6 Updating computers. Sophos Enterprise Console
Reklamë
Reklamë
Sophos Enterprise Console
6 Updating computers
6.1 Configuring the update manager
6.1.1 What is an update manager?
An update manager enables you to set up automatic updating of Sophos security software from a Sophos website. An update manager is installed with and managed from Enterprise Console.
Note: To update encryption software, use the protect computers wizard. For information, see
Install encryption software automatically (page 53).
You can install additional update managers. For example, if you have a complex network with several locations, you may want to install an additional update manager at a remote location. For
information, see Add an additional update manager (page 70).
6.1.2 How does an update manager work?
Once you have configured an update manager, it:
■
Connects at a scheduled frequency to a data distribution warehouse at Sophos or on your network.
■
■
Downloads updates to the threat detection data and updates for the security software to which the administrator has subscribed.
Places the updated software in one or more network shares in a form suitable for installation on endpoint computers.
The computers update automatically from the shares, provided the Sophos software installed on them has been configured to do so, for example, by applying an updating policy.
6.1.3 View or edit update manager configuration
If you use role-based administration, you must have the Policy setting - updating right to configure an update manager. For more information, see
(page 20).
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
2. In the list of update managers, select the update manager whose configuration you want to view or edit. Right-click and click View/Edit configuration.
Note: Alternatively, select the update manager, go to the Actions menu, point to Update
manager, and then click View/Edit configuration.
The Configure update manager dialog box appears.
64
Help
3. Edit the configuration as described in the following topics:
■
Select an update source for an update manager
(page 65).
■
■
Select which software to download (page 66).
Specify where the software is placed
(page 66).
■
■
■
Create or edit an update schedule
(page 68).
Configure the update manager log (page 68).
Configure the self-updating of an update manager
(page 69).
For information about clearing update manager alerts from the console, see
Clear update manager alerts from the console (page 84).
After you configure the update manager, you can configure your updating policies and apply them to the endpoint computers.
6.1.4 Select an update source for an update manager
If you use role-based administration, you must have the Policy setting - updating right to configure an update manager. For more information, see
(page 20).
You need to select a source from which an update manager will download security software and updates for distribution across the network.
You can select several sources. The first source in the list is the primary source. Additional sources in the list are optional alternate locations that the update manager uses if it cannot collect an update from the primary source.
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
2. In the list of update managers, select the update manager for which you want to select an update source. Right-click and click View/Edit configuration.
3. In the Configure update manager dialog box, on the Sources tab, click Add.
4. In the Source details dialog box, in the Address field, enter the address of the source. The address can be a UNC or HTTP path.
If you want to download software and updates directly from Sophos, select Sophos.
5. If necessary, in the Username and Password fields, enter the username and password for the account that will be used to access the update source.
■
■
If the update source is Sophos, enter the download credentials supplied by Sophos.
If the update source is the default update share created by an update manager located higher in the updating hierarchy, the Username and Password fields will be pre-populated.
The default update share is a UNC share
\\<ComputerName>\SophosUpdate
, where
ComputerName is the name of the computer where the update manager is installed.
■
If the update source is a non-default update share on your network, enter credentials for the account that has read rights to the share. If the Username needs to be qualified to indicate the domain, use the form domain\username.
65
Sophos Enterprise Console
6. If you access the update source via a proxy server, select Use a proxy server to connect.
Then enter the proxy server Address and Port number. Enter a Username and Password that give access to the proxy server. If the username needs to be qualified to indicate the domain, use the form domain\username. Click OK.
The new source appears in the list in the Configure update manager dialog box.
If you have already installed an update manager on a different computer, the share where that update manager downloads software and updates will appear on the list of addresses. You can select it as a source for the update manager you are configuring. Then you can move the address that you want to be the primary one to the top of the list, using the Move up and Move down buttons to the right of the list.
6.1.5 Select which software to download
If you use role-based administration, you must have the Policy setting - updating right to configure an update manager. For more information, see
(page 20).
You need to select the subscriptions that the update manager will keep up to date.
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
2. In the list of update managers, select the update manager for which you want to select the software to download. Right-click and click View/Edit configuration.
3. In the Configure update manager dialog box, on the Subscriptions tab, select a software subscription in the list of available subscriptions.
To view the details of the subscription, for example, what software is included in the subscription, click View details.
4. To move the selected subscription to the “Subscribed to” list, click the “Add” button.
To move all subscriptions to the “Subscribed to” list, click the “Add all” button.
66
6.1.6 Specify where the software is placed
If you use role-based administration, you must have the Policy setting - updating right to configure an update manager. For more information, see
(page 20).
After you have selected which software to download, you can specify where it should be placed on the network. By default, the software is placed in a UNC share
\\<ComputerName>\SophosUpdate
, where ComputerName is the name of the computer where the update manager is installed.
You can distribute downloaded software to additional shares on your network. To do this, add an existing network share to the list of available shares and then move it to the list of update shares
Help as described below. Ensure that the Update Manager user account (SophosUpdateMgr) has read rights to the shares.
Note: You created the Update Manager user account before you installed Enterprise Console.
For more information about the account, see Enterprise Console startup documentation.
(page 67)
To specify where the software is placed:
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
2. In the list of update managers, select the update manager for which you want to select network shares for distributing the software. Right-click and click View/Edit configuration.
3. In the Configure update manager dialog box, on the Distribution tab, select a software subscription from the list.
4. Select a share from the “Available” shares list and move it to the “Update to” list by clicking the “Add” button (>).
The default share
\\<ComputerName>\SophosUpdate
is always present in the “Update to” list. You cannot remove this share from the list.
The “Available” shares list includes all the shares that Enterprise Console knows about and that are not already being used by another update manager.
You can add an existing share to or remove a share from the “Available” shares list, using the
“Add” button (>) or “Remove” button (<).
5. If you want to enter a description for a share or credentials needed to write to the share, select the share and click Configure. In the Share Manager dialog box, enter the description and credentials.
If you want to enter the same credentials for multiple shares, select the shares in the “Update to” list and click Configure. In the Configure multiple shares dialog box, enter credentials that will be used to write to the shares.
6.1.7 On what platforms are network shares supported?
Network shares on the following platforms are supported:
■
Shares on Windows NT and later.
■
■
Samba shares hosted on a Linux server, for example, SUSE Linux Enterprise 10 (SLES 10).
Samba shares hosted on Netware 5.1 SP3 and Netware 6.5 SP3 to SP7, Netware kernel.
■
■
■
■
■
Samba shares hosted on Mac OSX 10.2 or later.
Samba shares hosted on Unix.
Novell Storage Services (NSS) shares, supporting NDS authentication, hosted on Novell Open
Enterprise Server 1 and 2, Linux kernel.
Netware File System (NFS) shares, supporting NDS authentication, hosted on Netware 5.1
SP3 and Netware 6.5 SP3 to SP7, Netware kernel.
NetApp filers.
67
Sophos Enterprise Console
■
■
Samba shares hosted on Novell Open Enterprise Server 1 and 2.
Novell Storage Services (NSS) shares, supporting NDS authentication, hosted on Netware
5.1 SP3 and Netware 6.5 SP3 to SP7, Netware kernel.
6.1.8 Create or edit an update schedule
If you use role-based administration, you must have the Policy setting - updating right to configure an update manager. For more information, see
(page 20).
By default, an update manager checks the Sophos databank for threat detection data updates every 10 minutes.
You can change this update interval. The minimum is 5 minutes and the maximum 1440 minutes
(24 hours). We recommend an update interval of 10 minutes for threat detection data, so that you receive protection from new threats promptly after the detection data is published by Sophos.
By default, an update manager checks the Sophos databank for software updates every 60 minutes.
You can change this update interval. The minimum is 10 minutes and the maximum 1440 minutes
(24 hours).
For software updates, you can either specify an update interval that is used every hour of every day, or you can create more sophisticated schedules, in which each day can be specified independently and each day can be divided into periods with different update intervals.
Note: You can create a different schedule for each day of the week. Only a single schedule can be associated with a day of the week.
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
2. In the list of update managers, select the update manager for which you want to create an update schedule. Right-click and click View/Edit configuration.
3. In the Configure update manager dialog box, on the Schedule tab, enter the interval between threat detection data updates.
4. Enter the interval between software updates.
■
■
If you want to specify an update interval that is used every hour of every day, select the
Check for updates every n minutes option and enter the interval in minutes.
If you want to create a more sophisticated schedule, or different schedules for different days of the week, select the Set up and manage scheduled updates option and click
Add.
In the Update schedule dialog box, enter a name for the schedule, select the days of the week, and update intervals.
68
6.1.9 Configure the update manager log
If you use role-based administration, you must have the Policy setting - updating right to configure an update manager. For more information, see
(page 20).
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
Help
2. In the list of update managers, select the update manager for which you want to configure the log. Right-click and click View/Edit configuration.
3. In the Configure update manager dialog box, on the Logging tab, select the number of days you want to keep the log for and the log's maximum size.
6.1.10 Configure the self-updating of an update manager
If you use role-based administration, you must have the Policy setting - updating right to configure an update manager. For more information, see
(page 20).
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
2. In the list of update managers, select the update manager for which you want to configure self-updating. Right-click and click View/Edit configuration.
3. In the Configure update manager dialog box, on the Advanced tab, select an update manager version you want to keep up to date with.
For example, if you select “recommended”, the update manager will always be upgraded to the version that is labeled as such at Sophos. The actual update manager version will change.
6.1.11 Make an update manager check for updates immediately
If you use role-based administration, you must have the Remediation - updating and scanning
right to perform this task. For more information, see About roles and sub-estates
(page 20).
After you have configured an update manager, it checks for updates and downloads them from its update source to the update shares it maintains automatically, according to the specified schedule. If you want an update manager to check for and download threat detection data updates, software updates for endpoint computers and software updates for the update manager itself immediately, follow these steps:
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
2. In the list of update managers, select the update manager which you want to update. Right-click and click Update Now.
6.1.12 Make an update manager comply with the configuration settings
If you use role-based administration, you must have the Remediation - updating and scanning
right to perform this task. For more information, see About roles and sub-estates
(page 20).
1. If you are in the Endpoints view, click the Update managers button on the toolbar to display the Update managers view.
2. In the list of update managers, select the update manager which you want to comply with the configuration settings. Right-click and click Comply with Configuration.
69
Sophos Enterprise Console
6.1.13 Add an additional update manager
Sophos Update Manager (SUM) is always installed on the computer where you install Enterprise
Console. If you selected Custom Setup during the installation, this is the computer where the management server is installed.
You can add one or more additional update managers to your network. You may want to do this to reduce the load on the update manager that is already installed and distribute updates more efficiently. You can install an additional update manager on a computer that does not yet have an update manager installed.
Important: Do not remove the update manager installed on the same computer as the Enterprise
Console management server. Enterprise Console cannot protect the network fully until this update manager is configured with an update source. This will enable Enterprise Console to receive necessary updates (for example, information about the versions of security software that endpoint computers should be running, new and updated Content Control Lists for data control, or the list of new controlled devices and applications).
To enable an additional update manager to download security software from Sophos or another update manager via HTTP, open TCP port 80 (outbound) on the computer on which you want to install the additional update manager. To enable the update manager to download security software from another update manager via a UNC path, open the following outbound ports on the computer:
UDP port 137, UDP port 138, TCP port 139, and TCP port 445.
If the computer is running a version of Windows that includes the Network Discovery feature, and the feature is turned off, turn it on and restart the computer.
If User Account Control (UAC) is enabled on the computer, turn off UAC and restart the computer.
You can turn UAC on again after you have installed the update manager and subscribed to Sophos updates.
If the computer is in a domain, log on as a domain administrator.
If the computer is in a workgroup, log on as a local administrator.
The update manager installer is located on the computer where Enterprise Console management server is installed, in the shared folder
\\Servername\SUMInstallSet
. To view the location of the installer, go to the View menu and click Sophos Update Manager Installer Location.
You can install Sophos Update Manager using Windows Remote Desktop.
To install an additional update manager:
1. Run the Sophos Update Manager installer Setup.exe.
An installation wizard is launched.
2. On the Welcome page of the wizard, click Next.
3. On the License Agreement page, read the license agreement and click I accept the terms
in the license agreement if you agree to the terms. Click Next.
4. On the Destination folder page, accept the default or click Change and enter a new destination folder. Click Next.
70
Help
5. On the Sophos Update Manager Account page, select an account that endpoint computers will use to access the default update share created by the update manager. (The default update share is
\\<ComputerName>\SophosUpdate
, where ComputerName is the name of the computer where the update manager is installed.) This account must have read rights to the share and does not need to have administrative rights.
You can select the default user, select an existing user, or create a new user.
By default, the installer will create the SophosUpdateMgr account with read rights to the default update share and no interactive logon rights.
If you want to add more update shares later, select an existing account or create a new account that has read rights to those shares. Otherwise, ensure that the SophosUpdateMgr account has read rights to the shares.
6. On the Sophos Update Manager Account Details page, depending on the option you selected on the previous page, enter a password for the default user, details for the new user, or select an existing account.
The password for the account must comply with your password policy.
7. On the Ready to Install the Program page, click Install.
8. When installation is complete, click Finish.
The computer where you installed Sophos Update Manager should now appear in Enterprise
Console, Update managers view. (On the View menu, click Update Managers.)
To configure the update manager, select it, right-click, and then click View/Edit Configuration.
6.1.14 Publish security software on a web server
You might want to publish Sophos security software on a web server for computers to access via
HTTP. If you want to install Sophos Anti-Virus for UNIX, version 4, you must do this, although you can leave this until you have downloaded Sophos Anti-Virus for UNIX, version 4 if you want to.
To publish security software on a web server:
1. To find out the path of the shared folder to which the security software has been downloaded, known as the bootstrap location: a) In Enterprise Console, on the View menu, click Bootstrap Locations.
In the Bootstrap Locations dialog box, the Location column displays the bootstrap location for each platform.
b) Make a note of the path up to but not including the
CIDs
folder. For example:
\\server name\SophosUpdate
2. Make the bootstrap location, including subfolders, available on the web server.
71
Shkarko
Lidhja publike u përditësua
Lidhja publike për bisedën tuaj është përditësuar. You may view and manage your chat links after registration here.
Lidhja publike e dokumentit
Reklamë