ServerProtect for Linux クイックスタートガイド

Size: px

Start display at page:

Download "ServerProtect for Linux クイックスタートガイド"

えりかなぐも
4 years ago
Views:

1 Trend Micro ServerProtect for Linux クイックスタートガイド

2 トレンドマイクロへのお客様情報の送信について Web ID Web URL ID Web Web 輸出規制について U.S. Export Administration Regulations 著作権について TRENDMICRO On-Line-Scan PC-cillin InterScan INTERSCAN VIRUSWALL ISVW InterScanWebManager ISWM InterScan Message Security Suite InterScan Web Security Suite IWSS TRENDMICRO SERVERPROTECT PortalProtect Trend Micro Control Manager Trend Micro MobileSecurity GateLock VSAPI edoctor emanager Trend Micro Policy Server Certified Rescue Partner License for Enterprise Information Security LEISec Trend Park Trend Labs Trend Micro Enterprise Protection Strategy RBL+ Phish Checker InterScan Gateway Security Appliance Trend Micro Network VirusWall Network VirusWall Enforcer Trend Flex Security EPS Trend Micro EPS LEAKPROOF Copyright Trend Micro Incorporated. All rights reserved. P/N: SPLXFF-AE0107_R1 (2008/7)

3 ServerProtect ServerProtect ServerProtect Control Manager RemoteInstall ServerProtect RemoteInstall iii

4 Trend Micro ServerProtect for Linux ServerProtect ServerProtect Web Java ServerProtect EICAR ServerProtect SUSE Linux syslog-ng A B SUSE Linux Linux iv

5 KHM Web Q&A TrendLabs v

6 Trend Micro ServerProtect for Linux vi

7 7

8 Trend Micro ServerProtect for Linux ( ) man ( ) splxmain splx tmsplx.xml RemoteInstall CMconfig 8

9 Readme Q&A

10 Trend Micro ServerProtect for Linux 10

11 11

12 Trend Micro ServerProtect for Linux 12

13 13

14 Trend Micro ServerProtect for Linux 14

15 Fault Tolerant X Window Web 15

16 Trend Micro ServerProtect for Linux ServerProtect Trend Micro Control Manager 16

17 17

18 Trend Micro ServerProtect for Linux /home /home 18

19 19

20 Trend Micro ServerProtect for Linux ServerProtect./SProtectLinux-3.0.bin -h -c -f RedHat SuSE i686 x86_64 -h -n -r -s -S { } -x -X RedHat SuSE i686 x86_64 -w {yes/no} -c -n 20

21 ServerProtect 21

22 Trend Micro ServerProtect for Linux./SProtectLinux-3.0.bin ServerProtect -n -n tmsplx.xml RealtimeScan -n /opt/trendmicro/sprotectlinux/splx.util./add_splx_service 22

23 NOTICE:Trend Micro licenses its products in accordance with certain terms and conditions.by breaking the seal on the CD jacket in the Software package or installing a serial number, registration key or activation code, You already accepted a Trend Micro license agreement.a courtesy copy of a representative Trend Micro License Agreement is included for reference below.the language and terms of the actual Trend Micro license agreement that you accepted may vary.by accepting the License Agreement below, or using the Software, You confirm Your agreement to the terms and conditions of the original Trend Micro license agreement you accepted. Trend Micro License Agreement (Package Version 0403Nov03E021004) [SNIP] SPLX version 3.0 Released June 29, 2007 Do you agree to the above license terms?(yes or no) 2-1. ( ) ServerProtect Control Manager 23

24 Trend Micro ServerProtect for Linux ServerProtect Control Manager Do you wish to connect this SPLX server to Trend Micro Control Manager? y y n Activate ServerProtect to continue scanning and security updates. SPLX server name or IP address Do you wish to connect to Control Manager server using HTTPS?(y/n) [n] y n Control Manager server name or IP address: Control Manager server port:[80] Do you access Control Manager through a proxy server?(y/n) [n] y n n 24

25 Please specify the name you would like to display on the Control Manager console:[splx server name or IP address] Please specify a folder name for this product (for example:/splx) [New entity]: Is the above information correct? (y/n) [n] n n y 25

26 Trend Micro ServerProtect for Linux Step 1. Register Use the Registration Key that came with your product to register online ( (Please skip this step if the product is already registered.) Step 2. Activate Type the Activation Code received after registration to activate ServerProtect. (Press [Ctrl+D] to abort activation.) 2-2. ServerProtect aspx 26

27 World Virus Tracking Program Trend Micro consolidates virus-scanning results from worldwide customers,compiles real-time statistics, and displays them on the Virus Map ( this map to view virus trends for each continent and selected countries. Yes, I would like to join the World Virus Tracking Program.I understand that when a virus is detected on my system, aggregated detection information, including virus names and number of detections, will be sent to the World Virus Tracking Program.It will not send out company names, individual names, machine names, site names, IP addresses, or any other identifying information.i understand that I can disable this automatic reporting function at any time by changing the configuration to "No" within the product's management console. No, I don't want to participate. Please input your choice [Yes] : ( 日本語訳 ) ウイルストラッキングプログラムトレンドマイクロでは世界各国で実施されたウイルス検索の結果を収集し統計情報をリアルタイムで提供していますこの情報はトレンドマイクロウイルストラッキングセンター ( で参照することができますウイルストラキングセンターでは世界で流行しているウイルスや選択した地域別の情報を得ることができます Yes - 私はウイルストラッキングプログラムに参加しますシステムでウイルスが検出されたときにウイルス名や検出数などの情報がウイルストラッキングセンターに送信されること企業名や個人名コンピュータ名サイト名 IP アドレスなどのその他の情報は送信されないこと製品コンソール内で設定を [No] に変更すればいつでもこの自動レポート機能を無効にできることを私は了解しています No - 私はウイルストラッキングプログラムに参加しませんオプションを選択してください [ 初期設定 : Yes] :

28 Trend Micro ServerProtect for Linux RemoteInstall 28

29 RemoteInstall ServerProtect -r./sprotectlinux-3.0.bin -r remote.install.splx config/ KHM.module/ RemoteInstall RemoteInstall.conf RemoteInstall.csv tmsplx.xml tmsplx.xml.template tmsplx.xmltmsplx.xml xmldeployer xmlvalidator tmsplx.xml.csv conf 2-1. RemoteInstall 29

30 Trend Micro ServerProtect for Linux RemoteInstall.conf remote.install.splx RemoteInstall.conf 2-2. RemoteInstall.conf 30

31 CSV RemoteInstall.conf RemoteInstall CSV RemoteInstall.csv remote.install.splx -p./remoteinstall -p my_conf_file.csv RemoteInstall.conf RemoteInstall_yyyy-mm-dd_hhmmss.conf RemoteInstall.conf Client assignment #single deploy #group deploy 31

32 Trend Micro ServerProtect for Linux RemoteInstall.conf Client assignment#single deploy 32

33 2-3. 設定ファイル内のクライアント割り当てキー ( シングル配信 ) #single deploy 2-4. 設定ファイル内のクライアント割り当てキー ( グループ配信 ) RemoteInstall 33

34 Trend Micro ServerProtect for Linux RemoteInstall RemoteInstall.conf RemoteInstall.conf./RemoteInstall 2-5. RemoteInstall 34

35 RemoteInstall -h./remoteinstall -h -c -f { } RemoteInstall.conf RemoteInstall.conf -h -n -p {CSV } -v 2-6. RemoteInstall 35

36 Trend Micro ServerProtect for Linux 36

37 KHM ndex.html /opt/trendmicro/sprotectlinux/splx.module/ tar xzvf {SPLX バージョンとカーネルバージョン }.tar.gz { }.md5 37

38 Trend Micro ServerProtect for Linux splxmod-{ }smp.o splxmod-{ }.o /etc/init.d/splx restart ホストサーバ >: ホストサーバ >:14943 RemoteInstall KHM 38

39 ServerProtect /etc/init.d/splx status splxmod module is running... vsapiapp (pid 3854) is running... entity (pid ) is running... ServerProtect for Linux core is running... splxhttpd (pid ) is running... ServerProtect for Linux httpd is running... ServerProtect for Linux manual scan is stopped ServerProtect for Linux scheduled scan is stopped ServerProtect for Linux Control Manager agent is not registered to Trend Micro Control Manager server ServerProtect rpm -e SProtectLinux 39

40 Trend Micro ServerProtect for Linux 40

41 41

Trend Micro ServerProtect for Linux ServerProtect Web http://{ ホストサーバの IP アドレス }:14942 https://{

42 Trend Micro ServerProtect for Linux ServerProtect Web ホストサーバの IP アドレス }: ホストサーバの IP アドレス }:14943 tmsplx.xml /opt/trendmicro/sprotectlinux SessionTimeout 3-1. ServerProtect Web 42

43 3-2. Web 43

44 Trend Micro ServerProtect for Linux Java 3-3. Java Runtime Environment (JRE) Mozilla cd /usr/lib/mozilla/plugins ln -s \ > /usr/java/j2re1.4.2/plugin/i386/ns610-gcc32\ > libjavaplugin_oji.so libjavaplugin.so 44

45 splxmain 45

46 Trend Micro ServerProtect for Linux 3-4. [General] 46

47 3-5. [Component Update] 47

48 Trend Micro ServerProtect for Linux ServerProtect XX-XXXX-XXXX-XXXX-XXXX 48

49 XX-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX /opt/trendmicro/sprotectlinux/splx.vsapiapp./splxmain -q ServerProtect [Product Registration] 49

50 Trend Micro ServerProtect for Linux ServerProtect /opt/trendmicro/sprotectlinux/splx.vsapiapp./splxmain -q < アクティベーションコード > 50

51 3-6. [Product Registration] : 51

52 Trend Micro ServerProtect for Linux 3-7. [Product Registration] : 3-8. [Product Registration] : 52

53 53

54 Trend Micro ServerProtect for Linux EICAR ServerProtect EICAR virus.com H* 54

55 SUSE Linux syslog-ng etc/syslog-ng/ syslog-ng.conf # this is for splx debug log filter f_splx { facility(local3); }; # logs for splx debug destination splx_debug_log { file("/var/log/splx.debug"); }; log { source(src); filter(f_splx); destination(splx_debug_log); }; etc/init.d/syslog restart tmsplx.xml UserDebugLevel service splx restart /var/log/ splx.debug 55

56 Trend Micro ServerProtect for Linux 56

57 57

58 Trend Micro ServerProtect for Linux 58

59 1: Linux uname -r ELsmp < > uname -m i686 x86_64< > 2: 59

60 Trend Micro ServerProtect for Linux /etc/issue cat /etc/issue Red Hat Enterprise Linux rpm -ivh <rpm パッケージ名 > ELi686 rpm -ivh kernel-devel el.i686.rpm ELsmpx86_64 rpm -ivh kernel-smp-devel el.x86_64.rpm 60

61 up2date SUSE Linux Enterprise Server/Desktop rpm -ivh <rpm パッケージ名 > default rpm -ivh kernel-source i586.rpm rpm -ivh kernel-syms i586.rpm YaST 61

62 Trend Micro ServerProtect for Linux /boot /usr/src/linux-< > make oldconfig make modules_prepare cp /boot/config-<kernel Version> /usr/src/linux-< カーネルバージョン >/.config cd /usr/src/linux-< カーネルバージョン > make oldconfig make modules_prepare 3: cd /lib/modules/< カーネルバージョン >/build make menuconfig 62

63 .config CONFIG_DEBUG_INFO=y CONFIG_DEBUG_INFO=n make modules_prepare 4: KHM /opt/trendmicro/sprotectlinux/splx.module/src/module 63

64 Trend Micro ServerProtect for Linux make cd /opt/trendmicro/sprotectlinux/splx.module/src/module make splxmod-< >.< >.o bin 5: KHM /etc/init.d/splx stop make test 64

65 6: KHM make install /opt/trendmicro/sprotectlinux/splx.module 7: ServerProtect /etc/init.d/splx restart 65

66 Trend Micro ServerProtect for Linux 66

67 67

68 Trend Micro ServerProtect for Linux 64 SUSE Linux insmod Linux 68

69 KHM make rpm -q <rpm パッケージ名 > Unable to locate source package /usr/src/linux-< > make Cannot find... symbol in System.map /boot/system.map-< > 69

70 Trend Micro ServerProtect for Linux Cannot remove KHM from kernel make 70

71 /opt/trendmicro/sprotectlinux/splx.module/src/module/bin/kernel x86_64_execve_entry.< >.S ia32_execve_entry.< >.S arch/x86_64/kernel/entry.s arch/x86_64/ia32/ia32entry.s bin/kernel make System.map phys_base change_page_attr_addr sys_call_table Makefile phys_base change_page_attr_addr bin/modreg.c #define PHYS_BASE 0xffffffff8034ce78 #define CHANGE_PAGE_ATTR_ADDR 0xffffffff8007dd22 /boot/system.map-< > # grep phys_base /boot/system.map-< カーネルバージョン > # grep change_page_attr_addr /boot/system.map-< カーネルバージョン > make /boot/system.map-< > 71

72 Trend Micro ServerProtect for Linux init 1 /opt/trendmicro/sprotectlinux/splx.module rm /opt/trendmicro/sprotectlinux/splx.module/splxmod-un ame -r.uname -m.o Web 72

73 splxhttpd 73

74 Trend Micro ServerProtect for Linux Q&A /

75 75

76 Trend Micro ServerProtect for Linux TrendLabs 76

77 77

78 Trend Micro ServerProtect for Linux

79 /etc/init.d/splx status 39 Control Manager 16 IP Control Manager 23 Control Manager Trend Micro Control Manager 16 CVS 31 EICAREuropean Institute of Computer Antivirus Research 54 EICAR 54 European Institute of Computer Antivirus Research (EICAR) 54 HotFix 77 Java Runtime Environment (JRE) 15 Java 44 Java 44 JRE Java Runtime Environment (JRE) 15 KDE Konqueror Desktop Environment 15 KHM 36 KHM.module/ 29 Konqueror Desktop Environment 15 man 8 Patch 77 Quick Access 15 Readme 9 remote.install.splx 29 RemoteInstall CVS RemoteInstall 29 RemoteInstall.conf 30 RemoteInstall.conf RemoteInstall.csv 29 RemoteInstall 33 Security Patch 77 ServerProtect 38 ServerProtect 38 Service Pack 77 splx.debug 55 syslog-ng 55 syslog-ng.conf 55 syslog-ng 55 tmsplx.xml 29 79

80 Trend Micro ServerProtect for Linux クイックスタートガイド tmsplx.xml.tmplate 29 Trend Micro Control Manager 16 TrendLabs 76 Web Web 42 Web WVTP 27 xmldeployer 29 xmlvalidator (WVTP) KHM Q&A

81 ConfigFilePath 30 RemoteInstall HotFix 77 Patch 77 Security Patch 77 Service Pack Web 15 X Windows CPU Control Manager 24 Web 15 X Windows Java KHM

82 Trend Micro ServerProtect for Linux クイックスタートガイド

Trend Micro ServerProtect™ for Linux クイックスタートガイド

Trend Micro ServerProtect™ for Linux クイックスタートガイド Trend Micro ServerProtect for Linux CentOS / Suse 11 クイックスタートガイドトレンドマイクロへのお客様情報の送信について Web /URL Web URL( IP) URLWeb Web (a)web Web URLWeb URLIDURL Web Web / /TrendCare/ /Web URL E-mail Web