Trend Deep security Protection on AWS – Part 1

Posted on April 30, 2018 by

Enable agility with security built for Amazon EC2. Trend Micro’s instance-based  protection, deep API integration and AWS CloudFormation templates help you automate security and accelerate compliance. Together Trend Micro and AWS deliver proactive cloud security that Security trusts and DevOps likes. With AWS Marketplace; as a service or software deployment options and pay-as-you-go pricing options, you can seamlessly integrate security into your environment, whether you’re all in the cloud or still supporting hybrid infrastructures.

Same like old blog series on Trend DSM , we can see the new blog series on the below topics to enable the EC2 instance with Trend DSM as a service.

  1. Login setup
  2. Adding the AWS Account in to the Trend DSM
  3. How to use deployment scripts to add and protect computers
  4. Activating the Trend Agent
  5. Bake the agent into your AMI

 

  1. Login setup

Login to the below link and create the free account for the testing.

https://www.trendmicro.com/aws/free-trial/

Create the own account and login , We can see the Trend Deep security Manager dashboard.

Advertisements
Posted in AWS, Trend Deep Security Manager - ( DSM ), Trend Micro Deep Security | Tagged , , , , | Leave a comment

Trend Deep Security – Customizing the alert configuration.

Posted on March 28, 2018 by

In Trend DSM, if we want to send the alert email notification , we have to go to settings – alert and select what type of notification we want to receive but by default all the alerts are enabled and to disable we need to open each alert and select it manually.

It will take time to open and modify each alert and easy way to fix the same is to open the SQL database and run the below query .

———————
select * from alerttypes
———————
The 3 columns “NotifyStart”, “NotifyEnd”, and “NotifyChange” if the value is set to 1, it means it will generate an email alert for that alert type.   We can use the following sql queries to turn off all these settings.
—————————————-
update alerttypes set NotifyStart = ‘0’
update alerttypes set NotifyEnd = ‘0’
update alerttypes set NotifyChange = ‘0’
—————————————-

Once the alert configurations are turned off, you will need to enable the alert you want to receive notification manually from the Deep Security Web Console, this action helps you turn off all of the settings instead of having to go through them one at a time.

Posted in Trend Micro Deep Security, Trend Micro Deep Security 9.5 Events and Monitoring | Tagged , , | Leave a comment

Trend Deep Security agentless windows 2016 protection

Posted on February 28, 2018 by

Even-though the 9.6 Service pack 1 was supporting the agentless protection which was tested in our lab, it was not officially supported by Trend and from the latest version Deep Security 9.1 Update Release (9.6 ServicePack 1 Patch1 Update 15) it started supporting now.

As per the Trend support team the EPSECLib 6.3.3 packaged into the RedHat agent version that goes into the DSVA to properly support Windows 2016 servers.

Also another issue which got fixed by this patch is when doing vMotion of many simultaneous VMs, some of the VMs may appear as Anti-Malware Engine Offline after it moves to the new host. This occurred because the DSM checked the status of the VMs during heartbeat before the vMotion is finished. It looks like from this patch it will do another check status or waiting for the next heartbeat will fix the status.

 

Posted in Trend Deep Security Manager - ( DSM ), Trend Micro Deep Security, Trend Micro Deep Security 9.5 ( Deep Security Agent ), Trend Micro Deep Security 9.5 ( VDI Environment-Agentless Protection ), Windows | Tagged , , , | Leave a comment

Useful links about Meltdown and Spectre

Posted on January 9, 2018 by

Everyone is  working on to fix the Meltdown and Spectre so just thought of sharing few links which will help to handle the issue efficiently .

HP

Today HP has released update for System ROM and we can find below link to download and information.

http://h22208.www2.hpe.com/eginfolib/securityalerts/SCAM/Side_Channel_Analysis_Method.html

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00039267en_us

VMware

On addition to the NOV Patch , VMware has released today the below link which have to be updated.

https://kb.vmware.com/s/article/52085

https://kb.vmware.com/s/article/52245

https://kb.vmware.com/s/article/52264

 

Redhat

https://access.redhat.com/security/vulnerabilities/speculativeexecution

AWS Linux

https://alas.aws.amazon.com/ALAS-2018-939.html,

https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/

Ubuntu

https://usn.ubuntu.com/usn/

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown)

Trend

Trend has released the useful link for the Deep Security Protection and also office scan.

https://success.trendmicro.com/solution/1119183

Debian

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown

SUSE

https://www.suse.com/support/kb/doc/?id=7022512

Windows

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002

https://support.microsoft.com/en-us/help/4073119/windows-client-guidance-for-it-pros-to-protect-against-speculative-exe

https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution

Apple

https://support.apple.com/en-us/HT208394

https://support.apple.com/en-us/HT208397

Google

https://support.google.com/faqs/answer/7622138

Mozilla

https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/

Citrix XenServer

https://support.citrix.com/article/CTX231390?_ga=2.162681087.2115616259.1515182465-735926685.1515182464

NVIDIA

http://nvidia.custhelp.com/app/answers/detail/a_id/4611

Other Links

Below Links will help to verify and more info on the issue.

https://blog.workinghardinit.work/2018/01/05/spectre-and-meltdown/

https://www.thomasmaurer.ch/2018/01/use-powershell-to-verifying-protections-again-peculative-execution-side-channel-vulnerabilities-cve-2017-5754-meltdown-and-cve-2017-5715-spectre/

http://vthinkbeyondvm.com/powercli-script-confirm-esxi-host-patched-vmware-hypervisor-patched-microcode-spectre-vulnerability/

Validating compliance of VMSA-2018-0002 and BIOS update

 

Posted in Dell, ESXi issue, ESXi Patches, ESXi Tools, Firmware upgrade, HP, Trend Micro Deep Security, VCSA6.5, VMware, Windows | Tagged , , | Leave a comment

Looking back on 2017

Posted on December 31, 2017 by

Just want to register my memory on 2017 , It has been wonderful journey with lot of happiness and also some bad memories .

So after doing almost six years of consultant job , I joined as the full time employee around mid 2016  and it was totally different  experience .When I was doing the consultant job , had lot of time for outside activity other than my daily responsibilities, like preparing and learning new stuff to improve my skills ,writing blog but after joining full time job the story is totally different and in my personal life my kids also now needed lot of time from me. On all these changes, I somehow managed to post at least one blog on each month.

2017 I have done some significant project like designing DR and Implemented the VMware SRM  and worked in the project to setup internal cloud in our environment. This year VMworld was so informative and had chance to meet some top personalities in the market. Year-end was not so good because of the recent layoff which affected lot of my close friends in the office. It is really nightmare for everyone and now lot of pressure to project our-self to show that we are worth for the company growth. Even though the vision of the company is to move to external cloud but one positive note is company are still showing interest on internal infrastructure  so the goal on 2018 is to learn open stack and AWS to improve the skills. I know 2018 going to be very challenging because of VISA issues in US and the new vision of our company. It will be very interesting and as i said challenging  year to prepare myself to respond for the situation in up-coming months..

 

Wishing everyone a very happy new year and hope will spend more time on writing the blogs with helpful information ..

Posted in year 2017 | Tagged | Leave a comment

VCSA 6.5 upgrade\Installation issues and fixes

Posted on November 30, 2017 by

Recently I have started upgrading the VC6.0 U3 ( VCSA ) to 6.5 U1 and encountered few issues  so  same like by previous blogs on VC6.0  issues , planned to do it for VC6.5 also and  find the old blogs below.

vCSA 6.0 Installation issues 

vmware-kb-articles-with-no-resolution

We have around 25 different vCenters to be upgraded and will update the blog accordingly .

Issue 1.

Invalid Appliance (OS) root password

So while upgrading the appliance we need to provide the SSO Password and also source VC\PSC appliance root password and it was failing with the OS root password is invalid. I have verified  the password which is correct and later found that SSO and OS password is same which fails to accept . Once I have changed the OS password, issue got fixed.

Issue 2.

Unable to retrieve the migration assistant extension on source vCenter server.

So as per the KB 2148400 , environment which is not using the VUM , we need to remove the com.vmware.vcIntegrity extension. KB 1025360 will guide the steps.

Issue 3.

The Installer is unable to connect to the vCenter Appliance Management Interface.

So my source VC was running in one cluster and trying to implement the upgrade 6.5 appliance on different cluster . Since the network is different it got failed on the end of the Stage 1 . Once I pointed the upgrade 6.5 appliance to the same cluster issue got fixed.

Issue 4.

Could not reach the given source vCenter Server address on port 22

Lot of blogs are pointed to check the SSH on the source appliance but in my case it was already enabled so I just restarted all the services before the upgrade and the issue got fixed on the next try.

 

 

 

Posted in ESXi issue, VC6.0 Appliance Installation Issue, Vcenter Appliance, vCSA 6.0, VCSA6.5, VMware | Tagged , , | 2 Comments

Options to check and alert the vcenter certificate expiration

Posted on October 9, 2017 by

Last week one of our vCenter went down because of the machine certificate got expired and it took some time to find out the issue so I thought it will be helpful to show the options to verify the certificate and make sure to enable the alarm.

Since the certificate as expired most of the services will fail to work properly since it cannot function/use the certificate it is assigned to use.

In our case, we are unable to vMotion because the service to vMotion (vmware-sps) is unable to connect to vpxd due to “server certificate chain not verified.”

Below is the log path to verify .

/var/log/vmware/vmware-sps/sps.log

com.vmware.vim.vmomi.client.exception.SslException: com.vmware.vim.vmomi.core.exception.CertificateValidationException: Server certificate chain not verified

Below is the command to verify the Machine certificate.

/usr/lib/vmware-vmafd/bin/vecs-cli entry list –store MACHINE_SSL_CERT –text |less

Solution certificate

/usr/lib/vmware-vmafd/bin/vecs-cli entry list –store machine –text |less

Also we can check the same using the web-browser  .

Using the “ /usr/lib/vmware-vmca/bin/certificate-manager” Replace the certificates on the vCenter via option 3 (just the MACHINE_SSL) or if it is with internal CA then follow the steps here.

So to make the alarm configured for the certificate expiration, already by default 30 days threshold is configured in the vcenter and You can change how soon you are warned with the vpxd.cert.threshold advanced option.

  1. Log in to the vSphere Web Client.
  2. Select the vCenter Server object, the select the Manage tab and the Settings subtab.
  3. Click Advanced Settings, select Edit, and filter for threshold.
  4. Change the setting of vpxd.cert.threshold to the desired value and click OK.

Also make sure under Alarm settings – Certificate Status – Enable this alarm is active so that according to the threshold  we will get the alarm notification when the issue occurred.

Reference :

https://docs.vmware.com/en/VMware-vSphere/6.0/com.vmware.vsphere.security.doc/GUID-D3DB7279-0A25-4AA8-83A0-F34E5676A8B9.html

Posted in Certificate, ESX command, Replacing vCenter 6.0 SSL Certificate, Vcenter Appliance, vCSA 6.0, VCSA6.5, VMware, vSphere 6.0 Template. | Tagged , , , | 1 Comment