encryption for Files and Folders Reports Installed Version This report will check each machine and report on whether or not Endpoint Encryption for Files and Folders is installed. It also displays which version is running. 1. Click the Reporting button from the main toolbar. 2. Click EEFF Installed Version from the left hand Queries menu. 3. Click the Run button. The report will appear as a pie chart. Click on the pie chart to view the detail of this report. Endpoint Encryption for PC Installed Version This report will check each machine and report on whether or not Endpoint Encryption for PC is installed. It also displays the Endpoint Encryption for PC version and whether (or not) the client is active (running). 1. Click the Reporting button from the main toolbar. 2. Click EEPC Installed Version from the left hand Queries menu. 3. Click the Run button. The report will appear as a pie chart. Click on the pie chart to view the detail of this report Summary This report checks all machines and their encryption status, e.g. is the machine fully encrypted (i.e. are all drives fully encrypted). It also displays the number of drives in an each encrypted state, e.g. full encryption, partially encrypted, in progress* and not encrypted. * NOTE: The In Progress status indicates a machine that is in the process of either decrypting, or, encrypting. 1. Click the Reporting button from the main toolbar. 2. Click EEPC Install Summary from the left hand Queries menu. 3. Click the Run button. The report will appear as a pie chart. Click on the pie chart to view the detail of this report. 13

14 Drive Check This report lists all machines that have Endpoint Encryption for PC installed including the encryption status of each drive. It also reports on machines that do not have DE installed by placing Unknown in the Drive and Encryption columns. 1. Click the Reporting button from the main toolbar. 2. Click EEPC Drive Check from the left hand Queries menu. 3. Click the Run button. The report will appear as a pie chart. Click on the pie chart to view the detail of this report. Adding the reports to the Dashboard Version 4.0 of epolicy Orchestrator allows the administrator to report on the status of Endpoint Encryption for Files and Folders and Endpoint Encryption for PC. These admin reports can be made accessible from the Dashboard option. Note: You must have installed the reporting extensions to complete this procedure. See Installing the extensions. Add them as buttons on the Dashboard toolbar: 1. Select the Dashboard option. 2. Click the Options drop down button. 3. Select the Manage Dashboards option. 4. Click the report from the My Dashboards left hand column, e.g. Endpoint Encryption for Files and Folders or Endpoint Encryption for PC. 5. Click the Make Active button (bottom right). This will add the report to the Dashboard toolbar. 14

15 Figure 2 The Dashboard with Endpoint Encryption Reports for PC WARNING: The epolicy Orchestrator is not compatible with versions 4.x of Endpoint Encryption (formerly SafeBoot). 15