Getting Started Symantec Client Security About Security Security provides scalable, cross-platform firewall, intrusion prevention, and antivirus protection for workstations and antivirus protection for network servers. You can establish and enforce security policies; retrieve content updates, such as virus and security risk definitions and intrusion prevention signatures; quarantine and delete live viruses; analyze logged events; and generate the reports that are based on security events in your network. Security provides a variety of management tools. You can use the Symantec System Center, a centralized management console, on an administrator computer to manage security on your networked computers and remotely deploy Security software. Additional tools allow you to collect and store security events in a centralized database, set up the internal distribution of content updates, and automate responses to new or unrecognized viruses and security risks. Security can also protect the computers that are not connected to your network. Copyright 2006 Symantec Corporation. All rights reserved. Printed in the U.S.A. P/N: 10517957 Symantec, the Symantec logo, LiveUpdate, Norton AntiVirus, Symantec AntiVirus, Firewall, Symantec Client Security, Symantec Security Response, and Symantec System Center are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. How to get started This card describes the easiest and quickest way to install Security on computers that run Microsoft Windows and provides the information that you need to run the product. For a description of all of the methods that you can use to install Security, including Windows Installer (.msi) technology, the Web Installer, third-party tools, logon scripts, and NetWare, see the Security Installation Guide. 1
If you are upgrading from an earlier version of Symantec Client Security, refer to the chapter about migration in the Security Installation Guide. To use this card to get started, do the following: Read about the Security components. Review the system requirements. Review preinstallation information and perform any required tasks. Install the product. After completing the installation, review the post-installation tasks. What's new in this release Security includes new features, as well as improvements to existing features. Table 1 lists what's new in this release. Table 1 New features in Security Table 1 Feature Symantec AntiVirus for Linux Security risks exclusions New features in Security (continued) Description Provides real-time antivirus file protection through Auto-Protect and file system scanning on supported kernels and distributions of Red Hat Enterprise, SuSE Enterprise, and Novell Desktop Linux. Client computers are unmanaged, but administrators can configure them by using the provided command-line interface. Users can display product information and initiate a LiveUpdate from client computers. For more information, see the Symantec AntiVirus for Linux Implementation Guide and the Symantec AntiVirus for Linux Client Guide. Lets administrators better define their company's security policies by allowing them to exclude security risks from on-demand scans and Auto-Protect scans. Feature Reporting Description Includes an integrated reporting system, which enables administrators to quickly and easily review Security events and configurations, and configure alerts. Administrators can also review the reports from a Web browser. Security risk scanning improvements Rates impact of security risks on several different factors including: Privacy Performance Ease of removal Amount of stealth risks exhibit when they install Auto-Protect improvements Anti-spyware improvements Includes a reporting agent that you can install on legacy Security servers so that a reporting server can collect events from these servers as well. Protects your Security computers by blocking security risks before they install if Symantec determines that this action would not leave the computer in an unstable state. Repairs complicated risks, such as Winsock LSP and host file infections, stealthed user mode risks (rootkits), and persistent security risks that are difficult to remove or that reinstall themselves. Improved CD Start Menu Centrally managed endpoint compliance Scanning options additions You can use this information to decide what security risks should be excluded from scanning. Simplifies Security installation by grouping client, server, and management component installation tasks. Lets you create and manage endpoint compliance policies and determine the compliance status of the endpoints that attempt to access your network. Provides administrators greater control of scans by allowing them to perform the following tasks: Disable startup scans. Disable the Quick Scan that runs when new definitions are updated on client computers. Enable user-defined scheduled scans even when the user who defined the scan is not logged in. 2
Table 1 New features in Security (continued) Table 1 New features in Security (continued) Feature Description Feature Description Promoting servers to primary management servers Automatically copies the server group private key to a newly promoted primary server as long as the certificate is available on the previous primary server. This process was previously done manually by the administrator. UDP connections Increases network performance for Security clients by analyzing UDP traffic and applying the action that is taken on the initial UDP datagram to all subsequent UDP datagrams for the current program session. Exchange scanning improvements Internet Email Auto-Protect enhancements Network scanning options Quarantine enhancements Tamper Protection enhancements Predefined firewall policies and updates Configuring Ignore Digest Values Provides automatic exclusion of files and folders from scans when an Exchange server is present on the computer where Symantec Client Security is installed. Administrators no longer have to exclude files and folders manually. Handles encrypted email over secure POP3 and SMTP connections in pass-through mode. Improves network performance by allowing administrators to enable trust in remote versions of Auto-Protect and to use a network cache to reduce duplicate scanning across network drives and improve file transfer speed. Reduces the footprint of Security clients and servers by letting administrators configure how long quarantined items are stored on their computers. Protects Symantec internal objects, as well as processes. Provides administrators with the preconfigured firewall policies and updates that they can use to deploy to new Symantec Client Firewall clients or update existing clients. Provides administrators greater flexibility when creating prules by letting them determine whether digest values are ignored for each individual prule, rather than for the entire prule set in a policy file. Stateful NetBIOS inspection Configure Firewall permissions Increases network performance for Firewall clients by monitoring outgoing NetBIOS packets and allowing incoming NetBIOS replies without scanning the replies. Provides administrators the option to allow users to view firewall settings without letting users configure the settings. Previously, if users were not given permissions to configure firewall settings, they could not view the settings as well. Security components Security lets you install only the components that you need to implement security at your site. Although you can install and manage the Symantec Client Security server and client programs without the Symantec System Center, a centrally managed implementation works best for most businesses. The Symantec System Center is required if you want to manage new and legacy Security servers and clients from a central console. The following management components are installed by default when you install the Symantec System Center: Symantec AntiVirus Snap-In: Required if you want to centrally manage antivirus protection. Firewall Snap-In: Required for firewall client administration. Symantec Endpoint Compliance Snap-In: Required to configure endpoint compliance policies and to determine the compliance status of endpoints from the Symantec System Center. AV Server Rollout Tool: Required to push the Symantec AntiVirus server installation to remote computers. 3
ClientRemote Install Tool: Required to push the Symantec Client Security client installation to the remote computers that run supported Windows operating systems. Reporting Snap-In: Required to collect Security events and to create reports from the events that are collected. If you elect not to install any of these management components with the Symantec System Center, you can run the Symantec System Center installation later and select them. System requirements This section includes system requirements for the main Security components. For system requirements for other components, see the Security Installation Guide. About Desktop firewalls If your servers and clients run firewall software, and you want to manage these servers and clients, you must open certain ports so that communication between the servers, clients, and Symantec System Center is possible. Alternatively, you can permit Rtvscan.exe on all computers and Pds.exe on servers and consoles to send and receive traffic through your firewalls. Also, remote server and client installation tools require that TCP port 139 be opened. Table 2 lists the network protocols and ports that Symantec Client Security client and server require for communicating and network installations. Table 2 Function Client deployment Server deployment Ports for client and server installation and communication Component Management server and target clients Management servers and target servers Protocol and port TCP 139 TCP 139 UDP 38293 Table 2 Function General communication General communication Discovery Discovery Reporting Ports for client and server installation and communication (continued) Component Netware servers Symantec System Center Servers Symantec System Center Servers and agents Protocol and port TCP (Inbound) 2968 Note: This port number is configurable. TCP (Outbound) 2967 and 2968 Note: These port numbers are configurable. UDP 38293 UDP 1024-5000 Note: You do not need to open these ports if your router or firewall recognizes UDP datagram program sessions. TCP 80 (HTTP) 443 (SSL) Note: If you set up a database on a remote machine, you must create an alias and ensure that port number is open. The default for SQL Server is TCP 1433. Operating system requirements Table 3 lists Security component operating system requirements General communication Servers and clients TCP (Inbound) 2967 Note: This port number is configurable. 4
Table 3 Component Symantec System Center Operating system requirements Description Windows 2000 Professional/Server/ Advanced Server Windows XP Professional Windows Server 2003 Web/Standard/ Enterprise/Datacenter RAM, storage, and application requirements Table 4 lists RAM, storage, and application requirements for Security components Table 4 Component RAM, storage, and application requirements RAM, storage, and applications Security server Reporting Server Reporting Agent Firewall Administrator Security client (firewall and antivirus protection) Windows 32-bit Windows 2000 Professional/Server/ Advanced Server Windows XP Professional Windows Server 2003 Web/Standard/ Enterprise/Datacenter NetWare 5.1 with Support Pack 8 or higher NetWare 6.0 with Support Pack 5 or higher NetWare 6.5 with Support Pack 2 or higher Windows 2000 Server/Advanced Server Windows Server 2003 Standard/ Enterprise with Support Pack 1 or higher Note: You must enable active scripting on your Web browser before using the reporting server from the Symantec System Center or your Web browser. Windows 2000 Professional/Server/ Advanced Server Windows XP Professional Windows Server 2003 Web/Standard/ Enterprise/Datacenter Windows 2000 Professional/Server/ Advanced Server Windows XP Professional Windows Server 2003 Web/Standard/ Enterprise/Datacenter Windows 2000 Professional Windows XP Home Edition/Professional/ Tablet PC Edition Symantec System Center Security server for Windows 64 MB RAM 36 MB disk space without snap-ins 337 MB disk space for Reporting Snap-in 518 MB disk space for Symantec Endpoint Compliance Snap-in 24 MB disk space for AMS 2 Snap-in 6 MB disk space for Symantec AntiVirus Snap-in 1 MB disk space for Firewall Snap-in 130 MB disk space for AV Server Rollout tool 2 MB disk space for ClientRemote Install Snap-in Microsoft Management Console 1.2 or later If MMC is not already installed, you will need 3 MB free disk space (10 MB during installation). If version 1. is not on the computer to which you are installing, the installation program will install it. 64 MB RAM 140 MB disk space 15 MB disk space for reporting agent files (if you choose to install the reporting agent) Static IP address (recommended) Note: Security does not support the scanning of Macintosh volumes on Windows servers for Macintosh viruses. Security antivirus client Windows 64-bit Windows XP 64-bit Edition Version 2003 Windows Server 2003 Standard/ Enterprise/Datacenter 64-bit 5
Table 4 RAM, storage, and application requirements (continued) Before you install Component Security server for NetWare Reporting Server Reporting Agent Firewall Administrator Security client 32-bit Security client 64-bit RAM, storage, and applications 15 MB RAM 116 MB disk space (70 MB disk space for server files and 46 MB disk space for the client disk image) 20 MB disk space for AMS 2 server files (if you choose to install the AMS 2 server) Static IP address (recommended) 256 MB RAM for 100 clients, 512 MB RAM for 1,000 clients, 1 GB RAM for 50,000 clients 1.5 GB disk space for 100 clients, or 2 GB disk space for 1,000 clients, or 40 GB disk space for 50,000 clients MSDE 2000 with Service Pack 4 (installable), or Microsoft SQL Server 2000 with Service Pack 1 or later (existing), or Microsoft SQL Server 2005 or later (existing) Internet Information Services 4.0 or later 11 MB RAM 15 MB disk space 80 MB RAM 130 MB disk space 128 MB RAM 115 MB disk space 80 MB RAM 70 MB disk space Intel EM64T or AMD 64-bit Opteron and Athlon processors Note: The ClientRemote Install Tool does not check to verify that is installed on computers when it is required. If the target computers do not have the correct version of Internet Explorer, the installation fails without informing you. Before you begin any installation procedure, you need to consider several factors. Disabling Internet Connection Firewall Windows XP with Service Pack 1 includes a firewall that is called Internet Connection Firewall that can interfere with remote Security installation, and communications between servers and clients. If any of your servers or clients run Windows XP, you can disable the Windows XP firewall on them before you install Symantec Client Security clients. To disable Internet Connection Firewall 1 On the Windows XP taskbar, click Start > Control Panel. 2 In the Control Panel window, double-click Network Connections. 3 In the Network Connections window, right-click the active connection, and then click Properties. 4 On the Advanced tab, under Internet Connection Firewall, uncheck Protect my computer and network by limiting or preventing access to this computer from the Internet. 5 Click OK. Disabling Windows Firewall Windows XP with Service Pack 2 and Windows 2003 Server include a firewall that is called Windows Firewall that can interfere with remote Security installation, and communications between servers and clients. If any of your servers or clients run Windows XP with Service Pack 2 or Windows Server 2003, you can disable the firewall on them before you install Security clients. To disable Windows Firewall 1 On the Windows XP taskbar, click Start > Control Panel. 2 In the Control Panel window, double-click Network Connections. 3 In the Network Connections window, right-click the active connection, and then click Properties. 4 On the Advanced tab, under Windows Firewall, click Settings. 6
5 In the Windows Firewall window, on the General tab, check Off (not recommended). 6 Click OK. Permitting remote software installation on Windows XP computers By default, you cannot install Security software remotely on the Windows XP computers that are installed in a Workgroup. When Windows XP is installed in a Workgroup, the Local Security Policy for Network Access Sharing and Security model is set to Guest instead of Classic. You must set this value to Classic to install software remotely on each server and client. Note: This default does not apply to the Windows XP computers that are installed in a domain. To permit remote software installation on Windows XP computers 1 On the Windows XP taskbar, click Start > Settings > Control Panel > Administrative Tools > Local Security Policy. 2 In the Local Security Settings window, expand Local Policies, and then click Security Options. 3 Locate the policy for Network access: Sharing and security model for local accounts. 4 Change the setting from Guest only - local users authenticate as Guest to Classic - local users authenticate as themselves. Installing Security for the first time When you install Security for the first time, be sure to install the various components on a few computers, preferably in a test environment. The popular, small, and inexpensive routers that use DHCP to assign clients 192.168.1.x addresses are an excellent tool to use to create test environments. The following list shows the order in which you install and configure the essential management, server, and client software for the first time: Install the Symantec System Center. Install the Security server software on the same computer as the Symantec System Center. Configure the Security server as a primary management server. Install Security client software on other computers. Installing the Symantec System Center The Symantec System Center is installed directly from the Security CD. Install the Symantec System Center to the computers from which you want to manage your antivirus and firewall protection. To install the Symantec System Center 1 Insert the Security CD into the CD-ROM drive. 2 In the Security panel, click Install Security > Install Symantec System Center. 3 In the Welcome panel, click Next. 4 In the License Agreement panel, click I accept the terms in the license agreement, and then click Next. If Microsoft Management Console 1. is not installed on the computer, a message indicates that you must allow it to install. 5 In the Select Components panel, check any of the following components that you want to install: Alert Management System Console (optional, for legacy support) Symantec AntiVirus Snap-In Firewall Snap-In Symantec Endpoint Compliance Snap-in AV Server Rollout Tool ClientRemote Install Tool Reporting Snap-In If these components are not present on the computer, all of them except Alert Management System Console are checked automatically. 6 Click Next. 7 In the Destination Folder panel, do one of the following: To accept the default destination folder, click Next. Click Change, locate and select a destination folder, click OK, and then click Next. 8 In the Ready to Install the Program panel, click Install. 7
9 In the InstallShield Wizard Completed panel, to close the wizard, click Finish. 10 When you are prompted to restart the computer, click Yes. This reboot is not optional. It must be done before you proceed with the rest of the Security installation. Installing the primary management server You can install the Security management server that you want to designate as the primary management server from the Security CD or the Symantec System Center. When you install for the first time, you should install the server on the computer that contains the Symantec System Center. To install the primary management server from the CD 1 Insert the Security CD into the CD-ROM drive. 2 In the Security panel, click Install Security > Install Security Server. 3 In the Welcome panel, click InstallSymantecAntiVirus server, and then click Next. 4 In the License Agreement panel, click I agree, and then click Next. 5 In the Select Items panel, click Server program, click Reporting Agent if you want to forward security events to the reporting server, and then click Next. 6 In the Select Computers panel, under Network, select a computer, and then click Add. 7 Click Next. 8 In the Server Summary panel, review the information, and then click Next. 9 In the Select Symantec AntiVirus Server Group panel, type a server group name, and then click Next. 10 In the Enter Password for the Server Group dialog box, enter a user name and password for the server group. 11 In the Server Startup Options panel, click Automatic startup, and then click Next. 12 In the Using the Symantec System Center Program panel, click Next. 13 In the Setup Summary panel, review the information, and then click Finish. 14 In the Setup Progress panel, click Close after the server installation completes. Configuring a primary management server Every server group requires one primary management server. This server controls all other servers and clients in the server group. You cannot install clients from the Symantec System Center without configuring a primary management server. After you install Security server, you should designate the server as the primary management server. This designation allows you to deploy other servers and clients from the Symantec System Center. Note: After you designate the primary management server, you must designate a reporting server to which the primary management server sends events. To configure a primary management server 1 Start the Symantec System Center. 2 In the Symantec System Center console, in the left pane, expand Symantec System Center > System Hierarchy. 3 Right-click the server group that you created when you installed the Security server. 4 Click Unlock Server Group. 5 In the Unlock Server Group dialog box, do the following: 6 Click OK. In the Username box, type the user name that you entered when you installed the Security server. In the Password box, type the password that you entered when you installed the antivirus server. 7 In the left pane, right-click the computer name of the Security server. 8 Click Make Server a Primary Server. 9 In the prompt, click Yes. 10 In the Reporting Server Options dialog box, enter the host name or IP address of the Reporting Server that you want to associate with the primary management server, and then click OK. 11 On the main menu bar, click Console > Save. 8
Installing client software You have two primary options for installing client software. You can install the software from the Symantec System Center or you can install the software from the installation CD. You can also install client software by using Web-based installations and logon scripts. For information on installing to Linux operating systems, see the Symantec AntiVirus for Linux Implementation Guide. Note: You cannot install Security client software on to server operating systems, such as Windows 2000 Server or Windows 2003 Server. Security client contains Firewall, which is not supported on server operating systems. If you attempt to install Security client to server operating systems, Symantec automatically installs Security server software instead. If you prefer to install Symantec AntiVirus client to these computers, you can install it from the SAV folder in the Security CD. Installing client software by using the Symantec System Center When you install clients from the Symantec System Center, the clients are automatically managed. To install client software by using the Symantec System Center 1 In the Symantec System Center console, in the left pane, right-click the server group that you created when you installed the Security server. 2 If necessary, click Unlock Server Group, and then unlock the server group. 3 In the left pane, click the primary management server so that it remains highlighted. 4 On the Tools menu, click ClientRemote Install. ClientRemote Install is available only if you selected the ClientRemote Install Tool when you installed the Symantec System Center. This component is selected for installation by default. 5 In the Welcome panel, click Next. 6 In the Select Install Source Location panel, click Default location, and then click Next. 7 In the Select Computers panel, under AntiVirus Servers on the right side, select a computer to act as the parent server (your primary management server). 8 Under Available Computers on the left side, expand Microsoft windows network, expand a group, and then select a client computer. 9 Click Add. The client computer moves under the AntiVirus parent server in the right pane. 10 Continue selecting and adding client computers until all of the clients that you want to manage are added, and then click Finish. 11 In the Status of Remote Client Installation(s) panel, when the remote installation is finished, click Done. 12 Restart the client computers. 13 After a few minutes, in the Symantec System Center console, on the main menu bar, click Actions > Refresh. The client computers appear in the right pane when the client software is fully installed, which may take up to a minute. 14 On the main menu bar, click Console > Save. Installing client software from the CD You can install the client software from the Security CD. The following procedure shows how to install the software on one client. To install client software from the CD 1 Insert the Security CD into the CD-ROM drive. 2 In the Security panel, click Install Security, and then in the next panel, click Install Security Client. 3 In the Welcome panel, click Next. 4 In the License Agreement panel, click I accept the terms in the license agreement, and then click Next. 5 In the Setup Type panel, click Complete, and then click Next. 6 In the Network Setup Type panel, click Managed, and then click Next. 7 In the Select Server panel, do one of the following: Next to Server Name, type the host name of the primary management server that you installed and configured. Click Browse, select the primary management server that you installed and configured, and then click OK. 8 Click Next. 9
9 In the Ready to Install the Program panel, click Install. 10 In the Installing Security panel, when the installation is finished, click Finish. 11 Click Yes to restart the client computer. 12 (Temporary) Upon restart, display the Firewall window, and then click Security > Turn Off. This action is temporary until you install a rulebase that permits testing with Firewall Administrator. Post-installation tasks After installation, you should do the following: Install and configure the reporting server, which lets you forward security events to a centralized database, create reports based on the security events, and configure alerts. For more information, see the Security Installation Guide and the Reporting User's Guide. Read about how to configure Firewall to permit testing in Chapter 3 of the Security Installation Guide. Read about how to test antivirus and threat detection capabilities in Chapter 3 of the Security Installation Guide. Read about how to install and configure endpoint compliance in the Endpoint Compliance Implementation Guide. Perform a virus and security risk definitions content update by using LiveUpdate. Run a scan on all protected computers. Schedule when client computers scan for risks and update definitions. Configure Auto-Protect and Tamper Protection. Back up your private key for your server group root certificate, which is located in the <Drive:>\Program Files\SAV\Symantec Antivirus\pki\private-keys directory on the primary server. Install Firewall Administrator on the computer that contains the Symantec System Center console and on a client computer. On the client computer, become familiar with Symantec Client Firewall Administrator by importing and exporting policy files to and from the client. Experiment with creating rulebases and policy files, and test the policy files by logging on to domains, printing, and checking Web sites. Read about how to create rulebases that support networking in the Security Administration Guide. Move the firewall policy files to the computer that runs the Symantec System Center console and push the files to clients by using the Symantec System Center console. Modify firewall policy files by using the Firewall Administrator that is installed on the computer that runs the Symantec System Center console and push the files to clients. Become familiar with the Profiling feature of Symantec Client Firewall Administrator. Devise implementation plans and modify client configurations until end users are satisfied with usability and administrators are satisfied with security. Distribute your security policies. For information on how to perform management tasks, see the Security Administrator's Guide. 10