McAfee Public Cloud Server Security Suite

Transcription

1 Installation Guide McAfee Public Cloud Server Security Suite For use with McAfee epolicy Orchestrator

2 COPYRIGHT Copyright 2015 McAfee, Inc., 2821 Mission College Boulevard, Santa Clara, CA 95054, , TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Public Cloud Server Security Suite Installation Guide

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Introduction 7 McAfee Public Cloud Server Security suite Installation 9 Requirements Installing the Public Cloud Security extension Download and install the extension manually Install the extension through Software Manager Configuring your security products and viewing reports Launching the PCS suite AMI 13 Products in PCS suite AMI Launch the PCS suite AMI Configure and deploy McAfee security products Verifying McAfee security products PCS support for public clouds Operating system support for McAfee products 19 5 Use DevOps scripts to deploy McAfee products 21 Using Chef Using Puppet Using Amazon OpsWorks Using AWS UserData for McAfee Agent deployment Index 23 McAfee Public Cloud Server Security Suite Installation Guide 3

4 Contents 4 McAfee Public Cloud Server Security Suite Installation Guide

5 Preface This guide provides the information you need to work with your McAfee product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Conventions This guide uses these typographical conventions and icons. Book title, term, emphasis Bold User input, code, message Interface text Hypertext blue Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. McAfee Public Cloud Server Security Suite Installation Guide 5

6 Preface Find product documentation Find product documentation After a product is released, information about the product is entered into the McAfee online Knowledge Center. Task 1 Go to the Knowledge Center tab of the McAfee ServicePortal at 2 In the Knowledge Base pane, click a content source: Product Documentation to find user documentation Technical Articles to find KnowledgeBase articles 3 Select Do not clear my filters. 4 Enter a product, select a version, then click Search to display a list of documents. 6 McAfee Public Cloud Server Security Suite Installation Guide

7 1 Introduction 1 This document explains about McAfee Public Cloud Server Security (PCS) suite and provides guidelines for installing the Public Cloud Security extensions and packages on McAfee epolicy Orchestrator (McAfee epo ). McAfee Public Cloud Server Security suite The PCS suite includes McAfee epo and a set of extensions for managed products that install on the McAfee epo server. McAfee epo McAfee Agent 4.8 patch 3 Public Cloud Security extension McAfee Firewall for Linux McAfee VirusScan Enterprise 8.8 patch 6 McAfee VirusScan Enterprise for Linux McAfee VirusScan Enterprise for Linux McAfee Host Intrusion Prevention for Servers 8.0 patch 6 McAfee Host Intrusion Prevention for Linux 8.0 patch 6 McAfee Application Control (for Windows) McAfee Application Control (for Linux) McAfee Change Control (for Windows) McAfee Change Control (for Linux) Public Cloud Security extension The Public Cloud Security extension contains extensions and packages for these products. Data Center Connector for AWS Data Center Connector for Microsoft Azure McAfee Data Protection for Cloud Cloud Usage Metering Assurance Information Module McAfee Public Cloud Server Security Suite Installation Guide 7

8 1 Introduction McAfee Public Cloud Server Security suite When you install the Public Cloud Security extension, the extensions are installed and packages checked in to your McAfee epo server. For information about each one of these products in the PCS suite, see the product guides of these products. 8 McAfee Public Cloud Server Security Suite Installation Guide

9 2 Installation 2 Install the Public Cloud Security extension on the McAfee epo server and deploy and configure your McAfee products. Contents Requirements Installing the Public Cloud Security extension Configuring your security products and viewing reports Requirements To install the Public Cloud Security extension, make sure that your environment meets these requirements. Component McAfee epo Version McAfee Agent 4.8 patch 3 Amazon Web Services account Microsoft Azure account 4.6.8, 4.6.9, 5.1.1, 5.1.2, 5.3.0, or later Installing the Public Cloud Security extension You can install the Public Cloud Security extension with the Software Manager utility on McAfee epo, or by manually downloading and installing the extension from McAfee download site. Download and install the extension manually Download and install the Public Cloud Security package on the McAfee epo server. Task For option definitions, click? in the interface. 1 From the McAfee download site ( use your grant number and click McAfee Public Cloud Server Security suite. 2 From the products listed, select and download the Public Cloud Security extension for your version of McAfee epo. Public_Cloud_Security_ePO_4.6.x.zip Public_Cloud_Security_ePO_5.x.zip McAfee Public Cloud Server Security Suite Installation Guide 9

10 2 Installation Configuring your security products and viewing reports 3 Log on to the McAfee epo server as an administrator. 4 Select Menu Software Extensions Install Extension. 5 Browse to and select the extension file, then click OK. For McAfee epo 4.6.8, unzip Public_Cloud_Security_ePO_4.6.x.zip and install the extension Public_Cloud_Security_Extensions_ePO_4.6.x.zip. You need to extract and check in the software deployment packages separately. For details on how to check in the software deployment packages to McAfee epo 4.6.x, see McAfee epo 4.6.x product guide. For McAfee epo 5.x, install Public_Cloud_Security_ePO_5.x.zip. The software deployment packages are automatically checked in to the Master Repository when using Public_Cloud_Security_ePO_5.x.zip. The Install Extension page displays the extension name and version details. The Public Cloud Security package is installed. Install the extension through Software Manager Use McAfee epo Software Manager to install the Public Cloud Security extension. This feature is available on McAfee epo 5.x or later. Task For option definitions, click? in the interface. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Software, then click Software Manager. 3 From the Product Categories list, select the connector extension and McAfee Data Protection for Cloud extension from Software Not Checked In Licensed, then click Check In All. The Public Cloud Security extension is installed through the Software Manager. Configuring your security products and viewing reports After installing the Public Cloud Security extension, complete these tasks to configure the products in the software extension on your McAfee epo. 1 Register your Microsoft Azure cloud account with McAfee epo, so that McAfee epo discovers, imports, and displays the VM information in the System Tree. For details, see Register Microsoft Azure account in the Data Center Connectors Product Guide. 2 Register your AWS cloud account with McAfee epo, so that McAfee epo discovers, imports, and displays the VM information in the System Tree. It also discovers EBS volumes. For details, see Register AWS account in Data Center Connectors Product Guide. 3 When you select System Tree, you can see that your EC2 instances have been discovered. You can assign product installation or configuration client tasks and policies to the AWS group in the System Tree. 10 McAfee Public Cloud Server Security Suite Installation Guide

11 Installation Configuring your security products and viewing reports 2 4 Deploy McAfee Data Protection for Cloud to your managed systems with the product deployment client task. For details, see Deploy Data Protection to the client system in the McAfee Data Protection for Cloud Product Guide. 5 Select Data Protection for Cloud to see that it displays all zones from your registered AWS cloud account. You can encrypt volumes from here. For details, see Performing encryption in McAfee Data Protection for Cloud Product Guide. 6 Track the usage of AWS and Microsoft Azure cloud VMs using the metering feature. You can get a monthly report of your usage hours for your cloud instances. You can also create custom queries to display this information. For details, see Cloud Usage Metering in Data Center Connectors Product Guide. 7 Select Dashboard Public Cloud to see the security summary of your EC2 instances and EBS volumes. You can also see details about Data Centers, OS Distribution, Anti-Malware Status, Security Incidents, Host Firewall Status, File Integrity Monitoring Status, Data Protection Per Cloud Volumes, Data Protection Per Cloud VM, and Usage Metering Report. For details, see Dashboards and monitors in Data Center Connectors Product Guide. McAfee Public Cloud Server Security Suite Installation Guide 11

12 2 Installation Configuring your security products and viewing reports 12 McAfee Public Cloud Server Security Suite Installation Guide

13 3 Launching 3 the PCS suite AMI You can use the McAfee Public Cloud Server Security Suite(PCS) AMI from the AWS marketplace to launch McAfee epo with all the PCS products to secure your cloud instances. Contents Products in PCS suite AMI Launch the PCS suite AMI Configure and deploy McAfee security products Verifying McAfee security products PCS support for public clouds Products in PCS suite AMI Launch this AMI to have your epolicy Orchestrator server set up with these McAfee products, and preconfigured with policies and tasks. McAfee epo McAfee Agent 4.8 patch 3 Data Center Connector for AWS Data Center Connector for Microsoft Azure McAfee Data Protection for Cloud Assurance Information Module Cloud Usage Metering McAfee VirusScan Enterprise 8.8 patch 6 McAfee VirusScan Enterprise for Linux McAfee VirusScan Enterprise for Linux McAfee Host Intrusion Prevention for Servers 8.0 patch 6 McAfee Host Intrusion Prevention for Linux 8.0 patch 6 McAfee Firewall for Linux McAfee Application Control (for Windows) McAfee Application Control (for Linux) McAfee Change Control (for Windows) McAfee Change Control (for Linux) McAfee Public Cloud Server Security Suite Installation Guide 13

14 3 Launching the PCS suite AMI Launch the PCS suite AMI This AMI makes the McAfee epo deployment process simple and easy. This is bring your own license PCS AMI with 30 day trial. Launch the PCS suite AMI Launch McAfee epo preconfigured with McAfee security products. Before you begin You must have power user permissions for EC2 (Elastic Cloud Compute) and EBS (Elastic Block Store) web service. Task 1 From the AWS Marketplace, select McAfee Public Cloud Server Security Suite (PCS) AMI, then select Launch. 2 On the Choose an instance type screen, select the hardware configuration. For McAfee epo, the recommended minimum setting is type m3 large with 2 vcpus, and a minimum 7.5 GB of memory. 3 Click Next: Configure instance Details and specify any configuration details. 4 Click Next: Add Storage and specify any storage details. We recommend General Purpose SSD for Volume Type. 5 Click Next: Tag Instance and specify a tag for your instance. 6 Click Next: Configure Security Group. We recommend that you leave the default settings. Ports 8443 and 80 must be available for McAfee epo. To create a more secure Security Group, see the product guide for your version of McAfee epo for port configuration specifications. 7 Click Launch. 8 In the Select an existing key pair or create a new key pair dialog box, select Choose an existing key pair, to select a key pair that you already created, or create a new key pair. 9 Select the acknowledgment checkbox, then click Launch Instances. It can take approximately 45 minutes to launch McAfee epo. A confirmation page lets you know that your instance is launching. Click View Instances to close the confirmation page and return to the console. 14 McAfee Public Cloud Server Security Suite Installation Guide

15 Launching the PCS suite AMI Configure and deploy McAfee security products 3 10 From Instances, right-click the instance and select Instance Settings Get System Log. The system log shows you the success or failure messages of launching your instance. The system log also shows the URL and credentials for your McAfee epo account. If there are failures, you can contact us through this group pcs. The system log shows this message after McAfee epo installation is complete. McAfee-ePO has been installed successfully. The epo admin console password is xxxxxxxxxx. Login to epo via the url with a user of admin and the password mentioned above. 11 To log on to McAfee epo, open a web browser and type epo IP address>:8443. The default user name is Admin and the password is specified in the system log. The password specified in the system log is the password for McAfee epo admin console and also for the SQL database. The default SQL authentication user is sa. You must change the McAfee epo admin console and the SQL database password. See the McAfee epo product guide to change the admin console password. See Microsoft SQL documentation to change the default database password. 12 Update the configuration file using the link epo IP address>:8443/core/ config with the new SQL database password. This makes sure that the McAfee epo server connects to the database. Configure and deploy McAfee security products Configure security products on your McAfee epo server. Register your cloud accounts, encrypt volumes and view reports for your systems. Task For option definitions, click? in the interface. 1 Install the extension for McAfee Host Intrusion Prevention for Servers on your McAfee epo server. This extension McAfee_HostIPS_Extension_924 is available on the desktop of your instance. You can remotely log on to your instance and install this extension. 2 Log on to the McAfee epo server as an administrator. 3 Select Menu Software Extensions Install Extension browse and select McAfee_HostIPS_Extension_924. Click OK. Your McAfee Host Intrusion Prevention for Servers extension is installed on the McAfee epo server. 4 Register your cloud account and discover your AWS cloud instances. Select Menu Configuration Registered Cloud Accounts and register your AWS account. For details, see Data Center Connectors Product Guide. 5 Select Menu Systems System Tree, you can see that all your EC2 instances have been discovered and are Unmanaged. For details about managing discovered instances, see McAfee Agent Product Guide. McAfee Public Cloud Server Security Suite Installation Guide 15

16 3 Launching the PCS suite AMI Verifying McAfee security products 6 Download and install McAfee Agent on the systems that you want to secure. For details, see the product guide of McAfee Agent. If you have Active Directory available on your cloud, you can install McAfee Agent on your instances while you register your AWS cloud account. For details see Register AWS account in Data Center Connectors Product Guide. Systems are changed to Managed on the System Tree. 7 To deploy the PCS suite products to your group of systems, select Menu Policy Client Task Catalog. Here choose Deploy PCS-Windows or Deploy PCS-Linux. For example, you can deploy PCS suite products to your AWS group of systems. All McAfee products in the PCS suite are installed on all the systems in this group. 8 Select Data Protection for Cloud, to see that it displays all zones from your registered AWS cloud account. You can encrypt volumes from here. For details, see Performing encryption in McAfee Data Protection for Cloud Product Guide. 9 From Volume Tree, select Data Protection for Cloud, to see the encryption status of EBS volumes. For details, see McAfee Data Protection for Cloud Product Guide. 10 Select Dashboard Public Cloud, to see the security summary of your EC2 instances and EBS volumes. Your instances are now protected with anti-virus, anti-malware, intrusion prevention, and file integrity monitoring. The dashboard is automatically updated to reflect the detailed security posture of new instances as they are launched on AWS. If the dashboard shows green on all charts, your instances and volumes are fully protected from threats. For details about dashboard, see Dashboards and monitors in Data Center Connectors Product Guide. For details about EBS volumes, see McAfee Data Protection for Cloud Product Guide. Verifying McAfee security products Verify that McAfee security products are installed correctly on your McAfee epo instance so that your systems are secure. To test anti-virus: run the Eicar test on the endpoint and verify that the file is blocked. For details about Eicar, see To test McAfee Data Protection for Cloud: from the Volume Tree, select a volume that is not encrypted and select the Encrypt action. You can see that the volume gets encrypted. To test McAfee Host Firewall for Linux: check the status on client by using this command /opt/ McAfee/mfw/bin/mfw --fw status. If the application is installed, the status is shown as Enabled or Disabled. To test File Integrity Monitoring status: make a change to the hosts file to see that the change is reported on the McAfee epo server. 16 McAfee Public Cloud Server Security Suite Installation Guide

17 Launching the PCS suite AMI PCS support for public clouds 3 PCS support for public clouds This is the PCS suite support for the public clouds. Host-based security (AV, FW, IPS, AC,CC) Cloud Connector Usage-based licensing Encryption Management Amazon Web Services Microsoft Azure OpenStack based clouds (Rackspace, HP Helion, IBM Softlayer) Other cloud providers (Verizon, VMware vcloudair, Google) McAfee Public Cloud Server Security Suite Installation Guide 17

18 3 Launching the PCS suite AMI PCS support for public clouds 18 McAfee Public Cloud Server Security Suite Installation Guide

19 4 Operating system support for McAfee products These are the supported operating systems for the products in the PCS suite. Operating system VirusScan Enterprise Host Firewall Host Intrusion Prevention Application Control Change Control Data Protection for Cloud (AWS only) Windows Windows 2008/R2 Windows 2012/R2 Linux (64-bit) RHEL 6 and variants (Cent OS, Oracle EL, Amazon Linux) (RHEL) RHEL 7 and variants (Cent OS, Oracle EL, Amazon Linux) (RHEL) (RHEL) SLES 11 (SP1) SLES 12 Ubuntu Server 12 Ubuntu Server 14, 15 See this KnowledgeBase article KB84007 for details about RHEL6 support for McAfee Data Protection for Cloud. See this KnowledgeBase article KB51109 for details about supported environments for different products. McAfee Public Cloud Server Security Suite Installation Guide 19

20 4 Operating system support for McAfee products 20 McAfee Public Cloud Server Security Suite Installation Guide

21 5 Use 5 DevOps scripts to deploy McAfee products You can use automation platforms like Chef and Puppet to deploy McAfee products on the virtual instances without using McAfee epo. Contents Using Chef Using Puppet Using Amazon OpsWorks Using AWS UserData for McAfee Agent deployment Using Chef Chef is an automation platform used for managing and automating large-scale infrastructure. For details about using Chef to configure security solutions provided by McAfee, see this McAfee KnowledgeBase article KB Using Puppet Puppet is an automation platform used for managing and automating large-scale infrastructure. Puppet relies on the manifests and modules created in a custom declarative language. For details about using Puppet to configure security solutions provided by McAfee, see this McAfee KnowledgeBase article KB Using Amazon OpsWorks AWS OpsWorks features an integrated management experience for the entire application lifecycle including resource provisioning, configuration management, application deployment, monitoring, and access control. It works with applications of any level of complexity and is independent of any particular architectural pattern For details about using Amazon OpWorks to configure security solutions provided by McAfee, see this McAfee KnowledgeBase article KB McAfee Public Cloud Server Security Suite Installation Guide 21

22 5 Use DevOps scripts to deploy McAfee products Using AWS UserData for McAfee Agent deployment Using AWS UserData for McAfee Agent deployment You can create an Agent deployment URL and use AWS UserData to install McAfee Agent on AWS instances. For details, see this McAfee KnowledgeBase article: KB McAfee Public Cloud Server Security Suite Installation Guide

23 Index A about this guide 5 accounts, registering AWS 10 Azure 10 Amazon Machine Image configuring products 15 deploying products 15 Amazon OpsWorks, product deployment 21 automation platform chef 21 puppet 21 AWS account, registering 10 Azure account, registering 10 C Chef, product deployment 21 cloud usage metering 10 configuration overview 10, 15 security products 10, 15 conventions and icons used in this guide 5 D dashboards, public cloud anti-malware status 10, 15 application reputation 10 Data Center 10 File Integrity Monitoring Status 10, 15 Firewall Status 10 OS Distribution 10 security incidents 10 Data Center Connectors 10, 15 deployment methods DevOps scripts 21 McAfee epo 9 PCS AMI 13 DevOps scripts for product deployment 21 documentation audience for this guide 5 product-specific, finding 6 typographical conventions and icons 5 E encrypting volumes 10 extensions downloading 9 installing 9 products included in package 7 M McAfee ServicePortal, accessing 6 P PCS AMI hardware configuration 14 launching 14 password 14 ports 14 products 13 security group 14 products included in package 7 Public Cloud Security extension about 7 downloading, installing 9 products 7 requirements 9 using Software Manager 10 Public Cloud Server Security suite about 7 products 7 Puppet, product deployment 21 R requirements 9 S scripts, product deployment 21 ServicePortal, finding product documentation 6 Software Manager, installation 10 T technical support, finding product information 6 McAfee Public Cloud Server Security Suite Installation Guide 23

24 0-00