Client operations issues, 154 | McAfee 6.1 guide

McAfee® Host Intrusion Prevention 6.1 Product Guide	Host Intrusion Prevention Client
	Solaris client

Verifying installation files

After an installation, check that all the files were installed in the appropriate directory on the client. The /opt/McAfee/hip directory should contain these essential files and directories:

File/Directory Name	Description

HipClient	Solaris client
HipClient-bin

HipClientPolicy.xml	Policy rules

hipts	Troubleshooting tool
hipts-bin

*.so	Host Intrusion Prevention and ePO agent shared
	object modules

log directory	Contains log files: HIPShield.log and HIPClient.log

9

Installation history is written to /opt/McAfee/etc/hip-install.log. Refer to this file for any questions about the installation or removal process of the Host Intrusion Prevention client.

Verifying client is running

The client might be installed correctly, but you might encounter problems with its operation. If the client does not appear in the ePO console, for example, check that it is running, using either of these commands:

/etc/rc2.d/SS99hip status

ps –ef grep hip.

Client operations issues

The Solaris client has no user interface to troubleshoot operation issues. It does offer a command-line troubleshooting tool, hipts, located in the /opt/McAfee/hip directory. To use this tool, you must provide a Host Intrusion Prevention client password. Use the default password that ships with the client (abcde12345), or send a Client UI policy to the client with either an administrator’s password or a time-based password set with the policy, and use this password.

Use the troubleshooting tool to:

Indicate the logging settings and engine status for the client.

Turn message logging on and off.

Turn engines on and off.

Log on as root and run the following commands to aid in troubleshooting:

Run this command...	To do this...

hipts status	Obtain the current status of the client indicating
	which type of logging is enabled, and which
	engines are running.

hipts logging on	Turn on logging of specific messages types.

hipts logging off	Turn off logging of all message types. Logging is off
	by default.

154

Image 154

McAfee 6.1 manual Client operations issues, 154, File/Directory Name Description, Run this command To do this

Contents

McAfee Host Intrusion Prevention Page McAfee Host Intrusion Prevention Copyright Contents IPS Policies General Policies 103 Frequently Asked Questions 160 Writing Custom Signatures 164 IntroducingPrevention Host Intrusion What’s new in this release New featuresChanges from the previous release Using this guide Audience Bold Condensed ConventionsThis guide uses the following conventions Example Getting product information Standard documentation Professional Services Customer ServiceContact information Basic Concepts IPS featureSignature rules Reactions Behavioral rulesEvents Exception rules Firewall rules Firewall featureClient firewall rules General feature Application Blocking featureClient application blocking rules Policy enforcement Policy managementPolicies and policy categories Policy ownership Policy inheritance and assignmentPolicy assignment locking Adaptive and Learn mode Preset protectionDeployment and management Tuning Reports Using ePolicy Orchestrator „ Deploy Host Intrusion Prevention clients EPolicy Orchestrator console EPolicy Orchestrator console Policy management Assign Policies Assigning owners to policies Installing the Host Intrusion Prevention serverHost Intrusion Prevention operations Generating notifications Deploying Host Intrusion Prevention clients Viewing and working with client data Placing clients in Adaptive or Learn mode Configuring policies Policy viewing alerts Fine-tuning Active X control security warning Using Help Help navigation procedures IPS Exception Rules Help in the user interfaceIPS Events/Signatures IPS Signature Rules IPS Policies Overview Host and network IPS signature rules Benefits of Host IPS Behavioral rules Preset IPS policiesBenefits of Network IPS Quick access Configuring the IPS Options policyTo configure the IPS Options policy IPS Options dialog box appears Click ApplyTo create a new IPS Options policy Select the needed options Configuring the IPS Protection policy To configure the IPS Protection policy To create a new IPS Protection policy IPS Protection dialog box appears Select the type of reaction for each severity level To assign IPS Rules policies Configuring the IPS Rules policyTo create a new IPS Rules policy IPS Rules policy details Creating exception rules To create an exception You can view and edit details of an existing exception Editing exception rulesTo edit an exception rule Deleting exception rules To disable/enable an exceptionEnabling and disabling exception rules Moving exception rules to another policy Host signatures SignaturesTypes of signatures Custom host signatures Viewing signatures IPS Rules-Signatures tab Creating custom signatures To modify default signaturesModifying host and network signatures To modify the view of signatures Using the wizard to create signatures To create signatures using the wizard Using the standard mode to create signatures To create a signature with the standard mode New Custom Signature-General tab To use Standard Method To use Expert Method Editing custom signaturesDeleting custom signatures To edit a custom signature Application Protection Rules 11 Application Protection Rules analysis To create an application protection rule 12 IPS Rules-Application Protection Rules 13 New Trusted Application dialog box-General tab Enabling and disabling Application Protection Rules IPS EventsEditing Application Protection Rules Deleting Application Protection Rules Viewing events To view IPS events Filtering events Configuring the event viewTo change the event view To mark an event as unread Marking eventsTo mark an event as read To hide an event „ Agent „ Signatures „ User „ Process „ Severity Level Marking similar eventsTo mark similar events Hidden Creating event-based exceptions and trusted applications Viewing event detailsTo view event details To create an event-based exception To create an event-based trusted application Searching for related exceptions IPS Client RulesTo search for a related exception Regular View To migrate client rules to an IPS Rules policy To aggregate client rules Aggregated ViewClick the Aggregate View tab on the IPS Client Rules tab Search IPS Exception Rules To search for exceptions and manage the list of exceptions 22 Search IPS Exception Rules tab Firewall Policies HIP 6.0 rules HIP 6.1 rules Stateful packet filtering State tableStateful packet inspection How firewall rules work Ordering the firewall rule list How stateful filtering works Stateful filtering process Stateful protocol tracking How stateful packet inspection worksProtocol Description of handling Firewall rule groups and connection-aware groups TCP Overview Firewall Learn and Adaptive modes Stateful filtering Quarantine policies and rules Migrating custom 6.0 firewall rules to 6.1 rules Preset Firewall policiesTo migrate rules Select For these settings Off McAfee Default Configuring the Firewall Options policyTo configure the Firewall Options policy Learn Create New Policy dialog box appears „ Select New Policy Creating new Firewall Rules policies Configuring the Firewall Rules policyTo create a Firewall Rules policy Include Local Subnet Automatically selected Select this For this protection Policy Server Medium Server High To view and edit a firewall rule Viewing and editing firewall rulesDo any of the following Add Policy or Duplicate Policy Creating a new firewall rule or firewall group Select the appropriate settings Click OKTo create a firewall rule To create a connection-aware group To create a new rule groupFirewall Rule Group dialog box appears Type a name for this group in the Name field To add predefined rules Deleting a firewall rule or groupTo delete a firewall rule or group To view all firewall client rules Viewing firewall client rulesTo modify the view, do any of the following To view aggregated firewall client rules To view details of an aggregated firewall rule To configure the Quarantine Options policy Configuring the Quarantine Options policySelect New Policy Creating new Quarantine Rules policies Configuring the Quarantine Rules policyQuarantine Rules policy provides access for To create a Quarantine Rules policy To view and edit a quarantine rule Viewing and editing quarantine rulesClick Properties To create a quarantine rule Creating a new quarantine rule or groupDeleting a quarantine rule or group To delete a quarantine rule or group Application Blocking Policies Application creation Application Blocking feature contains two policy categories Preset Application Blocking policiesApplication hooking Select this policy For these settings Off McAfee Default Configuring the Application Blocking Options policyTo apply an Application Blocking Options policy Application Blocking Options Creating new Application Blocking Rules policies Configuring the Application Blocking Rules policyTo create an Application Blocking Rules policy Viewing and editing Application Blocking Rules To view and edit an application blocking rule Application Rule dialog box appears Creating new Application Blocking RulesTo create a new application blocking rule 100 To delete an application blocking rule Deleting an application blocking ruleViewing application client rules To view all client application rules To view aggregated client application rules To view details of an aggregated client application rule General Policies Preset General policies General feature contains four policy categories To change the policy setting Configuring Enforce PoliciesConfiguring the Client UI policy Regular User Creating and applying a Client UI policy Administrator UserTo configure a Client UI policy Disconnected User Setting passwords 107 Click the Advanced Options tab in the Client UI policy To create an administrator password108 Tray icon control To create a time-based passwordTo provide tray icon control of Windows UI To configure trusted network options Configuring the Trusted Networks policy110 Remove Select To do this AddEdit Include Local Subnet To create a new policy Configuring the Trusted Applications policyCreating and applying Trusted Applications policies Trusted Application tab appears Creating trusted applications To create a trusted application Enabling and disabling trusted applications To disable/enable a trusted applicationEditing trusted applications Deleting trusted applications Analyzing IPS events MaintenanceFine-tuning a deployment 115 Creating and applying new policies Creating exception rules and trusted application rulesWorking with client exception rules For details on working with client rules, see Policies tab Policy maintenance and tasksTo view and reset broken inheritance below a specific node Policy inheritance and assignment To copy and paste policy assignments of a node Click Copy policy assignments Viewing policy information To view nodes where a policy is assignedPolicy Catalog To view all policies that have been created To view assignments where policy enforcement is disabled To view the settings and owner of a policyEditing policy information To edit a policy Event Archiver Running server tasksDirectory Gateway Property Translator How notifications work Setting up notifications for eventsCreating rules Host Intrusion Prevention notifications 124 Pre-defined reports Running reportsReport repository Summary information and details Report content controlHost Intrusion Prevention reports IPS Events Summary by Signature Network Intrusion Summary by Source IP IPS Event Summary by TargetSignature Blocked Application Summary Top 10 Attacked Nodes for IPSTop 10 Triggered Signatures Filters on platform and signature type Top 10 Blocked Applications Failed Quarantine UpdatesInitial View Drill Down Host Name Updating Checking in the update packageTo add update packages automatically From the Task type list, select Repository Pull To have a client request an update To add update packages manuallyTo run an update task Updating clients Host Intrusion Prevention Client Windows client Client console System tray icon133 To unlock the Host Intrusion Prevention interface Setting optionsUnlocking the client interface To customize client options Show tray icon Error Reporting Error ReportingTroubleshooting Select For this To set Firewall logging options To set IPS logging optionsSecurity Violations Intrusion alerts Alerts137 138 To respond to a firewall Learn Mode alertFirewall alerts Has the Treat rule match as an intrusion option selected Application Blocking alerts Spoof Detected alerts Quarantine alerts„ The IP address that the traffic pretends to come from 140 141 IP Spoof Detected Alert dialog box To customize IPS Policy options IPS Policy tabIPS Policy options 142 To edit the exception rules IPS Policy exception rulesException rules list 143 To customize Firewall Policy options Firewall Policy tabFirewall Policy options 144 Firewall rules list Firewall Policy Rules145 To customize Application Policy options Application Policy tabApplication Policy options 146 Application rules list Application Policy rules147 148 Blocked Hosts tabBlocked Hosts list Column What it shows 149 To edit the Blocked Hosts listUntil removed This list shows all monitored processes on the client Application Protection tabApplication Protection list 150 To customize Activity Log options Activity Log tabActivity Log options 151 Select Create Sniffer Capture... Activity Log list152 McAfee Host Intrusion Prevention Options Solaris client TroubleshootingClient installation issues Policy enforcement with the Solaris client 154 Client operations issuesRun this command To do this File/Directory Name Description To restart a Solaris client To stop a Solaris client155 Linux client Policy enforcement with the Linux client Verifying the client is running File Name Description Troubleshooting tool 158 To restart a Linux client Run the command hipts agent offTo stop a Linux client 159 What is the McAfee Default policy? Frequently Asked QuestionsWhat is a policy? 160 161 How do I view IPS events triggered by clients? How do I create an exception based on an IPS Event? How do I create custom signatures for an IPS Policy? How do I find existing policies that match a given profile? Basic structure of a rule is the following Writing Custom SignaturesRule Structure 164 165 Mandatory common sectionsSection Name Value Description Use of Include and Exclude Name/domain user name Section value variables Optional common sectionsUse of the dependencies section Use of predefined variables Use of wildcardsUse of environment variables Windows IIS Web Server Solaris Apache and iPlanet MS SQL Database Server169 Class Files This topic describes how to write Windows custom signaturesWindows Custom Signatures 170 171 Advanced Details GUI name Explanation Class Isapi Machine where the client is installed in the manner host Windows Custom Signatures Class Registry 177 Class Services Section Values Meaning/remarks GUI Name Explanation Possible Values Windows Custom Signatures Class UNIXfile This topic describes how to write Solaris custom signaturesSolaris Custom Signatures 181 Relevant X directives per section Directive File Source File permission New permission Class UNIXapache Advanced Details183 Solaris Custom Signatures Linux Custom Signatures 185 List of directives according to type Summary of parameters and directivesList of parameters according to type 186 Glossary 187 188 Blocked host 189 Console tree 190 EPolicy Orchestrator database server 191 See also minimal properties 192 Inactive agent 193 Policy enforcement interval 194 Severity level 195 SYN flood Index Working with clients Signatures, 46 creating, 48 creating custom Firewall policy tab rules List IPS Policy tab Page Mcafee.com