Manually installing sophos

[_Bat_]

G'morning,

 

We run sophos enterprise manager which obviously allows us to remotely install the client A/V program remotely across the network to all the client machines. The issue I have at the moment is that some machines end up in the section of "computers that need manual installation" even though there is no reason they should. I had a laptop yesterday that ended up in there because the firewall was enabled, but after disabling it, it still remained in there almost as if sophos had cached it. All computers run windows 2000 pro SP4 or WinXP pro SP2 so there really should be no reason.

 

Does anyone know why it would do this and if not, where is the location of the file to manually install sophos? I wasn't left with any documentation about this.

 

Thanks

 

James

[Geoff]

On XP machines, make sure simple file sharing is disabled. Some of the patches re-enable it, causing problems in a domain environment.

[plexer]

server it is installed on should have a share called interchk

 

You need to run \\servername\interchk\esxp\setup.exe

 

Ben

[Nij.UK]

The location of the install to manually install the client is

 

Program Files\Sophos SWEEP for NT\ESXP

[steve]

Check the time and date on the laptop, we've had issues with sophos when the server and laptop aren't the same.

[_Bat_]

Check the time and date on the laptop, we've had issues with sophos when the server and laptop aren't the same.

 

This is probably the reason, i'll look into that. Thanks.

 

Thanks for the file location as well.

 

Just one more question now regarding security... I'm assuming it would be considered insecure to use the domain admin account as the account sophos uses to update? I don't know how this could be exploited, but something tells me it's not good. If so, should I have created a separate account for sophos updates and what permissions does that account need?

 

Thanks.

[riedquat]

yep, using the domain login account is not a good idea as although the password is stored as an encrypted hash in the config files on the local machine, it's not inconceivable that this could be cracked given enough time and resources. Using a specific update account (such as EMLIB as described in the network install guide) which only has access to the install shares is preferred method.

[Geoff]

Sophos Autoupdate uses the standard windows 'password' GUI control for the password in the update dialog. Any of the hundreds of 'password revealer' tools floating around the internet will show it in clear text.

[_Bat_]

Using a specific update account (such as EMLIB as described in the network install guide) which only has access to the install shares is preferred method.

 

Can you give me any more information on this and/or point me towards to network install guide? What Geoff said made me nervous

[Grommit]

server it is installed on should have a share called interchk

 

You need to run \\servername\interchk\esxp\setup.exe

 

Ben

 

After you have done this you have to go to the Command Consol and find the PC, Add the PC to the group and then update for your Antivirus to work as the manual installation is not fit for purpose.

 

I was happy with the new Sophos.. but now after 3 days of struggling to get it on 500PC i am tearing my hair out..

 

you set it to delete any virus.. but when it detects a virus it does nothing.. even tho the group settings says delete..

 

It's not installing on half of my PC's

 

You can only install on 15 PC's at a time of the installation crashes..

 

rant rant rant..

 

Dunno what remote registry settings are and if they are off or on

 

rant rant rant.

 

Had a perfectly working Sophos AV ver 4 last week... now chaos

 

Have to go round to hundreds of PC's and take off simple file share..

 

Rant rant rant

[riedquat]

Basically you need to create a new account called EMLIB in your active directory and give it read permissions to the server share containing your sophos central installation directory (CID) which by default is \\servername\Interchk\ESXP

 

Then in your update policy (created and configured in Enterprise Console) you use this account for your autoupdate credentials, using \\domain\EMLIB as the account name and \\servername\Interchk\ESXP as the update address.

 

This way, when your client machines connect to retrieve thier sophos updates, the access the network using an account with very limited permissions. Should the password for the account be discovered, they can only gain read access to the CID.

 

If you really do have a need to use an account with higher privledges, the EM Library comes with a tool called ObfuscationUtil.exe which can be used to hide the update details from casual view should anyone look at the configuration options http://www.sophos.com/support/knowledgebase/article/13094.html

 

All of the installation documentation including network configuration and deployment guides can be found in the documentation section of the sophos website, http://www.sophos.com/support/docs/

[Grommit]

Using a specific update account (such as EMLIB as described in the network install guide) which only has access to the install shares is preferred method.

 

Can you give me any more information on this and/or point me towards to network install guide? What Geoff said made me nervous

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=6667&postdays=0&postorder=asc&start=0

 

There is a Link to the Network Guide..

[_Bat_]

Thanks for the help, i'll make sure I do that first thing tomorrow along with my other pile of work that I'm always "getting around" to.

[john]

@mattx, completly agree with you, I loved Trend when I evaluated it, but at the end of the day its cost and when its a MAJOR (being many many thousands of pounds) more than Sophos its never going to win.

 

I have been having joys with EMLib these last few weeks, got V5 an V6 together on it to allow me to move over certain machines and leave others on V5 etc, but its not good at all

[Grommit]

Thanks for the help, i'll make sure I do that first thing tomorrow along with my other pile of work that I'm always "getting around" to.

 

Tomorrow... !?! it's gonna take a week

[srochford]

Just think, all that just to install a AV !! Just shows what a load of shit Sophos is.

I remember installing Officescan from a web page over 4 years ago and pushing out Officescan without any problems at all.

How anybody can sing Sophos's praises is beyond me. Cheap and shit.

 

What's that saying about workmen and blaming tools :-)

 

Sophos is different from other virus scanners (just as McAfee is different; Symantec is different etc etc). If you work out how to use it then (IME) it works well.

 

Use the EM to push out the software is OK but it doesn't scale and (crucially) it won't install it on any new machine until you run a discovery.

 

We run this command as part of a startup script if Sophos isn't installed:

\\server\InterChk\ESXP\Setup.exe -updp "\\server\InterChk\ESXP" -user domain\sophosinstaller -pwd secretpassword -mng yes

 

This makes sure that Sophos gets installed and will be managed; the user "sophosinstaller" has to have access to the network share and needs to be able to install software on machines.

 

the only problem is that the computers end up in the unassigned group. You can either manually move them or just change the SQL database. (I use SQL profiler to help with things like this - turn it on, make the change with the GUI and find out what's actually happening)

 

If you have an existing virus scanner then you have to remove it before Sophos will install. Sophos have a product called Lancet (I think it's free) which can do this but it failed a few times for us. If you're running McAfee then I have a script which does a brute force remove of the product including all files and registry keys which I'm happy to share.

 

As a final point, I've found Sophos support to be very good.

[chrbb]

When you say that the domain password can be 'worked out' from the config on the workstations that would only apply to domain users wouldn't it not from outside the domain. I've used the domain admin and password on one setup, I'm hoping that as it's a primary school we won't have budding hackers! is there any way of changing it after installation?

[john]

Well my issues seem a bit better at last, seems that the EM Library download schedule was damaged, a new one fixed that and the removal of a file to make sure it had gone.