Release Notes Revision A McAfee Data Loss Prevention 9.3.1 Contents About this release Enhancements Resolved issues Installation instructions Known issues Find product documentation About this release Thank you for choosing McAfee Data Loss Prevention (McAfee DLP). This document contains important information about the current release. We strongly recommend that you read the entire document. McAfee DLP version 9.3.1 introduces feature enhancements and resolves issues present in the previous release. You must have version 9.2.0 or later installed on your target system before installing version 9.3.1. Version 9.3.1 does not support coexistence with previous versions; therefore, in a managed environment, all appliances must be upgraded to version 9.3.1 at the same time. For virtual appliance installation instructions, see the McAfee Data Loss Prevention Virtual Appliance Installation Guide. Supported McAfee DLP products This release supports these McAfee DLP product versions: McAfee Data Loss Prevention Manager 9.3.1 McAfee Data Loss Prevention Monitor 9.3.1 McAfee Data Loss Prevention Discover 9.3.1 McAfee Data Loss Prevention Prevent 9.3.1 McAfee Data Loss Prevention Endpoint Agent 9.3.0.637 or 9.3.100.52 1
These host extensions are supported: 9.3.1.4 For use with a unified McAfee DLP policy 9.3.0.617 or 9.3.100.72 For use only with incident management in McAfee epolicy Orchestrator (epolicy Orchestrator) These extensions are compatible with epolicy Orchestrator versions 4.5, 4.6, and 5.0. Supported systems The following platform versions and operating systems are supported: McAfee DLP 4400/5500 appliances McAfee Linux Operating System 1.1.5 (McafeeNDLPmlos-1.1.5-1.x86_64.rpm) McAfee DLP 1650/3650 appliances Fedora-3 Linux Operating System Virtual appliances VMware vsphere ESX 4.x, ESXi 5.x Compatible McAfee point products The following McAfee product versions were tested for compatibility with McAfee DLP 9.3.1 software: McAfee epolicy Orchestrator 4.5, 4.6, 5.0 McAfee Web Gateway 6.x, 7.x McAfee Email Gateway 7.x McAfee Logon Collector 1.x, 2.0 Supported repositories McAfee DLP Discover supports the following: Database repositories DB2 5x iseries, 6.1 iseries, 7.x 9.x Microsoft SQL Server 2000, 2005, 2008, 7.0, MSDE 2000, 2012 MySQL (Enterprise) 5.0.x, 5.1 Oracle 8i, 9i, 10g, 11g File systems and servers EMC Celerra 5.6 EMC Documentum 5.3, 6.0, 6.5 Microsoft SharePoint 2007, 2010, 2013 FTP HTTP/HTTPS NFS (Network File System) CIFS (Common Internet File System) Microsoft Windows Server 2003, 2008, 2008 R2 cluster Microsoft Windows XP Professional SP3 or later (32-bit) Microsoft Windows Vista SP1 or later Enterprise and Business editions (32-bit) Microsoft Windows 7 SP1 or later (32- and 64-bit) NetApp 7.2, 7.3 Supported browsers McAfee DLP supports the following third-party browsers. These versions were tested for compatibility with the software: 2
Microsoft Internet Explorer 7, 8, 9, 10 Mozilla Firefox 17 and earlier Supported languages In scanned content, McAfee DLP supports the following languages: English Italian Chinese (Traditional) Japanese Chinese (Simplified) Korean Hebrew Russian Arabic Dutch French Greek German Hungarian Spanish Czech Portuguese Turkish Enhancements This release includes these enhancements. McAfee DLP Discover scans Microsoft SQL Server 2012 and Microsoft SharePoint 2013 are supported. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the release notes for the specific release. Concepts Resolves an issue where regular expressions were not correctly validating when using hexadecimal ASCII characters (906575) Updates support for Social Security number changes per the U.S. Social Security Administration (911813) Incidents and cases Resolves an issue where set permissions did not appear on the Case Permissions page (874638) Resolves an issue where incidents containing an email message with Big5 encoding appeared correctly only if Content-Type was set in the email headers (875442) Resolves an issue where users could not edit an incident view they created if their user name started with a capital letter (906076) Resolves an issue where an Active Directory user could not be assigned as an incident reviewer (906969) 3
Resolves an issue where an exported incident report in PDF format would not print in the correct orientation (911334) Corrects an error when viewing details on incidents where there is a special character, such as the ampersand (&), in the LDAP user or group name (913220) Policies and rules Resolves an issue where web pages were incorrectly blocked due to HTTP POST requests, causing URL exceptions to be ignored (881050) Removes the 14 KB size limitation for rule instantiation that prevented large rules from completely loading (884119) Resolves an issue where a rule match count was not correctly displayed if the source or destination condition of the rule was set to an email address (905540) Other Resolves an issue where a Microsoft Windows 2008 R2 share could not be configured as the evidence server (909454) Adds support for configuring the eth2 interface as the capture interface on a McAfee DLP Monitor virtual installation (910649) Adds support for using the dollar sign character ($) and the grave accent (`) in the Active Directory server password (912999) Installation instructions Install or upgrade your appliance to version 9.3.1. Tasks Install a new image on 4400 or 5500 appliances on page 4 Install a new image on the primary and secondary disks. Install a new image on 1650 or 3650 appliances on page 5 To install a product on 1650 or 3650 appliances, run the platform and application scripts. Upgrade the products on 4400 or 5500 appliances on page 7 If your product is at version 9.2.0 or later, you can upgrade directly to 9.3.1. Upgrade the products on 1650 or 3650 appliances on page 8 If your product is at version 9.2.0 or later, you can upgrade directly to 9.3.1. Using destination NAT IP addresses on page 9 If destination Network Address Translation (NAT) is being performed on connections from your management computer to the McAfee DLP appliance, you must add the NAT address to the McAfee DLP appliance. Install a new image on 4400 or 5500 appliances Install a new image on the primary and secondary disks. Before you begin Download the product archive and copy it to the appliance. 4
Task 1 Using a command line session, log on to the appliance as root. The default root password is mcafee. 2 Make an installation directory. # mkdir /data/install 3 Copy the archive to the appliance. If you downloaded the archive to a Windows-based computer, use WinSCP. If you downloaded the archive to a Linux server, log on to the server and use the SCP command. scp -rp <filename> root@<name or ip address>:/data/install 4 Go to the /data/install directory. # cd /data/install 5 Extract the contents of the archive. # tar xvzf ndlp_<product>.tgz 6 Run the installation script. Before you type the command, run pwd to establish that you are in the correct product directory. You must be sure that you are running the updated scripts in the upgrade archive that you just downloaded and extracted. #./install_new_full <product>. where <product> is imanager, iguard, idiscover, or iprevent. The product image installs on the primary and secondary disks. 7 Restart the system. # reboot Restarting the system might take 10 15 minutes. 8 Log on to the appliance as root and verify the installation. If you are using the default root password, you are prompted to change the password after logging on. If the Release field contains the installed version, installation is complete. If the installation fails, do not perform the installation again. Call McAfee support and submit an installation log file. Install a new image on 1650 or 3650 appliances To install a product on 1650 or 3650 appliances, run the platform and application scripts. Before you begin Download the product archive and copy it to the appliance. 5
Task 1 Using a command line session, log on to the appliance as root. 2 Make an installation directory. # mkdir /data/install 3 Copy the archive to the appliance. If you downloaded the archive to a Windows-based computer, use WinSCP. If you downloaded the archive to a Linux server, log on to the server and use the SCP command. scp -rp <filename> root@<name or ip address>:/data/install 4 Go to the /data/install directory. # cd /data/install 5 Extract the contents of the archive. # tar jxf <product>.bz2 6 Run the platform installation script. Enter./install_platform for help on available options. #./install_platform -P <platform type> After the platform script finishes, you might be instructed to restart the system. This message can be ignored; you do not need to restart the system until after the Stingray script finishes. 7 Run the application installation script. #./install_stingray -P <platform type> When the script finishes, a message appears instructing you to reboot. 8 Restart the system. # reboot Restarting the system might take 10 15 minutes. 9 Log on to the appliance as root and verify the installation. If you are using the default root password, you are prompted to change the password after logging on. If the Release field contains the installed version, installation is complete. If the installation fails, do not perform the installation again. Call McAfee support and submit an installation log file. 6
Upgrade the products on 4400 or 5500 appliances If your product is at version 9.2.0 or later, you can upgrade directly to 9.3.1. Before you begin Download the product archive. Stop all scans and search tasks, and wait until they are completely stopped. If you are running version 9.2.0 on a McAfee DLP Manager or a standalone McAfee DLP product on a model 4400 appliance, and you want to perform a backup before upgrading, you must apply hotfix 754037_45668_01. McAfee recommends performing frequent backups. Without a backup, the data, settings, and configuration on your appliance might be lost in the event of a system failure. To upgrade a product, you must install the new image on the disk that is not used by the previous installation. This ensures that the original image can still be accessed after the upgrade is complete. The system automatically boots from the latest image. The install_to_pri and install_to_sec scripts install the upgrade. After the process runs, the existing configuration and database are copied to the new image. If you use the wrong script, you will write over your existing installation. Task 1 Using a command line session, log on to the appliance as root. 2 Make an installation directory. # mkdir /data/install 3 Copy the archive to the appliance. If you downloaded the archive to a Windows-based computer, use WinSCP. If you downloaded the archive to a Linux server, log on to the server and use the SCP command. scp -rp <filename> root@<name or ip address>:/data/install 4 Verify which version is currently installed. You must be at version 9.2.0 or later to upgrade to version 9.3.1. 5 Go to the /data/install directory. # cd /data/install 6 Extract the contents of the archive. # tar xvzf ndlp_<product>.tgz 7 Run the system_info utility to determine if the system is currently using the primary or secondary image. # /data/stingray/ksh/system_info Install the update on the disk that is not used. Example: Install the update on the secondary disk with install_to_sec if system_info returns this message: "The system is currently running <product> from the primary image." 7
8 Run the installation script. Before you type the command, run pwd to establish that you are in the correct product directory. You must be sure that you are running the updated scripts in the upgrade archive that you just downloaded and extracted. #./install_to_pri <product>. or #./install_to_sec <product>. where <product> is imanager, iguard, idiscover, or iprevent. The product image installs on the primary or secondary disk. When the upgrade is complete, a message appears stating which image the appliance will boot to next. 9 Restart the system. # reboot Restarting the system might take 10 15 minutes. 10 Log on to the appliance as root and verify the installation. If you are using the default root password, you are prompted to change the password after logging on. If the Release field contains the updated version, installation is complete. If the installation fails, do not perform the installation again. Call McAfee support and submit an installation log file. Upgrade the products on 1650 or 3650 appliances If your product is at version 9.2.0 or later, you can upgrade directly to 9.3.1. Before you begin Download the product archive and copy it to the appliance. Stop all scans and search tasks, and wait until they are completely stopped. McAfee recommends performing a backup before upgrading. Without a backup, the data, settings, and configuration on your appliance might be lost in the event of a system failure. Task 1 Using a command line session, log on to the appliance as root. 2 Make an installation directory. # mkdir /data/install 3 Copy the archive to the appliance. If you downloaded the archive to a Windows-based computer, use WinSCP. If you downloaded the archive to a Linux server, log on to the server and use the SCP command. scp -rp <filename> root@<name or ip address>:/data/install 8
4 Verify which version is currently installed. You must be at version 9.2.0 or later to upgrade to version 9.3.1. 5 Go to the /data/install directory. # cd /data/install 6 Extract the contents of the archive. # tar jxf <product>.bz2 7 Run the platform installation script. Type./install_platform for help on available options. #./install_platform -U -P <platform type> After the platform script finishes, you might be instructed to restart the system. This message can be ignored; you do not need to restart the system until after the Stingray script finishes. 8 Run the application installation script. #./install_stingray -U -P <platform type> When the script finishes, a message appears instructing you to reboot. 9 Restart the system. # reboot Restarting the system might take 10 15 minutes. 10 Log on to the appliance as root and verify the installation. If you are using the default root password, you are prompted to change the password after logging on. If the Release field contains the updated version, installation is complete. If the installation fails, do not perform the installation again. Call McAfee support and submit an installation log file. Using destination NAT IP addresses If destination Network Address Translation (NAT) is being performed on connections from your management computer to the McAfee DLP appliance, you must add the NAT address to the McAfee DLP appliance. For instructions, see the chapter on post-installation tasks in the McAfee Data Loss Prevention Product Guide, version 9.3.1. Known issues For known issues in this product release, refer to KnowledgeBase article KB79499. 9
Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com. 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. Copyright 2014 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. A00