SafeGuard PortProtector 3.30 SP6 Installation guide

Transcription

1 SafeGuard PortProtector 3.30 SP6 Installation guide Document date: March 2010

2 Important Notice This guide is delivered subject to the following conditions and restrictions: This guide contains proprietary information belonging to Sophos. Such information is supplied solely for the purpose of assisting explicitly and properly authorized SafeGuard PortProtector users. No part of its contents may be used for any other purpose, disclosed to any person or firm or reproduced by any means, electronic or mechanical, without the express prior written permission of Sophos. The text and graphics are for the purpose of illustration and reference only. The specifications on which they are based are subject to change without notice. The software described in this guide is furnished under a license. The software may be used or copied only in accordance with the terms of that agreement. Information in this guide is subject to change without notice. Corporate and individual names and data used in examples herein are fictitious unless otherwise noted. The information in this document is provided in good faith but without any representation or warranty whatsoever, whether it is accurate, or complete or otherwise and on express understanding that Sophos shall have no liability whatsoever to other parties in any way arising from or relating to the information or its use. SafeGuard PortProtector and SafeGuard PortAuditor are OEM versions of Safend Protector and Safend Auditor from Safend. Therefore some screenshots throughout this manual may still contain the Safend branding but mean the same as within the SafeGuard OEM version. Boston, USA Oxford, UK Copyright Sophos. All rights reserved. All trademarks are the property of their respective owners. Other company and brand products and service names are trademarks or registered trademarks of their respective holders. 2

3 About This Guide This Installation Guide is comprised of the following chapters: Chapter 1, Installation Workflow, suggests workflow for using the SafeGuard PortProtector solution to protect your organization's endpoints. Chapter 2, Preparing for Installation, describes the SafeGuard PortProtector architecture and the SafeGuard PortProtector installation workflow. It then describes the system requirements and prerequisites for installation and all the preparations that need to take place before installing SafeGuard PortProtector. Chapter 3, Installing SafeGuard PortProtector Management Server, describes how to install, restore and upgrade the SafeGuard PortProtector Management Server, and how to launch the SafeGuard PortProtector Management Console. Chapter 4, Installing SafeGuard PortProtector Management Console, describes how to install SafeGuard PortProtector Management Console. Chapter 5, Installing SafeGuard PortProtector Client, describes the various methods for installing, or deploying, SafeGuard PortProtector Client. It also explains how to uninstall and upgrade SafeGuard PortProtector Client. Appendix A - OPSEC Interoperability, describes Check Point's OPSEC and how it interfaces with SafeGuard PortProtector. Appendix B - NAC Interoperability, describes Cisco's NAC and how it interfaces with SafeGuard PortProtector. 3

4 Contents 1 Installation Workflow Preparing for Installation Installing SafeGuard PortProtector Management Server Installing SafeGuard PortProtector Management Console Installing SafeGuard PortProtector Client Appendix A - OPSEC Interoperability Appendix B - NAC Interoperability

5 1 Installation Workflow About This Chapter Before installing SafeGuard PortProtector V3.3, it is important to fully understand the implementation process of the SafeGuard PortProtector solution. This chapter suggests a workflow for using the SafeGuard PortProtector solution to protect your organization's data. It contains the following section: SafeGuard PortProtector Implementation Workflow describes the workflow for implementing and using SafeGuard PortProtector. 5

6 1.1 SafeGuard PortProtector Implementation Workflow The following is an overview of the workflow for implementing and using SafeGuard PortProtector. 6

7 Step 1: Install the SafeGuard PortProtector Management Server and Console, as described in Chapter 2, Preparing for Installation and Chapter 3, Installing SafeGuard PortProtector Management Server. Step 2: Install Additional Management Consoles, as described in Chapter 4, Installing SafeGuard PortProtector Management Console. Step 3: Define General SafeGuard PortProtector Administration Settings, such as the method in which policies are published, as described in Chapter 7, Administration in SafeGuard PortProtector User help. Step 4: Scan Computers and Detect Port/Device Usage. Use SafeGuard PortAuditor to detect the ports that have been used in your organization and the devices and WiFi networks that are or were connected to these ports, as described in SafeGuard PortAuditor User help. Step 5: Define SafeGuard PortProtector Policies. In this stage you define the blocked, allowed and restricted ports, devices and WiFi networks according to the security and productivity requirements of your organization as described in Chapter 3, Defining Policies in SafeGuard PortProtector User help. Step 6: Install SafeGuard PortProtector Client on Endpoints, as described in Chapter 5, Installing SafeGuard PortProtector Client. Step 7: Distribute SafeGuard PortProtector Policies to Endpoints: in this stage, you can either associate policies to users and computer and distribute directly to endpoints (via SSL), or use Active Directory's GPO feature to distribute SafeGuard PortProtector Policies or any other third-party tool, as described in Chapter 4, Distributing Policies in SafeGuard PortProtector User help. Step 8: Endpoints are Protected by SafeGuard PortProtector Policies: in this stage, only approved devices and WiFi networks can be used, through permitted ports. Logs about port, device and WiFi network use and attempted use, as well as tampering attempts, are created and sent to the Management Server as described in Chapter 8, End-User Experience in SafeGuard PortProtector User help. Step 9: Monitoring Logs and Alerts, view and export the log entries generated by SafeGuard PortProtector Clients, as described in Chapter 5, Viewing Logs in SafeGuard PortProtector User help. 7

8 2 Preparing for Installation About This Chapter This chapter first describes the SafeGuard PortProtector architecture and the SafeGuard PortProtector installation workflow. It then specifies the system requirements and prerequisites for installing the different components of SafeGuard PortProtector, followed by instructions on how to prepare the network for installation. It contains the following sections: System Requirements, page 9, describes the system requirements for each one of the SafeGuard PortProtector components. Preparing your Network, page 10, describes the preparation that needs to be done on your network in order to allow the different SafeGuard PortProtector components to communicate without interruptions. Tips on preparing your Endpoints, page 11, describes the preparation that needs to be done on your endpoints before installing SafeGuard PortProtector in order to optimize the security of your network. 8

9 2.1 System Requirements Following are the system requirements for the various system components: SafeGuard PortProtector Client Requirements SafeGuard PortProtector Console Requirements SafeGuard PortProtector Server Requirements Operating System Windows XP Professional (SP 1-3) Windows XP 64 bit Professional (SP 2-3) note that there is a separate MSI from version 3.2 for 64 bit OS Windows XP Professional (SP 2) Windows 2003 Server (SP 1-2) Windows XP Professional (SP2 not supported for production environments) Windows 2003 Server (SP 1-2) Windows 2003 Server (SP 1-2) Windows 2000 SP4 Rollup 1 Windows Vista Business/Enterprise /Ultimate (SP 1-2) 32- bit Windows 7 Business/ Enterprise/Ultimate 32-bit Hardware Pentium 800 MHz 256 MB RAM 50 MB HDD space Pentium 800 MHz 256 MB of RAM 50 MB HDD space The server hardware requirements depend on the number of installed SafeGuard PortProtector clients. To obtain the specifications suitable for your organization, please contact your local Sophos reseller or Sophos support at support@sophos.com. Software Microsoft.NET Framework 2.0 (Make sure that the server and console are installed with the same.net 2.0 SP) Microsoft.NET Framework 2.0 (Make sure that the server and console are installed with the same.net 2.0 SP) Microsoft IIS 9

10 2.2 Preparing your Network Before installing the system, be sure to enable the following communications in your network and personal firewalls. To prepare your network: 1 In order to communicate freely between the SafeGuard PortProtector management Server and the SafeGuard PortProtector Clients, make sure that the SSL port is open in your network firewall. Sophos typically uses port 443 (SSL standard) for this. If you have chosen otherwise, make sure to allow this port in your firewall. 2 In order for the SafeGuard PortProtector Management Console to be able to control clients (send control commands to clients to send their logs and update their policy), it needs WMI ports to be open on the personal firewalls of each endpoint. WMI uses port 135 and a series of random ports Opening WMI ports on Windows XP (SP2) Firewall If you are using Windows XP (SP2) firewall as the personal firewall on your endpoints, you can use the GPO mechanism to configure endpoints to accept incoming WMI communications. The following section is quoted from Microsoft documentation. "Without configured exceptions, Windows Firewall will drop traffic for server, peer, or listener applications and services. Therefore, it is likely you will want to configure Windows Firewall for exceptions to ensure that the Windows Firewall works appropriately for your environment. Windows Firewall settings are available for Computer Configuration only. They are located in Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall. Identical sets of policy settings are available for two profiles: Domain profile. Used when computers are connected to a network that contains your organization s Active Directory domain. Standard profile. Used when computers are not connected to a network that contains your organization s Active Directory domain, such as a home network or the Internet. The relevant policy setting for WMI is: Windows Firewall: Allow remote administration exception This allows remote administration of this computer using administrative tools such as the Microsoft Management Console (MMC) and Windows Management Instrumentation (WMI). To do this, Windows Firewall opens TCP ports 135 and 445. Services typically use these ports to communicate using RPC and DCOM. The default is Not Configured". 10

11 2.3 Tips on Preparing Your Endpoints Booting via an external boot device (floppy, CD etc.) will circumvent any security software. However, there are a few ways to either prevent this scenario from happening, or make it impossible to be able to read the data outside the Sophos protected operating system: Changing the boot sequence: Change the boot sequence so that the machine does not boot first from the floppy, then the CD\DVD-ROM, and, finally, the hard disk drive. The hard disk drive should always be the first boot device. If the floppy or the CD\DVD-ROM is the initial boot device, anyone can use a bootable medium that can directly access the hard disk drive and reset the administrator password in seconds. Physical seal \ chassis protection: Make sure that the hardware is sealed and that the hard disk drive cannot be simply disconnected. Setting a password to protect the BIOS: This prevents users from entering the BIOS and re-enabling the boot access through devices other than the internal hard disk drive. Disk Encryption: Several disk encryption software packages are available in the market. These are used to encrypt the entire disk, making sure that the data can be read only when loading the operating system (which contains a decrypt-able client). Booting from any external boot device will not prove useful since all data will be encrypted. SafeGuard PortProtector Client has been tested to work along with the leading software products of this type, including PGP Wholedisk, Sophos SafeGuard Easy, WinMagic and Pointsec. 11

12 3 Installing SafeGuard PortProtector Management Server About This Chapter This chapter describes how to install SafeGuard PortProtector Management Server and contains the following sections: Prerequisites, describes the requirements for installing the management server. Installing Prerequisite Software, describes how to install Microsoft.NET framework and IIS. Before Installing SafeGuard PortProtector Management Server, provides a checklist of issues you need to verify before starting the installation process. Installing the Management Server, describes how to install the SafeGuard PortProtector Management Server for the first time and how to launch the SafeGuard PortProtector Management Console. Restoring an Existing Management Server, describes how to restore an existing SafeGuard PortProtector Management Server in case of hardware upgrade or failure. Upgrading the Management Server, explains how to upgrade SafeGuard PortProtector from version 3.2 to version 3.3. Post-Installation Settings (Checklist), lists a set of critical settings to define after installation. Uninstalling SafeGuard PortProtector Management Server, explains how to uninstall SafeGuard PortProtector Management Server. Changing your Database, explains how to switch from using an embedded SafeGuard PortProtector database to and external MS SQL database, and vice versa. 12

13 3.1 Prerequisites Operating System Windows XP Professional (SP0-2) 32-bit Windows 2003 Server (SP0-2) 32-bit Hardware The server hardware requirements depend on the number of installed SafeGuard PortProtector Clients. To obtain the specifications suitable for your organization, please contact your local Sophos reseller or Sophos support at Software Microsoft.NET Framework 2.0 installed Microsoft Internet Information Services (IIS) 3.2 Installing Prerequisite Software Installing Microsoft.NET Framework 2.0 To install.net Framework Microsoft.NET Framework 2.0 is built in by default on Windows 2003, and can be downloaded for free from the Microsoft website for Windows XP. Link to.net framework 2.0 installation package: 13

14 3.2.2 Installing Microsoft IIS To install Microsoft IIS: 1 In Control Panel on your computer, double-click Add or Remove Programs. The Add or Remove Programs window opens. 2 Click Add/Remove Windows Components. The Windows Components Wizard window opens. 3 If you are installing the application on a machine running Windows 2003, check the Application Server checkbox. If you are installing IIS on a machine running Window XP, check the Internet Information Services checkbox, as shown below: 4 Click Next. 5 The Insert Disk window opens, asking for the utility disc or location that holds the relevant Microsoft Windows installation components: 6 Insert the disc and click OK. The installation may take a few moments. 14

15 7 When the wizard notifies you that the installation is complete, as shown in the following figure, click Finish to close the wizard. IIS is now installed. 3.3 Before Installing SafeGuard PortProtector Management Server 1 Verify that all system requirements and prerequisites are met. 2 Make sure that the SafeGuard PortProtector Server machine belongs to the same domain in which you intend to deploy SafeGuard PortProtector policies. 3 Make sure that a MySQL DB is not installed on the SafeGuard PortProtector Management Server machine. 15

16 3.4 Installing the Management Server To install SafeGuard PortProtector Management Server: 1 Locate on your installation CD. 2 Double-click the file. The SafeGuard PortProtector Server Installation window appears: 3 Click Browse to select a destination folder for the extracted installation files. Note: Make sure that the files are extracted to a local folder. The installation will not run from a network path. 4 Click Install. 16

17 5 Following extraction, you will be asked to select the SafeGuard PortProtector Server language, as shown below: 6 Select the required language and click OK. The first step of the installation wizard appears: 17

18 Click Next and read the End User License Agreement. After accepting, click Next again. The Installation Mode step opens: Select one of the following options: For a new installation select the New radio button and proceed to step 9 below. For instructions regarding the Restore option, refer to Restoring an Existing Management Server on page 33). To join a server cluster, select the Join a Cluster radio button. A server cluster enables the installation of several SafeGuard PortProtector Management Servers connected to a single external database, so that they seamlessly share the load of traffic from the endpoints, as well as to provide redundancy and high availability. 18

19 The following window opens: 7 Click Next. The Database window opens: SafeGuard PortProtector can create its own internal database for storing configuration and data. Alternatively, you can use an existing external database. Note: SafeGuard PortProtector supports MS SQL 2000 and up. 8 In the Database window, select the required radio button. Select the first radio button if you want to use a database which resides on the same machine as the Management Server (the database is managed by SafeGuard PortProtector Management Server). Select the second option if you have an MS SQL database on another machine and you want to use it as your SafeGuard PortProtector database. Note: If you select to use an existing external database, this database must already be installed. 19

20 9 Click Next. If you selected to install an embedded database, skip to Step If you have selected to use an existing database server or to join a cluster, the following window opens: 11 In the Database Credentials window, perform the following steps: a. In the Database Server field, enter the database server name (for a non-default instance use the format server\instance). b. Under Database authentication mode, click the appropriate radio button to select whether to use MS SQL Security or Microsoft Windows Security. c. Enter database authentication credentials User Name and Password. If you selected Microsoft Windows Security you must also enter a Domain name. 12 Click Next. The installation program validates access to the database. Note: If validation fails, re-enter the correct information, or click Cancel to exit the installation wizard. 20

21 Note: If a valid SafeGuard PortProtector database already exists on this database server, the following window opens: In this window, click Yes in order to overwrite the existing database. If you wish to use the existing database, click No and skip to Restoring an Existing Management Server on page The Destination Folder step opens: 21

22 14 Click Next to select the default installation folder: C:\Program Files\Sophos\SafeGuard PortProtector, or click Change to select a different installation folder then click Next. The Domain Credentials window opens: 15 In the Domain Credentials window, enter the domain user credentials: SafeGuard PortProtector Management Server requires a domain account from your Active Directory in order to perform tasks such as creating GPOs and for controlling clients via WMI. We recommend that you enter an account with domain administrator privileges (you may change this user after installation). 22

23 16 Click Next. Users' access to the Management Console is restricted for security reasons. SafeGuard PortProtector does not require its own users and computers database. Instead, credentials are checked against Active Directory and/or local user accounts on the Management Server machine. Following installation, access to the Management Console is restricted to users who have local administrative rights on the computer hosting the Server, as shown below: 17 Click Next. The Communication Port window opens. SafeGuard PortProtector Management Server communicates with the SafeGuard PortProtector Management Consoles and Clients through SSL ports. Port definitions differ in Windows XP and Windows Windows XP 23

24 The Management Server will use the default SSL port which is defined by the website of the host computer for communicating both with SafeGuard PortProtector Clients and with the Management Console. Note: If no website is found on the host computer, the same window appears, with the Communication Port (SSL) text box editable. If you are not using the standard port 443, change it as required. 24

25 Windows 2003 In Windows 2003, SafeGuard PortProtector uses two different ports to communicate with SafeGuard PortProtector Clients and with the Management Server. The default ports are 443 for Clients communications and 4443 for Management Console communications. If you wish, you may change these default ports. 18 In order for SSL to operate, a certificate is needed to authenticate the Management Server. This certificate is also used for encrypting the data sent on the communication port. If the computer that is running the Server already has an active website that allows the SSL port activation, the application will use the existing certificate. If no certificate exists, the application will create a new certificate and will notify you of this. 25

26 Note: A Sophos generated certificate is not signed by a valid Certificate Authority (CA). Although this does not affect the overall security level of the system, using this certificate will cause Internet Explorer to display security alerts. In order to avoid these alerts you will need to replace the certificate with a signed certificate you receive from a trusted Certificate Authority. 19 Click OK to continue with the installation. 20 Click Next. In the following window, you will be asked to backup the encryption keys that are generated by SafeGuard PortProtector. To enhance the security of the system, encryption keys are generated during the installation. These keys are unique to your organization and raise the tampering resistance of your system. The keys are used to encrypt policies and logs as well as for mutual authentication between the Server and the endpoints. One example for the use of these unique keys is in that endpoints need to be initialized upon installation with the organization's unique keys. From this point on, an endpoint will treat any information (i.e. policy) that does not correlate to the keys as an attempt to circumvent its protection. For this reason it is highly recommended to backup the keys and store them on another machine/site in order to ensure smooth recovery in cases of server malfunction without the need to re-deploy Clients to endpoints. 26

27 In order to backup your encryption keys, you need to set a password that will be used to protect the keys: If you do not want to backup your encryption keys during the installation, check the Do not backup encryption keys now checkbox and click Next. To backup you encryption keys click Browse to select a path. Enter a password, confirm it. Note: The password should be at least 7 characters long and should contain one upper case character and one digit. 21. Click Next. 27

28 In the following window, you will be asked to configure the schedule for automatic system backup to the network, which includes the encryption keys that are generated by SafeGuard PortProtector. You may change the default Perform backups interval (Daily, Weekly, Monthly) and the time. The backup path supplied must reside on a network share, with write permissions for the user provided in the Domain Credentials window (step 16) in the setup wizard. Click Browse to select the Network backup path. Enter a Password and Confirm it. If there is a problem with the password you choose (or share permission), the following message will be displayed. 22. Click Next. 28

29 The Summary window opens: 29

30 21 Confirm the installation summary and click Install to perform the Server installation. Installation begins, and the Installation Progress window opens: 30

31 22 Once installation has been completed, the following window opens: 23 The SafeGuard PortProtector Management Server has been installed. Check the checkbox at the bottom of the screen if you wish to launch the SafeGuard PortProtector Management Console, and click Finish. Note: The installation process installs the SafeGuard PortProtector Management Console as well. 31

32 24 If you have chosen to launch the SafeGuard PortProtector Management Console, the Login window opens: Enter your User Name, Password and Domain and click Login. The application opens, displaying the main window. 25 Take the time to define preliminary settings in the Administration and Global Policy Settings. Please refer to Post-Installation Settings (Checklist) on page 38 for a list of settings which you may want to review and change. 32

33 3.5 Restoring an Existing Management Server In some cases you will need to install SafeGuard PortProtector Management Server while maintaining your system unique encryption keys, in order to work with your existing SafeGuard PortProtector Clients. This may happen when you want to migrate the Server from a low-cpu machine to a stronger one, or when recovering from hardware malfunctions. In order to restore an existing Management Server you will need to provide the encryption keys backup file and the password that was set to protect it. To restore an existing Management Server: 1 Perform the steps described in Installing the Management Server on page 16 up to Step 7. 2 At this stage, you will be asked to choose the installation mode, as shown below: 33

34 3 Select the Restore radio button. The following window opens: 4 In the Restore window, select the appropriate radio button according to whether you wish to use SafeGuard PortProtector backup files or connect to an existing external SafeGuard PortProtector MS SQL database. If you select the second option, Connect to an existing SafeGuard PortProtector MS SQL database, skip to step 8 below. 34

35 5 Click Next. The Backup Files window opens: 6 Enter the path to your keys backup file and the password protecting it. If you have saved your previous installation configuration (policies, queries etc.), you can restore the configuration as well. Do this by checking the checkbox and selecting the path to the configuration backup file. Note: To learn how to restore logs refer to Restoring Logs on page Skip to step 11 below. 35

36 8 If you have selected to use an existing database server, the following window opens: 9 In the Database Credentials window, perform the following steps: a. In the Database Server field, enter the database server name (for a non-default instance use the format server\instance). b. Under Database authentication mode, click the appropriate radio button to select whether to use MS SQL Security or Microsoft Windows Security. c. Enter database authentication credentials User Name and Password. If you selected Microsoft Windows Security you must also enter a Domain name. 10 Click Next. The installation program validates access to the database. Note: If validation fails, re-enter the correct information, or click Cancel to exit the installation wizard. 11 Follow the instructions in steps in Installing the Management Server. 36

37 3.5.1 Restoring Logs The need may arise to restore version 3.2 logs that you have previously backed up. This may happen in one of the following cases: You wish to upgrade or replace your version 3.2 Management Server machine Upgrading from version 3.2 to a higher version fails and rolls back to version 3.2 without logs. Note: This utility only restores logs from and to an embedded SafeGuard PortProtector database, since backing up and restoring logs on an external database is handled by your DBA. Log restoring is performed using the Log Restore Utility. Running this utility deletes the existing log tables, and restores the exact log schema from the backup file. Log views are created automatically when starting the Management Server. To view Log Restore Tool version (optional): 1 Locate RestoreTool.exe in your SafeGuard PortProtector Management Server installation folder under the "bin" folder (if you installed in the default destination folder the path is \Program Files\Sophos\SafeGuard PortProtector\Management Server\Bin) 2 Run RestoreTool.exe using the following syntax: RestoreTool version The command returns the assembly version of RestoreTool.exe. To restore logs: 1 Stop the Management Server. 2 Locate RestoreTool.exe in your SafeGuard PortProtector Management Server installation folder under the "bin" folder (if you installed in the default destination folder the path is \Program Files\Sophos\SafeGuard PortProtector\Management Server\Bin) 3 Run RestoreTool.exe using the following syntax: RestoreTool restore -backupfile [-silent ] [-verbose ] -backupfile -silent -verbose specifies full backup (SLB) file path to restore from do not ask user for confirmation verbose operation 37

38 The program notifies you of any errors in the restore process. If there are no errors, your log data and structure are restored. 4 Start the Management Server. 3.6 Upgrading the Management Server Upgrading from a previous version of SafeGuard PortProtector to this new version 3.3 SP5 is not supported. Customers will have to uninstall the older version and re-install the SP5 version. Also the policies will not be migrated. If customers have purchased professional services, we can help in the migration of policies. 3.7 Upgrading in a Clustered Environment Upgrading in a clustered environment is not support due to the rebranding of the product. 3.8 Post-Installation Settings (Checklist) The SafeGuard PortProtector Management Server installation package defines default settings for system behavior which you can find under Administration and Global Policy Settings (both available from the Tools menu in the SafeGuard PortProtector Management Console). Once you complete installing SafeGuard PortProtector Management Server and access the Management Console, you may want to visit these windows and set the parameters relevant to your environment Checklist for the Most Critical Settings in the Administration Window: 1 Policy Publishing Method Select the format and destination for publishing policies. 2 Encryption Keys Backup If you haven't backed up the encryption keys during installation. 3 Client Installation Folder Set a shared folder for creating client installation files. You will need these files in order to install clients. Refer to Chapter 7, Administration in SafeGuard PortProtector User help for an explanation of Administration settings. 38

39 3.8.2 Checklist for the Most Critical Settings in the Global Policy Settings Window: 1 Log Transfer Interval Define the frequency in which logs will be sent from endpoints to the Server. Important: Take extra care while configuring the Logs Transfer Interval in order not to burden your network and endpoints with excessive log sending. Consider the following: The number of endpoints in your network The number of expected events from each endpoint (client and file logs) The level of need for "real time" logs information in the Management Console During installation, the default log interval is set to 90 minutes. In the case of large scale deployments, please consult Sophos Support in order to optimize your settings. 2 Clients Uninstall Password Change the default password to your own preference. Important: Upon product installation the password is set to "Password1". Since the password is one of the foundations for the tampering resistance of the client, it is highly recommended that you change it as soon as you start deploying the product in a production environment. Important: Make sure you have created a backup for the Server encryption keys. This will prevent situations in which you cannot uninstall Clients due to password loss. Refer to Chapter 3, Defining Policies in SafeGuard PortProtector User help for an explanation of Global Policy settings. 39

40 3.9 Uninstalling SafeGuard PortProtector Management Server To uninstall the Management Server: 1 Open the add \ remove programs on your Control Panel. 2 Select the SafeGuard PortProtector Management Server from the list, and click Remove as described below: Note: Uninstalling SafeGuard PortProtector Management Server will delete the SafeGuard PortProtector database; therefore, if you wish to install the latest Server version, it is recommended to upgrade your Server rather than to perform an uninstall/install process. 40

41 3.10 Changing your Database If you wish to change from using a SafeGuard PortProtector embedded database to an external MS SQL database, or vice versa, you can do so by using the Restore option as explained in Restoring an Existing Management Server on page 33 and selecting the new database type. Note: You can only change your database if you are using version 3.2 and above. Note: Changing your database will result in loss of previous logs. Previous policies are transferred to the new database, but policy associations to organizational objects (when using the "direct distribution from the Management Server to Clients" policy distribution mode) are lost. 41

42 4 Installing SafeGuard PortProtector Management Console About This Chapter This chapter describes how to install the SafeGuard PortProtector Management Console. It contains the following sections: Prerequisites, describes the prerequisites of the Management Console. Installing Prerequisite Software, describes how to install Microsoft.NET framework. Installing SafeGuard PortProtector Management Console, describes two methods for installing the Console. Launching SafeGuard PortProtector Management Console for the First Time, describes how to launch SafeGuard PortProtector Management Console. Uninstalling SafeGuard PortProtector Management Console, describes how to uninstall SafeGuard PortProtector Management Console. 42

43 4.1 Prerequisites Operating System Windows XP Professional (SP1-2) 32-bit Windows 2003 Server (SP0-2) 32-bit Hardware Pentium 800 MHz 256 MB RAM 50 MB HDD space Software Microsoft.NET Framework 2.0 installed 4.2 Installing Prerequisite Software Installing Microsoft.NET Framework 2.0 To install.net Framework Refer to Installing Prerequisite Software on page in section Installing SafeGuard PortProtector Management Console SafeGuard PortProtector Management Console can be installed and run from any computer on your network. The first console is installed on the same machine that hosts the Management Server as part of the Server installation, and additional consoles can be installed on any machine in your domain that meets the prerequisites. Additional consoles can be installed on your domain either through Sophos s Management Console Installation web page (recommended), or by running the ManagementConsole.msi file from an external source, such as a CD. Note: Access to the Management Consoles is restricted by default to the local administrators group of the machine hosting the server. In order not to expose your server machine user and password unnecessarily, make sure you change this setting to a user group in your Active Directory before installing additional Management Consoles. You can change this setting from the Administration window in the Management Console. 43

44 4.3.1 Installing the Console from the Installation Web Page SafeGuard PortProtector Management console features a 'One-click' deployment process which gives you easy access to installing the Management Console by pointing your browser to the SafeGuard PortProtector Management Server address. This method automatically keeps all your Management Consoles up-to-date with the latest software version of the Management Server, and is therefore the recommended installation method. To install the Management Console from the installation web page: 1 Access the address of the installation web page in the target machine The link is in the following format: Tip: You may also use a shorter link format: (This address can be found in the General tab of the Administration window, which you can access from the Management Console's Tools menu). The installation page opens: 44

45 The page contains the following: A link to the Microsoft.NET framework 2.0 installation package. A link to the Management Console installation package. Server details. 2 If the machine on which you wish to install an additional Console does not have.net framework installed, enter the link and install it before proceeding with the Management Console installation. 3 Click the link to the Management Console installation package. The following window opens: 45

46 4 Click Save and then run the program. The Management Console installation wizard opens: 46

47 5 Click Next. The Select Installation Folder window opens: 6 In the Select Installation Folder window, select the folder in which the SafeGuard PortProtector Management console will be installed. The default folder is C:\Program Files\Sophos\SafeGuard PortProtector\. If you wish to install the Management Console in a different folder, click the Browse button and select the desired folder. 7 Select one of the following options by clicking its radio button: Everyone: allow access to the application to any user who uses the computer Just me: allow access to the application only to the logged on user. 47

48 Click Next. The following window opens: 8 In the Confirm Installation window, click Next to perform the installation. 48

49 9 Once the installation completes, the following window opens: 10 Click Close to exit. 11 Open the Management Console application by clicking the icon on your desktop or from Start > Programs > SafeGuard PortProtector > Management Console. 49

50 12 Depending on the browser you are using, the following message may appear: Fill in the server name and port as it appears in the installation web page, and click Connect. 13 The Login window appears: Type your user name, Password and Domain and click Login. The application will open, displaying the main window. 50

51 4.3.2 Installing SafeGuard PortProtector Management Console Manually To manually install the Management Console: 1 Locate the ManagementConsole.msi file on your CD and run it. The setup window opens: 2 Proceed with steps 5 through 13 as described above. 51

52 4.4 Launching SafeGuard PortProtector Management Console for the First Time 1 Click the icon on your desktop. OR Go to Start > Programs > SafeGuard PortProtector > Management Console. The application open for the first time: 2 Enter your user name, password and domain. The following window opens: 52

53 Each time the Management Console connects to the Server, it automatically downloads the latest version of the Management Console (if an update exists). Once the updated files are downloaded, the window closes, and the following window opens: 3 If you are evaluating the software, click Remind Me Later OR Click Enter License Key if you have a valid Sophos license, and enter your Sophos license key as described in the SafeGuard PortProtector User help, Chapter 7, Administration. SafeGuard PortProtector Management console opens, displaying the main window. 4.5 Uninstalling SafeGuard PortProtector Management Console To uninstall the Management Console: 1 From the Control Panel, open Add or Remove Programs. 2 From the list, select SafeGuard PortProtector Management Console and click Remove. Note: Uninstalling SafeGuard PortProtector Management Console does not cause any information loss. You can re-install it at any time. 53

54 5 Installing SafeGuard PortProtector Client About This Chapter This chapter describes the various methods for installing, or deploying, SafeGuard PortProtector Client. It also explains how to uninstall and upgrade SafeGuard PortProtector Client. It contains the following sections: Prerequisites, page 55, describes the prerequisites of the SafeGuard PortProtector Client. Before Deploying SafeGuard PortProtector Client, page 55, describes the steps you need to take before installing SafeGuard PortProtector Clients. Installing SafeGuard PortProtector Client, page 58, describes the following installation methods: Automatic Client Installation (through Active Directory) Automatic Client Installation (generic) Manual Installation Upgrading SafeGuard PortProtector Client, page 65, describes how to upgrade SafeGuard PortProtector Client from V2.0 to V3.x. Defining Endpoint Behavior during Installation, Page 71, describes how to define the End Point reboot sequence after installation. Uninstalling SafeGuard PortProtector Client, Page 73, describes how to uninstall SafeGuard PortProtector Client. 54

55 5.1 Prerequisites Operating System Windows 2000 Professional (SP3-4) 32-bit Windows 2000 Server (SP3-4) 32-bit Windows 2000 Advanced Server (SP3-4) 32-bit Windows XP Professional (SP1-2) 32-bit Windows 2003 Server (SP0-2) 32-bit Windows Vista Business/Enterprise/Ultimate (SP1-2) 32-bit Windows 7 Business/Enterprise/Ultimate 32- bit Hardware Pentium 800 MHz 256 MB of RAM 50 MB HDD space Software None required 5.2 Before Deploying SafeGuard PortProtector Client In order to install SafeGuard PortProtector Client, you must first install the Management Server. This is necessary in order to raise the security level of the system, by "imprinting" each installed client with the encryption keys of the server. From the point of installation, SafeGuard PortProtector Client knows the keys which it uses when communicating with the Server. From this point on, the Client will not accept any policy or perform any communication with a Server that does not hold matching keys. This "imprinting" process is performed by initializing the Client with a file called ClientConfig.scc. This file is generated by the Server upon user request. This file should be available during Client installation. Before you can start deploying SafeGuard PortProtector Clients you need to define the path to which the Server will generate all the files needed for Client installation. The process of generating the installation files may be performed again at any time. 55

56 To generate SafeGuard PortProtector Client installation files: 1 In the Management Console, from the Tools menu, open the Administration window as shown in the following figure: 56

57 2 In the Administration window that opens, click the Clients tab on the left. The Administration- Clients window opens: 3 Select a shared folder as the Client installation folder. Once the files are created, the following message appears: Important: Make sure you enter a network path and not a local path. 4 Click OK. 5 You are now ready to deploy SafeGuard PortProtector Clients on the computers in your organization. Once Clients have been deployed, you can distribute policies to them as described in SafeGuard PortProtector User help. 57

58 5.3 Installing SafeGuard PortProtector Client There are three ways to install the SafeGuard PortProtector Client: Automatically through the Active Directory Group Policy Management. Automatically using any corporate software deployment tool, such as SMS and Tivoli. Manually by running the installation wizard on each computer Automatic Client Installation (Active Directory) Automatic SafeGuard PortProtector Client installation is performed using Active Directory's Group Policy Management (if installed) and Active Directory's Users and Computers. These options enable you to define a GPO that will distribute the SafeGuard PortProtector Client to the OUs (computer or user groups) of your choice. When this option is used, the clients are installed in Silent mode. To automatically install the SafeGuard PortProtector Client: 1 Open the Active Directory Users and Computers window. 2 Right-click the OU to which to install the SafeGuard PortProtector Client and select Properties. The User Properties window opens. 3 In the User Properties window, select the Group Policy tab. This tab looks different depending on whether the Group Policy Management Console is installed or not. 4 If the Group Policy Management Console is not installed, the following window is displayed: 58

59 5 Click Add to add the SafeGuard PortProtector deployment GPO, name it, then right-click that GPO and select Edit. Go to Step 9 below. 6 If the Group Policy Management console is installed, click Open in the Group Policy tab to display the Group Management window, as shown below: 7 In the OU tree display on the left pane, select the OU to which to install the SafeGuard PortProtector Client. The right pane displays the GPO's that are already assigned to this OU. 8 Add a GPO that installs software to this OU. Right-click on the OU and select Create and Link a GPO Here, then name the GPO. 59

60 9 Right-click the SG PP deployment GPO and select Edit. The Group Policy window is displayed. An example is shown below: 10 Under Computer Configuration in the tree on the left, right-click Software Settings and select New, and then select Package, as shown below (the right pane may display names of other software to be installed if any have been defined): 60

61 A file selection window is displayed. 11 Locate the shared folder in which you have selected the Client installation files to be created. This folder should contain both the SafeGuardPortProtectorClient.msi and ClientConfig.scc files. If you are deploying clients to an XP 64 bit machine make sure you are using the files under the XP64Bit sub-folder. 12 Browse to the full UNC path of the SafeGuard PortProtector Client installation file named SafeGuardPortProtectorClient.msi, select it and click Open. Make sure this path includes the ClientConfig.scc file. 13 Double-click the SafeGuardPortProtectorClient.msi file. The following window opens: 61

62 14 Select Assigned and click OK. Wait a few moments while the MSI is added. a. When installing the SafeGuard PortProtector Client in a foreign language (German, Japanese): b. Select the Modifications tab from the dialog box and click Add. Select the appropriate Transform file from the network share and press Open. 62

63 15 Prepare the endpoints of your organization for automatic installation, as described in the Preparing an Endpoint for Automatic Installation section below. 16 In some rare cases, a restart may be required on the endpoint computer. If so, a message will be displayed Preparing an Endpoint for Automatic Installation In order to install the SafeGuard PortProtector Client, the target computers are required to have access to the shared network folder when the system is rebooted. If the target computers are running Windows XP, you must turn on the Always wait for computer network to startup at logon GPO, which can be found under Computer Configuration Administrative Templates System Logon. The next time a computer or user in this OU reboots, SafeGuard PortProtector client will be deployed to it. Note: In some cases, depending on the Domain configuration, it may take some time for the GPO containing the installation package, which is linked to the dedicated OU, to replicate to other domain controllers (usually up to 15 minutes). This may appear as endpoints that are not installing the SG PP Clients. In this case it is necessary to wait for the replication to finish before restarting the endpoints for installation. 63

64 5.3.2 Automatic Client Installation (Generic) In order to install using a third-party corporate software management solution, follow the procedure below. To install perform generic automatic client installation: 1 Locate the shared folder in which you have selected the Client installation files to be created. This folder should contain both the SafeGuardPortProtectorClient.msi and ClientConfig.scc files. 2 Create a batch file containing the following command that installs the Protector Client silently: msiexec /i DriveName:\InstallationPath\SafeGuardPortProtectorClient.msi /qn When installing the Protector client in a foreign language, use the following command line parameters: msiexec /i DriveName:\InstallationPath\SafeGuardPortProtectorClient.msi TRANSFORMS="\\InstallationPath\MSTFileName.mst"/qn (This should be written in a single line.) 3 In some rare cases, a restart may be needed on the endpoint computer. If so, a message will be displayed. 64

65 5.3.3 Manual Client Installation You can manually install the SafeGuard PortProtector Client on each computer in your organization that needs to be protected. To manually install the SafeGuard PortProtector Client: 1 Locate the shared folder in which you have selected the SafeGuard PortProtector Client installation files to be created. This folder contains the SafeGuardPortProtectorClient.msi installation file. We recommend that the ClientConfig.scc file necessary for the installation be in the same folder. To view the path to this folder, select Administration from the Management Console's Tools menu, then select the Clients tab, as shown in the following figure: 65

66 Run SafeGuardPortProtectorClient.msi. If you are deploying clients to an XP 64 bit machine make sure you are using the files under the XP64Bit sub-folder. The installation wizard opens: 2 Click Next to continue. The License Agreement window opens: 66

67 3 In the License Agreement window, select the I accept the terms in the license agreement radio button and click Next. The Destination Folder window opens: 4 In the Destination Folder window, determine the folder to which you want to install SafeGuard PortProtector Client. If you want to install it to a folder other than the default, click Change, and in the Change Current Destination Folder window that opens, select the desired folder and click OK. 67