VirusScan Enterprise for Linux 1.9.0 - Photo/Video Software MCAFEE - Free user manual and instructions

Product Type	Antivirus Software
Version	1.9.0
Platform	Linux (32-bit and 64-bit)
Supported Operating Systems	SuSE Linux Enterprise 10.x/11.x, Red Hat Enterprise 5.x/6.x, Oracle Enterprise Linux 5.x/6.x, Novell Open Enterprise Server 2.x, CentOS 5.x/6.x, Ubuntu 10.04/11.10/12.04/12.10
Minimum Free Disk Space	1 GB
Supported Management Software	McAfee ePolicy Orchestrator 4.5, 4.6, 5.0
Supported McAfee Agent	McAfee Agent 4.6, 4.8
Key Features	Virus detection and removal, on-demand and scheduled scanning, real-time monitoring, kernel module support (RKMS), Amazon EC2 support, Novell Cluster Services, Corosync OCFS2 File System Cluster
Administration	Remote administration via browser-based interface with HTTPS and SSL, secure authentication
Reporting	Real-time statistics, detailed database for detected items and events, query export to CSV, configurable email notifications, diagnostic reports
Installation Methods	Manual (interactive) and silent (unattended) installation
Upgrade Path	From versions 1.6, 1.7, 1.7.1 to 1.9.0
User Interface	Web-based GUI accessible via HTTPS on port 55443
Security	HTTPS with SSL, user authentication (nails user/password), certificate handling
Maintenance	Virus definition updates, scanning engine updates, schedule updates
Reparability / Removal	Uninstall using rpm -e or dpkg -purge commands; reboot recommended
General Information	Copyright 2013 McAfee, Inc. Licensed software, no physical product

Frequently Asked Questions - VirusScan Enterprise for Linux 1.9.0 MCAFEE

How do I install VirusScan Enterprise for Linux manually?

Download the package, extract it, then install McAfee Runtime (MFErt), McAfee Agent (MFEcma), and run the installer script as root. Follow the prompts and accept defaults. Verify with /etc/init.d/nails status.

Can I perform a silent installation?

Yes, create a nails.options file in /root with required parameters (e.g., SILENT_ACCEPT_EULA=yes, SILENT_INSTALLDIR, etc.) then run the installer. Use SILENT_CONTINUE_INSTALL_ON_PAM_ERROR if 32-bit PAM libraries are missing.

What are the system requirements?

Minimum 1 GB free disk space, a supported Linux distribution (32-bit or 64-bit) like Red Hat, SUSE, Ubuntu, and a monitor with 1024x768 resolution. Compatible with McAfee ePolicy Orchestrator 4.5-5.0 and McAfee Agent 4.6/4.8.

How do I upgrade from a previous version?

Upgrade McAfee Agent first with rpm -Uvh MFEcma.i686.rpm (or dpkg -i for Ubuntu), then run the VirusScan installer. Upgrade supported from versions 1.6, 1.7, and 1.7.1 to 1.9.0.

How do I open the web interface?

Open a supported browser and navigate to https://:55443. Log in with username nails and the password set during installation. HTTPS with SSL is used for secure access.

What new features are in version 1.9.0?

New features include scheduling of on-demand scans and updates, enhanced policies (enable/disable Web GUI, SMTP, syslog), logging from ePolicy Orchestrator, and new system properties showing scanning summary and threat information.

Can I integrate this with ePolicy Orchestrator?

Yes. On the ePO server, extract the package, check in the McAfee Agent and VirusScan extension, download a client installation package, and deploy via a Product Deployment Task. The Linux client connects to ePO using the agent.

How do I uninstall the software?

Use rpm -e McAfeeVSEForLinux (or dpkg --purge mcafeevseforlinux on Ubuntu) followed by removing the agent and runtime. Reboot to fully remove kernel modules, though not strictly required.

What should I do if I get certificate errors when accessing the web interface?

These are self-signed certificates. You can accept the exception in your browser or follow the manual’s section on handling old certificates to replace them.

Does it support Amazon EC2?

Yes, VirusScan Enterprise for Linux supports Amazon EC2 Linux machines with 2.6.x kernels. It also supports Novell Cluster Services and Corosync OCFS2 File System Cluster.

USER MANUAL VirusScan Enterprise for Linux 1.9.0 MCAFEE

Copyright © 2013 McAfee, Inc. Do not copy without permission.

TRADEMARK ATTRIBUTIONS

McAfee, the McAfee logo, McAfee Active Protection, McAfee AppPrism, McAfee Artemis, McAfee CleanBoot, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, McAfee Enterprise Mobility Management, Foundscore, Foundstone, McAfee NetPrism, McAfee Policy Enforcer, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, SmartFilter, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure, WormTrac are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

Contents

Preface 5

About this guide 5

Audience 5

Conventions 5

What's in this guide 6

Find product documentation....6

1 Introduction 7

Product Features 7

What's new in this release 8

2 System Requirements 11

Hardware and software requirements 11

3 Installation 13

Manual installation 13

Silent installation 1 6

Running McAfee VirusScan Enterprise for Linux 18

Upgrading from previous versions 18

Integrating with ePolicy Orchestrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Removing the software 20

Index

21

Contents

Preface

This guide provides the information you need to install your McAfee product. This guide provides the information you need to install McAfee® VirusScan® Enterprise for Linux.

For instructions on how to configure, use and maintain McAfee VirusScan Enterprise for Linux using McAfee® ePolicy Orchestrator (McAfee ePO) software, see the McAfee VirusScan Enterprise for Linux — Configuration Guide for your product version. For detailed information all phases of product use from configuration to troubleshooting, see the McAfee VirusScan Enterprise for Linux — Product Guide for your product version.

Contents

About this guide

▶ Find product documentation

About this guide

This Information describes the guide's target audience, the typographical conventions and Icons used in this guide, and how the guide is organized.

Audience

McAfee documentation is carefully researched and written for the target audience.

The information in this guide is intended primarily for:

- Administrators — People who implement and enforce the company's security program.

Preface

Find product documentation

Tlp: Suggestions and recommendations.

Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data.

Warning: Critical advice to prevent bodily harm when using a hardware product.

What's in this guide

This guide is organized to help you find the information you need.

This guide provides you with an introduction to McAfee VirusScan Enterprise for Linux and how to install and configure the software.

Topics include:

• Introducing McAfee VirusScan Enterprise for Linux
• System requirements and prerequisites before installing the software
• Types of installation such as manual and silent installation
• Detailed instructions on how to set up the software on various platforms
  • How to run the software
• Handling old certificates
• Upgrading the software from previous versions
• Removing the software
• Brief description about integrating the software with ePolicy Orchestrator

Find product documentation

McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase.

1

Introduction

McAfee VirusScan Enterprise for Linux detects and removes viruses and other potentially unwanted software on Linux-based systems.

This information is intended for network administrators who are responsible for their company's anti-virus and security program.

Contents

Product Features
What's new in this release

Product Features

This section describes the product features for the McAfee VirusScan Enterprise for Linux software.

McAfee VirusScan Enterprise for Linux software has these features:

• Support for Amazon EC2 Linux machines (2.6.x kernels)
  • Support for Novell Cluster Services
  • Support for Corosync OCFS2 File System Cluster
  • Runtime kernel module support (RKMS)

McAfee VirusScan Enterprise for Linux Kernel modules will be created dynamically in case of a mod-version failure. To manually compile the kernel module, refer Frequently asked questions

Introduction

What's new in this release

• Scheduling of on-demand scans.
• Scheduling of updates for scanning engine and virus definition files.

- Administration

• Remote administration using browser-based interface.
• Secure browser interface with authentication and HTTPS (SSL) support.

- Reporting

• Real-time statistics.
• Detailed database for detected items and system events.
- Ability to query the database by date range or individual field values, for example, virus name. Results of query can be exported to a CSV file.
- Configurable email notification for detected items, out-of-date virus definition files, configuration changes, and system events.
- Diagnostic report for use when reporting a problem with the product.

What's new in this release

This section describes the new enhancements in this release of VirusScan Enterprise for Linux. These new features are available in this release, that could be used from McAfee ePolicy Orchestrator to configure McAfee VirusScan Enterprise for Linux client systems.

General policies

• Enable or disable Web GUI Apache services
• Enable or disable SMTP notifications
• Enable or disable Syslogging with different levels
• Enable logging from ePolicy Orchestrator

Introduction What's new in this release

System properties

• Scanning summary information on Files Scanned and Number of Infections for the selected Linux client
• Threat information is available now

Events

• On-demand scan task status events
• Password change task status events

Queries and reports

• Threat report
• Compliance report

Help Content

New ePolicy Orchestrator Help extension for McAfee VirusScan Enterprise for Linux

Introduction

What's new in this release

2

System Requirements

This section describes the software and hardware requirements to install VirusScan Enterprise for Linux.

Hardware and software requirements

Make sure that your Linux server meets these requirements.

Supported operating systems (32-bit/64-bit)

• SuSE Linux Enterprise 10.x and 11.x (Desktop/Server)
  • Red Hat Enterprise 5.x Advanced Platform, Desktop
  • Red Hat Enterprise 6.0, 6.1, 6.2, and 6.3 Server, Workstation, Client
  • Oracle Enterprise Linux 5.x and 6.x
  • Novell Open Enterprise Server 2.x
• CentOS 5.x and 6.x
• Ubuntu 10.04, 11.10, 12.04, and 12.10 (Desktop/Server edition)

To view a complete list of supported environments, see McAfee KnowledgeBase article KB75270.

System Requirements

Hardware and software requirements

Free Disk space

- Minimum: 1 GB

Supported McAfee Management software

• McAfee ePolicy Orchestrator 4.5
• McAfee ePolicy Orchestrator 4.6
• McAfee ePolicy Orchestrator 5.0

Supported McAfee Agent software

• McAfee Agent 4.6
- McAfee Agent 4.8

Display

Monitor screen with a recommended minimum resolution of 1024 x 768.

3

Installation

This chapter describes the installation process of VirusScan Enterprise for Linux.

You can install VirusScan Enterprise for Linux manually on hosts (see Manual installation) or you can use a script (see Silent installation).

Download and extract the VirusScan Enterprise for Linux software package (McAfeeVSKForLinux-1.9.0, -release-full.noarch.tar.gz) on to a temporary directory.

Contents

▶ Manual installation
Silent installation
Running McAfee VirusScan Enterprise for Linux
▶ Upgrading from previous versions
▶ Integrating with ePolicy Orchestrator
Removing the software

Manual installation

During installation, you are prompted to supply a password and other information. For most of the questions, you can accept the default value that is offered.

Before you begin

- Make sure that there is no user named as "nails" or group named as "nailsgroup" on the computer.

Installation

Manual installation

Task

1 From the terminal, go to the temporary directory and execute the following commands:
tar -zxvf McAfeeVSEForLinux-1.9.0.release.tar.gz
tar -zxvf McAfeeVSEForLinux-1,9,0.-others.tar.gz

2 To install McAfee Runtime, type the following command in the terminal window:
rpm -ivh MFErt.i686.rpm

3 To Install McAfee Agent (MA), type the following command in the terminal window:
rpm -ivh MEEcma.i686.rpm

4 To confirm that the McAfee Agent is running correctly, type the following command in the terminal window:
/etc/init.d/cma status

5 To install VirusScan Enterprise for Linux, type the following command in the terminal window:
bash McAfeeVSEForLinux-1.9.0.-installer

6 Answer the questions when prompted. Accept the default values, or specify your own.

7 When prompted to start the VirusScan services, select the default option Y.

8 To confirm that VirusScan Enterprise for Linux is running correctly, type the following command in the terminal window:

/etc/init.d/nails status

Tasks

• Installing on Novell Open Enterprise Server on page 14
Install VirusScan Enterprise for Linux on Novell Open Enterprise Server.
- Installing on Ubuntu (Desktop or Server edition) on page 15 Install VirusScan Enterprise for Linux on Ubuntu Server.

Installing on Novell Open Enterprise Server

Install ViewCase Extension for Listing on Maxwell Open Extension Course

5 Install McAfee Runtime and McAfee Agent using the following commands:

rpm -ivh MFErt.i686.rpm 

rpm -ivh MFEcma.i686.rpm 

6 To Install VirusScan Enterprise for Linux, type this command in the terminal window:

bash McAfesVSEForLinux-1.9.0.<build number>-installer 

7 Type railsgroup for the Linux group for VirusScan administrator.
8 Type rails for the VirusScan user.
9 Answer the questions when prompted. Accept the default values, or specify your own.
10 When prompted to start the VirusScan services, select the default option Y.

Installing on Ubuntu (Desktop or Server edition)

Install VirusScan Enterprise for Linux on Ubuntu Server.

Before you begin

If you are installing VirusScan Enterprise for Linux on a 64-bit Ubuntu system, ensure that you perform these steps before installation:

1 Copy pam_unix.so and pam_nologin.so from /lib/security of a 32-bit ubuntu system (till version 10.10) to a temporary directory (/tmp) on the 64-bit ubuntu system. From Ubuntu 11.04 onwards pam_unix.so and pan_nologin.so are available under the /lib/ i786-linux-gnu/security directory.
2 In the root (/), create a folder pam321fb.
3 Execute the following commands to copy pam_un1x32.so and pam_relog'n.so to the pam32lib directory:

cp /tmp/pam_unix.so /pam3211b/pam_unix32.so
cp /tmp/pam_nologin.so /pam32lib/pam_nologin32.so

Silent installation

Install VirusScan Enterprise for Linux in silent mode.

Before you begin

• Before installing VirusScan Enterprise for Linux, make sure that there is no user as "nails" and no group as "nailsgroup" in the computer.
• Before installing VirusScan Enterprise for Linux, you must have McAfee Runtime and McAfee Agent already installed on the computer.
• Create a file "nails.options" in the root home (/root) directory.

For example:

SILENT_ACCEPTPO_TOLA-"yes"
SILENT_INSTALLOR-"font/NAI/LinuxShield"
SILENT_RONIMEDOR-"var/opt/NAI/LinuxShield"
SILENT_ADMIN-"adminRexample.com"
SILENT_XTHOST="0.0.0.0"
SILENT_YTHOST="5543"
SILENT_MONIXOCKY="65443"
SILENT_SHI-HOST="0.0.0.0"
SILENT_SHTR-POST="729"
SILENT_NATIS_CHER="yes"
SILENT_NATIS_GROUP="natiagroup"
SILENT_CREATE_USER="yes"
SILENT_CREATE)xGROUP="yes"
SILENT_SUN_NITH_MONITOR="yes"
SILENT_OKARANTINELIE="/guarantine"
SILENT_START_PROCESSERS="yes"
SILENT_CONTINUE_TESTT.I. ON RAM_ERROR="yes" 

Use SILENT_CONTINUE_INSTALL_ON_PAM_ERROR only when 32-bit PAM libraries are not present.

If you set this flag to yes and continue without Pluggable Authentication Module (PAM) libraries, the installation of VirusScan Enterprise for Linux monitor component is skipped, and the web interface will not be available. However, you can still manage the VirusScan Enterprise for Linux host using ePolicy Orchestrator or the web interface of some other VirusScan Enterprise for Linux host. See Information about Configuring VirusScan Enterprise for

Installing on Novell Open Enterprise Server in silent mode

Install VirusScan Enterprise for Linux on Novell Open Enterprise server in silent mode.

Task

1 From the Novell eDirectory server, use IManager and create a user called "nails" and a group called "nailsgroup".
2 Add the user "nails" a member of the "nailsgroup", enable the user and group using the Linux User Management.
3 Provide "nails" user with administrative privileges on all the NSS volumes.

rights -F /media/nsv/<VOL-name> -r s trustee nails, <context>, <tree> 

You need to provide administrative privileges to the "nails" user, every time a new NSS volume is created. 

4 In the "nails.options" file, check if the following parameters are available:

SILENT NAME_USER="nails"
SILENT NAME GROUP="nailsgroup"
SILENT CREATE_USER="no"
SILENT CREATE GROUP="no" 

5 From the terminal window, type bash McAfeeVSRForLinux-1.9.0.installer
6 After performing the installation, use iManager to assign a password to the user "nails".

Installing on Ubuntu (Desktop or Server edition) in silent mode

Install VirusScan Enterprise for Linux on Ubuntu (Desktop/Server edition) in silent mode.

Before you begin

Ensure that the nails.options file is available in the root home (/root) directory. For information on how to create the nails.options file, refer to the Silent installation section.

If you are installing VirusScan Enterprise for Linux on a 64-bit Ubuntu system, ensure that you perform these steps before installation:

Running McAfee VirusScan Enterprise for Linux

Use this task to open the McAfee VirusScan Enterprise for Linux user interface.

Task

1 From a supported web-browser, go to https://: Specify the hostname or IP address of the computer, on which VirusScan Enterprise for Linux is installed. By default, the port number is "55443".

https://192.168.200.200:55443 (or) https://server1:55443 

2 On the log on page, type the user name as nails and type the password that you specified during Installation.

If you see messages caused by the use of certificates, see the Handling old certificates section.

Upgrading from previous versions

Upgrade your previous McAfee VirusScan Enterprise for Linux version 1.6, 1.7 or 1.7.1 to version 1.9.0.

Task

1 To upgrade McAfee Agent, type the following command in the terminal window:

rpm -Uvh MFRcna.1686.rpm 

If you want to upgrade McAfee Agent on a Ubuntu server, type this command:

dpkg -i MFEcma.i686.deb

2 To confirm that McAfee Agent is running correctly, type the following command in the terminal window:

/etc/init.d/cma status 

3 To upgrade VirusScan Enterprise for Linux, type the following command in the terminal window: back: NoAfsaWSEWorld1 & C build numbersinstaller

Task

1 Download and extract the VirusScan Enterprise for Linux software package (McAfeeVSEForLinux-1.9.0.-release-full.noarch.tar.gz) on to a temporary directory on the ePolicy Orchestrator server.
2 Go to the temporary directory and extract McAfeeVSEForLinux-1.9.5.-others.tar.q7.
3 Check In the McAfee Agent (MSA-LNX_4.8.0_Package.ZTP) bundled with this package on to the ePolicy Orchestrator Master repository.
4 Check In McAfeeVSEFortLinux-1.9.0.-KPO.ZTP on to the ePolicy Orchestrator Master repository.
5 Check in these extensions on to the ePolicy Orchestrator "Extensions":

• EPOAGENTMETA.ZIP
• LYNXSHLD1900.ZIP
• LYNXSHLD1900PASER.ZIP
• HELP VSEL 190.ZIP

6 Create and download the agent installation package by performing these steps:

a From System Tree, click System Tree Actions | New Systems. The New Systems page appears.
b Under How to add systems select Create and download agent installation package, click Non-Windows, then select McAfee Agent for Linux 4.8.0 (Current) and click OK.
c From Download file, right-click install and select Save Target As... to download the file on to your local system.

7 From the Linux terminal, execute the following command:

sh install.sh -i

This will establish a connection between ePolicy Orchestrator and the Linux client computer.

8 Create a Product Deployment Task on ePolicy Orchestrator to deploy VirusScan Enterprise for Linux

Installation

Removing the software

Removing the software

Use this task to remove McAfee VirusScan Enterprise for Linux from your computer.

Task

1 To uninstall VirusScan Enterprise for Linux, type the following at the command prompt:

rpm -e McAfeeVSEFor1inux 

rpm -e EFESCA 

rpm -e MEERl 

If you want to uninstall from a Ubuntu server, type:

dpkg -purge mcafeevseforlinux 

ópkq -purqe mfečna 

dpkg -purge mfert 

2 Reboot the computer to remove the VirusScan Enterprise kernel modules.

You do not have to reboot the computer immediately, because the VirusScan Enterprise for Linux kernel modules does not interrupt functioning of any other running service.

Index

A

about 7

about this guide 5

audience 7

C

conventions and icons used in this guide 5

D

documentation

audience for this guide 5

product-specific, finding 6

typographical conventions and icons 5

F

features

administration 7

reporting 7

scanning 7

I

introduction 7

M

McAfee ServicePortal, accessing 6

P

product features 7

R

release

what's new 8

requirements

system 11

s

ServicePortal, finding product documentation 6

system

requirements 11

T

Technical Support, finding product information 6

W

what's in this guide 6

what's new