symantec endpoint protection 14 centos remote install

#SYMANTEC ENDPOINT PROTECTION 14 CENTOS REMOTE INSTALL INSTALL#
#SYMANTEC ENDPOINT PROTECTION 14 CENTOS REMOTE INSTALL UPDATE#
#SYMANTEC ENDPOINT PROTECTION 14 CENTOS REMOTE INSTALL PATCH#
#SYMANTEC ENDPOINT PROTECTION 14 CENTOS REMOTE INSTALL VERIFICATION#

The LiveUpdate requires a Java Runtime Environment (JRE) but the Symantec package does not ship with one.

#SYMANTEC ENDPOINT PROTECTION 14 CENTOS REMOTE INSTALL INSTALL#

Change to the Symantec AV folder where RPMs were extracted and install the savjlu package (stands for Symantec Anti-Virus Java LiveUpdate).

#SYMANTEC ENDPOINT PROTECTION 14 CENTOS REMOTE INSTALL PATCH#

Installing LiveUpdate on Linux turned out to be a royal pain, however, it sure beat the alternative of copying patch files manually to each managed Linux client. That is simple on Windows, yes? In fact, we simply use the Symantec Endpoint Protection Manager (SEPM) to generate our install package and we run it, ez-peezy-lemon-squeezy, right? Now we want our anti-virus signatures to update. OK, kids, we’ve got Symantec AV installed and we patched the auto-protect daemon symap so it would load on our Linux kernel. # the output 'enabled' above indicates that, yes, auto-protect is running. # finally, verify that the auto-protect function is available by using the Symantec 'sav' bin.ira]# /opt/Symantec/symantec_antivirus/sav info -a Setting major=248 from bin.ira]# /etc/init.d/rtvscand restart # third, restart the Auto-Protect bin.ira]# /etc/init.d/autoprotect restart

# second, manually 'install' the build.sh results to the shared bin.ira]# mv * /opt/Symantec/autoprotect/ # after a successful auto-protect build.sh call, move to the local bin.ira ap-kernelmodule-1.0.14-13]# cd bin.ira/

#SYMANTEC ENDPOINT PROTECTION 14 CENTOS REMOTE INSTALL VERIFICATION#

For reference, the â€œinstallationâ€ commands and verification commands are pasted below:

#SYMANTEC ENDPOINT PROTECTION 14 CENTOS REMOTE INSTALL UPDATE#

So.performing a yum update and patching your Linux kernel will instantly break the Symantec Auto-Protect feature! However, these steps appear to work equally well for 32- and 64-bit releases. Now for the bad news: The above steps must be performed for each new SymAV or kernel upgrade.

After this copy the build.sh command succeeded as shown below:.

That is the content to copy to the kernel’s nfsfs.h/usr/src/kernels/2.6.32-279.19.1.el6.x86_64/include/linux/nfsd/nfsfh.h. In that file, look for and copy the the lines after the #include line and before the final #endif line. This is a bit complex open the local include/linux/nfsd/nfsfh1.h file from your local folder ( /home/SRR/AV/sym/rpm/ap-kernelmodule-1.0.14-13 in this example.

From the local SymAV folder, insert the contents of include/linux/nfsd/nfsfh1.h into the kernelâ€™s nfsfh.h file, before the #endif /* _KERNEL_ */ line.

One way to address this through a shell script would be to execute uname -a and extract the kernel version dynamically. A different kernel version would result in a different destination. As you can see, this command was issued against CentOS kernel version 2.6.32-279.

Issue command: cd /home/SRR/AV/sym/rpm/ap-kernelmodule-1.0.14-13.

Again, the actual version number for you may be different. For our use case this is /home/SRR/AV/sym/rpm/ap-kernelmodule-1.0.14-13.

Open a shell window and change to the SymAV auto-protect build folder.

Please note that version numbers *will change* based on the SymAV version and the and installed CentOS kernel version. Found resource at this link to address the issue, which has a solution as documented below. However, the auto-protect build fails looking for function fh_init.

Using the documentation, we eventually call the provided build.sh command provided by Symantec.

We cover the steps required for the auto-protect build below

First â€“ here is the documentation from Symantec: Symantec Auto-Protect Documentation Link.

Let’s cover the steps I used in my lab to solve this problem: But rebuilding the SymAV auto-protect package can be difficult due to some kernel header file requirements that – by default – CentOS does not include. This is a problem on CentOS because the module supplied with the SymAV package as of version 12.1 reports “incompatible kernel”. This works by having a compiled loadable kernel module installed (via the chkconfig command after installation).

Let’s talk a moment about how Symantec implements Auto-Protect on Linux systems. Read on for information on my process for installing Symantec AV including Auto-Protect on my hardened CentOS base image without any of the graphics packages installed (translation: no X11).

Symantec AntiVirus on Linux is a fragile and unforgiving beast – especially the problematic LiveUpdate client which is not correctly documented for install / config.

Symantec endpoint protection 14 centos remote install