McAfee VirusScan Enterprise for Linux 1.9.0

Configuration Guide McAfee VirusScan Enterprise for Linux 1.9.0 For use with epolicy Orchestrator 4.5, 4.6 and 5.0 Software

COPYRIGHT Copyright 2013 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee AppPrism, McAfee Artemis, McAfee CleanBoot, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Enterprise Mobility Management, Foundscore, Foundstone, McAfee NetPrism, McAfee Policy Enforcer, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, SmartFilter, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure, WormTraq are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Contents Preface 5 About this guide.................................. 5 Audience.................................. 5 Conventions................................. 5 What's in this guide.............................. 6 Find product documentation.............................. 6 1 Introduction 7 Product Features.................................. 7 What s new in this release.............................. 8 2 Integrating with epolicy Orchestrator 11 Prerequisites................................... 11 Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator.......... 12 Upgrading your client systems using epolicy Orchestrator................. 14 Sending an agent wake-up call............................ 15 Setting policies within epolicy Orchestrator....................... 16 Creating or editing policies........................... 16 Enforcing policies............................... 17 Scheduling tasks.................................. 17 Creating a Product Update task......................... 17 Creating an on-demand scan task........................ 18 Setting the VirusScan Enterprise for Linux admin password.............. 19 Configuring reports................................. 20 Uninstallation................................... 21 Removing McAfee VirusScan Enterprise for Linux from the client computer....... 21 Removing McAfee VirusScan Enterprise for Linux from epolicy Orchestrator....... 22 Index 23 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 3

Contents 4 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Preface This guide provides the information you need to configure, use and maintain McAfee VirusScan Enterprise for Linux using McAfee epolicy Orchestrator software. This guide provides detailed information on how you can deploy VirusScan Enterprise for Linux on client computers and manage the product using epolicy Orchestrator. For instructions on how to install McAfee VirusScan Enterprise for Linux software on a stand alone computer, see the McAfee VirusScan Enterprise for Linux Installation Guide for your product version. For detailed information all phases of product use from configuration to troubleshooting on a standalone Linux server, see the McAfee VirusScan Enterprise for Linux Product Guide for your product version. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Users People who use the computer where the software is running and can access some or all of its features. Conventions This guide uses these typographical conventions and icons. Book title, term, emphasis Bold User input, code, message Interface text Hypertext blue Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 5

Preface Find product documentation Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. What's in this guide This guide is organized to help you find the information you need. This guide provides you with an introduction to McAfee VirusScan Enterprise for Linux and how to integrate it with epolicy Orchestrator. Topics include: Deploying McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Settings policies within epolicy Orchestrator Scheduling tasks such as product update and on demand scan Configuring reports Removing the software Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com. 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 6 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

1 Introduction 1 McAfee VirusScan Enterprise for Linux detects and removes viruses and other potentially unwanted software on Linux based systems. This information is intended for network administrators who are responsible for their company s anti virus and security program. Contents Product Features What s new in this release Product Features This section describes the product features for the McAfee VirusScan Enterprise for Linux software. McAfee VirusScan Enterprise for Linux software has these features: Support for Amazon EC2 Linux machines (2.6.x kernels) Support for Novell Cluster Services Support for Corosync OCFS2 File System Cluster Runtime kernel module support (RKMS) McAfee VirusScan Enterprise for Linux Kernel modules will be created dynamically in case of a mod version failure. To manually compile the kernel module, refer Frequently asked questions Runtime kernel module support in the Product Guide. Support for 64 bit AMD64/Intel EM64T operating systems. The latest version (5600) of the McAfee anti virus engine. Incremental Virus Signature (DAT) updates. Mod versioning for automatic kernel support. Regular expression based exclusions for On access scan and On demand scan from the user interface. Scanning Comprehensive on access anti virus scanning and cleaning using the McAfee scanning engine. On access scanning for local file systems, NFS and Samba/CIFS. Kernel level scan cache for improved performance. McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 7

1 Introduction What s new in this release Scheduling of on demand scans. Scheduling of updates for scanning engine and virus definition files. Administration Remote administration using browser based interface. Secure browser interface with authentication and HTTPS (SSL) support. Reporting Real time statistics. Detailed database for detected items and system events. Ability to query the database by date range or individual field values, for example, virus name. Results of query can be exported to a CSV file. Configurable email notification for detected items, out of date virus definition files, configuration changes, and system events. Diagnostic report for use when reporting a problem with the product. What s new in this release This section describes the new enhancements in this release of VirusScan Enterprise for Linux. These new features are available in this release, that could be used from McAfee epolicy Orchestrator to configure McAfee VirusScan Enterprise for Linux client systems. General policies Enable or disable Web GUI Apache services Enable or disable SMTP notifications Enable or disable Syslogging with different levels Enable logging from epolicy Orchestrator On Access policy Specify primary and secondary actions for Programs and Jokes On Demand scan task Specify primary and secondary actions for Programs and Jokes Specify custom Maximum scan time for each on demand scan task Product deployment task Deploy the product successfully without PAM libraries Password change task Set the McAfee VirusScan Enterprise for Linux administrator password from epolicy Orchestrator 8 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Introduction What s new in this release 1 System properties Scanning summary information on Files Scanned and Number of Infections for the selected Linux client Threat information is available now Events On demand scan task status events Password change task status events Queries and reports Threat report Compliance report Help Content New epolicy Orchestrator Help extension for McAfee VirusScan Enterprise for Linux McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 9

1 Introduction What s new in this release 10 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

2 Integrating with epolicy Orchestrator Configure McAfee VirusScan Enterprise for Linux using McAfee epolicy Orchestrator management software. To use this chapter effectively, you need to be familiar with epolicy Orchestrator 4.5, 4.6 or 5.0 software. McAfee epolicy Orchestrator provides a scalable platform for centralized policy management and enforcement on your McAfee security products and systems on which they reside. It also provides comprehensive reporting and product deployment capabilities; all through a single point of control. This guide does not provide detailed information about installing or using epolicy Orchestrator software. See the McAfee epolicy Orchestrator Product Documentation. Contents Prerequisites Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Upgrading your client systems using epolicy Orchestrator Sending an agent wake-up call Setting policies within epolicy Orchestrator Scheduling tasks Configuring reports Uninstallation Prerequisites Before deploying McAfee VirusScan Enterprise for Linux on Novel Open Enterprise Server 2.x: 1 From the Novell edirectory server, use imanager and create a user called "nails" and a group called "nailsgroup". 2 Add the user "nails" a member of the "nailsgroup". Enable the user and group using the Linux User Management. 3 Provide "nails" user with administrative privileges on all the NSS volumes. For example: rights f /media/nss/<vol name> r s trustee nails.<context>.<tree> You need to provide administrative privileges to the "nails" user, every time a new NSS volume is created. McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 11

2 Integrating with epolicy Orchestrator Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator Deploy McAfee VirusScan Enterprise for Linux on client computers using the epolicy Orchestrator software. Before you begin If you have any McAfee VirusScan Enterprise for Linux 1.7.0 or 1.7.1 hotfix checked in to the Master Repository's Current branch, move the hotfix to previous branch or delete it. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Create a temporary directory on your local drive. 3 Download the archive McAfeeVSEForLinux 1.9.0.<build number> release full.noarch.tar.gz and extract the files to the temporary directory. 4 Click Menu Software Master Repository. The Packages in Master Repository page appears. 5 Click Actions Check In Package. The Check In Package page appears. 6 Select the Package type as Product or Update (.ZIP) and browse in File path to locate the McAfee Agent for Linux package MSA LNX_4.8.0_Package.ZIP extracted in the temporary directory. 7 Click Next. The Package Options page appears with the package information. 8 Select a Branch. 9 In Options, select the required option(s), then click Save. 10 Click Menu Software Master Repository. The Packages in Master Repository page appears. 11 Click Actions Check In Package. The Check In Package page appears. 12 Select the Package type as Product or Update (.ZIP) and browse in File path to locate McAfee VirusScan Enterprise for Linux product deployment package McAfeeVSEForLinux 1.9.0.<build number> EPO.ZIP extracted in the temporary directory. 13 Click Next. The Package Options page appears with the package information. 14 Select a Branch. 15 In Options, select the required option(s), then click Save. 16 Click Menu Software Extensions. The Extensions page appears. 17 Click Install Extension to install the McAfee Agent policy extension. The Install Extension dialog box appears. 18 Click Browse, select the extension file EPOAGENTMETA.ZIP, then click OK on the Install Extension page. 19 Click Menu Software Extensions. The Extensions page appears. 20 Click Install Extension to install the McAfee VirusScan Enterprise for Linux policy extension. The Install Extension dialog box appears. 21 Click Browse, select the extension file LYNXSHLD1900.ZIP, then click OK on the Install Extension page. 22 Click Menu Software Extensions. The Extensions page appears. 12 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Integrating with epolicy Orchestrator Installing McAfee VirusScan Enterprise for Linux using epolicy Orchestrator 2 23 Click Install Extension to install the McAfee VirusScan Enterprise for Linux reports extension. The Install Extension dialog box appears. 24 Click Browse, select the extension file LYNXSHLD1900PARSER.ZIP, then click OK on the Install Extension page. To install the McAfee VirusScan Enterprise for Linux Help extension, browse for the file help_vsel _190.zip and check in the extension. You will find the Help extension under Extensions McAfee Help Content. 25 Create and download the agent installation package by performing these steps: a From System Tree, click System Tree Actions New Systems. The New Systems page appears. b c Under How to add systems select Create and download agent installation package, click Non Windows, then select McAfee Agent for Linux 4.8.0 (Current) and click OK. From Download file, right click install and select Save Target As... to download the file on to your local system. If you are deploying the product on a Ubuntu client system, download the installdeb.sh file on to your local system. In case of epolicy Orchestrator 4.5, this file is not available for download, hence copy this file from C:\Program Files\McAfee\ePolicy Orchestrator\DB\Software \Current\EPOAGENT3700LYNX\Install\0409. 26 From the Linux terminal, execute the following command: sh install.sh i This will establish a connection between epolicy Orchestrator and the Linux client computer. 27 Click Menu Systems System Tree. The System Tree page appears. 28 To install McAfee VirusScan Enterprise for Linux on the client Linux computer: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 or 5.0 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 29 To schedule a client task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the task and select the Type as Product Deployment and click Next. On epolicy Orchestrator 4.6 or 5.0 Under Task to schedule, select McAfee Agent as Product, select the Task Type as Product Deployment, then click Create New Task under Task Name. 30 To configure the client task: On epolicy Orchestrator 4.5 Under Configuration, select the Target platforms as Linux and in Products and components, select VirusScan Enterprise for Linux 1.9.0.<build number> from the drop down list, then select the Action as Install. On epolicy Orchestrator 4.6 or 5.0 Under Client Task Catalog, select Linux as Target Platforms, VirusScan Enterprise for Linux 1.9.0.<build number> as Products and components, Install as Action and the appropriate Language, then click Save. If you want to deploy McAfee VirusScan Enterprise for Linux with customized settings, then copy the nails.options file to the /root and / directory on your Linux client system. For more information on how to create the nails.options file, refer to the Silent installation section in the McAfee VirusScan Enterprise for Linux Installation Guide. 31 Click Next to schedule this task immediately or as required. McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 13

2 Integrating with epolicy Orchestrator Upgrading your client systems using epolicy Orchestrator 32 Click Next to view a summary of the task. 33 Click Save and send an agent wake up call. Wait for the deployment task to complete. Upgrading your client systems using epolicy Orchestrator Upgrade your existing Linux client systems running on McAfee VirusScan Enterprise for Linux version 1.6, 1.7 or 1.7.1 to version 1.9.0, using the epolicy Orchestrator software. Before you begin If you have any McAfee VirusScan Enterprise for Linux 1.7.0 or 1.7.1 hotfix checked in to the Master Repository's Current branch, move the hotfix to previous branch or delete it. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Create a temporary directory on your local drive. 3 Download the archive McAfeeVSEForLinux 1.9.0.<build number> release full.noarch.tar.gz and extract the files to the temporary directory. 4 Click Menu Software Master Repository. The Packages in Master Repository page appears. 5 Click Actions Check In Package. The Check In Package page appears. 6 Select the Package type as Product or Update (.ZIP) and browse in File path to locate the McAfee Agent for Linux package MSA LNX_4.8.0_Package.ZIP extracted in the temporary directory. 7 Click Next. The Package Options page appears with the package information. 8 Select a Branch. 9 In Options, select the required option(s), then click Save. 10 Click Menu Software Master Repository. The Packages in Master Repository page appears. 11 Click Actions Check In Package. The Check In Package page appears. 12 Select the Package type as Product or Update (.ZIP) and browse in File path to locate McAfee VirusScan Enterprise for Linux product deployment package McAfeeVSEForLinux 1.9.0.<build number> EPO.ZIP extracted in the temporary directory. 13 Click Next. The Package Options page appears with the package information. 14 Select a Branch. 15 In Options, select the required option(s), then click Save. 16 Click Menu Software Extensions. The Extensions page appears. 17 Click Install Extension to install the McAfee Agent policy extension. The Install Extension dialog box appears. 18 Click Browse, select the extension file EPOAGENTMETA.ZIP, then click OK on the Install Extension page. 19 Click Menu Software Extensions. The Extensions page appears. 20 Click Install Extension to install the McAfee VirusScan Enterprise for Linux policy extension. The Install Extension dialog box appears. 14 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Integrating with epolicy Orchestrator Sending an agent wake-up call 2 21 Click Browse, select the extension file LYNXSHLD1900.ZIP, then click OK on the Install Extension page. 22 Click Menu Software Extensions. The Extensions page appears. 23 Click Install Extension to install the McAfee VirusScan Enterprise for Linux reports extension. The Install Extension dialog box appears. 24 Click Browse, select the extension file LYNXSHLD1900PARSER.ZIP, then click OK on the Install Extension page. To install the McAfee VirusScan Enterprise for Linux Help extension, browse for the file help_vsel _190.zip and check in the extension. You will find the Help extension under Extensions McAfee Help Content. 25 Click Menu Systems System Tree. The System Tree page appears. 26 To install McAfee VirusScan Enterprise for Linux on the client Linux computer: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 or 5.0 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 27 To schedule a client task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the task and select the Type as Product Deployment and click Next. On epolicy Orchestrator 4.6 or 5.0 Under Task to schedule, select McAfee Agent as Product, select the Task Type as Product Deployment, then click Create New Task under Task Name. 28 To configure the client task: On epolicy Orchestrator 4.5 Under Configuration, select the Target platforms as Linux and in Products and components, select VirusScan Enterprise for Linux 1.9.0.<build number> from the drop down list, then select the Action as Install. On epolicy Orchestrator 4.6 or 5.0 Under Client Task Catalog, select Linux as Target Platforms, VirusScan Enterprise for Linux 1.9.0.<build number> as Products and components, Install as Action and the appropriate Language, then click Save. If you want to upgrade the McAfee Agent on the Linux client system to McAfee Agent 4.8, first add McAfee Agent for Linux 4.8.0.x, then click the + button to add VirusScan Enterprise for Linux 1.9.0.<build number> to upgrade both McAfee Agent and the product. 29 Click Next to schedule this task immediately or as required. 30 Click Next to view a summary of the task. 31 Click Save and send an agent wake up call. Wait for the deployment task to complete. 32 Restart the client computer using the command: reboot Sending an agent wake-up call Use this task to send an agent wake up call to the client computer using epolicy Orchestrator. All systems in the network are managed in the Systems tab. The System Tree contains all systems that are managed by the epolicy Orchestrator server. It is the primary interface for managing policies and tasks on these systems. You can organize or sort these systems into logical groups in the System Tree. McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 15

2 Integrating with epolicy Orchestrator Setting policies within epolicy Orchestrator My Organization is the root of the System Tree. It includes a Lost&Found group that stores systems whose locations cannot be determined by the server. Depending on the methods you use to create and maintain the System Tree segments (systems), the server uses different characteristics to place the systems in the System Tree. For information on adding a new system, refer to the McAfee epolicy Orchestrator Product Guide. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree. 3 Select a group in the System Tree. 4 Select the Computer Name(s) of that group. 5 Click Actions Agent Wake Up Agents. The Wake Up McAfee Agent page appears. 6 Select the Wake up call type as Agent Wake Up Call and a Randomization period (0 60 minutes) by which the system(s) respond to the wake up call sent by the epolicy Orchestrator server. 7 Select Get full product properties for the agent(s) to send complete properties instead of sending only those that have changed since the last agent to server communication. 8 Click OK. To see the status of the agent wake up call, click Menu Automation Server Task Log. Setting policies within epolicy Orchestrator The epolicy Orchestrator console allows you to enforce policies across groups of computers or on a single computer. These policies override configurations set on individual computers. For information regarding policies and how they are enforced, see the McAfee epolicy Orchestrator Product Guide for your product version. Before configuring any policies, select the group of computers for which you want to modify McAfee VirusScan Enterprise for Linux policies. You can modify McAfee VirusScan Enterprise for Linux policies from the pages and tabs that are available in the details pane of the epolicy Orchestrator console. These pages are nearly identical to those you can access directly from the McAfee VirusScan Enterprise for Linux user interface. After you have modified the appropriate policies and saved the changes for the intended computer or group of computers, you are ready to deploy new settings via the McAfee Agent. Creating or editing policies You can create, edit, delete, or assign a policy to a specific group in the System Tree. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree. The System Tree page appears. 3 Click Assigned Policies. 16 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Integrating with epolicy Orchestrator Scheduling tasks 2 4 Select Product as VirusScan Enterprise for Linux 1.9.0. A list of policies managed by McAfee VirusScan Enterprise for Linux appears in the lower pane. 5 Locate the required policy, and click Edit Assignment next to the policy. The policy assignment for the chosen group page appears. 6 Click Edit Policy or New Policy as required. If you click New Policy, the Create a new policy dialog box appears. Select the policy you want to duplicate from the Create a policy based on this existing policy drop down list, type a name then click OK. The new policy wizard appears. 7 Edit the policy setting as required, then click Save. Enforcing policies You can enforce a policy to multiple managed systems within a group. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree and select a required group or system(s). 3 Click Assigned Policies and from the Product drop down menu, select VirusScan Enterprise for Linux 1.9.0. 4 Select the Category and click Edit Assignment. 5 Select the policy from the Assigned policy drop down menu and click Save. 6 Select the systems again. 7 Send an agent wake up call. For instructions on sending an agent wake up call, please refer to Sending an agent wake up call section. You can create and enforce McAfee VirusScan Enterprise for Linux policies and view reports only after adding the McAfee VirusScan Enterprise for Linux extension files. Scheduling tasks The epolicy Orchestrator software allows you to create, schedule, and maintain client tasks that run on the managed systems. You can define client tasks for the entire System Tree, a specific group, or an individual system. Creating a Product Update task Schedule autoupdates on the Linux server using epolicy Orchestrator. Your software can only provide full protection if you keep it up to date with the latest anti virus definitions (DATs), spam engine, and anti virus scanning engine. We recommend that you update DAT files daily and regularly check the McAfee Labs website for new DAT files. McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 17

2 Integrating with epolicy Orchestrator Scheduling tasks Task For option definitions, click? in the interface. 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree and select a required group or system(s) for which you want to create the Product Update task. 3 To create a client task: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 or 5.0 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 4 To select the product update task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the task and select the Type as Product Update and click Next. On epolicy Orchestrator 4.6 or 5.0 Under Task to schedule, select McAfee Agent as Product, select the Task Type as Product Update, then click Create New Task under Task Name. 5 Click Next. 6 Schedule the task as desired and click Next to select the DAT, ExtraDAT and Linux Engine. 7 Schedule the task immediately or as required, then click Next to view the Summary of the product update task. 8 Click Save. 9 Send an agent wake up call. Click Edit to change the description or schedule of a product update task or Delete to remove it. Creating an on-demand scan task Schedule an on demand scan on the Linux client computer using epolicy Orchestrator. On demand scan task involves a scheduled scanning of your Linux server(s) to find a threat, vulnerability, or other potentially unwanted code. It can take place immediately, at a scheduled time in the future, or at regularly scheduled intervals. Task For option definitions, click? in the interface. 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree and select a required group or system(s) for which you want to create the on demand scan task. 3 To create a client task: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 or 5.0 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 18 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Integrating with epolicy Orchestrator Scheduling tasks 2 4 To create the on demand scan task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the on demand scan task and select the Type as On Demand Scan (VirusScan Enterprise for Linux 1.9.0) and click Next. On epolicy Orchestrator 4.6 or 5.0 Under Task to schedule, select VirusScan Enterprise for Linux 1.9.0 as Product, select the Task Type as On Demand Scan, then click Create New Task under Task Name. 5 In Configuration, specify what you want this task to do, then click Next. 6 Schedule the task immediately or as required, then click Next to view the Summary of the on demand scan task. 7 Click Save. 8 Send an agent wake up call. Click Edit to change the description or schedule of an on demand scan task or Delete to remove it. Setting the VirusScan Enterprise for Linux admin password Set the VirusScan Enterprise for Linux administrator password on Linux client systems using epolicy Orchestrator. Task For option definitions, click? in the interface. 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree and select a required group or system(s) for which you want to create the change password task. 3 To create a client task: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 or 5.0 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 4 To create the change password task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the change password task and select the Type as Change VSEL Administrator's Password (VirusScan Enterprise for Linux 1.9.0) and click Next. On epolicy Orchestrator 4.6 or 5.0 Under Task to schedule, select VirusScan Enterprise for Linux 1.9.0 as Product, select the Task Type as Change VSEL Administrator's Password, then click Create New Task under Task Name. 5 In Configuration, specify what you want this task to do, then click Next. 6 Schedule the task immediately or as required, then click Next to view the Summary of the change password task. 7 Click Save. 8 Send an agent wake up call. Click Edit to change the description or schedule of this task or Delete to remove it. McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 19

2 Integrating with epolicy Orchestrator Configuring reports Configuring reports Reports are pre defined queries which query the epolicy Orchestrator database and generate a graphical output. McAfee epolicy Orchestrator has its own querying and reporting capabilities. McAfee includes a set of default queries on the left pane. However, you can create a new query, edit, and manage all the queries related to McAfee VirusScan Enterprise for Linux. Task 1 Log on to the epolicy Orchestrator server as an administrator. If the pre defined queries on the left side does not serve your purpose, epolicy Orchestrator enables you to create your own queries. 2 To view reports: On epolicy Orchestrator 4.5 Click Menu Reporting Queries. The Queries page appears. On epolicy Orchestrator 4.6 or 5.0 Click Menu Reporting Queries & Reports. The Queries & Reports page appears. 3 To create a new query: On epolicy Orchestrator 4.5 Click Actions New Query. The Query Wizard page appears. On epolicy Orchestrator 4.6 or 5.0 Click Actions New. The Query Builder page appears. 4 On the left pane, select a Feature Group that the query should retrieve. 5 Select a Result Type and click Next. The Chart page appears. 6 Select and accordingly configure a display chart/table and click Next. The Columns page appears allowing you to select columns for the chart/table. 7 Select column(s) from the Available Columns pane and click Next. 8 The Filter page appears. Specify criteria by selecting properties and operators to limit the data retrieved by the query. 9 Click Run, then Save. The Save Query page appears. 10 Type a Name and Notes (if required) for the query, then click Save. Table 2-1 Option definitions Option Delete Edit Duplicate Export Data Run Actions View Query SQL Import Query Definition Deletes a selected query. Launches the Query Builder page loaded with the details of the selected query, where you can edit the details of a selected query. Creates and saves a copy of the selected query. Exports the selected query to an XML file that can be imported to any epolicy Orchestrator server. Runs the selected query and displays its result. Takes you to the View Query SQL page, where you can view and copy the SQL script of the selected query. Launches a dialog box that allows you to browse to an exported query file. When you import a query file, the server adds it to My Queries list. 20 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Integrating with epolicy Orchestrator Uninstallation 2 Running a default query 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Reporting Queries. A list of queries appear on the left pane. 3 Select VirusScan Enterprise for Linux under Shared Groups. 4 By default there are two VirusScan Enterprise for Linux queries: Query VSEL: VirusScan Enterprise for Linux Compliance VSEL: VirusScan Enterprise for Linux Threats Description Shows a graphical display of the compliant and non compliant linux systems in the network. Shows a graphical display of the threat summary and action taken on all linux systems in the network. 5 Click Run. The graphical output is displayed. Uninstallation This section provides instructions to uninstall McAfee VirusScan Enterprise for Linux from the client computers and remove the extensions from the epolicy Orchestrator server. Removing McAfee VirusScan Enterprise for Linux from the client computer Remove McAfee VirusScan Enterprise for Linux from the client computer using epolicy Orchestrator. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Systems System Tree. The System Tree page appears. 3 To create a client task: On epolicy Orchestrator 4.5 Click Client Tasks New Task. The Client Task Builder page appears. On epolicy Orchestrator 4.6 or 5.0 Click Assisgned Client Tasks Actions New Client Task Assignment. The Client Task Assignment Builder page appears. 4 To schedule a client task: On epolicy Orchestrator 4.5 Under Description, type a Name, Notes for the task and select the Type as Product Deployment and click Next. On epolicy Orchestrator 4.6 or 5.0 Under Task to schedule, select McAfee Agent as Product, select the Task Type as Product Deployment, then click Create New Task under Task Name. 5 To configure the client task: On epolicy Orchestrator 4.5 Under Configuration, select the Target platforms as Linux and in Products and components, select VirusScan Enterprise for Linux 1.9.0.<build number> from the drop down list, then select the Action as Remove. On epolicy Orchestrator 4.6 or 5.0 Under Client Task Catalog, select Linux as Target Platforms, VirusScan Enterprise for Linux 1.9.0.<build number> as Products and components, Remove as Action and the appropriate Language, then click Save. 6 Click Next to schedule the task immediately or as required. McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 21

2 Integrating with epolicy Orchestrator Uninstallation 7 Click Next to view a summary of the task. 8 Click Save and send an agent wake up call. Removing McAfee VirusScan Enterprise for Linux from epolicy Orchestrator Remove McAfee VirusScan Enterprise for Linux from the epolicy Orchestrator repository. Task 1 Log on to the epolicy Orchestrator server as an administrator. 2 Click Menu Software Master Repository. The Packages in Master Repository page appears. 3 Click the Delete link of VirusScan Enterprise for Linux with Version as 1.9.0. 4 To remove the product and reports extension, click Menu Software Extensions. The Extensions page appears. 5 From the left pane, select VirusScan Enterprise for Linux. 6 For the report extension file McAfee VirusScan Enterprise for Linux Reports, then click Remove. 7 Select the option Force removal, bypassing any checks or errors, then click OK. 8 For the product extension file VirusScan Enterprise for Linux 1.9.0 and click Remove. 9 Select the option Force removal, bypassing any checks or errors, then click OK. 22 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide

Index A about 7 about this guide 5 audience 7 C conventions and icons used in this guide 5 D documentation audience for this guide 5 product-specific, finding 6 typographical conventions and icons 5 F features administration 7 reporting 7 scanning 7 M McAfee ServicePortal, accessing 6 P product features 7 R release what's new 8 S ServicePortal, finding product documentation 6 T Technical Support, finding product information 6 W what's in this guide 6 what's new 8 I introduction 7 L Linuxshield previously known as 7 McAfee VirusScan Enterprise for Linux 1.9.0 Configuration Guide 23

00