McAfee VirusScan Enterprise for Linux Software

Transcription

1 Configuration Guide McAfee VirusScan Enterprise for Linux Software For use with epolicy Orchestrator and 4.6.0

2 COPYRIGHT Copyright 2011 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

3 Contents Preface 5 About this guide Audience Conventions What's in this guide Finding product documentation Introducing McAfee VirusScan Enterprise for Linux 7 Product Features What s new in this release Integrating with epolicy Orchestrator 9 Prerequisites Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Upgrading to McAfee VirusScan Enterprise for Linux 1.7 using epolicy Orchestrator Sending an agent wake-up call Setting policies within epolicy Orchestrator Creating or editing policies Enforcing policies Scheduling tasks Creating a Product Update task Creating an on-demand scan task Configuring reports Uninstallation Removing McAfee VirusScan Enterprise for Linux from the client computer Removing McAfee VirusScan Enterprise for Linux from epolicy Orchestrator Index 21 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

4 Contents 4 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

5 Preface This guide provides the information you need to configure, use and maintain McAfee VirusScan Enterprise for Linux using McAfee epolicy Orchestrator software. This guide provides detailed information on how you can deploy VirusScan Enterprise for Linux on client computers and manage the product using epolicy Orchestrator. For instructions on how to install McAfee VirusScan Enterprise for Linux software version 1.7 on a stand-alone computer, see the McAfee VirusScan Enterprise for Linux 1.7 Installation Guide. For detailed information all phases of product use from configuration to troubleshooting, see the McAfee VirusScan Enterprise for Linux 1.7 Product Guide. Contents About this guide Finding product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Users People who use the computer where the software is running and can access some or all of its features. Conventions This guide uses the following typographical conventions and icons. Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis. Bold User input or Path Code Text that is strongly emphasized. Commands and other text that the user types; the path of a folder or program. A code sample. User interface Hypertext blue Words in the user interface including options, menus, buttons, and dialog boxes. A live link to a topic or to a website. Note: Additional information, like an alternate method of accessing an option. McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

6 Preface Finding product documentation Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. What's in this guide This guide is organized to help you find the information you need. This guide provides you with an introduction to McAfee VirusScan Enterprise for Linux and how to integrate it with epolicy Orchestrator. Topics include: Deploying McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Settings policies within epolicy Orchestrator Scheduling tasks such as product update and on-demand scan Configuring reports Removing the software Finding product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 6 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

7 1 Introducing 1 McAfee VirusScan Enterprise for Linux McAfee VirusScan Enterprise for Linux (previously known as LinuxShield) detects and removes viruses and other potentially unwanted software on Linux-based systems. This information is intended for network administrators who are responsible for their company s anti-virus and security program. Contents Product Features What s new in this release Product Features This section describes the product features for the McAfee VirusScan Enterprise for Linux software. McAfee VirusScan Enterprise for Linux software has the following features: Support for 64-bit AMD64/Intel EM64T operating systems. The latest version (5400) of the McAfee anti-virus engine. Incremental Virus Signature (DAT) updates. Mod-versioning for automatic kernel support. Regular expression based exclusions for On-access scan and On-demand scan from the user interface. Scanning Comprehensive on-access anti-virus scanning and cleaning using the McAfee scanning engine. On-access scanning for local file systems, NFS and Samba/CIFS. Kernel-level scan cache for improved performance. Scheduling of on-demand scans. Scheduling of updates for scanning engine and virus definition files. Administration Remote administration using browser-based interface. Secure browser interface with authentication and HTTPS (SSL) support. Remote administration and reporting using epolicy Orchestrator 4.5 or 4.6. McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

8 1 Introducing McAfee VirusScan Enterprise for Linux What s new in this release Reporting Real-time statistics. Detailed database for detected items and system events. Ability to query the database by date range or individual field values, for example, virus name. Results of query can be exported to a CSV file. Configurable notification for detected items, out-of-date virus definition files, configuration changes, and system events. Diagnostic report for use when reporting a problem with the product. What s new in this release This section describes the new enhancements in this release of VirusScan Enterprise for Linux. Support for Novell Cluster Services. Support for Corosync OCFS2 File System Cluster. Run-time Kernel Module Support McAfee VirusScan Enterprise for Linux Kernel modules will be created dynamically in case of a mod-version failure. To manually compile the kernel module, refer to the Frequently asked questions Run-time Kernel Module Support section in the Product Guide. 8 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

9 2 Integrating with epolicy Orchestrator This chapter describes how to configure McAfee VirusScan Enterprise for Linux, version 1.7 using McAfee epolicy Orchestrator management software. To use this chapter effectively, you need to be familiar with epolicy Orchestrator 4.5 or 4.6. McAfee epolicy Orchestrator provides a scalable platform for centralized policy management and enforcement on your McAfee security products and systems on which they reside. It also provides comprehensive reporting and product deployment capabilities; all through a single point of control. This guide does not provide detailed information about installing or using epolicy Orchestrator software. See the McAfee epolicy Orchestrator 4.5 or 4.6 Installation/Product Guide. Contents Prerequisites Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Upgrading to McAfee VirusScan Enterprise for Linux 1.7 using epolicy Orchestrator Sending an agent wake-up call Setting policies within epolicy Orchestrator Scheduling tasks Configuring reports Uninstallation Prerequisites Before deploying McAfee VirusScan Enterprise for Linux on Novel Open Enterprise Server 2.x: 1 From the Novell edirectory server, use imanager and create a user called "nails" and a group called "nailsgroup". 2 Add the user "nails" a member of the "nailsgroup". Enable the user and group using the Linux User Management. 3 Provide "nails" user with administrative privileges on all the NSS volumes. For example: rights -f / media/nss/<vol-name> -r s trustee nails.<context>.<tree> You need to provide administrative privileges to the "nails" user, every time a new NSS volume is created. McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

10 2 Integrating with epolicy Orchestrator Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Use this task to install McAfee VirusScan Enterprise for Linux on client computers using epolicy Orchestrator. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Create a temporary directory on your local drive. 3 Download the archive McAfeeVSEForLinux <build>-release.noarch.tar.gz and extract the files to the temporary directory. 4 Click Menu Software Master Repository. The Packages in Master Repository page appears. 5 Click Actions Check In Package. The Check In Package page appears. 6 Select the Package type as Product or Update (.ZIP) and browse in File path to locate the McAfee Agent for Linux package MSA-LNX_4.6.0_Package.ZIP extracted in the temporary directory. 7 Click Next. The Package Options page appears with the package information. 8 Select a Branch. 9 In Options, select the required option(s), then click Save. 10 Click Menu Software Master Repository. The Packages in Master Repository page appears. 11 Click Actions Check In Package. The Check In Package page appears. 12 Select the Package type as Product or Update (.ZIP) and browse in File path to locate McAfee VirusScan Enterprise for Linux product deployment package McAfeeVSEForLinux <build>-EPO.ZIP extracted in the temporary directory. 13 Click Next. The Package Options page appears with the package information. 14 Select a Branch. 15 In Options, select the required option(s), then click Save. 16 Click Menu Software Extensions. The Extensions page appears. 17 Click Install Extension to install the McAfee Agent policy extension. The Install Extension dialog box appears. 18 Click Browse, select the extension file EPOAGENTMETA.ZIP, then click OK on the Install Extension page. 19 Click Menu Software Extensions. The Extensions page appears. 20 Click Install Extension to install the McAfee VirusScan Enterprise for Linux policy extension. The Install Extension dialog box appears. 21 Click Browse, select the extension file LYNXSHLD1700.ZIP, then click OK on the Install Extension page. 22 Click Menu Software Extensions. The Extensions page appears. 23 Click Install Extension to install the McAfee VirusScan Enterprise for Linux reports extension. The Install Extension dialog box appears. 10 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

11 Integrating with epolicy Orchestrator Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator 2 24 Click Browse, select the extension file LYNXSHLD1700PARSER.ZIP, then click OK on the Install Extension page. Before installing the reports extension (LYNXSHLD1700PARSER.ZIP), ensure that you have removed the previous LinuxShield reports extension module (LYNXSHLDPARSER) from epolicy Orchestrator. 25 Create and download the agent installation package by performing the following steps: a b c From System Tree, click System Tree Actions New Systems. The New Systems page appears. Under How to add systems select Create and download agent installation package, click Non-Windows, then select McAfee Agent for Linux (Current) and click OK. From Download file, right-click install and select Save Target As... to download the file on to your local system. If you are deploying the product on a Ubuntu client system, download the installdeb.sh file on to your local system. In case of epolicy Orchestrator 4.5, this file is not available for download, hence copy this file from C:\Program Files\McAfee\ePolicy Orchestrator\DB\Software \Current\EPOAGENT3700LYNX\Install\ From the Linux terminal, execute the following command: sh install.sh i This will establish a connection between epolicy Orchestrator and the Linux client computer. 27 Click Menu Systems System Tree. The System Tree page appears. 28 To install McAfee VirusScan Enterprise for Linux on the client Linux computer: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 29 To schedule a client task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the task and select the Type as Product Deployment and click Next. On epolicy Orchestrator 4.6 Under Task to schedule, select McAfee Agent as Product, select the Task Type as Product Deployment, then click Create New Task under Task Name. 30 To configure the client task: On epolicy Orchestrator 4.5 Under Configuration, select the Target platforms as Linux and in Products and components, select VirusScan Enterprise for Linux <build number> from the drop-down list, then select the Action as Install. On epolicy Orchestrator 4.6 Under Client Task Catalog, select Linux as Target Platforms, VirusScan Enterprise for Linux <build number> as Products and components, Install as Action and the appropriate Language, then click Save. If you want to deploy McAfee VirusScan Enterprise for Linux with customized settings, then copy the nails.options file to the /root and / directory on your Linux client system. For more information on how to create the nails.options file, refer to the Silent installation section in the product's Installation Guide. 31 Click Next to schedule this task immediately or as required. McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

12 2 Integrating with epolicy Orchestrator Upgrading to McAfee VirusScan Enterprise for Linux 1.7 using epolicy Orchestrator 32 Click Next to view a summary of the task. 33 Click Save and send an agent wake-up call. Wait for the deployment task to complete. Upgrading to McAfee VirusScan Enterprise for Linux 1.7 using epolicy Orchestrator Use this task to upgrade your Linux client systems running on McAfee VirusScan Enterprise for Linux 1.6 or LinuxShield to McAfee VirusScan Enterprise for Linux version 1.7 using the epolicy Orchestrator software. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Create a temporary directory on your local drive. 3 Download the archive McAfeeVSEForLinux <build>-release.noarch.tar.gz and extract the files to the temporary directory. 4 Click Menu Software Master Repository. The Packages in Master Repository page appears. 5 Click Actions Check In Package. The Check In Package page appears. 6 Select the Package type as Product or Update (.ZIP) and browse in File path to locate the McAfee Agent for Linux package MSA-LNX_4.6.0_Package.ZIP extracted in the temporary directory. 7 Click Next. The Package Options page appears with the package information. 8 Select a Branch. 9 In Options, select the required option(s), then click Save. 10 Click Menu Software Master Repository. The Packages in Master Repository page appears. 11 Click Actions Check In Package. The Check In Package page appears. 12 Select the Package type as Product or Update (.ZIP) and browse in File path to locate McAfee VirusScan Enterprise for Linux product deployment package McAfeeVSEForLinux <build>-EPO.ZIP extracted in the temporary directory. 13 Click Next. The Package Options page appears with the package information. 14 Select a Branch. 15 In Options, select the required option(s), then click Save. 16 Click Menu Software Extensions. The Extensions page appears. 17 Click Install Extension to install the McAfee Agent policy extension. The Install Extension dialog box appears. 18 Click Browse, select the extension file EPOAGENTMETA.ZIP, then click OK on the Install Extension page. 19 Click Menu Software Extensions. The Extensions page appears. 20 Click Install Extension to install the McAfee VirusScan Enterprise for Linux policy extension. The Install Extension dialog box appears. 21 Click Browse, select the extension file LYNXSHLD1700.ZIP, then click OK on the Install Extension page. 12 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

13 Integrating with epolicy Orchestrator Sending an agent wake-up call 2 22 Click Menu Software Extensions. The Extensions page appears. 23 Click Install Extension to install the McAfee VirusScan Enterprise for Linux reports extension. The Install Extension dialog box appears. 24 Click Browse, select the extension file LYNXSHLD1700PARSER.ZIP, then click OK on the Install Extension page. Before installing the reports extension (LYNXSHLD1700PARSER.ZIP), ensure that you have removed the previous LinuxShield reports extension module (LYNXSHLDPARSER) from epolicy Orchestrator. 25 Click Menu Systems System Tree. The System Tree page appears. 26 To install McAfee VirusScan Enterprise for Linux on the client Linux computer: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 27 To schedule a client task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the task and select the Type as Product Deployment and click Next. On epolicy Orchestrator 4.6 Under Task to schedule, select McAfee Agent as Product, select the Task Type as Product Deployment, then click Create New Task under Task Name. 28 To configure the client task: On epolicy Orchestrator 4.5 Under Configuration, select the Target platforms as Linux and in Products and components, select VirusScan Enterprise for Linux <build number> from the drop-down list, then select the Action as Install. On epolicy Orchestrator 4.6 Under Client Task Catalog, select Linux as Target Platforms, VirusScan Enterprise for Linux <build number> as Products and components, Install as Action and the appropriate Language, then click Save. If you want to upgrade the McAfee Agent on the Linux client system to McAfee Agent 4.6, first add McAfee Agent for Linux x, then click the + button to add VirusScan Enterprise for Linux <build number> to upgrade both McAfee Agent and the product. 29 Click Next to schedule this task immediately or as required. 30 Click Next to view a summary of the task. 31 Click Save and send an agent wake-up call. Wait for the deployment task to complete. Sending an agent wake-up call Use this task to send an agent wake-up call to the client computer using epolicy Orchestrator. All systems in the network are managed in the Systems tab. The System Tree contains all systems that are managed by the epolicy Orchestrator server. It is the primary interface for managing policies and tasks on these systems. You can organize or sort these systems into logical groups in the System Tree. My Organization is the root of the System Tree. It includes a Lost&Found group that stores systems whose locations cannot be determined by the server. Depending on the methods you use to create and maintain the System Tree segments (systems), the server uses different characteristics to place the systems in the System Tree. McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

14 2 Integrating with epolicy Orchestrator Setting policies within epolicy Orchestrator Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree. 3 Select a group in the System Tree. 4 Select the Computer Name(s) of that group. 5 Click Actions Agent Wake Up Agents. The Wake Up McAfee Agent page appears. 6 Select the Wake-up call type as Agent Wake-Up Call and a Randomization period (0-60 minutes) by which the system(s) respond to the wake-up call sent by the epolicy Orchestrator server. 7 Select Get full product properties for the agent(s) to send complete properties instead of sending only those that have changed since the last agent-to-server communication. 8 Click OK. To see the status of the agent wake-up call, click Menu Automation Server Task Log. Setting policies within epolicy Orchestrator The epolicy Orchestrator console allows you to enforce policies across groups of computers or on a single computer. These policies override configurations set on individual computers. For information regarding policies and how they are enforced, see the McAfee epolicy Orchestrator 4.5 or 4.6 Product Guide. Before configuring any policies, select the group of computers for which you want to modify McAfee VirusScan Enterprise for Linux policies. You can modify McAfee VirusScan Enterprise for Linux policies from the pages and tabs that are available in the details pane of the epolicy Orchestrator console. These pages are nearly identical to those you can access directly from the McAfee VirusScan Enterprise for Linux user interface. After you have modified the appropriate policies and saved the changes for the intended computer or group of computers, you are ready to deploy new settings via the McAfee Agent. Creating or editing policies You can create, edit, delete, or assign a policy to a specific group in the System Tree. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree. The System Tree page appears. 3 Click Assigned Policies. 4 Select Product as VirusScan Enterprise for Linux A list of policies managed by McAfee VirusScan Enterprise for Linux appears in the lower pane. 5 Locate the required policy, and click Edit Assignment next to the policy. The policy assignment for the chosen group page appears. 14 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

15 Integrating with epolicy Orchestrator Scheduling tasks 2 6 Click Edit Policy or New Policy as required. If you click New Policy, the Create a new policy dialog box appears. Select the policy you want to duplicate from the Create a policy based on this existing policy drop-down list, type a name then click OK. The new policy wizard appears. 7 Edit the policy setting as required, then click Save. Enforcing policies You can enforce a policy to multiple managed systems within a group. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree and select a required group or system(s). 3 Click Assigned Policies and from the Product drop-down menu, select VirusScan Enterprise for Linux Select the Category and click Edit Assignment. 5 Select the policy from the Assigned policy drop-down menu and click Save. 6 Select the systems again. 7 Send an agent wake-up call. For instructions on sending an agent wake-up call, please refer to Sending an agent wake-up call section. You can create and enforce McAfee VirusScan Enterprise for Linux policies and view reports only after adding the McAfee VirusScan Enterprise for Linux extension files. Scheduling tasks The epolicy Orchestrator software allows you to create, schedule, and maintain client tasks that run on the managed systems. You can define client tasks for the entire System Tree, a specific group, or an individual system. Creating a Product Update task Use this task to schedule autoupdates on the Linux server using epolicy Orchestrator. Your software can only provide full protection if you keep it up-to-date with the latest anti-virus definitions (DATs), spam engine, and anti-virus scanning engine. We recommend that you update DAT files daily and regularly check the McAfee AVERT (Anti-Virus Emergency Response Team) website for new DAT files. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree and select a required group or system(s) for which you want to create the Product Update task. McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

16 2 Integrating with epolicy Orchestrator Scheduling tasks 3 To create a client task: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 4 To select the product update task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the task and select the Type as Product Update and click Next. On epolicy Orchestrator 4.6 Under Task to schedule, select McAfee Agent as Product, select the Task Type as Product Update, then click Create New Task under Task Name. 5 Click Next. 6 Schedule the task as desired and click Next to select the DAT, ExtraDAT and Linux Engine. 7 Schedule the task immediately or as required, then click Next to view the Summary of the product update task. 8 Click Save. 9 Send an agent wake-up call. Click Edit to change the description or schedule of a product update task or Delete to remove it. Creating an on-demand scan task Use this task to schedule an on-demand scan on the Linux client computer using epolicy Orchestrator. On-demand scan task involves a scheduled scanning of your Linux server(s) to find a threat, vulnerability, or other potentially unwanted code. It can take place immediately, at a scheduled time in the future, or at regularly-scheduled intervals. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree and select a required group or system(s) for which you want to create the on-demand scan task. 3 To create a client task: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 4 To create the on-demand scan task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the on-demand scan task and select the Type as On Demand Scan (VirusScan Enterprise for Linux 1.7.0) and click Next. On epolicy Orchestrator 4.6 Under Task to schedule, select VirusScan Enterprise for Linux as Product, select the Task Type as On Demand Scan, then click Create New Task under Task Name. 5 In Configuration, specify what you want this task to do, then click Next. 6 Schedule the task immediately or as required, then click Next to view the Summary of the on-demand scan task. 16 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

17 Integrating with epolicy Orchestrator Configuring reports 2 7 Click Save. 8 Send an agent wake-up call. Click Edit to change the description/schedule of an on-demand scan task or Delete to remove it. Configuring reports Reports are pre-defined queries which query the epolicy Orchestrator database and generate a graphical output. McAfee epolicy Orchestrator has its own querying and reporting capabilities. McAfee includes a set of default queries on the left pane. However, you can create a new query, edit, and manage all the queries related to McAfee VirusScan Enterprise for Linux. Task 1 Log on to the epolicy Orchestrator server as an administrator. If the pre-defined queries on the left side does not serve your purpose, epolicy Orchestrator enables you to create your own queries. 2 To view reports: On epolicy Orchestrator 4.5 Click Menu Reporting Queries. The Queries page appears. On epolicy Orchestrator 4.6 Click Menu Reporting Queries & Reports. The Queries & Reports page appears. 3 To create a new query: On epolicy Orchestrator 4.5 Click Actions New Query. The Query Wizard page appears. On epolicy Orchestrator 4.6 Click Actions New. The Query Builder page appears. 4 On the left pane, select a Feature Group that the query should retrieve. 5 Select a Result Type and click Next. The Chart page appears. 6 Select and accordingly configure a display chart/table and click Next. The Columns page appears allowing you to select columns for the chart/table. 7 Select column(s) from the Available Columns pane and click Next. 8 The Filter page appears. Specify criteria by selecting properties and operators to limit the data retrieved by the query. 9 Click Run, then Save. The Save Query page appears. 10 Type a Name and Notes (if required) for the query, then click Save. Table 2-1 Option definitions Option Delete Edit Duplicate Definition Deletes a selected query. Launches the Query Builder page loaded with the details of the selected query, where you can edit the details of a selected query. Creates and saves a copy of the selected query. McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

18 2 Integrating with epolicy Orchestrator Uninstallation Table 2-1 Option definitions (continued) Option Export Data Run Actions View Query SQL Import Query Definition Exports the selected query to an XML file that can be imported to any epolicy Orchestrator server. Runs the selected query and displays its result. Takes you to the View Query SQL page, where you can view and copy the SQL script of the selected query. Launches a dialog box that allows you to browse to an exported query file. When you import a query file, the server adds it to My Queries list. Running a default query 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Reporting Queries. A list of queries appear on the left pane. 3 Select VirusScan Enterprise for Linux under Shared Groups. 4 By default there are two VirusScan Enterprise for Linux queries: Query VSEL: VirusScan Enterprise for Linux Compliance VSEL: VirusScan Enterprise for Linux Threats Description Shows a graphical display of the compliant and non-compliant linux systems in the network. Shows a graphical display of the threat summary and action taken on all linux systems in the network. 5 Click Run. The graphical output is displayed. Uninstallation This section provides instructions to uninstall McAfee VirusScan Enterprise for Linux from the client computers and remove the extensions from the epolicy Orchestrator server. Removing McAfee VirusScan Enterprise for Linux from the client computer Use this task to remove McAfee VirusScan Enterprise for Linux from the client computer using epolicy Orchestrator. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree. The System Tree page appears. 3 To create a client task: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 18 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

19 Integrating with epolicy Orchestrator Uninstallation 2 4 To schedule a client task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the task and select the Type as Product Deployment and click Next. On epolicy Orchestrator 4.6 Under Task to schedule, select McAfee Agent as Product, select the Task Type as Product Deployment, then click Create New Task under Task Name. 5 To configure the client task: On epolicy Orchestrator 4.5 Under Configuration, select the Target platforms as Linux and in Products and components, select VirusScan Enterprise for Linux <build number> from the drop-down list, then select the Action as Remove. On epolicy Orchestrator 4.6 Under Client Task Catalog, select Linux as Target Platforms, VirusScan Enterprise for Linux <build number> as Products and components, Remove as Action and the appropriate Language, then click Save. 6 Click Next to schedule the task immediately or as required. 7 Click Next to view a summary of the task. 8 Click Save and send an agent wake-up call. Removing McAfee VirusScan Enterprise for Linux from epolicy Orchestrator Use this task to remove McAfee VirusScan Enterprise for Linux from the epolicy Orchestrator repository. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Software Master Repository. The Packages in Master Repository page appears. 3 Click the Delete link of VirusScan Enterprise for Linux with Version as To remove the product and reports extension, click Menu Software Extensions. The Extensions page appears. 5 From the left pane, select VirusScan Enterprise for Linux. 6 For the report extension file McAfee VirusScan Enterprise for Linux Reports, then click Remove. 7 Select the option Force removal, bypassing any checks or errors, then click OK. 8 For the product extension file VirusScan Enterprise for Linux and click Remove. 9 Select the option Force removal, bypassing any checks or errors, then click OK. McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

20 2 Integrating with epolicy Orchestrator Uninstallation 20 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and 4.6.0

21 Index A about McAfee VirusScan Enterprise for Linux 7 VirusScan Enterprise for Linux 7 about this guide 5 audience 7 C conventions and icons used in this guide 5 D documentation audience for this guide 5 product-specific, finding 6 typographical conventions and icons 5 F features administration 7 reporting 7 scanning 7 VirusScan Enterprise for Linux 7 I introduction McAfee VirusScan Enterprise for Linux 7 VirusScan Enterprise for Linux 7 L Linuxshield previously known as 7 M McAfee ServicePortal, accessing 6 McAfee VirusScan Enterprise for Linux introduction 7 P product features 7 S ServicePortal, finding product documentation 6 T Technical Support, finding product information 6 V VirusScan Enterprise for Linux features 7 introduction 7 W what's in this guide 6 McAfee VirusScan Enterprise for Linux Software Configuration Guide For use with epolicy Orchestrator and

22 00