Secunia CSI integrated with WSUS (SCCM)

Transcription

1 Secunia CSI integrated with WSUS (SCCM) A how to documentation 1 Requirement: 1.1 CSI GUI/console requirements The CSI Console must be launched by a user with Domain Admin privileges must be added to the Trusted sites in the Internet Options of IE Port 443/TCP open outbound (towards the Internet) Minimum 1024 * 768 screen resolution Adobe Flash plug-in for Internet Explorer (needed to display charts and other graphics) You can run the agent on the computer as a client or clientless, requirements: 1.2 Agent requirements Port 443/TCP open outbound Windows Update Agent 2.0 or later 1.3 Scan group/agent-less requirements Ports 139/TCP and 445/TCP open inbound (on hosts) File sharing enabled on hosts Easy/simple file sharing disabled on hosts Windows Update Agent 2.0 or later Required Windows services started on hosts (should be by default): Workstation service Server service Remote Registry service COM+ services (COM+ System Application: Set to Automatic) 1.4 OS requirments: Windows 2000 SP4 Windows XP SP3 Windows Vista Windows 7 Windows Server 2003 Windows Server 2008

2 To integrate Secunia CSI with WSUS (SCCM) you will also need to complete the following requirements: 1.5 CSI with patching capability WSUS installer (Administration console only) Visual C runtime Microsoft.NET runtime V2.0 SP2 If running the Secunia CSI 4.0 for the first time in Windows Vista, 7 or 2008, right click the CSI icon and select 'Run as administrator' Remote Registry must be enabled in order to successful install the certificates (In Vista and Win7 the service is by default disabled) In my test scenario I installed the Secunia CSI on the SCCM server. Remember that you will also need to have the WSUS Admin Console installed on the server you are launching the Secunia CSI from (remember to have the same version as the WSUS server (WSUS Admin Console 3.0 SP2 if you are running WSUS 3.0 SP2 on your WSUS server). 2 Installation and configuration of Secunia CSI. Double click the installer icon and follow the wizard instructions. Launch the Secunia CSI as an Domain Administrator, i.e. right-click and 'Run as administrator' (if running on Windows Vista, 7 or 2008) Log in with user name and password. You will be prompted to configure or skip CSI 4.0 initial configuration (i skipped it). Go to the Patch Menu and Click Configuration: Then you will see the following screen:

3 In this section you should provide the relevant information (IP-address / DNS-name) regarding the WSUS server you wish to use. After inserting the necessary information, press 'Save and Connect. If the connection is successful, a message box will be displayed (for troubleshooting read section 4 Troubleshooting). Please note that the port number used to connect to your WSUS depends on your settings, ports 80 or 8530 are the most common. 2.1 Create and install the Certificate In order for the clients to consider the locally created updates, a signing certificate must be created for the WSUS. The Secunia CSI will search for the Certificate and if the Certificate doesn t exist, the following message will displayed. Click the 'OK' button to create a new Certificate: And press OK on the Following: After pressing the 'OK' button, the certificate is created on the WSUS server. It is then ready to be Installed both locally on the system running the Secunia CSI, and on the target computers.

4 This certificate must be present in the following systems: WSUS Server (This is done my clicking the 'Create Signing Certificate' button) The system running CSI (This is done by clicking 'Install Certificate, and if you cannot see the Install Certificate button the certificate is installed') Clients receiving Updates (This is done with GPO or with Right clicking clients, se below). This Certificate can be distributed with GPO or by going to Patch Deployment, select the target computers where the certificate is to be installed (CRTL+ mouse click for multiple selection) and right clicking to select 'Verify and Install Certificate'. If you are using right click installation of the Certificate, remember that you need to be sure you completed the following requirements: When installing the Certificate, please make sure that CSI was launched with 'Run as administrator' (applicable in Windows Vista, 7 and 2008). Remote Registry is needed to install the certificates (in Vista, Win7 this service is disabled by default). Note that the certificate must also be installed on the system being used to create the packages. 2.2 GPO Configuration After installing and creating and the Signing Certificate, the Secunia CSI will search for the CSI WSUS Group Policy. If that policy doesn't exist, the following message will be displayed. If you press OK the following screen will appear: IMPORTANT NOTE: If you use Microsoft SCCM (System Center Configuration Manager) please make sure you don't check the first option 'Use the WSUS Server specified in the CSI'.

5 In my lab I changed the GPO myself on the AD server, and then ran gpupdate /force on the SCCM server, WSUS server and on the clients: 1. In the Group Policy Management Console (GPMC), browse to the GPO on which you want to configure WSUS, and then click Edit. 2. In the GPMC, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Windows Update. Enable: Allow signed updates from an intranet Microsoft update service location. (Important enables WSUS to distribute patches through the Secunia CSI) Note: The user running the Secunia CSI must have the necessary privileges so it can perform tasks such as: Configure / connect to Microsoft WSUS, perform remote scans to hosts in the network, install the necessary certificates so client machines can accept the packages created with the Secunia CSI. 3. Scanning computers for applications that need patching: Go to Scan in Secunia CSI, and then select Quick Scan. I selected Scan this Computer (Local host) and then pressed SCAN Hosts. This will scan the computer where secunia csi is installed(my sccm server). Remember than you can scan clients using the agent or agentless. If you are using agentless remember that you need to complete the requirements in section 1.3

6 After scanning I found that some applications need patching, so I went to Patch, and Create: And then right clicked on Adobe Reader and choose Create Update Click on the Path and then Next.

7 I then clicked on the download link to download the application, and saved it to my disk. After the download was completed I choose Browse, and browsed to the area where the file is located, then clicked next. Check for parameters to your applications.

8 Click Finish to create the Application.. Go to your SCCM server and Run Synchronization: Then after a minute or two, browse down to Security Updates, and yes it s there:

9 Deploy these updates as you would with normal Windows updates. 4 Troubleshooting If you are having trouble, enable the logging feature, and read the log file: Go to: "Configuration" -> "Settings" -> "Enable Logging, then read where the log file will be created. Do the steps that created an error, open the log file and read what went wrong. (Thanks go to Richard from Secunia for this one). 5 Sources Sources for some of the material: Secunia_CSI_4_setup_and_usage_guide.pdf from Secunia. 6 More to come: How to scan computers with an agent or agentless How to configure Secunia when you have a Hierarchy of SCCM and WSUS server. More troubleshooting?