Sophos Enterprise Console
70
6.2.4 Run the Download Security Software Wizard
If you use role-based administration, you must have the Policy setting - updating right to run the Download Security Software Wizard. For more information, see
Managing roles and sub-estates
(page 19).
If you haven't completed the Download Security Software Wizard after you installed Enterprise
Console, do the following:
■
On the Actions menu, click Run the Download Security Software Wizard.
The Download Security Software Wizard guides you through selecting and downloading software.
Note: After you have successfully completed the wizard, the Run the Download Security
Software Wizard option will disappear from the Actions menu.
6.2.5 See which updating policies use the software subscription
To see which updating polices use a particular software subscription:
■
Select the subscription, right-click and then click View Subscription Usage.
In the Software Subscription Usage dialog box, you see a list of updating polices that use the subscription.
6.3 Configuring the updating policy
Updating policies enable you to keep your computers up to date with your chosen security software.
Enterprise Console checks for updates and updates computers, if necessary, at a specified interval.
The default updating policy enables you to install and update the software specified in the
“Recommended” subscription.
If you want to change the default updating policy or create a new updating policy, follow the instructions in the following topics:
■
■
■
■
Select a subscription
(page 71)
Configure update servers
(page 72)
Schedule updates (page 76)
Select a different source for initial installation (page 76)
■
Log updates
(page 77)
Note: If you use role-based administration:
■
■
You must have the Policy setting - updating right to configure an updating policy.
You cannot edit a policy if it is applied outside your active sub-estate.
For more information about role-based administration, see Managing roles and sub-estates (page
19).
help
6.3.1 Select a subscription
If you use role-based administration:
■
You must have the Policy setting - updating right to configure an updating policy.
■
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
Managing roles and sub-estates
(page 19).
A subscription specifies which versions of endpoint software are downloaded from Sophos for each platform. The default subscription includes the latest software for Windows.
To select a subscription:
1. Check which updating policy is used by the group(s) of computers you want to configure.
See
Check which policies a group uses
(page 32).
2. In the Policies pane, double-click Updating. Then double-click the policy you want to change.
3. In the Updating policy dialog box, click the Subscription tab and select the subscription for the software you want to keep up to date.
71
Sophos Enterprise Console
6.3.2 Configure update servers
By default, computers update from a single primary source UNC share,
\\<ComputerName>\SophosUpdate
, where
<ComputerName>
is the name of the Update
Manager’s computer. You can also specify an alternative secondary source for updates, enable location roaming, and enable bandwidth throttling.
If endpoint computers cannot contact their primary source, they attempt to update from their secondary source (if one has been specified). We recommend that you always specify a secondary source.
Both primary and secondary update server locations may be either UNC shares or HTTP URLs from any accessible Update Manager on your network. The secondary update server location may alternatively be set to get updates directly from Sophos over the internet via HTTP.
Note: Update Managers may have multiple distribution shares available, depending on how you have set them up.
6.3.2.1 Primary server
The primary server is set up automatically with the default primary server location. By default, computers update from a single primary source UNC share,
\\<ComputerName>\SophosUpdate
, where
<ComputerName>
is the name of the computer where Sophos Update Manager is installed.
To access the share, the computers use the Sophos Update Manager credentials that you entered during the installation of Enterprise Console. If you followed recommendations in the Enterprise
Console startup guide, the account is named “SophosUpdateMgr”.
If you need to change the credentials, see
Change primary server credentials (page 74).
If you access the update source via a proxy server, click Proxy details and enter the proxy server details.
If you want to enable location roaming, see Location roaming for laptops (page 72).
You can also enable bandwidth throttling to limit the amount of bandwidth the computers can use when updating. On the Primary Server tab in the updating policy, click the Advanced button. In the Advanced Settings dialog box, select the Limit amount of bandwidth used check box, and then use the slider control to specify the maximum bandwidth in Kbits/second.
6.3.2.2 Location roaming for laptops
Some laptop users may roam extensively or internationally within an organization. When location roaming is enabled (on an updating policy for roaming laptops), roaming laptops attempt to locate and update from the nearest update server location by querying other (fixed) endpoints on the local network they are connected to, minimizing update delays and bandwidth costs.
A roaming laptop gets update server locations and credentials by querying fixed computers on the same local network. If multiple locations are returned, the laptop determines which is nearest and uses that. If none work, the laptop uses the primary (then secondary) location(s) defined in its updating policy.
Note: When fixed computers send update locations and credentials to the laptop, passwords are obscured both in transmission and storage. However, accounts set up for endpoints to read
72
help update server locations should always be as restrictive as possible, allowing only read-only access.
See Specify where the software is placed (page 61).
If you want to know in more detail how location roaming works, see
How does location roaming work?
(page 73)
Location roaming is only usable where:
■
There is a single common Enterprise Console for both roaming and fixed endpoints.
■
■
The fixed endpoints use the same software subscription as the roaming laptops.
There is a primary update location specified in the updating policy used by the roaming laptops.
■
Any third-party firewalls are configured to allow update location queries and responses. The port used is normally UDP port 51235 but is configurable; for details see Sophos knowledgebase article 110371 .
You enable location roaming as part of specifying sources for updates. Location roaming should only be enabled on groups of machines that frequently move from office to office. For information
on how to enable location roaming, see Change primary server credentials
(page 74).
For frequently asked questions about location roaming, see Sophos knowledgebase article 112830 .
6.3.2.2.1 How does location roaming work?
Location roaming is a method of intelligent updating for roaming laptops where updates are performed from a ''best'' update location and updating does not rely solely on the primary and secondary update locations specified in the laptops' updating policy.
When location roaming is enabled, the following happens:
1. When a laptop changes its location, the Sophos AutoUpdate component of Endpoint Security and Control installed on the laptop determines that the MAC address of the default gateway on the connected network has changed since the last update. It then sends an ICMP broadcast over the local subnet to neighboring AutoUpdate installations, using UDP port 51235 by default.
2. The neighboring AutoUpdate installations reply with their updating policy, using the same port.
Only the primary update location is sent in the response.
All Endpoint Security and Control installations listen for broadcasts regardless of whether location roaming is enabled or not.
Sensitive information in replies is obfuscated and fields are hashed for integrity.
Reply messages have a randomized reply time, to avoid message storms. The replies are also ICMP broadcasts, so any other machine that would have replied with the same details will also receive the broadcast and know not to respond.
3. AutoUpdate chooses the "best" location from the locations received and checks whether the sender is managed by the same Enterprise Console and the subscription ID matches the one used by AutoUpdate on the laptop.
The "best" update location is determined based on the amount of hops required to access the update location.
4. An update is then attempted and, if successful, the location is cached.
A maximum of four accessible update locations with the same subscription ID and the lowest hop count are stored on the laptop (in the file iustatus.xml
in the following location:
C:\Program Files\Sophos\AutoUpdate\data\status\iustatus.xml
).
73
Sophos Enterprise Console
These update locations are checked every time AutoUpdate performs an update.
Note: If you need to revert back to using the primary and secondary update locations specified in the updating policy (for example, if you wish to roll out customizations from the update location specified in the policy), you will need to disable location roaming.
6.3.2.2.2 Enable location roaming
If you use role-based administration:
■
■
You must have the Policy setting - updating right to configure an updating policy.
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
Managing roles and sub-estates
(page 19).
You should only enable location roaming on groups of machines that frequently move from office to office.
To enable location roaming:
1. In the Policies pane, double-click Updating. Then double-click the updating policy you want to change.
2. In the Updating Policy dialog box, on the Primary Server tab, select the Allow location
roaming check box.
3. In the Groups pane, select a group that uses the updating policy you just changed. Right-click and select Comply with, Group updating policy.
Repeat this step for each group that uses this updating policy.
Note: If you later need to revert back to using the primary and secondary update locations specified in the updating policy, disable location roaming.
6.3.2.3 Change primary server credentials
If you use role-based administration:
■
■
You must have the Policy setting - updating right to configure an updating policy.
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
Managing roles and sub-estates
(page 19).
To change the primary server credentials:
1. In the Policies pane, double-click Updating. Then double-click the updating policy you want to change.
2. In the Updating Policy dialog box, on the Primary Server tab, enter new credentials that will be used to access the server. Change other details, if appropriate.
Note: If your primary update source is a folder on your website and you are using Internet
Information Services (IIS) with anonymous authentication, you will still need to enter credentials on the Primary Server tab. Use the credentials for the "initial install source" UNC share, even if you don't need them to access the webserver. If you leave the Username and Password fields on the Primary Server tab blank, you will not be able to protect endpoint computers from the console.
74
help
3. In the Groups pane, select a group that uses the updating policy you just changed. Right-click and select Comply with, Group updating policy.
Repeat this step for each group that uses this updating policy.
6.3.2.4 Set the secondary update server
If you use role-based administration:
■
■
You must have the Policy setting - updating right to configure an updating policy.
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
Managing roles and sub-estates
(page 19).
To set the secondary update server location:
1. Check which updating policy is used by the group(s) of computers you want to configure.
See
Check which policies a group uses
(page 32).
2. In the Policies pane, double-click Updating, then double-click the policy you want to change.
3. In the Updating Policy dialog box, click the Secondary Server tab, and then select the
Specify secondary server details check box.
4. In the Address (HTTP or UNC) box, do one of the following:
■
■
Enter the HTTP URL or UNC network path of the update server share.
Select Sophos.
Important: If you choose an HTTP URL or a share that is not maintained by a managed
Update Manager, Enterprise Console cannot check that the specified software subscription is available. You must manually ensure that the share contains the specified software subscription, otherwise computers will not be updated.
5. If the policy includes Mac endpoints and you specified a UNC path in the Address field, under
Select a file-sharing protocol for Mac OS X, select a protocol for Macs to access the update share.
6. If necessary, in the Username field, enter the username for the account that will be used to access the server, and then enter and confirm the password. For Sophos HTTP, this is your subscription credentials.
This account should have only read-only (browsing) access rights to the share you entered in the address field above.
Note: If the username needs to be qualified to indicate the domain, use the form domain\username. For information about how to check a Windows user account, see Sophos knowledgebase article 11637 .
7. To throttle bandwidth, click Advanced. In the Advanced settings dialog box, select the Limit
amount of bandwidth used check box, and then use the slider control to specify the maximum bandwidth in Kbits/second.
8. If you access the update source via a proxy server, click Proxy details. In the Proxy details dialog box, select the Access the server via a proxy check box, and then enter the proxy server Address and Port number. Enter a Username and Password that give access to the proxy server. If the username needs to be qualified to indicate the domain, use the form domain\username.
Note: Some internet service providers require HTTP requests to be sent to a proxy server.
75
Sophos Enterprise Console
9. Click OK to close the Updating Policy dialog box.
10. In the Groups pane, right-click a group that uses the updating policy you just changed, and then click Comply with > Group Updating Policy.
Repeat this step for each group that uses this updating policy.
6.3.3 Schedule updates
If you use role-based administration:
■
You must have the Policy setting - updating right to configure an updating policy.
■
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
Managing roles and sub-estates
(page 19).
By default, endpoint computers check for updates in the network share every 5 minutes.
Note: If the computers download updates directly from Sophos, this update interval does not apply. Computers running Sophos PureMessage can check for updates every 15 minutes.
Computers that are not running Sophos PureMessage will update every 60 minutes.
To specify the update interval:
1. Check which updating policy is used by the group(s) of computers you want to configure.
See
Check which policies a group uses
(page 32).
2. In the Policies pane, double-click Updating. Then double-click the policy you want to change.
3. In the Updating policy dialog box, on the Schedule tab, leave Enable networked computers
to use Sophos updates automatically selected. Enter the interval between software updates
(in minutes).
4. If the computers update via a dial-up connection to the internet, select Check for updates on
dial-up.
Computers will then attempt to update whenever they connect to the internet.
6.3.4 Select a different source for initial installation
If you use role-based administration:
■
You must have the Policy setting - updating right to configure an updating policy.
■
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
Managing roles and sub-estates
(page 19).
By default, security software is installed on computers and then kept updated from the source specified on the Primary server tab. You can specify a different source for initial installation.
Note:
This setting applies only to Windows.
If your primary server is an HTTP (web) address, and you want to perform installation on the computers from the console, you must specify a first-time install source.
76
