F-Secure Security for Virtual and Cloud Environments

Contents

Chapter 1: Overview...............................................................................31.1 How it works.............................................................................................................................41.2 System requirements................................................................................................................4

1.2.1 Supported virtualization platforms..............................................................................41.2.2 Supported guest operating systems ..........................................................................51.2.3 Scanning and Reputation Server requirements .........................................................61.2.4 Centralized management ..........................................................................................6

Chapter 2: Deployment...........................................................................72.1 Installing Policy Manager..........................................................................................................8

2.1.1 Installation steps.........................................................................................................82.1.2 Import installation packages.......................................................................................9

2.2 Installing F-Secure Scanning and Reputation Server............................................................102.2.1 Deploying the virtual machine..................................................................................102.2.2 Setting up F-Secure Scanning and Reputation Server.............................................112.2.3 Activating the full license..........................................................................................122.2.4 Configuring network..................................................................................................132.2.5 Configuring centralized management settings.........................................................16

2.3 Installing F-Secure Client Security and F-Secure Server Security.........................................18

Chapter 3: Testing the installation.......................................................223.1 Checking the deployment.......................................................................................................233.2 Checking the connectivity.......................................................................................................24

TOC | F-Secure Security for Virtual and Cloud Environments

Overview

F-Secure Security for Virtual and Cloud Environments protectsvirtualized servers and desktops against malware, exploits,network-based attacks, and other security threats.

Topics:

• How it works• System requirements F-Secure Security for Virtual and Cloud Environments makes sure that

security and policy compliance stay up-to-date in a virtual infrastructure.It can be deployed in private or public cloud environments that arebased on any virtualization platforms. The product minimizes theresource consumption and performance impact to the virtualizationinfrastructure.

F-Secure Security for Virtual and Cloud Environments consists ofdedicated security servers that run F-Secure Scanning and ReputationServer, and F-Secure Client Security and F-Secure Server Securityproducts that are installed on virtual desktops and servers.

F-Secure Scanning and Reputation Server works as a virtual appliancethat is deployed in the virtualization environment and employstechnologies that are used in globally awarded F-Secure end-pointand server protection products.

The solution is centrally managed with F-Secure Policy Manager.

1.1 How it worksAs an administrator, you use F-Secure Policy Manager to centrally manage F-Secure security productsthat are installed in your network. F-Secure Policy Manager is available for Windows and Linux platforms.

F-Secure Client Security and F-Secure Server Security products are installed on physical or virtualdesktops and servers. They download and install software and database updates automatically, and sendstatus information and alerts to F-Secure Policy Manager.

To minimize the impact on performance on virtual machines, F-Secure Client Security and F-SecureServer Security offload the malware scanning and content reputation checking to a dedicated server thatruns F-Secure Scanning and Reputation Server.

F-Secure Scanning and Reputation Server is a virtual appliance that is based on hardened Linux platformand provides malware scanning and content reputation services.

1.2 System requirementsHardware and software requirements for installing and using the product.

1.2.1 Supported virtualization platformsHardware requirements for the virtualization platfom depend on the virtualization platform that you use.

This release supports the following virtualization platforms:

• VMware vSphere 5.0, 5.1 with VMware vCenter Server 5.0, 5.1• Citrix XenServer 6.2 or newer• Microsoft Hyper-V Server 2008R2, 2012, 2012R2

4 | Overview

• Citrix VDI-in-a-Box 5.x

Note: For the latest information and more details about supported virtualization platforms, referto the product release notes.

Virtualization platforms hardware requirements

Hardware requirements for the virtualization platfom in vSphere 5 and XenCenter environments:

64bit x86 CPU with at least two coresProcessor:

At least 3 GBMemory:

SCSI disk or a local RAID LUN with unpartitioned space for virtualmachines

Hard drive:

At least one network interface, Gigabit or 10GbNetwork connection:

Note:

For the complete list of supported hardware with ESXi 5.0 and 5.1, seehttp://www.vmware.com/resources/compatibility.

Hardware requirements for the virtualization platfom in Windows Server with Hyper-V Role environment:

x64 compatible CPU with Intel VT or AMD-V technology enabled. 2 GHzor faster is recommended.

Processor:

Hardware Data Execution Prevention (DEP) must be available and enabled(Intel XD or AMD NX).

At least 3 GB, 1 TB maximumMemory:

SCSI disk or a local RAID LUN with partitioned space for virtual machinesHard drive:

At least one network interface, Gigabit or 10GbNetwork connection:

1.2.2 Supported guest operating systemsYour guest machines must be running supported operating systems to install F-Secure Client Securityor F-Secure Server Security.

This release supports the following operating systems on virtualized servers and desktops:

• Microsoft® Windows XP• Microsoft® Windows Vista• Microsoft® Windows 7• Microsoft® Windows 8• Microsoft® Windows 8.1• Microsoft® Windows Server 2003• Microsoft® Windows Server 2003 R2• Microsoft® Windows Server 2008• Microsoft® Windows Server 2008 R2• Microsoft® Small Business Server 2003• Microsoft® Small Business Server 2003 R2• Microsoft® Small Business Server 2008• Microsoft® Small Business Server 2011, Standard edition• Microsoft® Small Business Server 2011, Essentials• Microsoft® Windows Server 2012• Microsoft® Windows Server 2012 Essentials• Microsoft® Windows Server 2012 R2

F-Secure Security for Virtual and Cloud Environments | 5

For performance and security reasons, you can install the product only on NTFS partition.

Note: All Operating Systems should have the latest service pack from Microsoft installed. For thelatest information and more details about supported OS platforms, refer to the product releasenotes.

1.2.3 Scanning and Reputation Server requirementsF-Secure Scanning and Reputation Server is a preconfigured virtual machine that is based on a hardened64-bit CentOS distribution.

The number of installed instances depends on the number and type of virtual machines you need toprotect and how much resources are available on the hypervisor host. At minimum, F-Secure Scanningand Reputation Server requires the following:

• 20 GB disk space• 2 GB RAM• 2 virtual CPUs

Note: For better performance, allocate more resources if available.

1.2.4 Centralized managementThe product is centrally managed with F-Secure Policy Manager.

This release supports the following versions of F-Secure Policy Manager:

• Windows: F-Secure Policy Manager 11.10 or newer• Linux: F-Secure Policy Manager 10.30 or newer

F-Secure Policy Manager can be deployed on a dedicated Windows or Linux virtual machine.

Note: For more information, see F-Secure Policy Manager release notes.

6 | Overview

Deployment

This chapter gives you an overview of the deployment steps, followedwith detailed instructions on each topic.

Topics:

• Installing Policy ManagerFollow these steps to deploy F-Secure Security for Virtual and CloudEnvironments solution in your virtualization infrastructure:• Installing F-Secure Scanning

and Reputation Server1. Install tools to administer F-Secure Security for Virtual and Cloud

Environments.• Installing F-Secure Client

Security and F-Secure ServerSecurity a) Install F-Secure Policy Manager on a dedicated virtual machine.

b) Install F-Secure Policy Manager Console either on the same orseparate virtual machine.

c) Import JAR installation packages of F-Secure Client Securityand F-Secure Server Security to F-Secure Policy ManagerConsole.

2. Deploy the F-Secure Scanning and Reputation Server.a) Install the F-Secure Scanning and Reputation Server virtual

appliance on the hypervisor hosts.b) Register F-Secure Scanning and Reputation Server to F-Secure

Policy Manager and make sure that it has received policysettings and latest database updates.

c) In Policy Manager Console, specify the network addresses thatF-Secure Client Security and F-Secure Server Security productswill use to communicate with F-Secure Scanning and ReputationServer installations.

3. Install F-Secure Client Security and F-Secure Server Securityproducts.a) Export F-Secure Client Security and F-Secure Server Security

installation packages with F-Secure Policy Manager Console.b) Use the installation packages to install products on virtual

desktops and servers.

2.1 Installing Policy ManagerThis section explains how to install Policy Manager.

Note: Only Policy Manager 11.10 is fully compatible with the product.

2.1.1 Installation stepsFollow these steps in the order given here to install Policy Manager Server and Policy Manager Consoleon the same machine.

Download and run the installation packageThe first stage in installing Policy Manager is to download and run the installation package.

To begin installing the product:

1. Download the installation package from www.f-secure.com/webclub.You will find the file in the Download section of the Policy Manager page.

2. Double-click the executable file to begin installation.Setup begins.

3. Select the installation language from the drop-down menu and click Next to continue.4. Read the license agreement information, then select I accept this agreement and click Next to

continue.

Select components to installThe next stage is to select the product components to install.

To continue installing the product:

1. Select the components to install and click Next to continue.

• Select both Policy Manager Server and Policy Manager Console to install both components on thesame machine.

• Select Policy Manager Server if you want to install Policy Manager Console on a separate machine.

2. Choose the destination folder and then click Next.It is recommended to use the default installation directory. If you want to install the product in a differentdirectory, you can click Browse and select a new directory.

Note: If you have Management Agent installed on the same machine, this window will not beshown.

3. Enter and confirm a password for your admin user account, then click Next.Use this password to log in to Policy Manager Console with the user name admin.

4. Select the Policy Manager Server modules to enable:

• The Host module is used for communication with the hosts. The default port is 80.• The Administrationmodule is used for communication with Policy Manager Console. The default

HTTPS port is 8080.

Note: If you want to change the default port for communication, you will also need to includethe new port number in the Connections URL when logging in to Policy Manager Console.

By default, access to the Administration module is restricted to the local machine.

• TheWeb Reporting module is used for communication with Web Reporting. Select whether itshould be enabled. Web Reporting uses a local socket connection to the Administration moduleto fetch server data. The default HTTPS port is 8081.

8 | Deployment

Note: Make sure that your firewall rules allow access to the ports used by Policy ManagerConsole and the hosts so that they can fetch policies and database updates.

5. Click Next to continue.

Complete installation of the productThe next stage is to complete the installation of the product.

1. Review the changes that setup is about to make, then click Start to start installing the selectedcomponents.When completed, the setup shows whether all components were installed successfully.

2. Click Finish to complete the installation.3. Restart your computer if you are prompted to do so.

Run Policy Manager ConsoleThe last stage in setting up the product is to run Policy Manager Console for the first time.

To run Policy Manager Console for the first time:

1. Run Policy Manager Console by selecting Start > Programs > F-Secure Policy Manager > F-SecurePolicy Manager Console.When Policy Manager Console is run for the first time, you will be asked to register the product usingyour customer number. You can find your customer number in the license certificate provided with theproduct. If you do not register the product, you can use it normally for a 30-day evaluation period.When the evaluation period expires, you will not be able to connect to the server, but any clientapplications that you have installed will continue to work and your product setup will remain unchanged.

2. Click Continue to complete the setup process.

The setup wizard creates the user group FSPM users. The user who was logged in and ran theinstaller is automatically added to this group. To allow another user to run Policy Manager you mustmanually add this user to the FSPM users user group.

Policy Manager Console starts in Anti-virus mode, which is an optimized user interface for managingClient Security, Anti-virus for Workstations and Server Security. If you are going to use Policy ManagerConsole for managing any other F-Secure product, you should use the Advanced mode user interface.You can access it by selecting View > Advanced mode from the menu.

2.1.2 Import installation packagesYou need to import the installation packages for the products that you want to manage in Policy Manager.

To import installation packages:

1. On the Installation tab, click Installation packages.2. In the Installation packages view, select the installation packages for Client Security and Server

Security and then click Import.The .jar installation packages are fetched and the products appear on the product list.

F-Secure Security for Virtual and Cloud Environments | 9

2.2 Installing F-Secure Scanning and Reputation ServerInstructions how to install the F-Secure Scanning and Reputation Server virtual appliance to a virtualmachine.

2.2.1 Deploying the virtual machineYou can use either vSphere 5 client, XenCenter 6.2, or Hyper-V Manager to install and administer theproduct.

Check F-Secure Community and Knowledge Base for more details and instructions how to deploy theSRS virtual appliance on other virtualization platforms.

Deploying the virtual machine in vSphere clientFollow these instructions to deploy the virtual machine in vSphere 5.

1. Start the vSphere 5 client.2. Choose the host and log in.

vSphere 5 client opens.3. Go to File > Deploy OVF Template.4. Browse to the fssrs-va-11.0.X.Y.ova installation file and click Open.5. Follow the setup wizard instructions.

a) In the Disk Format step, select Thick Provision Eager Zeroed.b) In the Hostname step, enter the hostname or if you want to use a DNS provided name, leave the

field empty.

6. Finish the wizard and wait until you receive the Deployment Completed Successfullymessage.Click Close.

Deploying the virtual machine in XenCenterFollow these instructions to deploy the virtual machine in XenCenter 6.2.

1. Start XenCenter.2. Go to File > Import.3. Browse to the fssrs-va-11.0.X.Y.xva installation file and click Next.4. Follow the setup wizard instructions.5. Finish the wizard and wait until the import is finished.

Deploying the virtual machine in Hyper-V ManagerFollow these instructions to deploy the virtual machine in Hyper-V Manager.

1. Start Hyper-V Manager.2. Select Hyper-V host in the server tree.3. In actions bar, click New > Virtual Machine.4. Select a name and location for the new virtual machine and click Next.5. Copy the fssrs-va-11.0.X.Y.vhd installation file to the selected location.6. Specify at least 2048 MB RAM for the virtual machine and click Next .7. Specify the Network adapter for VM and click Next.8. When selecting hard drive to use, select existing virtual hard drive and browse for the

fssrs-va-11.0.X.Y.vhd file that you have copied to the virtual machine's location.9. Make sure that the configuration is correct and click Finish.10.Wait until the virtual machine is ready.

10 | Deployment

2.2.2 Setting up F-Secure Scanning and Reputation ServerYou need to set up the administrator password to log in to the console and web user inteface and configurethe timezone that you use.

Follow these instructions to set up F-Secure Scanning and Reputation Server:

1. Select the virtual machine from the vSphere client, XenCenter, or Hyper-V manager.2. Start the virtual machine.3. Open the virtual machine console.4. Enter and confirm your administrator password.

TheWelcome screen opens.

5. In theWelcome screen, select Set Timezone to change the timezone that is used on the host.

Note: The Set Timezone option is only available in the vSphere client.

6. Use lists of locations to set your timezone.

F-Secure Security for Virtual and Cloud Environments | 11

2.2.3 Activating the full licenseF-Secure Scanning and Reputation Server is installed in the evaluation mode. Activate and enter yourfull license key after you have set up the product.

To activate the full license, follow these instructions:

1. Open the virtual machine console.2. In theWelcome screen, select Login to go to the Admin menu.3. Enter admin as your login name and your administrator password.

The Admin menu opens.

4. Select 5 to enter your license code.The License menu shows the current license information.

5. Select 1 to enter your license key.6. Enter your full license code and press Enter.

F-Secure Scanning and Reputation Server is fully licensed after you enter the correct license key.

12 | Deployment

2.2.4 Configuring networkAfter completing the installation, you need to configure the network settings.

You can configure the IP address for the product manually or the product can retrieve it automaticallyfrom a DHCP server. If the product cannot retrieve the IP address from a DHCP server, you must configurenetwork manually.

Note: If you start the product for the first time without a DHCP server, the console shows warningmessages about the issue. You can still continue the setup as instructed.

Configuring network manuallyIf you do not want to use a DHCP server with the product, you can configure the IP address manually.

Follow these steps to log in to the console and configure the network:

1. Open the virtual machine console.2. In theWelcome screen, select Login to go to the Admin menu.3. Enter admin as your login name and your administrator password.

The Admin menu opens.

4. Select 1 to edit the network settings.The Network configuration menu opens.

F-Secure Security for Virtual and Cloud Environments | 13

5. Select 3 to configure the IP address.The network configuration asks if you want to configure an IPv4 address.

6. Select y to select the static IPv4 address you want to use.a) Enter the static IP address and netmask that you want to use.b) Enter the gateway address if there is any.

7. Return to the Network configuration menu to configure the host name for the static IP.a) In the network configuration menu, select 1 to edit the hostname.b) Enter the host name for the virtual machine.

8. Return to the Network configuration menu to configure DNS servers.a) In the network configuration menu, select 2 to edit DNS.b) Enter IP addresses of primary and secondary DNS servers.

9. Select 4 to return to the Admin menu.10. Press Enter to return to the Login screen.

Configuring network automatically with DHCPYou can use a DHCP server to retrieve the IP address for the product automatically.

To use the product with your existing DHCP server, you need to configure the DHCP server to assign anIPv4 address to the MAC address of your virtual machine.

Find the MAC address with vSphere clientFollow these steps to find the MAC address of the virtual machine with vSphere 5 client.

1. Right-click the virtual machine from the left pane of the vSphere5 client.2. Select Edit Settings from the menu.

The Virtual machine properties dialog opens.3. Make sure that Hardware tab is selected and select Network adapter 1 from the hardware list.

14 | Deployment

The MAC Address pane on the right shows the MAC address of your virtual machine.4. Configure your DHCP server to assign an IPv4 address to the MAC address of your virtual machine.

Find the MAC address with XenCenterFollow these steps to find the MAC address of the virtual machine with XenCenter.

1. Click on the virtual machine from the left pane of the XenCenter.2. Select Networking tab from the right pane.3. Right click on the network device and click properties.

F-Secure Security for Virtual and Cloud Environments | 15

In the dialog that opens, the Use this MAC address field under the MAC address setting shows theMAC address of your virtual machine.

4. Configure your DHCP server to assign an IPv4 address to the MAC address of your virtual machine.

Find the MAC address with Hyper-V ManagerFollow these steps to find the MAC address of the virtual machine with Hyper-V Manager.

1. Right click on the virtual machine in Hyper-V manager.2. Select Settings.3. Click Network Adapter and select Advanced Features from the list.4. Select Static in the MAC address setting.

Boxes show the static MAC address of your virtual machine.5. Configure your DHCP server to assign an IPv4 address to the MAC address of your virtual machine.

2.2.5 Configuring centralized management settingsFollow these instructions to centrally administer F-Secure Scanning and Reputation Server with F-SecurePolicy Manager.

Follow these steps after you have deployed the virtual appliance and configured its network settings:

1. Open the virtual machine console.2. In theWelcome screen, select Login to go to the Admin menu.3. Enter admin as your login name and your administrator password.

The Admin menu opens.

16 | Deployment

4. Select 3 to open the Centralized management menu.

5. In the Centralized management menu, select 1 to change the F-Secure Policy Manager address.6. Enter the address of Policy manager server.

The server connects to F-Secure Policy Manager to download the admin.pub file.

Tip: You can select 0 in the menu to check the md5sum digest of the admin.pub file.

7. Return to the Centralized management menu to retrieve the latest policy files.8. Select 2 to poll Policy Manager Server and take the new policy into use.9. Select 0 in the Centralized management menu to display the Policy Manager server details.

F-Secure Security for Virtual and Cloud Environments | 17

10. Login to F-Secure Policy Manager Console and import F-Secure Scanning and Reputation Serverhost to your policy domain.

11. Distribute the policy to the server with F-Secure Policy Manager Console.

2.3 Installing F-Secure Client Security and F-Secure ServerSecurity

After you have deployed F-Secure Scanning and Reputation Server, install F-Secure Client Security andF-Secure Server Security products on virtual desktops and servers.

Follow these instructions to install F-Secure Client Security or F-Secure Server Security to a virtualmachine:

1. Open F-Secure Policy Manager Console to create the default base policy.a) Go to F-Secure > F-Secure Offload Scanning Agent > Settings > Connection and enter the

address of F-Secure Scanning and Reputation Server in the Primary Servers setting.

18 | Deployment

Note: If you do not use the default 1344 port, enter the custom port number with the address(as IP:PORT).

2. Export the F-Secure Client Security or F-Secure Server Security installation package as MSI format.a) Go Tools > Installation packages menu in F-Secure Policy Manager Console.b) Select F-Secure Client Security or F-Secure Server Security JAR package that you have imported

to F-Secure Policy Manager and click Export.The Export Wizard starts.

c) Follow the Export Wizard instructions.d) On the Policy page, choose the Include policy for option and select the policy that you specified.

e) Enter the product keycode when you are prompted to do so.f) In the Select components to install step, make sure that the Offload Scanning Agent component

is selected.

F-Secure Security for Virtual and Cloud Environments | 19

g) In the Configure communication with Policy Manager Server step, select Host identificationbased on your network environment.

Note: We recommend that you use WINS.

h) Compete the wizard to export the MSI package.

3. Login to a virtual machine with the local administrator account and run the exported MSI package.Wait until installation is complete and the restart dialog appears.

4. Click Yes to restart the system.Wait until the virtual machine restarts.

5. F-Secure Client Security and F-Secure Server Security download and install software and databaseupdates automatically when the virtual machine starts.

The client host is protected when the current status on the main page of F-Secure Client Security displays"Your computer is protected":

20 | Deployment

The server on the virtual machine is protected when the F-Secure Server Security Summary page hasgreen status icons:

F-Secure Security for Virtual and Cloud Environments | 21

Testing the installation

This chapter describes how you can check the product status andmake sure that it is working.

Topics:

• Checking the deployment• Checking the connectivity

22 | Testing the installation

3.1 Checking the deploymentYou can make sure that the product is working after you have deployed the F-Secure Scanning andReputation Server virtual appliance and registered it in F-Secure Policy Manager.

Follow these instructions to make sure F-Secure Scanning and Reputation Server is working properly:

1. Open F-Secure Policy Manager Console.2. Select View > Advanced mode to switch to the advanced mode.3. Select the F-Secure Scanning and Reputation Server host in the Policy Manager Console.4. Open the Status tab.

Check that the Status tab reports the correct status and version information for F-Secure ManagementAgent, F-Secure Automatic Update Agent and F-Secure Scanning and Reputation Server.

5. Open F-Secure Automatic Update Agent > Statistics > Downloads > Available packages.

Check that the host has received the latest database updates. You should see updates for Aquarius,Hydra and File Manager Library.

6. Open F-Secure Automatic Update Agent > Statistics > Downloads > Installed packages.

F-Secure Security for Virtual and Cloud Environments | 23

Check that the latest database updates have been installed.

7. Open F-Secure Scanning and Reputation Server > Statistics > Server.

Check Connected hosts and Files scanned statistics to see how many clients are connected to theScanning and Reputation Server and how many files have been scanned so far.

Note: Open F-Secure Scanning and Reputation Server > Statistics > Cache to check thenumber of items in the cache and its hit/miss ratio.

3.2 Checking the connectivityHow to test that the client machine can connect to F-Secure Scanning and Reputation Server.

To check that the client can connect to F-Secure Scanning and Reputation Server, follow these instructions:

1. Open the web browser on the client.2. Browse to <srs_address>:<srs_port>.

<srs_address> is the host name or IP address of F-Secure Scanning and Reputation Server and<srs_port> is the port number that the server is configured to accept connections on (by default,1344).

24 | Testing the installation

If the server replies 400 Bad Request, the connection with the server is working.

If you see some other error, check your network settings and the firewall configuration.

F-Secure Security for Virtual and Cloud Environments | 25