Trend Micro ServerProtect™ for Linux クイックスタートガイド

Size: px

Start display at page:

Download "Trend Micro ServerProtect™ for Linux クイックスタートガイド"

たかとしこうだ
5 years ago
Views:

1 Trend Micro ServerProtect for Linux CentOS / Suse 11 クイックスタートガイド

2 トレンドマイクロへのお客様情報の送信について Web /URL Web URL( IP) URLWeb Web (a)web Web URLWeb URLIDURL Web Web / /TrendCare/ /Web URL Web < > 輸出規制について U.S. Export Administration Regulations Web 複数年契約について Web 著作権について商標について TRENDMICRO On-Line-Scan PC-cillin InterScan INTERSCAN VIRUSWALL ISVW InterScanWebManager ISWM InterScan Message Security Suite InterScan Web Security Suite IWSS TRENDMICRO SERVERPROTECT PortalProtect Trend Micro Control Manager Trend Micro MobileSecurity VSAPI License for Enterprise Information Security LEISec Trend Park Trend Labs InterScan Gateway Security Appliance Trend Micro Network VirusWall Network VirusWall Enforcer Trend Flex Security LEAKPROOF TrendExpert on Guard InterScan Messaging Security Appliance InterScan Web Security Appliance InterScan Messaging Hosted Security DataDNA Trend Micro Threat Management Solution Trend Micro Threat Management Services Trend Micro Threat Management Agent Trend Micro Threat Mitigator Trend Micro Threat Discovery Appliance Trend Micro USB Security InterScan Web Security Virtual Appliance InterScan Messaging Security Virtual Appliance Trend Micro Reliable Security License TRSL Trend Micro Smart Protection Network Smart Protection Network SPN SMARTSCAN Copyright Trend Micro Incorporated. All rights reserved. P/N: SPLXFF-AE0200_R2_CentOS (2010/06)

3 ServerProtect ServerProtect ServerProtect Control Manager RemoteInstall ServerProtect RemoteInstall iii

4 Trend Micro ServerProtect for Linux ServerProtect ServerProtect Web Java ServerProtect Control Manager EICAR ServerProtect SUSE Linux syslog-ng A B SUSE Linux Linux KHM iv

5 Web Q&A TrendLabs v

6 Trend Micro ServerProtect for Linux vi

7 7

8 Trend Micro ServerProtect for Linux ( ) man ( ) splxmain splx tmsplx.xml RemoteInstall CMconfig 8

9 Readme Q&A

10 Trend Micro ServerProtect for Linux 10

11 11

12 Trend Micro ServerProtect for Linux 12

13 Fault Tolerant 13

14 Trend Micro ServerProtect for Linux X Window Web 14

15 ServerProtect Trend Micro Control Manager 15

16 Trend Micro ServerProtect for Linux 16

17 17

18 Trend Micro ServerProtect for Linux ServerProtect./SProtectLinux-3.0.bin -h -f RedHat SuSE i686 x86_64 -h -n -r -s -S { } -x -X RedHat SuSE i686 x86_64 -w {yes/no} 18

19 ServerProtect 19

20 Trend Micro ServerProtect for Linux./SProtectLinux-3.0.bin ServerProtect -n -n tmsplx.xml RealtimeScan -n /opt/trendmicro/sprotectlinux/splx.util./add_splx_service 20

21 NOTICE:Trend Micro licenses its products in accordance with certain terms and conditions.by breaking the seal on the CD jacket in the Software package or installing a serial number, registration key or activation code, You already accepted a Trend Micro license agreement.a courtesy copy of a representative Trend Micro License Agreement is included for reference below.the language and terms of the actual Trend Micro license agreement that you accepted may vary.by accepting the License Agreement below, or using the Software, You confirm Your agreement to the terms and conditions of the original Trend Micro license agreement you accepted. Trend Micro License Agreement (Package Version 0403Nov03E021004) [SNIP] SPLX version 3.0 Released June 29, 2007 Do you agree to the above license terms?(yes or no) 2-1. ( ) ServerProtect Control Manager 21

22 Trend Micro ServerProtect for Linux ServerProtect Control Manager Do you wish to connect this SPLX server to Trend Micro Control Manager? y y n Activate ServerProtect to continue scanning and security updates. SPLX server name or IP address Do you wish to connect to Control Manager server using HTTPS?(y/n) [n] y n Control Manager server name or IP address: Control Manager server port:[80] Do you access Control Manager through a proxy server?(y/n) [n] y n n 22

23 Please specify the name you would like to display on the Control Manager console:[splx server name or IP address] Please specify a folder name for this product (for example:/splx) [New entity]: Is the above information correct? (y/n) [n] n n y 23

24 Trend Micro ServerProtect for Linux Step 1. Register Use the Registration Key that came with your product to register online ( (Please skip this step if the product is already registered.) Step 2. Activate Type the Activation Code received after registration to activate ServerProtect. (Press [Ctrl+D] to abort activation.) 2-2. ServerProtect aspx 24

25 World Virus Tracking Program Trend Micro consolidates virus-scanning results from worldwide customers,compiles real-time statistics, and displays them on the Virus Map ( this map to view virus trends for each continent and selected countries. Yes, I would like to join the World Virus Tracking Program.I understand that when a virus is detected on my system, aggregated detection information, including virus names and number of detections, will be sent to the World Virus Tracking Program.It will not send out company names, individual names, machine names, site names, IP addresses, or any other identifying information.i understand that I can disable this automatic reporting function at any time by changing the configuration to "No" within the product's management console. No, I don't want to participate. Please input your choice [Yes] : ( 日本語訳 ) ウイルストラッキングプログラムトレンドマイクロでは世界各国で実施されたウイルス検索の結果を収集し統計情報をリアルタイムで提供していますこの情報はトレンドマイクロウイルストラッキングセンター ( で参照することができますウイルストラキングセンターでは世界で流行しているウイルスや選択した地域別の情報を得ることができます Yes - 私はウイルストラッキングプログラムに参加しますシステムでウイルスが検出されたときにウイルス名や検出数などの情報がウイルストラッキングセンターに送信されること企業名や個人名コンピュータ名サイト名 IP アドレスなどのその他の情報は送信されないこと製品コンソール内で設定を [No] に変更すればいつでもこの自動レポート機能を無効にできることを私は了解しています No - 私はウイルストラッキングプログラムに参加しませんオプションを選択してください [ 初期設定 : Yes] :

26 Trend Micro ServerProtect for Linux RemoteInstall 26

27 RemoteInstall ServerProtect -r./sprotectlinux-3.0.bin -r remote.install.splx config/ KHM.module/ RemoteInstall RemoteInstall.conf RemoteInstall.csv tmsplx.xml tmsplx.xml.template tmsplx.xmltmsplx.xml xmldeployer xmlvalidator tmsplx.xml.csv conf 2-1. RemoteInstall 27

28 Trend Micro ServerProtect for Linux RemoteInstall.conf remote.install.splx RemoteInstall.conf 2-2. RemoteInstall.conf CSV RemoteInstall.conf 28

29 RemoteInstall CSV RemoteInstall.csv remote.install.splx -p./remoteinstall -p my_conf_file.csv RemoteInstall.conf RemoteInstall_yyyy-mm-dd_hhmmss.conf RemoteInstall.conf Client assignment #single deploy #group deploy RemoteInstall.conf Client assignment#single deploy 29

30 Trend Micro ServerProtect for Linux 2-3. 設定ファイル内のクライアント割り当てキー ( シングル配信 ) 30

31 #single deploy 2-4. 設定ファイル内のクライアント割り当てキー ( グループ配信 ) RemoteInstall RemoteInstall 31

32 Trend Micro ServerProtect for Linux RemoteInstall.conf RemoteInstall.conf./RemoteInstall 2-5. RemoteInstall 32

33 RemoteInstall -h./remoteinstall -h -c -f { } RemoteInstall.conf RemoteInstall.conf -h -n -p {CSV } -v 2-6. RemoteInstall 33

34 Trend Micro ServerProtect for Linux 34

35 KHM ndex.html /opt/trendmicro/sprotectlinux/splx.module/ tar xzvf {SPLX バージョンとカーネルバージョン }.tar.gz { }.md5 35

36 Trend Micro ServerProtect for Linux splxmod-{ }smp.o splxmod-{ }.o /etc/init.d/splx restart ホストサーバ >: ホストサーバ >:14943 RemoteInstall KHM 36

37 ServerProtect /etc/init.d/splx status splxmod module is running... vsapiapp (pid 3854) is running... entity (pid ) is running... ServerProtect for Linux core is running... splxhttpd (pid ) is running... ServerProtect for Linux httpd is running... ServerProtect for Linux manual scan is stopped ServerProtect for Linux scheduled scan is stopped ServerProtect for Linux Control Manager agent is not registered to Trend Micro Control Manager server ServerProtect rpm -e SProtectLinux 37

38 Trend Micro ServerProtect for Linux 38

39 39

Trend Micro ServerProtect for Linux ServerProtect Web http://{ ホストサーバの IP アドレス }:14942 https://{

40 Trend Micro ServerProtect for Linux ServerProtect Web ホストサーバの IP アドレス }: ホストサーバの IP アドレス }:14943 tmsplx.xml /opt/trendmicro/sprotectlinux SessionTimeout 3-1. ServerProtect Web 40

41 3-2. Web 41

42 Trend Micro ServerProtect for Linux Java 3-3. Java Runtime Environment (JRE) Mozilla cd /usr/lib/mozilla/plugins ln -s \ > /usr/java/j2re1.4.2/plugin/i386/ns610-gcc32\ > libjavaplugin_oji.so libjavaplugin.so 42

43 splxmain 43

44 Trend Micro ServerProtect for Linux 3-4. [General] 44

45 3-5. [Component Update] 45

46 Trend Micro ServerProtect for Linux ServerProtect XX-XXXX-XXXX-XXXX-XXXX 46

47 / XX-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX /opt/trendmicro/sprotectlinux/splx.vsapiapp./splxmain -q ServerProtect [Product Registration] 47

48 Trend Micro ServerProtect for Linux ServerProtect /opt/trendmicro/sprotectlinux/splx.vsapiapp./splxmain -q < アクティベーションコード > 48

49 3-6. [Product Registration] : 49

50 Trend Micro ServerProtect for Linux 3-7. [Product Registration] : 3-8. [Product Registration] : 50

51 Control Manager Control Manager 51

52 Trend Micro ServerProtect for Linux EICAR ServerProtect EICAR virus.com H* 52

53 SUSE Linux syslog-ng etc/syslog-ng/ syslog-ng.conf # this is for splx debug log filter f_splx { facility(local3); }; # logs for splx debug destination splx_debug_log { file("/var/log/splx.debug"); }; log { source(src); filter(f_splx); destination(splx_debug_log); }; etc/init.d/syslog restart tmsplx.xml UserDebugLevel service splx restart /var/log/ splx.debug 53

54 Trend Micro ServerProtect for Linux 54

55 55

56 Trend Micro ServerProtect for Linux 56

57 1: Linux uname -r ELsmp < > uname -m i686 x86_64< > 2: 57

58 Trend Micro ServerProtect for Linux /etc/issue cat /etc/issue CentOS Linux rpm -ivh <rpm パッケージ名 > ELi686 rpm -ivh kernel-devel el.i686.rpm ELsmpx86_64 rpm -ivh kernel-smp-devel el.x86_64.rpm 58

59 up2date SUSE Linux Enterprise Server/Desktop rpm -ivh <rpm パッケージ名 > default rpm -ivh kernel-source i586.rpm rpm -ivh kernel-syms i586.rpm YaST 59

60 Trend Micro ServerProtect for Linux /boot /usr/src/linux-< > make oldconfig make modules_prepare cp /boot/config-<kernel Version> /usr/src/linux-< カーネルバージョン >/.config cd /usr/src/linux-< カーネルバージョン > make oldconfig make modules_prepare 3: cd /lib/modules/< カーネルバージョン >/build make menuconfig 60

61 .config CONFIG_DEBUG_INFO=y CONFIG_DEBUG_INFO=n make modules_prepare 4: KHM /opt/trendmicro/sprotectlinux/splx.module/src/module 61

62 Trend Micro ServerProtect for Linux make cd /opt/trendmicro/sprotectlinux/splx.module/src/module make splxmod-< >.< >.o bin 5: KHM /etc/init.d/splx stop make test 62

63 6: KHM make install /opt/trendmicro/sprotectlinux/splx.module 7: ServerProtect /etc/init.d/splx restart 63

64 Trend Micro ServerProtect for Linux 64

65 65

66 Trend Micro ServerProtect for Linux 64 SUSE Linux insmod Linux 66

67 KHM make rpm -q <rpm パッケージ名 > Unable to locate source package /usr/src/linux-< > make Cannot find... symbol in System.map /boot/system.map-< > 67

68 Trend Micro ServerProtect for Linux Cannot remove KHM from kernel make 68

69 /opt/trendmicro/sprotectlinux/splx.module/src/module/bin/kernel x86_64_execve_entry.< >.S ia32_execve_entry.< >.S arch/x86_64/kernel/entry.s arch/x86_64/ia32/ia32entry.s bin/kernel make System.map phys_base change_page_attr_addr sys_call_table Makefile phys_base change_page_attr_addr bin/modreg.c #define PHYS_BASE 0xffffffff8034ce78 #define CHANGE_PAGE_ATTR_ADDR 0xffffffff8007dd22 /boot/system.map-< > # grep phys_base /boot/system.map-< カーネルバージョン > # grep change_page_attr_addr /boot/system.map-< カーネルバージョン > make /boot/system.map-< > 69

70 Trend Micro ServerProtect for Linux init 1 /opt/trendmicro/sprotectlinux/splx.module rm /opt/trendmicro/sprotectlinux/splx.module/splxmod-un ame -r.uname -m.o Web 70

71 splxhttpd 71

72 Trend Micro ServerProtect for Linux 72

73 Q&A Q&A

74 Trend Micro ServerProtect for Linux

75 TrendLabs 75

76 Trend Micro ServerProtect for Linux

77 77

78 Trend Micro ServerProtect for Linux 78

79 /etc/init.d/splx status 37 Control Manager 15 IP Control Manager 21 Control Manager Trend Micro Control Manager 15 CVS 28 EICAREuropean Institute of Computer Antivirus Research 52 EICAR 52 European Institute of Computer Antivirus Research (EICAR) 52 HotFix 75 Java Runtime Environment (JRE) 14 Java 42 Java 42 JRE Java Runtime Environment (JRE) 14 KDE Konqueror Desktop Environment 14 KHM 34 KHM.module/ 27 Konqueror Desktop Environment 14 man 8 Patch 76 Quick Access 14 Readme 9 remote.install.splx 27 RemoteInstall CVS RemoteInstall 27 RemoteInstall.conf 28 RemoteInstall.conf RemoteInstall.csv 27 RemoteInstall 31 Security Patch 75 ServerProtect 36 ServerProtect 36 Service Pack 76 splx.debug 53 syslog-ng 53 syslog-ng.conf 53 syslog-ng 53 tmsplx.xml 27 79

80 Trend Micro ServerProtect for Linux クイックスタートガイド tmsplx.xml.tmplate 27 Trend Micro Control Manager 15 TrendLabs 75 Web Web 40 Web WVTP 25 xmldeployer 27 xmlvalidator (WVTP) KHM Q&A

81 ConfigFilePath 28 RemoteInstall HotFix 75 Patch 76 Security Patch 75 Service Pack Web 14 X Windows CPU Control Manager 22 Web 14 X Windows Java KHM

82 Trend Micro ServerProtect for Linux クイックスタートガイド

ServerProtect for Linux クイックスタートガイド

Trend Micro ServerProtect for Linux クイックスタートガイドトレンドマイクロへのお客様情報の送信について Web ID Web URL ID Web Web 輸出規制について U.S. Export Administration Regulations http:www.treas.gov/ofac/www.bis.doc.gov/complianceandenforcement/liststocheck.htm