Getting Started Guide for Symantec On-Demand Protection

Transcription

1 Getting Started Guide for Symantec On-Demand Protection

2 Getting Started Guide for Symantec On-Demand Protection The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version: merged, not printed Legal Notice Copyright 2007 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Symantec Corporation Stevens Creek Blvd. Cupertino, CA

4

5 Contents Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 About Symantec On-Demand Protection Endpoint security... 9 Evaluation key Planning On-Demand Protection policies Symantec On-Demand workflows Installing Symantec On-Demand Protection On-Demand Manager generates On-Demand Agents Minimum installation requirements On-Demand Agent downloaded to endpoint computers Installing Symantec On-Demand Protection Upgrading Symantec On-Demand Protection Running Symantec On-Demand Protection Launching the On-Demand Manager Configuring the On-Demand Agent to implement protection policies Running the Virtual Desktop on client computers Running Host Integrity on client computers Running the Cache Cleaner on client computers Macintosh requirements Linux requirements Previewing On-Demand Agents Previewing On-Demand Agent files Previewing Host Integrity Previewing Virtual Desktop Previewing Cache Cleaner Generating and Uploading On-Demand Agent files Generating On-Demand Agent files Uploading On-Demand Agent files to your web server... 27

6 6 Contents Chapter 6 Chapter 7 Chapter 8 Enforcement for Symantec On-Demand Protection Types of Enforcement Using Symantec On-Demand Protection with Microsoft Outlook Web Access On-Demand Protection and Outlook Web Access integration Troubleshooting Questions and answers about On-Demand Protection General Questions Q: When do modified settings apply to the On-Demand Agent? Q: Do I need Administrator privileges to use the On-Demand Agent features? Q: How large are the On-Demand Agent Files that get downloaded to client machines? Q: What log files are stored on the client computer? Q: What is the Agent s CPU usage on the client computer? Q: Can I use wildcards when specifying location settings? Q: Can I use "Fast User Switching" on Windows XP? Q: Does Symantec On-Demand support the use of Hyper-threading technology? Q: What are cookies? How are they set? Q: I ve installed the On-Demand Manager, but it won t launch. What s wrong? Time-Out Questions Q: How does the "time-out" setting work on the On-Demand Agent? Q: What about Macintosh and Linux? Do they have a "time-out" setting? Host Integrity Questions Q: For Host Integrity, what is the AND/OR relationship among the various settings? Q: Under what conditions will the Host Integrity s Antivirus checks fail? Q: How do you use Custom rules to check for hotfix, antivirus, and personal firewall software on client computers? Q: Why do two Internet Explorer browsers launch when Host Integrity checks fail? How do I Use the Registry Key Exists Feature?... 42

7 Contents 7 Virtual Desktop Questions Q: Do I need Administrator privileges to use the Persistent Desktop option? Q: Does Symantec On-Demand s Virtual Desktop support ActiveX? Q: If I enable Persistent Desktop, how large is the download the second time? Q: If I enable Persistent Desktop, where are the files stored on the client computer? Q: Can I have multiple Virtual Desktops? Q: Are there security risks in deploying the Virtual Desktop module alone? Q: What kinds of removable media can the Virtual Desktop prevent or allow endpoint users to save data to? Q: Is it possible to install HyperTerminal when using the Virtual Desktop? Q: Can you connect to two sites at the same time that cause the Virtual Desktop to be downloaded to your computer? Q: Using the Persistent Desktop, what happens to the Persistent Desktop settings if a user accesses more than one Symantec-On-Demand protected application? Will the Persistent Desktop settings from the original application be used, or will new settings be saved? Security Questions Q: What security settings do I need to specify on user computers? Q: What kind of encryption is used in the Virtual Desktop and the Cache Cleaner? Q: Does Symantec plan to use a different type of encryption in the future? Q: Does Symantec On-Demand use a random or a fixed SEED key for encryption? Q: Where is the key stored, and how is it removed and destroyed at the end of a session? Q: How long can the password be for the Persistent Desktop? Networking and Firewall Questions Q: How do I integrate with Microsoft s IIS server? Q: Does the On-Demand Agent detect a second network card for the purpose of Location determination? Q: I am using a personal firewall. What applications must I "Allow" to access the network?... 50

8 8 Contents Q: What about Symantec Security Agent and Symantec Personal Firewall prompts for network access: Where do they appear?... 50

9 Chapter 1 About Symantec On-Demand Protection This chapter includes the following topics: Endpoint security Evaluation key Planning On-Demand Protection policies Symantec On-Demand workflows Endpoint security Symantec On-Demand Protection provides endpoint security for unmanaged devices accessing network resources by a Web browser. It offers pre-authentication checks of the following types: Adaptive Policies Location switching based on endpoint parameters such as IP range, registry key, DNS, and others. Symantec On-Demand Agent has the ability to adapt security policies that are based on identification of specific network locations and the type of network device used (corporate-owned versus non-corporate-owned) to ensure that confidential data is protected without impacting the productivity of a user. Host Integrity Predefined checks for antiviruses, personal firewalls, and service packs; custom checks for process, registry key, file, and operating

10 10 About Symantec On-Demand Protection Evaluation key system. The Symantec On-Demand Host Integrity module provides the ability to define, enforce, and restore the security of clients to secure enterprise networks and data. Host Integrity rules can be set up to verify that clients trying network access are running antivirus software, personal firewall software, service packs, and patches. Virtual Desktop Data protection by virtualization and encryption of the file system combined with restricted system access. The Symantec On-Demand Virtual Desktop is an encrypted space in which a user has an online session using a browser. It is transparent, fully secure, and requires only a browser for access. Malicious Code Prevention, Application Control, Authorized Modules, Authorized Drivers Detect and prevent keyloggers, screen scrapers, and account creation by behavioral and signature-based engines. Permit or deny the execution of specific applications, modules, or drivers within the Virtual Desktop. Connection Control Outbound connection blocking from the endpoint based on domain, URL, IP, or port. Cache Cleaner Data sanitization by deletion of browser history, downloaded data, temporary files, and cookies. An On-Demand location is the type of site from which a user connects to the corporate network. Settings and options for the Symantec On-Demand Agent can be different based on the location from which the user tries to connect. Typical locations include work, home, remote, and unknown. Symantec On-Demand Agent can be used to define as many locations as needed and each location can be configured with different settings and options. The On-Demand Agent settings and options are set and modified with the On-Demand Manager. When you have selected the options and settings you want per location, the On-Demand Manager generates all of the required files for you to upload to your server. You can then start providing the On-Demand Agent to your users. Evaluation key If you have been given an Evaluation key, it has certain capabilities and a time period during which it is valid. If you have a full registration key, there is no time limit. Click License from the Options menu to review your licensed capabilities in the License Information dialog box.

11 About Symantec On-Demand Protection Planning On-Demand Protection policies 11 Planning On-Demand Protection policies Before you begin configuring your security policies using On-Demand Protection, you may want to plan protection strategies. Start with the following considerations: Will your users access a corporate network using SSL VPN? Will they use a browser to access a Web application? Will they use both a browser and a corporate network to access a Web application? What kinds of endpoint machines will your users use: corporate-owned assets used offsite, home computers, public kiosks? Symantec On-Demand can be used with corporate web applications, SSL VPN, or Microsoft Outlook Web Access (OWA) deployments to secure endpoints that access your network. Table 1-1 shows a sample configuration of On-Demand modules based on the type of device and its location as a means for determining the policies that need to be enforced on the endpoint. Table 1-1 Planning protection strategies Location Location Criteria Symantec On-Demand Modules Host Integrity Checks Virtual Desktop Settings Cache Cleaner Settings Office IP Range Host Integrity Antivirus None None Firewall OS patches Remote (using corporatecontrolled computer) Registry check for HKEY_LOCAL_ MACHINE = company_name Host Integrity Virtual Desktop Personal Firewall Antivirus Enable printing Allow writing to removable USB storage devices None Other (using non-controlled computer) All users who do not meet the criteria for Office or Remote Host Integrity Virtual Desktop Cache Cleaner (for non-windows OS) Personal Firewall Antivirus Service Packs Enable automatic switch Enable file separation Terminate Virtual Desktop on browser termination Close all other browser instances Inactivity period: 5 minutes

12 12 About Symantec On-Demand Protection Symantec On-Demand workflows Symantec On-Demand workflows A series of generalized workflow steps for usage of Symantec On-Demand Protection are provided as follows. For information about integrating On-Demand with an SSL VPN appliance, please refer to the appropriate integration guide. To use Symantec On-Demand Protection in general 1 Launch Symantec On-Demand Manager. 2 Define locations to be protected. 3 Configure the protection options for each location. 4 Deploy the On-Demand Agent files to the appropriate Web/SSL VPN server. 5 Verify the On-Demand Agent execution on client machines. For example, a browser search on the client machine will pop-up the On-Demand Virtual Desktop. 6 Test the running of Symantec On-Demand Protection at client endpoints.

13 Chapter 2 Installing Symantec On-Demand Protection This chapter includes the following topics: On-Demand Manager generates On-Demand Agents Minimum installation requirements Installing Symantec On-Demand Protection Upgrading Symantec On-Demand Protection On-Demand Manager generates On-Demand Agents This section describes how to install Symantec On-Demand Manager which is used to configure and generate the On-Demand Agents that are in turn configured to protect specified locations or endpoints. When you have configured the options and selected the desired location settings or adaptive policies, the On-Demand Manager generates all of the required files for you to put on your server, switch, or Web application. After the On-Demand Agent files are generated per your defined policies and configuration settings, you will move them to your Web server, after which you can start providing the On-Demand Agent directly to your network users. See Generating On-Demand Agent files on page 27. Minimum installation requirements To install Symantec On-Demand Protection Manager, be sure your environment includes the following minimum requirements:

14 14 Installing Symantec On-Demand Protection Minimum installation requirements Windows 2000 Professional SP4, Windows 2000 Server/Advanced Server SP4, Windows XP SP2 (32 bit), Windows Server 2003 SP1 or SP2 (32 bit), and all 32-bit editions of Windows Vista Pentium 633MHz or faster 128 MB RAM 20 MB available hard disk space Administrator privileges Java Runtime Environment (JRE) version or On-Demand Agent downloaded to endpoint computers The downloaded On-Demand Agent requires less than 1 MB of hard disk space. After the agent is downloaded to a client computer, it uncompresses and installs on that network endpoint. The agent requires a total of 5 MB of hard disk space. The size of the On-Demand Agent files depends on which modules are downloaded and implemented. Table 2-1 lists the size of each individual module during the download to the client. These numbers represent compressed file sizes on the server; the files are then expanded and deployed on the client. Table 2-1 Module Sizes on download to client machine Module Virtual Desktop Host Integrity Cache Cleaner Module Size for Windows XP/ 2003/ KB 490 KB 421 KB Module Size for Windows Vista 565 KB 490 KB 421 KB Note: On-Demand Agent modules share common files. Therefore, when On-Demand modules are downloaded individually to the client endpoint, their file sizes are larger than when downloaded in combination. For example, if you download both the Virtual Desktop and Host Integrity modules at the same time, the combined file size is only 701KB, whereas the Virtual Desktop alone is 591 KB. In the case of Virtual Desktop, because the underlying file system and registry are virtualized and encrypted, more space is required after the agent is downloaded. If the user runs an application that accesses user data from the

15 Installing Symantec On-Demand Protection Installing Symantec On-Demand Protection 15 regular desktop, more space may be required, because the data files themselves are virtualized and encrypted. Installing Symantec On-Demand Protection Use the following instructions to install Symantec On-Demand Protection. Note: Symantec On-Demand is officially supported only on English-language operating systems at this time, but the English versions of On-Demand Manager and Agent may work on non-english operating systems as well. To install Symantec On-Demand Protection 1 Download the Symantec On-Demand Protection software from the Symantec server or copy from the product CD. 2 Locate and double-click the downloaded SymantecOn-Demand.exe file. The installer runs and installs the application on your computer. 3 When you are prompted, enter your name, company name, and serial number. The serial number determines the options that are active in your version of On-Demand Protection. Be certain to enter the company name and license number carefully; they must match your registration confirmation exactly. Upgrading Symantec On-Demand Protection Previous releases of On-Demand required that you uninstall your existing version before installing your new one. That procedure is no longer necessary. Installing On-Demand 3.0 effectively updates your existing installation so that all your current policy rules and configuration settings are preserved by the setup.xml utility that is included in the product download. This upgrade feature works only with the following officially released builds: Symantec On-Demand 2.5 MR1 (Build 2117) and 2.5 MR2 (Build 2154) Symantec On-Demand 2.6 GA (Build 2230), 2.6 MR 1 (Build 2235), 2.6 MP1 (Build 2243), 2.6 MP2 (Build 2258), and 2.6 MP3 (Build 2309) Upgrading from any other version of On-Demand is not supported.

16 16 Installing Symantec On-Demand Protection Upgrading Symantec On-Demand Protection Note: Do not uninstall your existing version of the On-Demand Manager if you intend to keep your existing rules and settings. And be sure to create a backup copy of your setup.xml file before you start your installation. To upgrade Symantec On-Demand Protection 1 Download the Symantec On-Demand Protection software from the Symantec server or copy from the product CD. 2 Double-click on the downloaded SymantecOn-Demand.exe file. The installer runs and upgrades the application on your computer. 3 When prompted, enter your name, company name, and serial number. Be certain to enter the company name and license number carefully; they must match your registration confirmation exactly.

17 Chapter 3 Running Symantec On-Demand Protection This chapter includes the following topics: Launching the On-Demand Manager Configuring the On-Demand Agent to implement protection policies Running the Virtual Desktop on client computers Running Host Integrity on client computers Running the Cache Cleaner on client computers Macintosh requirements Linux requirements Launching the On-Demand Manager When the installation is complete, launch the On-Demand application from the Windows Start menu. The On-Demand Manager application loads and the main screen displays. To begin running Symantec On-Demand Protection, first define the locations to be secured, then select the modules to be enabled per location. Lastly, configure the settings to be applied to your locations.

18 18 Running Symantec On-Demand Protection Configuring the On-Demand Agent to implement protection policies Configuring the On-Demand Agent to implement protection policies To set up On-Demand Protection to implement your security policies at specified locations, use On-Demand Manager to perform three categories of configuration: Create your locations. Define the modules to load in each location. Define the actions to be taken in those locations. For example, to create locations for Office, Remote, ot Other, use an IP address range to identify the endpoints that access your server from the Office location, and a registry check to identify endpoints using a company-owned computer from another location (Remote). All endpoints tha do not match any checking criteria are routed to Other. After your locations are created, you can define the protection modules to load in each location. For example, in the Remote location, you may want to implement the Host Integrity and Virtual Desktop modules, but not the Cache Cleaner, although in the Other location you do want to enable the Cache Cleaner. After you define the modules, define specific actions for these modules in each location. For example, in the Virtual Desktop module for Remote endpoints, you may want to allow users to print and copy information to removable USB media, while in the Other location you might want to force users to work only within the Virtual Desktop (Enable Automatic Switch) and to work with copies of files rather than the real versions (Enable File Separation). You may also want to terminate the Virtual Desktop when the browser session is terminated to ensure that the Virtual Desktop session does not remain active indefinitely on kiosks or shared computers. Note: For information about configuring locations, refer to the Implementation Guide for Symantec On-Demand Protection. Table 3-1 shows how to implement your security policies per location. Table 3-1 Protection policies per location Location Module Policy Success Action Failure Action Office (IP Range) Host Integrity Antivirus1, Antivirus 2, etc. hisuccess.htm Popup dialog displays; hifail.htm

19 Running Symantec On-Demand Protection Running the Virtual Desktop on client computers 19 Table 3-1 Protection policies per location (continued) Location Module Policy Success Action Failure Action Remote (Registry Key) Host Integrity Personal Firewall1, Antivirus1, etc. Load the next module; hisuccess.htm Next module does not load; popup dialog displays; hifail.htm Virtual Desktop Enable printing, Allow writing to removable USB Virtual Desktop loads; vdsuccess.htm Other Host Integrity Personal Firewall, Antivirus Load the next module; hisuccess.htm Next module does not load; popup dialog displays; hifail.htm Virtual Desktop Enable automatic switch, Enable file separation, Virtual Desktop loads; vdsuccess.htm Terminate Virtual Desktop on browser close Cache Cleaner Close all other browser instances, Inactivity period: 5 minutes Cache Cleaner loads; ccsuccess.htm Running the Virtual Desktop on client computers The On-Demand Virtual Desktop runs on computers meeting the following specifications: Pentium 633MHz or faster; For Vista: 1 GHz 256 MB RAM; For Vista: I GB RAM 25 MB MINIMUM available hard disk space is required for Agent to download and launch VD; For Vista: 100 MB MINIMUM available hard disk space required for Agent to download and launch the Virtual Desktop.

20 20 Running Symantec On-Demand Protection Running Host Integrity on client computers Note: If the Virtual Desktop is not selected for use, then the system does not require 25 or 100 MB hard disk space. If you are selecting Host Integrity or Cache Cleaner instead, 5MB of free hard disk space is required. Be mindful that more space may be required for your computer to run smoothly after the Agent is downloaded because user data files must be virtualized for successful launch of certain applications. Windows 2000 Professional SP4, Windows 2000 Server/Advanced Server SP4, Windows XP SP2 (32 bit), Windows Server 2003 SP1 or SP2 (32 bit), Windows Vista (32 bit) Browser: Internet Explorer 6.0 or 7.0, Netscape 8.1, Firefox or Java Runtime Environment (JRE) version 1.4.2, 1.5, or 1.6 Note: For SSL VPN users, only Firefox browser version has been tested on Aventail ASAP. Running Host Integrity on client computers Symantec On-Demand Host Integrity runs on computers meeting the following specifications: Pentium 633MHz or faster 128 MB RAM 5 MB available hard disk space required for Agent to download Windows 2000 Professional SP4, Windows 2000 Server/Advanced Server SP4, Windows XP SP2 (32 bit), Windows Server 2003 SP1 or SP2 (32 bit), Windows Vista (32 bit) Browser: Internet Explorer 6.0 or 7.0, Netscape 8.1, Firefox or Java Runtime Environment (JRE) version 1.4.2, 1.5, or 1.6 Running the Cache Cleaner on client computers The Cache Cleaner runs under the following environments: Pentium 633MHz or faster 128 MB RAM

21 Running Symantec On-Demand Protection Macintosh requirements 21 Windows 2000 Professional SP4, Windows 2000 Server/Advanced Server SP4, Windows XP SP2 (32 bit), Windows Server 2003 SP1 or SP2 (32 bit), Windows Vista (32 bit) 5 MB available hard disk space required for Agent to download Browser: Internet Explorer 6.0 or 7.0, Netscape 8.1, Firefox or Java Runtime Environment (JRE) version 1.4.2, 1.5, or 1.6 Macintosh requirements Macintosh requirements include the following: PowerPC 600Mhz or faster Mac OS X or MB RAM 5 MB available hard disk space required for Agent to download Browser: Safari 1.2 on Mac , Safari on Mac Java Runtime Environment (JRE) version or 1.5 Linux requirements Linux requirements include the following: Pentium 633Mhz or faster 128 MB RAM Linux Red Hat 9.0, Enterprise Server 3 5 MB available hard disk space required for Agent to download Browser: Mozilla 1.4 for Redhat Enterprise 3; Mozilla for Linux Redhat9.0 and Redhat Enterprise server 3 Java Runtime Environment (JRE) version 1.4.2, 1.5, or 1.6

22 22 Running Symantec On-Demand Protection Linux requirements

23 Chapter 4 Previewing On-Demand Agents This chapter includes the following topics: Previewing On-Demand Agent files Previewing Host Integrity Previewing Virtual Desktop Previewing Cache Cleaner Previewing On-Demand Agent files Preview On-Demand Agents to view the results of your location configuration and module settings in the user environments you created. Preview the modules your user will see before you upload the On-Demand Agent files to your Web server.

24 24 Previewing On-Demand Agents Previewing Host Integrity To preview On-Demand Agent files 1 Click Preview (next to the Apply button). The On-Demand Manager launches the program that your users see, so that you can verify that the configured protection modules works as you designed them. When you are satisfied with the results of your testing, you can then deploy Agent files to your server. 2 As you preview modules with the On-Demand Manager, be sure to click Apply, at the top right corner of the primary dialog box, to confirm your changes and to save your work. You can also click File > Save. Previewing Host Integrity Either action Apply or File > Save generates the On-Demand Agent files that you will deploy to your server for use at specified locations and endpoints. If you opted to implement the Host Integrity module, endpoint users connecting to your network will download an Agent that performs host integrity checking. If any of the On-Demand Protection checks fail, users will see a preview message that explains the reason for the failure. Figure 4-1 shows the reason for the failure. Figure 4-1 Host Integrity preview message If you chose to provide a failure URL during configuration of this module, users will be taken to that URL. If you choose to remediate, users will be taken to the configured remediation page when they click Remediate at which point they are

25 Previewing On-Demand Agents Previewing Virtual Desktop 25 given the opportunity to remediate by downloading the appropriate or required software (antivirus, personal firewall, patch, etc.) Previewing Virtual Desktop If you implement the Virtual Desktop module, endpoint users connecting to your network will download an Agent that installs and launches the Virtual Desktop. Figure 4-2 shows the Virtual Desktop. Figure 4-2 Virtual Desktop preview To display Virtual Desktop options (About, Help, Run Web Browser, Switch Desktop, Exit), right-click the Taskbar lock icon. When the browser or SSL VPN session is terminated or the inactivity time-out period has elapsed, the On-Demand Agent sanitizes the system, disabling or erasing all data from the session. Note: Data is not protected or sanitized after closing if it is created on the regular desktop. Only the On-Demand Virtual Desktop offers security and data protection.

26 26 Previewing On-Demand Agents Previewing Cache Cleaner Previewing Cache Cleaner The Cache Cleaner is designed to protect the endpoint computer until users finish using the browser, then the Cache Cleaner closes and cleans the cache when the browser is closed. The Cache Cleaner can also be configured to launch after a specified period of mouse and keyboard inactivity. The following message is displayed when the On-Demand Agent launches the Cache Cleaner: The Symantec On-Demand Cache Cleaner has been installed successfully and is running. Depending on how it is configured, users may be able to close the Cache Cleaner by right-clicking the Taskbar to display options (Exit, Disable, and About).

27 Chapter 5 Generating and Uploading On-Demand Agent files This chapter includes the following topics: Generating On-Demand Agent files Uploading On-Demand Agent files to your web server Generating On-Demand Agent files To generate files for the On-Demand Agent 1 Save any recent configuration or settings changes by clicking Apply at the top right corner of the On-Demand Manager screen or, alternatively, by clicking File > Save. 2 Review your configurations and selections by previewing them: Click the Preview button located next to the Apply button. Previewing saves all of your location and module configurations as Agent files and places them in the On-DemandAgent folder at: C:\Program Files\Symantec\Symantec On-Demand Next, you will copy the entire contents of the On-DemandAgent folder and upload it to your web server. Uploading On-Demand Agent files to your web server Before uploading On-Demand Agent files, be sure you have configured locations and settings with the On-Demand Manager, including setting up your endpoint modules: Host Integrity, Virtual Desktop, and Cache Cleaner.

28 28 Generating and Uploading On-Demand Agent files Uploading On-Demand Agent files to your web server If you are integrating Symantec On-Demand Protection with Outlook Web Access, refer to the Implementation Guide for Symantec On-Demand Protection to review the procedures required to copy the On-Demand Agent files. To upload the generated On-DemandAgent folder s files 1 Navigate to the folder in which the On-Demand Manager has placed the Agent files (C:\Program Files\Symantec\Symantec On-Demand) and copy the entire OnDemandAgent folder to your web server or SSL VPN appliance (or for example, copy the files to your IIS/Exchange server for OWA integration). 2 Be sure you have saved your settings by clicking File>Save in the On-Demand Manager screen, or by clicking Apply. This action generates all of the required On-Demand Agent files. They are stored in your On-DemandAgent folder by default in the following location: C:\Program Files\Symantec\Symantec On-Demand\On-DemandAgent 3 Transfer the contents of this folder to your Web server (your Webmail or Application server) or your SSL VPN appliance. Partners: If you are integrating Symantec On-Demand with an SSL VPN solution, please consult the appropriate integration guide. If no integration guide for the specific SSL VPN is available, the Agent files should be uploaded to the root directory that is being accessed by remote users. 4 Use the On-Demand Agent home page (index.htm), generated by the On-Demand Manager, as your Web server home page; it initiates the On-Demand agent download. This is the page that your users are directed to in order to trigger the On-Demand agent download. 5 The On-Demand Agent creates a secure environment on the user s computer and then opens the protected web page (or any other page that you have set as a Success URL page). For more information about success or failure URLs, refer to the Implementation Guide for Symantec On-Demand Protection. 6 Set up a home page that your users will first reach when they try to connect remotely. Make the index.htm page that was in the On-DemandAgent folder the home page. This page automatically triggers the Java installer tool. 7 Once the Virtual Desktop, Cache Cleaner and Host Integrity are installed, the Virtual Desktop opens and the page configured at step one loads automatically and takes users to their Webmail, web portal or SSL VPN authentication page, which are now formally protected.

29 Chapter 6 Enforcement for Symantec On-Demand Protection This chapter includes the following topics: Types of Enforcement Types of Enforcement Enforcer integration is available in Symantec On-Demand 3.1 as Enforcement for Internet Information Services (IIS) Web Server, Microsoft ISA Firewall Web Filter, and On-Demand NAC. Enforcement for Internet Information Services (IIS) Web Server Prevents bypass of On-demand security for Outlook Web Access (and other web applications deployed with IIS). Symantec On-Demand uses cookies to control network access. If a Symantec On-Demand module was running, the specified cookie was available to the current browser session, and a server-side ISAPI filter could check to see if the required cookie was included and it then allowed or blocked the request based on the results. This HTTP packet filter also allows administrators to control access to specific IIS directories. Microsoft ISA Firewall Web Filter If Microsoft ISA Firewall is used to protect web applications, a Web filter can be installed on the Firewall to ensure that On-Demand Protection is loaded on the endpoint before it can access resources protected by the Firewall. The Web filter works similar to the ISAPI filter such that it verifies the cookie and controls access to specific directories and urls on the Web server. On-Demand NAC

30 30 Enforcement for Symantec On-Demand Types of Enforcement The Symantec Gateway Enforcer acts as a gateway between an external and internal network. It monitors network traffic and can block the traffic from an endpoint system if there is no Agent running on the endpoint, or if the host integrity check fails on the endpoint. Previously, the Gateway Enforcer could interact only with Agents generated by other Symantec products (SSE, SNAC and SEP). In recent releases, the On-Demand Agent can also communicate with the Gateway Enforcer. On-Demand Protection supports Gateway and DHCP Enforcer Note: For more information about On-Demand IIS-ISAPI and ISA Web filter enforcement configuration, refer to the Implemention Guide for Symantec On-Demand Protection.

31 Chapter 7 Using Symantec On-Demand Protection with Microsoft Outlook Web Access This chapter includes the following topics: On-Demand Protection and Outlook Web Access integration On-Demand Protection and Outlook Web Access integration Symantec On-Demand Protection provides a secure environment for Outlook Web Access. This secure environment allows organizations to enforce corporate security policies without preinstalling software or making permanent changes to remote endpoints web mail access. The implementation of Symantec On-Demand Protection to protect Outlook Web Access requires no additional hardware or software deployment. The Symantec On-Demand Agent package can simply be installed on the Outlook Web Server and integrated within the Outlook Web Access authentication process. Symantec On-Demand Protection safeguards information downloaded during and after an Web session using state-of-the-art security technologies. With this protection tool, corporations can be confident that the unmanaged endpoints using Outlook Web Access for will be in compliance with corporate and regulatory standards.

32 32 Using Symantec On-Demand Protection with Microsoft Outlook Web Access On-Demand Protection and Outlook Web Access integration To integrate On-Demand with OWA, you need to configure Symantec On-Demand Protection and the Microsoft Internet Information Services (IIS) server for which OWA Cookie enforcement is to be used. When On-Demand Cookie enforcement is configured, the Microsoft IIS server will force any user to download the On-Demand Agent before accessing their s using OWA. Cookie enforcement for an IIS server prevents bypass of on-demand security for OWA. Cookies are used to control access when the On-Demand module is running. A specified cookie is configured for each browser session, and a server-side Agent verifies the cookie and then allows or blocks the request based on the results. Symantec On-Demand also provides an HTTP packet filter to improve cookie checking for applications such as OWA hosted on an IIS web server. The ISAPI verification filter allows administrators to control access to specific IIS directories. To configure Cookie enforcement 1 Install Symantec On-Demand Manager on a separate desktop. 2 Configure the Symantec On-Demand Agent policies. 3 Move the Symantec On-Demand Agent directory to the IIS/Exchange Web server - Outlook Web Access server. 4 Configure the Virtual Desktop Success URLS and Cookies. 5 Create a New Virtual Directory Named Secur to point to the On-DemandAgent Folder. 6 Edit SodaURLCookie.txt to point to the Exchange Server. 7 Configure the ISAPI filter. 8 Restart the IIS/Exchange Web server - Outlook Web Access server. Symantec On-Demand Protection provides a secure virtual workspace where the desktop of the endpoint is actually cloned and separated from the original desktop. The security policy aims to protect the information by encrypting and securing any data written to the hard drive. Additionally, it can enable the enforcement of policies that prevent the user from copying and pasting information, creating screen captures, and printing. And its outbound firewall disrupts Malware and Spyware communication. Note: For more information about the 8 steps required to integrate On-Demand Protection with OWA, and for detailed On-Demand/OWA deployment strategies for Small-Medium Business networks, High Availability networks, Enterprise-level networks, and ISA Firewall network installations, refer to the Implementation Guide for Symantec On-Demand Protection.

33 Chapter 8 Troubleshooting This chapter includes the following topics: Questions and answers about On-Demand Protection General Questions Time-Out Questions Host Integrity Questions Virtual Desktop Questions Security Questions Networking and Firewall Questions Questions and answers about On-Demand Protection Symantec On-Demand Manager, Symantec On-Demand Agent, and Symantec Cache Cleaner are simple to use, but sometimes questions arise. This section provides questions and answers in the following areas: General Questions Time-Out Questions Host Integrity Questions Virtual Desktop Questions Security Questions Networking and Firewall Questions

34 34 Troubleshooting General Questions General Questions The following questions deal with a broad range of areas of interest. Q: When do modified settings apply to the On-Demand Agent? A: When you modify the settings in the On-Demand Manager, you must deploy those settings by copying the files in the appropriate folder to your server. They then take effect the next time that a user starts the On-Demand Agent. Q: Do I need Administrator privileges to use the On-Demand Agent features? A: No. Symantec On-Demand can be delivered with guest rights, ActiveX disabled, and the endpoint s browser security at "high." Q: How large are the On-Demand Agent Files that get downloaded to client machines? A: The size of the On-Demand Agent files depends on which modules are downloaded and implemented. Table 8-1 lists the size of each individual module during download to the client. These numbers represent compressed file sizes on the server; the files are then expanded and deployed on the client. Table 8-1 Downloadable Module Sizes Module Virtual Desktop Host Integrity Cache Cleaner Module Size for Windows XP, Windows 2003, and Windows KB 490 KB 421 KB Module Size for Windows Vista 565 KB 490 KB 421 KB Note: On-Demand Agent modules share common files. Therefore, when On-Demand modules are downloaded individually, their file sizes are larger than when downloaded in combination. For example, if you download both the Virtual Desktop and Host Integrity modules at the same time, the combined file size is only 701KB, whereas the Virtual Desktop alone is 591 KB.

35 Troubleshooting General Questions 35 Q: What log files are stored on the client computer? A: Currently, Symantec On-Demand stores log files on client computers in the locations shown in Q: What log files are stored on the client computer? on page 35. Note: The Logfile paths are applicable to both JAVA delivery (which requires Sun JRE) or ActveX delivery. With either delivery method executed, the temporary paths remain the same. Table 8-2 shows the locations of stored log file paths on client computers. Table 8-2 Client Windows 2000/2003/XP Windows Vista (with Internet Explorer 7.0 protected mode is enabled) Windows Vista (with Internet Explorer 7.0 protected mode is disabled) Log file paths on client computers Logfile Path %TEMP%\Symantec On-Demand Note: For Windows XP, %TEMP% value is C:\Documents and Settings\Administrator\Local Settings\Temp %TEMP%\Low\Symantec On-Demand Note: For Vista, %TEMP% value is C:\Users\Administrator\AppData\Local\Temp %TEMP%\Symantec On-Demand\ Note: %TEMP% is the environment variable of OS Q: What is the Agent s CPU usage on the client computer? A: There are two areas to consider: Agent download and Agent operation. Agent download: Dependent on how much load the Java applet has on the underlying CPU; negligible in most tests. Agent operation: The Agent remains idle most of the time; it is activated only to perform the following functions: Cache cleaner: activates only to delete files, which is disk-intensive rather than CPU-intensive. Depending on how many files need to be deleted, this will take more or less time.

36 36 Troubleshooting General Questions Virtual desktop: when a file is opened within the virtual desktop, two copies are created, one of which is encrypted. The disk is accessed for the creation, encryption and deletion of files, but CPU usage is minimal. Q: Can I use wildcards when specifying location settings? A: Wildcards can be used only when specifying IP Address, Host Name and Domain Name. When you specify the Host or Domain Name, the "*" character must be placed at the end of the string of characters that you enter. It cannot be used at the beginning of the string or between characters. For example, "Fred*" would be a valid entry, while "*Fred" or "Fre*d" would be invalid. When you specify the Registry, you can select the Contains option, which is similar to using a wildcard. There is a known issue in which Fully Qualified Domain Names (FQDNs) behave differently when endpoint machines are using Sun JRE. JRE returns only the hostname. Therefor, if you specify an entire FQDN in the Host Name dialog, it will fail on endpoints using JRE. The current workaround is to specify a Host Name setting with just the host name and an asterisk at the end. For example, suppose you have a PC called PC1 with the following hostname: host1.domain.com In the On-Demand Manager, if you specify the Host Name rule with the FQDN, then PC1 will fail if it is running Sun JRE. Figure 8-1 shows the hostname specified incorrectly. Figure 8-1 Sun JRE and hostname specifications The current workaround is to specify a Host Name setting using just the host name with an asterisk appended (see Figure 8-2). This workaround allows endpoints using Sun JRE to access the network. This limitation will be addressed in a future

37 Troubleshooting General Questions 37 release of the On-Demand Manager, after which it will become possible to specify host1.domain.com and pass using Sun JRE. However, neither the current workaround nor the upcoming fix will allow you to identify individual computers. To do that, you need to create different host names and select "OR" as the logical condition. Figure 8-2 shows the wildcard workaround for hostname designations. Figure 8-2 Wildcard workaround for hostname designations Q: Can I use "Fast User Switching" on Windows XP? A: Fast user switching is the ability to switch users in XP and Vista without logging out. Fast User Switching is not recommended for use with the Symantec On-Demand Agent. Q: Does Symantec On-Demand support the use of Hyper-threading technology? A: There is no explicit hyper-threading support in Symantec On-Demand; Symantec On-Demand does not deal with multiple processors because it does not run at the system level. Q: What are cookies? How are they set? A: In the Symantec On-Demand Manager, you can configure cookie settings for each module. Note: Refer to the Implementation Guide for Symantec On-Demand Protection for information about Cookie enforcement and OWA integration.

38 38 Troubleshooting General Questions To set a cookie for the Virtual Desktop 1 Select the URL configuration tab for the Virtual Desktop. 2 Enter the success URL. 3 Click Set Cookie and enter the cookie string, then click Apply. 4 Copy all the Symantec On-Demand Agent files on your download web server for users to access. When copying all the Symantec On-Demand Agent files onto your download web server for users to access. let's call the download web server server1.symantec.com and the client computer agent1. When agent1 wants to access the internal network, it needs first to download the Symantec On-Demand Agent from server1.symantec.com. When the Agent has been downloaded successfully, it will automatically launch the Virtual Desktop. The Virtual Desktop will launch an applet to set the cookie and then display the success URL. Below is the syntax of the cookie string: NAME=VALUE; expires=date; path=path; domain=domain_name; secure In the syntax example above, NAME is the cookie s name; there should be no semi-colons, commas or white space between the NAME and the VALUE. The expires attribute specifies the date string. We recommend not using this attribute, so the cookie will be a session cookie, which means that if you close all browser windows, the cookie will be gone. Because the cookie is located in the memory, it will not be written to disk. The session cookie is more secure because it is hard to compromise. The path attribute is used to specify the subset of URLs in a domain for which the cookie is valid. The path "/" is the most general path. The domain attribute specifies which domain is valid for the cookie select. It is a tail match. For example, set the cookie string to: symantec=1;path=/;domain=.symantec.com (do not omit the leading period before the Symantec.com) When agent1 launches the success URL the cookie will be inserted into the HTTP request header, because server2.symantec.com tail-matches the domain.symantec.com. So, the server side application for this login page can judge whether to display the login page for agent1 based on the value of this session cookie.

39 Troubleshooting Time-Out Questions 39 However, if you set the cookie string to symantec=1;path=/, the cookie will not be piggybacked with the success URL Because the cookie was originally set relative to the domain name server1.symantec.com, it will only be sent with the URL from the same server. Of course, if your request URL is: there will be no problem. The secure attribute specifies that the cookie will be sent only when using the HTTPS protocol. Using the cookie feature, you can enforce your login processes. Only requests for the login page URL with the correct cookie value will be processed; all others will be rejected. That will force all users to install the Virtual Desktop. To retrieve the actual cookie value Check the actual login cookie value on a web server to determine if it is coming from On-Demand Protection by using the following JavaScript call: unescape(document.cookie) Previously, On-Demand used the call document.cookie(login_variable) to retrieve cookie information; the "unescape" call shown above is a replacement of this script. See the URL for further information about cookies. Q: I ve installed the On-Demand Manager, but it won t launch. What s wrong? A corrupt setup.xml file may be preventing the successful launch of Symantec On-Demand Manager. Options include: Time-Out Questions Contact and provide them with the corrupted setup.xml file. Replace the existing setup.xml with a clean template from a working instance of Symantec On-Demand Manager of the same version. The following time-out settings apply to the On-Demand Agent and the Cache Cleaner.

40 40 Troubleshooting Host Integrity Questions Q: How does the "time-out" setting work on the On-Demand Agent? A: The time-out setting is independent of the desktop on which the user is operating. If the user sets a time-out of 1 minute, and then shifts to the normal desktop and works there beyond the one-minute setting, the Virtual Desktop closes at the end of the minute. Depending upon other settings, the data may be saved in a Persistent Desktop or erased from the disk. Also, the Virtual Desktop software may also be uninstalled, if it is set to do so upon close. Q: What about Macintosh and Linux? Do they have a "time-out" setting? A: Yes. For these two operating systems a total timeout is the only choice available; there is no inactivity timeout. The timeout is in minutes, seconds, or hours that you specify. Host Integrity Questions The following questions apply to the area of Host Integrity. Q: For Host Integrity, what is the AND/OR relationship among the various settings? A: The whole area of Host Integrity is either enabled or disabled. If it is enabled, you can then enable or disable each of these areas: Antivirus software Personal firewall software Service packs Antispyware Custom If you enable more than one area, the end user s computer must "pass" in each area to "pass" the Host Integrity check. This means that there is an "AND" relationship among those areas. In most cases, you should specify an "OR" relationship among the choices for a particular type of setting. Note: The Service Pack setting is automatically defined as an "OR" relationship.