Smart Scan Server 1. Getting Started Guide. For Enterprise and Medium Business. Endpoint Security

Transcription

1 Smart Scan Server 1 For Enterprise and Medium Business Getting Started Guide es Endpoint Security

2 Trend Micro Smart Scan Server 1.0 Getting Started Guide

3 Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. Before installing and using the software, please review the readme files, release notes, and the latest version of the applicable user documentation, which are available from the Trend Micro Web site at: Trend Micro, the Trend Micro t-ball logo, TrendLabs, and OfficeScan are trademarks or registered trademarks of Trend Micro, Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright 2009 Trend Micro Incorporated. All rights reserved. Document Part No. SPEM14060/90326 Release Date: September 2009 Protected by U.S. Patent No. (Patents Pending) i

4 Trend Micro Smart Scan Server 1.0 Getting Started Guide The user documentation for Trend Micro Smart Scan Server is intended to introduce the main features of the software and installation instructions for your production environment. You should read through it prior to installing or using the software. Detailed information about how to use specific features within the software are available in the online help file and the online Knowledge Base at Trend Micro s Web site. Trend Micro is always seeking to improve its documentation. Your feedback is always welcome. Please evaluate this documentation on the following site: ii

5 Contents Preface Smart Scan Server Documentation...viii Audience...viii Document Conventions...ix Chapter 1: Introducing Trend Micro Smart Scan Server How Does Trend Micro Smart Scan Server Work? The Need for a New Solution The Trend Micro Smart Scan Solution Understanding Smart Scan Server Pattern Files What s New Features and Benefits Trend Micro Smart Protection Network About File Reputation About Smart Feedback Chapter 2: Installing Local Smart Scan Servers Recommended System Requirements Planning for Deployment Best Practices Deployment Guidelines Capacity Example Capacity Test Results Preparing to Install iii

6 Trend Micro Smart Scan Server 1.0 Getting Started Guide Running the Installation Program Post-Installation Logging on to Smart Scan Server for the First Time Chapter 3: Using Smart Scan Server Using the Product Console Accessing the Product Console Using the Summary Screen Using Tabs Using Widgets Adding Widgets Editing Server Information in Widgets Refreshing Server Information in Widgets Removing a Widget from a Tab Uploading Widgets Using the Active Users Widget Using the HTTP Traffic Report Widget Using the Real Time Status Widget Using the Top 10 Infected Computers Widget Managing Server Visibility Updating Components Configuring Manual Updates Configuring Scheduled Updates Configuring an Update Source Configuring Proxy Settings Updating the Program Administrative Tasks Using SNMP Service Configuring SNMP Service Downloading the MIB file Downloading Diagnostic Information Using Database Maintenance Changing the Product Console Password iv

7 Contents Chapter 4: Troubleshooting and Contact Information Before Contacting Technical Support Contacting Trend Micro TrendLabs FAQ Known Issues Appendix A: Command Line Interface (CLI) Commands Glossary List of Commands... A-2 v

8 Trend Micro Smart Scan Server 1.0 Getting Started Guide vi

9 Preface Preface Welcome to the Trend Micro Smart Scan Server Getting Started Guide. This document contains information about product settings. This preface discusses the following topics: Smart Scan Server Documentation on page viii Audience on page viii Document Conventions on page ix vii

10 Trend Micro Smart Scan Server 1.0 Getting Started Guide Smart Scan Server Documentation The Smart Scan Server documentation consists of the following: Getting Started Guide Helps you plan for deployment and configure all product settings. Online Help Provides detailed instructions on each field and how to configure all features through the user interface. Readme File Contains late-breaking product information that might not be found in the other documentation. Topics include a description of features, installation tips, known issues, and product release history. The Getting Started Guide and readme are available at: Audience The Smart Scan Server documentation is written for IT managers and administrators. The documentation assumes that the reader has in-depth knowledge of computer networks. The documentation does not assume the reader has any knowledge of virus/malware prevention or spam prevention technology. viii

11 Preface Document Conventions To help you locate and interpret information easily, the Smart Scan Server documentation uses the following conventions. CONVENTION ALL CAPITALS Bold Italics Monospace Note: DESCRIPTION Acronyms, abbreviations, and names of certain commands and keys on the keyboard Menus and menu commands, command buttons, tabs, options, and tasks References to other documentation or new technology components Examples, sample command lines, program code, Web URL, file name, and program output Configuration notes Tip: Recommendations WARNING! Reminders on actions or configurations that should be avoided ix

12 Trend Micro Smart Scan Server 1.0 Getting Started Guide x

13 Chapter 1 Introducing Trend Micro Smart Scan Server This chapter introduces and describes Trend Micro Smart Scan Server. Topics include: How Does Trend Micro Smart Scan Server Work? on page 1-2 What s New on page 1-8 Features and Benefits on page 1-9 Trend Micro Smart Protection Network on page 1-10 About File Reputation on page 1-10 About Smart Feedback on page

14 Trend Micro Smart Scan Server 1.0 Getting Started Guide How Does Trend Micro Smart Scan Server Work? Smart scan is a next-generation, in-the-cloud based anti-malware endpoint protection solution. At the core of this smart scan solution is an advanced scanning architecture, that leverages anti-malware signatures that are stored in-the-cloud. Smart scan leverages file reputation technology to detect security risks. The technology works by off loading a large number of anti-malware signatures that were previously stored on endpoint computers to local Smart Scan Servers or Global Smart Scan Servers. Using this approach, the system and network impact of the ever-increasing volume of signature updates to endpoint systems is significantly reduced. The Need for a New Solution In the current approach to file-based threat handling, patterns (or definitions) required to protect a computer are, for the most part, delivered on a scheduled basis. Patterns are delivered in batches from Trend Micro to endpoint systems. When a new update is received, the virus/malware prevention software on the computer reloads this batch of pattern definitions for new virus/malware risks into memory. If a new virus/malware risk emerges, this pattern once again needs to be updated partially or fully and reloaded on the user s computer to ensure continued protection. Over time, there has been a significant increase in the volume of unique emerging threats. The increase in the volume of threats is projected to grow at a near-exponential rate over the coming years. This amounts to a growth rate that far outnumbers the volume of currently known security risks. Going forward, the volume of security risks represents a new type of security risk. The volume of security risks can impact server and workstation performance, network bandwidth usage, and, in general, the overall time it takes to deliver quality protection - or "time to protect". 1-2

15 Introducing Trend Micro Smart Scan Server FIGURE 1-1. Estimated growth in the volume of threats A new approach to handling the volume of threats has been pioneered by Trend Micro that aims to make Trend Micro customers immune to the threat of virus/malware volume. The technology and architecture used in this pioneering effort leverages technology that off load the storage of virus/malware signatures and patterns to the cloud. By off loading the storage of these virus/malware signatures to the cloud, Trend Micro is able to better protect customers against the future volume of emerging security risks. The Trend Micro Smart Scan Solution The smart scan solution makes use of two new network-based products: Trend Micro Global Smart Scan Servers A globally scaled Internet-based infrastructure that provides scan services to users who do not have immediate access to their corporate network. Local Smart Scan Server Local Smart Scan Servers exist in the local network. This is made available for users who have access to their local corporate network. Local servers are designed to localize scan operations to the corporate network to optimize efficiency. Install multiple Smart Scan Servers to ensure the continuity of protection in the event that connection to a Smart Scan Server is unavailable. These two network-based products host the majority of the virus/malware pattern definitions, and make these definitions available to other computers on the network for verifying potential threats. Scan queries are only sent to Smart Scan Servers if the risk of the file cannot be determined by the scan the client performs. 1-3

16 Trend Micro Smart Scan Server 1.0 Getting Started Guide Clients leverage file reputation technology to perform queries against local Smart Scan Servers and Global Smart Scan Servers as part of their regular system protection activities. In the smart scan solution, clients send identification information, determined by Trend Micro technology, to Smart Scan Servers for scan queries. Clients never send the entire file and the risk of the file is determined using identification information. Understanding Smart Scan Server Pattern Files The cloud-based scan process makes use of a small local pattern file combined with a real-time cloud query system. The cloud query system verifies files and other components against a local Smart Scan Server or Global Smart Scan Servers during the scan process. Smart Scan Servers use several patent pending algorithms to ensure an efficient scan process that minimizes network bandwidth usage during the scan process. There are two smart scan solution pattern files: Smart Scan Pattern This pattern is downloaded to and available on local Smart Scan Servers or Global Smart Scan Servers. This file is updated hourly. Smart Scan Agent Pattern This pattern is stored on the local endpoint client for scans that do not require Smart Scan Servers. This file is updated daily. 1-4

17 Introducing Trend Micro Smart Scan Server Pattern Update Process The pattern update process begins when a new Smart Scan Pattern or Smart Scan Agent Pattern is released and uploaded to Trend Micro ActiveUpdate servers. Smart Scan Patterns download to Global Smart Scan Servers and local Smart Scan Servers through the Internet. Smart Scan Agent Patterns download to Trend Micro products that support smart scan, such as OfficeScan, through the Internet. Client computers within the company network download Smart Scan Agent Pattern files from Trend Micro client management products. External client computers are computers that are unable to connect to local Smart Scan Servers or Trend Micro products that support smart scan. FIGURE 1-2. Pattern update process Intranet Local Smart Scan Servers Trend Micro Global Smart Scan Servers Client Computers Trend Micro product that supports smart scan Cloud (Internet) Trend Micro ActiveUpdate Servers Smart Scan Pattern Smart Scan Agent Pattern External Client Computers 1-5

18 Trend Micro Smart Scan Server 1.0 Getting Started Guide The Scan Process Smart Scan Servers exist to perform virus/malware scans, protecting your network from security risks. Local Smart Scan Servers exist within the company on local servers and improve performance by providing scan services to computers within the company network. Global Smart Scan Servers are hosted by Trend Micro and are accessible from anywhere an Internet connection is available. Client computers that are currently in the company network use Local Smart Scan Servers for scans. Client computers that are currently not in the company network use Global Smart Scan Servers. While a network connection is required for utilizing Smart Scan Servers, client computers without access to network connection still benefit from Trend Micro technology. Smart Scan Agent Pattern and scan technology that reside on clients, protects client computers without access to a network connection. The smart scan client first performs scanning on the local computer. If the client cannot determine the risk of the file during the scan, the client verifies the risk by sending a scan query to a Smart Scan Server. Advanced filtering technology enables the client to "cache" the scan query result. This improves scan performance and eliminates the need to send the same scan query to Smart Scan Servers more than once. A client that cannot verify a file s risk locally and cannot connect to any Smart Scan Server after several attempts will flag the file for verification and temporarily allow access to the file. When connection to a Smart Scan Server is restored, all the files that have been flagged are re-scanned. Then, the appropriate scan action is performed on files that have been confirmed as infected. Note: Install multiple Smart Scan Servers to ensure the continuity of protection in the event that connection to a Smart Scan Server is unavailable. 1-6

19 Introducing Trend Micro Smart Scan Server FIGURE 1-3. Smart Scan Server solution scan process Intranet Client Computers Local Smart Scan Servers Cloud (Internet) Trend Micro Global Smart Scan Servers Trend Micro ActiveUpdate Servers Trend Micro product that supports smart scan External Client Computers 1-7

20 Trend Micro Smart Scan Server 1.0 Getting Started Guide What s New The following table is a list of new features in this release of Smart Scan Server: TABLE 1-1. What s new in this release NEW FEATURE Product console Virtualization support DESCRIPTION The product console now uses HTTPS for added security. Additional virtualization support: Microsoft Windows Server 2008 Enterprise Edition R2 Hyper-V, VMware ESX 4.0, and VMware ESXi 4.0 New widget features Monitor multiple Smart Scan Servers from the Summary screen using Server Visibility and widgets. Multiple tab layout for customized information viewing. Upload new widgets to add to the Summary screen tabs. Real Time Status widget displays File Reputation Query status, ActiveUpdate status, CPU load average, Free memory, Swap disk usage, and Free space. Active Users widget displays information in a graph. Top 10 infected computers widget displays information in a table. Traffic report widget displays information in a graph. Database Maintenance can be used to manage log storage. 1-8

21 Introducing Trend Micro Smart Scan Server Features and Benefits The following table lists the features and benefits: TABLE 1-2. Features and benefits FEATURES AND BENEFITS The corporate network will be better positioned to handle the threat of volume. The overall "time to protect" against emerging threats is greatly decreased. The frequency of pattern updates is decreased. The kernel memory consumption on workstations is significantly lowered and increases minimally over time. Streamlines administration and simplifies management. The bulk of pattern definition updates only need to be delivered to one server instead of many workstations. This reduces the bulk of the impact of a pattern update on many workstations. Protects against Web-based and blended attacks. Stops viruses/malware, Trojans, worms, plus new variants of these security risks. Detects and removes spyware/grayware (including hidden rootkits). Supports plug-ins that add new security capabilities. The network bandwidth usage consumed during a traditional pattern update and associated periods of network and production contention during this process are minimized. 1-9

22 Trend Micro Smart Scan Server 1.0 Getting Started Guide Trend Micro Smart Protection Network The Trend Micro Smart Protection Network is a next-generation cloud-client content security infrastructure designed to protect customers from security risks and Web threats. It powers both local and hosted solutions to protect users whether they are on the network, at home, or on the go, using light-weight clients to access its unique in-the-cloud correlation of , Web and file reputation technologies, and threat databases. Customers protection is automatically updated and strengthened as more products, services and users access the network, creating a real-time neighborhood watch protection service for its users. The smart scan solution leverages Smart Protection Network for in-the-cloud protection. About File Reputation File reputation technology from Trend Micro checks the reputation of each file against an extensive in-the-cloud database before permitting user access. Since the malware information is stored in the cloud, it is available instantly to all users. High performance content delivery networks and local caching servers ensure minimum latency during the checking process. The cloud-client architecture offers more immediate protection and eliminates the burden of pattern deployment besides significantly reducing the overall client footprint. About Smart Feedback Trend Micro Smart Feedback provides continuous communication between Trend Micro products and the company's 24/7 threat research centers and technologies. Each new threat identified through a single customer's routine reputation check automatically updates all of Trend Micro's threat databases, blocking any subsequent customer encounters of a given threat. For example, routine reputation checks sent to global Smart Scan Servers. By continuously processing the threat intelligence gathered through its extensive global network of customers and partners, Trend Micro delivers automatic, real-time protection against the latest threats and provides better together security. This is much like an automated neighborhood watch that involves the community in protection of others. The privacy of a customer's personal or business information is always protected because the threat information gathered is based on the reputation of the communication source. 1-10

23 Chapter 2 Installing Local Smart Scan Servers This chapter guides you through installing local Smart Scan Servers. In addition to listing the system requirements for installing local Smart Scan Servers the chapter also contains post-installation information. Topics include: Recommended System Requirements on page 2-2 Planning for Deployment on page 2-4 Preparing to Install on page 2-7 Running the Installation Program on page 2-7 Post-Installation on page

24 Trend Micro Smart Scan Server 1.0 Getting Started Guide Recommended System Requirements The following table lists the system requirements: TABLE 2-1. System Requirements HARDWARE / SOFTWARE REQUIREMENTS Hardware 2.0GHz Intel Core2Duo 64-bit processor supporting Intel Virtualization Technology or equivalent 1GB of RAM 20GB disk space (For over 10,000 clients, add 5GB for every 5,000 clients.) Note: Smart Scan Server automatically partitions the detected disk space as required. Monitor with 800 x 600 or greater resolution with 256 colors or higher Virtualization Microsoft Windows Server 2008 Enterprise Edition R2 Hyper-V (Legacy Network Adapter is required to detect the network device for Hyper-V installations.) VMware ESXi Server 4.0 or 3.5 Update 4 VMware ESX Server 4.0, 3.5, or 3.0 VMware Server 2.0 Note: A purpose-built, hardened, performance-tuned 64-bit Linux operating system is included with Trend Micro Smart Scan Server. 2-2

25 Installing Local Smart Scan Servers TABLE 2-1. System Requirements HARDWARE / SOFTWARE REQUIREMENTS Virtual Machine Red Hat Enterprise Linux 5 64-bit for VMware ESX 4.0, VMware ESX 3.5, VMware ESXi 4.0, VMware ESXi 3.5, or VMware Server 2.0 Red Hat Enterprise Linux 4 64-bit for VMware ESX 3.0 1GB RAM 2.0GHz processor 20GB available disk space (For over 10,000 clients, add 5GB for every 5,000 clients.) 1 network device 2 virtual processors Note: Install VMware Tools after successfully installing Smart Scan Server. Web Console Microsoft Internet Explorer 6.0 or later with the latest updates Mozilla Firefox or later Adobe Flash Player 8.0 or above is required for viewing charts in widgets Best viewing resolution is 1024 x 768 or greater resolution 2-3

26 Trend Micro Smart Scan Server 1.0 Getting Started Guide Planning for Deployment The following section provides information on how to determine the type of environment to configure when installing local Smart Scan Servers. Best Practices Avoid scheduling clients for Manual or Scheduled scans simultaneously. Stagger the scans in groups. Avoid configuring all clients from performing Scan Now simultaneously. (For example, the "Perform scan now after update" option.) Deployment Guidelines Consider the following when setting up your local Smart Scan Server: Smart Scan Server is a CPU-bound application. This means that increasing CPU resources increases the number of simultaneous requests handled. The number of processors allocated to the virtual machine will affect the performance of your local Smart Scan Server. Network bandwidth may become a bottleneck depending on network infrastructure and the number of simultaneous update requests or connections. Additional memory might be required if there is a large number of concurrent connections between Smart Scan Servers and clients. Install multiple Smart Scan Servers to ensure the continuity of protection in the event that connection to a Smart Scan Server is unavailable. 2-4

27 Installing Local Smart Scan Servers Capacity Example Consider an example that uses hardware described in Table 2-1. TABLE 2-1. Hardware used in example HARDWARE SPECIFICATIONS Server Model Dell PowerEdge 2950 Processor Memory Hard Disk Network Card Intel Quad Core Xeon E5420 x 2, 2 x 6MB Cache DDR-2 667MHz ECC 4GB 73GB, 15K RPM SAS, RAID-0 Broadcom NetXtreme II 5708 Gigabit Ethernet Card Capacity Test Results The following table lists the capacity data and the environment details from the capacity test done in a 1Gbps network. The table provides information regarding the maximum number of concurrent connections and the maximum number of active clients that the scan server can support. The maximum number of active clients is calculated by dividing the number of concurrent connections with the percentage of the total clients that will send concurrent HTTP requests. However, it is assumed that not all clients connect to the server simultaneously. Typically, about 5% of the total clients will send HTTP requests to the Smart Scan Servers. 2-5

28 Trend Micro Smart Scan Server 1.0 Getting Started Guide TABLE 2-2. Capacity test result data PLATFORM VIRTUAL PROCESSORS CONCURRENT CONNECTIONS MEMORY USAGE (MB) MAXIMUM NUMBER OF ACTIVE CLIENTS VMware ESX 3.5 VMware ESX 3.5 VMware ESX 4.0 VMware ESX 4.0 VMware ESX 4.0 VMware Server 2.0 Microsoft Hyper-V Microsoft Hyper-V , , , , , , , , ,364 Note: The performance data for Microsoft Hyper-V resulted from tests done on Windows 2008 Enterprise Edition R2 Hyper-V. 2-6

29 Installing Local Smart Scan Servers Preparing to Install The Smart Scan Server installation process formats your existing system for program installation. VMware or Hyper-V installation requires the creation of a virtual machine before installation. After determining the number of local Smart Scan Servers to use for your network, you can begin the installation process. Note: Install multiple Smart Scan Servers to ensure the continuity of protection in the event that connection to a Smart Scan Server is unavailable. You need the following information for the installation: Proxy server information A virtual machine server that fulfills the requirements for your network Running the Installation Program After preparing the requirements for installation, run the installation program to begin installation. To install Smart Scan Server: 1. Create a virtual machine on your VMware or Hyper-V server and specify the virtual machine to boot from the Smart Scan Server ISO. Note: Legacy Network Adapter is required to detect the network device for Hyper-V installations. 2-7

30 Trend Micro Smart Scan Server 1.0 Getting Started Guide 2. Power on the virtual machine. The Installation Menu displays with the following options: Install Smart Scan Server Select this option to install Smart Scan Server to the new virtual machine. System Memory Test Select this option to perform memory diagnostic tests to rule out any memory issues. Exit Installation Select this option to exit the installation process and to boot from other media. FIGURE 2-1. Installation Menu screen 2-8

31 Installing Local Smart Scan Servers 3. Select Install Smart Scan Server. The License Agreement screen appears. FIGURE 2-2. License Agreement screen Note: From this screen on, you can access the readme from a button in the lower left hand corner of the installation screen. 2-9

32 Trend Micro Smart Scan Server 1.0 Getting Started Guide 4. Click Accept to continue. The Keyboard Selection screen appears. FIGURE 2-3. Keyboard Selection screen 2-10

33 Installing Local Smart Scan Servers 5. Select the keyboard language and click Next to continue. The Hardware Components Summary screen appears. The installation program performs a scan to determine if the system specifications have been met and displays the results. If the hardware contains components that do not meet the system requirements, the installation program highlights those components. Installation can proceed as long as there is a hard drive and network device. If there is no hard drive and no network device, installation cannot continue. FIGURE 2-4. Hardware Components Summary screen 2-11

34 Trend Micro Smart Scan Server 1.0 Getting Started Guide 6. Click Next to continue. The Network Settings screen appears. If there are multiple network devices, configure settings for all devices. (Only one device can be active on boot.) FIGURE 2-5. Network Settings screen Note: To change the active on boot device after installation, log on to the Command Line Interface (CLI). 2-12

35 Installing Local Smart Scan Servers 7. Configure network settings. a. Specify the Active on Boot network devices, host name, and miscellaneous settings. If you specify the host name manually, the miscellaneous settings are also configurable. b. Click Next to continue. The Time Zone screen appears. FIGURE 2-6. Time Zone screen 2-13

36 Trend Micro Smart Scan Server 1.0 Getting Started Guide 8. Specify the time zone and click Next to continue. The Authentication screen appears. FIGURE 2-7. Authentication screen 2-14

37 Installing Local Smart Scan Servers 9. Specify passwords for the root" and "admin" accounts. Smart Scan Server uses two different levels of administrator types to secure the server. Tip: For best security, create a highly unique password known only to you. Use both upper and lower case alpha characters, numerals, and special characters on your keyboard to create your password. The password must be a minimum of 6 characters and a maximum of 32 characters. Root account This account is used to gain access to the operating system shell and has all rights to the server. This account includes the most privileges. Admin account This account is the default administration account used to access the Smart Scan Server Web and CLI product consoles. This account includes all rights to the Smart Scan Server application, but does not include access rights to the operating system shell. Tip: Trend Micro recommends using a strong, unique password. a. Type the "root" and "admin" passwords. b. Click Next to continue. The Installation Summary screen appears. 2-15

38 Trend Micro Smart Scan Server 1.0 Getting Started Guide FIGURE 2-8. Installation Summary screen 2-16

39 Installing Local Smart Scan Servers 10. Confirm the summary information. a. Review the summary information on this screen. Note: Continuing with the installation formats and partitions the necessary disk space and installs the operating system and application. If there is any data on the hard disk that cannot be erased, cancel the installation and back up the information before proceeding. b. If any of the information on this screen requires a different configuration, click Back. Otherwise, click Next to continue and click Continue at the confirmation message. The Installation Progress screen appears. FIGURE 2-9. Installation Progress screen 2-17

40 Trend Micro Smart Scan Server 1.0 Getting Started Guide 11. A message appears when the installation completes. The installation log is saved in the /root/install.log file for reference. FIGURE Installation Complete screen 2-18

41 Installing Local Smart Scan Servers 12. Click Reboot to restart the virtual machine. The initial Command Line Interface (CLI) logon screen appears and displays the client connection addresses and the Web console URL. Tip: Trend Micro recommends disconnecting the CD ROM device from the virtual machine after Smart Scan Server is installed. FIGURE CLI logon screen 13. Use admin to log on to the CLI or the Web console to manage Smart Scan Server. Log on to the Web console to perform post installation tasks such as configuring proxy settings. Log on to the CLI shell if you need to perform additional configuration, troubleshooting, or housekeeping tasks. 2-19

42 Trend Micro Smart Scan Server 1.0 Getting Started Guide Post-Installation Trend Micro recommends performing the following post-installation tasks: After successfully installing Smart Scan Server, install VMware Tools. Refer to VMware documentation for more information. If your network uses a proxy server, configure proxy settings first. See Configuring Proxy Settings on page Configure Smart Scan Server settings on other Trend Micro products that support smart scan solutions. Note: The Real Time Status widget and Smart Scan Server CLI console display Smart Scan Server addresses. Logging on to Smart Scan Server for the First Time Once Smart Scan Server has restarted, log on using the CLI or Web console. To log on to the CLI console, type the administrator user name (admin) and password. Use the admin account to log on to the CLI shell if you need to perform additional configuration, troubleshooting, or housekeeping tasks. To log on to the Web console, open a Web browser and type the URL indicated on the initial CLI banner. Log on to the Web console to perform post installation tasks, such as configuring proxy settings. FIGURE Log on screen 2-20

43 Chapter 3 Using Smart Scan Server This chapter provides Smart Scan Server configuration information. Topics include: Using the Product Console on page 3-2 Using the Summary Screen on page 3-3 Updating Components on page 3-16 Administrative Tasks on page 3-21 Changing the Product Console Password on page

44 Trend Micro Smart Scan Server 1.0 Getting Started Guide Using the Product Console The product console consists of the following elements: Main menu Provides links to the Summary, Update, and Administration screens. Work area View summary information and component status, configure settings, update components, and perform administrative tasks. FIGURE 3-1. Product console Main menu Work area 3-2

45 Using Smart Scan Server TABLE 3-1. Contents of Smart Scan Server Main Menu MAIN MENU MENU ITEM DESCRIPTION Summary Updates Administration Displays customized information about Smart Scan Servers, traffic, and detections when you add widgets. Provides options for configuring scheduled updates, proxy server settings, and manual program updates. Provides options to configure SNMP service, collect diagnostic information for troubleshooting, and maintain database size. Accessing the Product Console Upon opening the Web console, the initial screen displays the status summary for Smart Scan Server. To access the Web console: 1. Open a Web browser and type the URL indicated on the initial CLI banner. 2. Type admin for the user name and the password in the corresponding fields. 3. Click Log on. Using the Summary Screen The Summary screen can display customized information about Smart Scan Servers, traffic, and detections. You can do the following with the Summary screen: Add widgets that display information such as real time status, the number of active users, top infection computers, and server traffic. Organize widgets using tabs. Customize tab layout to display different numbers of columns that align the widgets. View multiple Smart Scan Server information. 3-3

46 Trend Micro Smart Scan Server 1.0 Getting Started Guide Smart Scan Server supports both HTTP and HTTPS protocols for client connections. HTTPS provides a more secure connection while HTTP uses less bandwidth. Smart Scan Server addresses are displayed on the Real Time Status widget and the CLI console banner. FIGURE 3-2. Summary Screen Note: Smart Scan Server Addresses are used with Trend Micro products that manage clients. Server Addresses are used for configuring client connections to Smart Scan Servers. 3-4

47 Using Smart Scan Server Using Tabs Customize and manage widgets by adding and configuring tabs. A maximum of 30 tabs can be added. FIGURE 3-3. Using tabs To add a new tab: 1. Log on to the Web console. 2. Click Summary from the main menu. The Summary screen appears. 3. Click New Tab from the work area. 4. Specify the Title. 5. Select the Layout. Note: The tab layout can be changed by clicking Tab Settings. 6. Click Save. 3-5

48 Trend Micro Smart Scan Server 1.0 Getting Started Guide Using Widgets Widgets allow you to customize the information displayed on the Summary screen. There are currently four types of widgets that can be added to the Summary screen and up to 30 widgets can be added to each tab. Active Users HTTP Traffic Report Real Time Status Top 10 Infected Computers New widgets can be added to the scan server. Widgets can be dragged and dropped to customize the order in which they display. Widget packages must be downloaded to an accessible server prior to uploading widgets for use on the Summary screen. Adding Widgets Select from a list of available widgets to add to each tab. Up to 30 widgets can be added to each tab. FIGURE 3-4. Adding widgets 3-6

49 Using Smart Scan Server To add widgets: 1. Log on to the Web console. 2. Click Summary from the main menu. The Summary screen appears. 3. Click Add widgets from the work area. 4. Select the widgets that you want to add. 5. Click Add and Reload. Editing Server Information in Widgets Editing server information is the same for all widgets. View information from multiple scan servers on one widget by selecting servers from the list of servers that displays. FIGURE 3-5. Editing server information in widgets To edit server information displayed in widgets: 1. Click the edit icon. 2. Select the check box for the Smart Scan Server Address to add to the graph. 3. Click Save. The widget automatically refreshes and displays the information of the selected scan servers. Note: Smart Scan Server Addresses are used with Trend Micro products that manage clients. Server Addresses are used for configuring client connections to Smart Scan Servers. 3-7

50 Trend Micro Smart Scan Server 1.0 Getting Started Guide Refreshing Server Information in Widgets Refreshing server information is the same for all widgets. When you click refresh, only information from selected servers will refresh. FIGURE 3-6. Refreshing server information in widgets Removing a Widget from a Tab Click the close button to remove a widget from a tab. The widget no longer displays. FIGURE 3-7. Refreshing server information in widgets Uploading Widgets Widgets must be uploaded to scan servers before they can be added to tabs. FIGURE 3-8. Uploading widgets To upload new widgets: 1. Log on to the Web console. 2. Click Summary from the main menu. The Summary screen appears. 3-8

51 Using Smart Scan Server 3. Click Basic Settings from the work area. 4. Click Upload Widget. 5. Specify the file. 6. Click Update. The Widget Details screen appears. 7. Click Add to add the new widget or Discard to cancel. Using the Active Users Widget The Active Users widget displays the number of users that have made file reputation queries to the Smart Scan Server. Each unique client computer is considered an active user. This widget displays information in a 2-D graph and is updated hourly. FIGURE 3-9. Editing server information displayed in Active Users 3-9

52 Trend Micro Smart Scan Server 1.0 Getting Started Guide Using the HTTP Traffic Report Widget The HTTP Traffic Report widget displays the total amount of network traffic in kilobytes (KB) that has been sent to the Smart Scan Server from file reputation queries generated by clients. The information in this widget is updated hourly and the data is displayed in a 3-D graph. In the 3-D graph, right-clicking on the graph provides options to reset the graph or display the graph in 2D, 3D, 100%, and best fit. You can also click the server name to display the values for each day on the graph. FIGURE Customizing information in the HTTP Traffic Report widget 3-10

53 Using Smart Scan Server Using the Real Time Status Widget Use the real time status widget to check Smart Scan Server status. When this widget displays on the Summary screen, the product console session will not expire. The Health Status is updated every minute which means the session will not expire due to the requests sent to the server. However, the session will still expire if the tab that is currently displayed does not contain this widget. FIGURE Real Time Status widget Protocol Smart Scan Server supports both HTTP and HTTPS protocols. HTTPS provides a more secure connection while HTTP uses less bandwidth. Note: Smart Scan Server Addresses are used with Trend Micro products that manage clients. Server Addresses are used for configuring client connections to Smart Scan Servers. Health Status Check the server file reputation query and ActiveUpdate connection status to ensure that the server features work properly and the latest components can be downloaded. 3-11

54 Trend Micro Smart Scan Server 1.0 Getting Started Guide The following items are displayed under Health Status: File reputation query displays whether file reputation query is functioning as expected. ActiveUpdate displays whether ActiveUpdate is functioning as expected. CPU load average displays the computer load average for the past 1, 5, and 15 minutes. Free memory displays the available physical memory on the computer. Swap disk usage displays the swap disk usage. Free space displays the available free disk space on the computer. Using the Top 10 Infected Computers Widget The Top 10 Infected Computers widget displays the top 10 computer IP addresses which have been classified as infected computers after Smart Scan Server receives a known virus from file reputation query. Information in this widget is displayed in a table, which includes the computer IP address and the total number of detections on each computer. The information in this widget is updated hourly. If you enable more than one scan server in this widget, this widget will calculate the total number of detections on the selected scan server and display the top 10 infected computers from the selected scan servers in the list. FIGURE Top 10 Infected Computers Widget 3-12

55 Using Smart Scan Server Managing Server Visibility Manage servers from the Server Visibility screen. To maximize performance, do not add more than 10 servers to the Server Visibility list. FIGURE Managing Server Visibility The server visibility screen displays the following information: Smart Scan Server Address The list of remote scan servers that can be monitored by the local scan server. Connection Displays the connection status between the local scan server and remote scan servers. Yes Indicates that a connection to the remote scan server can be established. No Indicates that a connection to the remote scan server cannot be established. Timeout Indicates that the remote scan server can be reached, but the response from the remote scan server exceeded 30 seconds. Edit Click the icon to change server information. Delete Click the icon to remove the server from the list. 3-13

56 Trend Micro Smart Scan Server 1.0 Getting Started Guide FIGURE Adding servers to Server Visibility To add servers to Server Visibility: 1. Log on to the Web console. 2. Click Summary from the main menu. The Summary screen appears. 3. Click Basic Settings from the work area. 4. Click Server Visibility. 5. Click Add Server. 6. Type the address next to Server Name. For example, Type the Account Note: Specify the same account that is being used to log on to the Smart Scan Server Web console. 8. Type the Password. 9. Click Save. The server address appears under Smart Scan Server Address. 3-14

57 Using Smart Scan Server FIGURE Configuring proxy server settings for server connection To configure proxy server settings for server connection: 1. Log on to the Web console. 2. Click Summary from the main menu. The Summary screen appears. 3. Click Basic Settings from the work area. 4. Click Server Visibility. 5. Expand the Proxy Server section. 6. Select Use a proxy server for connecting to other servers. 7. Specify the Proxy protocol. 8. Type the Server name or IP address. 9. Type the Port number. 10. Type the User ID and Password for Proxy authentication. 11. Click Apply. 3-15

58 Trend Micro Smart Scan Server 1.0 Getting Started Guide Updating Components The effectiveness of Smart Scan Server depends upon using the latest pattern files. Trend Micro releases new versions of the Smart Scan Pattern files hourly. Tip: Trend Micro recommends updating components immediately after installation. Configuring Manual Updates Smart Scan Server can perform manual updates for the Smart Scan Pattern file. FIGURE Configuring manual updates To configure manual updates: 1. Log on to the Web console. 2. Click Updates from the main menu. A drop down menu appears. 3. Click Component from the drop down menu. The Component screen appears. 4. Click Update Now. 3-16

59 Using Smart Scan Server Configuring Scheduled Updates Smart Scan Server can perform scheduled updates for the Smart Scan Pattern file. FIGURE Configuring scheduled updates To configure scheduled updates: 1. Log on to the Web console. 2. Click Updates from the main menu. A drop down menu appears. 3. Click Component from the drop down menu. The Component screen appears. 4. Select Enable scheduled updates. 5. Select either hourly or 15 minute updates. 6. Click Save. 3-17

60 Trend Micro Smart Scan Server 1.0 Getting Started Guide Configuring an Update Source Use this screen to specify the update source. The default update source is Trend Micro ActiveUpdate Server. FIGURE Configuring an update source To configure an update source: 1. Log on to the Web console. 2. Click Updates from the main menu. A drop down menu appears. 3. Click Component from the drop down menu. The Component screen appears. 4. Select Trend Micro ActiveUpdate Server or select Other update source and type a URL. 5. Click Save. 3-18

61 Using Smart Scan Server Configuring Proxy Settings If you use a proxy server in the network, configure proxy settings. FIGURE Configuring proxy settings To configure proxy settings: 1. Log on to the Web console. 2. Click Updates from the main menu. A drop down menu appears. 3. Click Component from the drop down menu. The Component screen appears. 4. Select the Use a proxy server for updates check box. 5. Select HTTP or SOCKS4 for the Proxy protocol. 6. Type the server name or IP address. 7. Type the port number. 8. If your proxy server requires credentials, type the User ID and Password. 9. Click Save. 3-19

62 Trend Micro Smart Scan Server 1.0 Getting Started Guide Updating the Program Update to the latest version of the product program to take advantage of product enhancements. FIGURE Updating the program To update the program: 1. Log on to the Web console. 2. Click Updates from the main menu. A drop down menu appears. 3. Click Program from the drop down menu. The Program screen appears. 4. Click Browse... to locate the program file. 5. Locate the file and click Open. 6. Click Update. 3-20

63 Using Smart Scan Server Administrative Tasks Administrative tasks allow you to perform database maintenance, configure SNMP Service, download diagnostic information. Using SNMP Service Smart Scan Servers supports SNMP to provide further flexibility in monitoring the product. Configure settings and download the MIB file from the Web console. Configuring SNMP Service Configure SNMP Service to allow SNMP managing systems to monitor Smart Scan Server status. FIGURE SNMP Service To configure SNMP Service: 1. Log on to the Web console. 2. Click Administration from the main menu. A drop down menu appears. 3. Click SNMP Service from the drop down menu. The SNMP Service screen appears. 4. Select the Enable SNMP Service check box. 3-21

64 Trend Micro Smart Scan Server 1.0 Getting Started Guide 5. Specify a Community name. 6. Select the Enable IP restriction check box to prevent unauthorized access to the SNMP service. Classless Inter-Domain Routing (CIDR) is not supported for IP restriction. a. Specify an IP address. b. Specify a subnet mask. 7. Click Save. Downloading the MIB file Download the MIB file from the Web console to use SNMP Service. FIGURE Downloading the MIB file To download the MIB file: 1. Log on to the Web console. 2. Click Administration from the main menu. A drop down menu appears. 3. Click SNMP Service from the drop down menu. The SNMP Service screen appears. 4. Click Smart Scan Server MIB to download the MIB file. A confirmation prompt displays. 5. Click Save. The Save As screen displays. 6. Specify the save location. 7. Click Save. 3-22

65 Using Smart Scan Server The following table provides a description of the Smart Scan Server MIB. TABLE 3-1. Description of Trend Micro Smart Scan Server MIB OBJECT NAME OBJECT IDENTIFIER (OID) DESCRIPTION Trend-MIB:: TBLVersion Trend-MIB:: TBLLastSuccessfulUpdate Trend-MIB:: LastUpdateError Trend-MIB:: LastUpdateErrorMessage Trend-MIB:: LastVerifyError Returns the current Smart Scan Pattern version. Returns the date and time of the last successful Smart Scan Pattern update. Returns the status of the last Smart Scan Pattern update. 0 Last pattern update was successful. <error code> - Last pattern update was unsuccessful. Returns an error message if the last Smart Scan Pattern update was unsuccessful. Returns the health status of file reputation query. 0 File reputation query is behaving as expected. <error code> - File reputation query is not behaving as expected. 3-23

66 Trend Micro Smart Scan Server 1.0 Getting Started Guide Downloading Diagnostic Information Use the Web console to download diagnostic information for troubleshooting and support. FIGURE Downloading Diagnostic Information To download diagnostic information: 1. Log on to the Web console. 2. Click Administration from the main menu. A drop down menu appears. 3. Click Support from the drop down menu. The Support screen appears. 4. Click Start. The download progress screen appears. 5. Click Save when the prompt for the downloaded file appears. 6. Specify the location and file name. 7. Click Save. 3-24

67 Using Smart Scan Server Using Database Maintenance Use the database maintenance screen to keep the size of your logs from occupying too much space on your hard disk by configuring a log deletion schedule. FIGURE Using Database Maintenance To configure Database Maintenance settings: 1. Log on to the Web console. 2. Click Administration from the main menu. A drop down menu appears. 3. Click Database Maintenance from the drop down menu. The Database Maintenance screen appears. 4. Type the number of days to keep logs. Logs older than the specified number of days will be deleted. The number of days can be between 1 and 120. Logs are deleted at 4 AM. 5. Click Save. 3-25

68 Trend Micro Smart Scan Server 1.0 Getting Started Guide Changing the Product Console Password The product console password is the primary means to protect Smart Scan Server from unauthorized changes. For a more secure environment, change the console password on a regular basis and use a password that is difficult to guess. The admin account password can be changed through the Command Line Interface (CLI). The CLI allows you to change the admin account passwords. Use the configure password command from the CLI to make changes. Tip: To design a safe password consider the following: (1) Include both letters and numbers. (2) Avoid words found in any dictionary (of any language). (3) Intentionally misspell words. (4) Use phrases or combine words. (5) Use both uppercase and lowercase letters. (6) Use symbols. To change the product console password using the CLI: 1. Log on to the CLI console with the admin account. 2. Type the following to enable administrative commands: enable 3. Type the following command: configure password admin 4. Type the new password. 5. Type the new password a second time to confirm the password. 3-26