My McAfee FRMP4.3 Notes

My McAfee FRMP4.3 Notes

- encrypts files on folders on local drives, network shares, removable media drives(eg: portable hard drive) via policies set in EPO

- depends on Windows credentials

- FRMP client installed on client machine, frmp sync (policies and encryption keys) with EPO server.

========================================================================
Steps to upgrade EEFF:
a) uninstall existing version.
b) install supported mcafe agent. (mcafee agent 4.8 / 5)
c) check mcafee agent communicates to epo server
c) use msiexec.exe /q /i eeff32.msi (for 32bit os) or msiexec.exe /q /i eeff64.msi (for 64bit os)
d) restart client machine
e) don't forget to check and test it works properly

========================================================================

How to move or migrate machines with installed FRMP from existing EPO server to another EPO server?
a) backup encryption keys and policy info
b) export encryption keys and policy info
Note: user domain and username do not change

In FRMP, it is like a persistent encryption engine. Eg: Even if move out of encrypted directory, file remains encrypted.

========================================================================

What are the Protection Level options available for Removable Media?

The available options are:

 Removable Media Policy is organized into two tabs:
- USB Media
- Floppy Disk Media

Options available for USB Media:
- Allow Unprotected Access
- Allow Encryption (with offsite access)
- Enforce Encryption (with offsite access)
- Enforce Encryption (onsite access only)
- BlockWrite Operations
NOTE: This option will restrict the USB devices to a read-only mode. (New FRP feature)

Options available for Floppy Disk Media:
- Allow Unprotected Access
- Block Write Operations

(From: KB81450)
========================================================================

FRMP Protection Options for usb devices:
- Use enforce encryption (onsite access only).
Example: Restrict access to encrypted usb devices within company's environment only.

-- No automatic decryption of existing files.
Example: If removable media device (eg: usb hard drive) has Enforce Encryption (onsite access only), data in usb device remains encrypted even disable it using policy to Allow Unprotected Access.

Remember FRMP is a persistent encryption engine.

--- To decrypt data in usb device, Key Field option = Decrypt
Changing policy to Allow Unprotected Access affects new devices (usb devices that not affected by Enforce Encryption (onsite access only) )

-- New files keep getting encrypted.

Problem Example: Disabling the enforce encryption (onsite access only) has no effect. New files still encrypted because encryption policy applied to usb device.
Workaround: To remove applied encrytion policy on removeable media, Key Field = Decrypt

-- Ignore existing content on media

Ignore existing content on media = Disabled,
Result - all existing files becomes encrypted (not ignored). This needs machines with

FRMP installed.

Ignore existing content on media = Enabled,
Result - Only new files are encrypted

- Use Allow encryption (with offsite access) or enforce enryption (with offsite access). Example: enable users to access encrypted usb devices on system without install mcafee encryption software

- Use enforce encryption (with offsite access).
Example: Copy a file to usb device only when encrypted, else, device is read only. If user managed option selected, files can copied only to encrypted portion of device.

- Block Write Operation option. Example: make usb sticks as read only.

========================================================================

Sharing with cd/dvd/iso

Enforce Encryption (onsite access only)
- burning applications
burning software should be supported else cd/dvd can be plaintext. See KB81450

- cd/dvd format limitation
cd/dvd media should be supported. See KB76478

========================================================================

FRMP Encryption
- policy driven
Example: Enforce encryption of a folder (or serveral folders) by specifting location and encryption key (or corresponding encryption keys) for that folder.

- user driven
Example: users can selectively encrypt or decrypt folders. Explicit Encrypt and Explicit Decrypt made enabled.

========================================================================

Removing a folder encryption policy - it does not decrypt content of that folder.
Problem Example: Removing a folder encryption policy - it does not decrypt content of that folder.
Workaround: Specifiy policy pointing to folder location. Encryption key field = Decrypt

========================================================================

Encrypted parent folder - decrypted subfolder

Default setting - all subfolder in a folder that is "encrypt" also encrypted. Follows inheritance.

Problem Example:
Parent Folder (Properties - encrypted)
- Sub Folder (Properties - decrypted)

Solution: Use decrypt option

========================================================================

Encryption Keys

Regular and user personal keys
- Recommend deactivate keys instead of deleting keys. Deleted key cannot be restored.

User personal keys
- Administrator can create unique keys for users
- can referenced in Grant Key policy generically (as single key) and create unique keys for users

Use personal keys and multiple EPO db
- Not recommended.
- Recommended for user register with one 1 EPO and gets policies and key from that EPO

========================================================================

User local keys
- local key limited to user and client machine where it was created


user local keys vs user personal keys
- user manually created (user) local keys on their local machines and share via export and import processes.
- user local keys NOT uploaded to EPO db and not transfer to user to other machines via default frmp
- Administrator create unique keys for users for user personal keys in EPO








References:
- KB81450
- FRMP4.3 Best Practice Guide




- wong chee tat :)

Recap: Agent Handlers in an enterprise network

In this figure, all Agent Handlers:
• Are connected to the McAfee ePO SQL database using low-latency high-speed links
• Are located close to the clients they support
• Have failover configured between Agent Handlers in other cities
• Are managed from the McAfee ePO server
The Agent Handlers in these cities have specific configurations.
• Dallas — The Agent Handler is configured with failover support to the Agent Handler in Los
Angeles.
• Los Angeles — The two Agent Handlers have load balancing configured.
• Washington DC — The Agent Handler uses specific ports to connect to the McAfee ePO server
from behind a firewall.


Notes:
Agent Handlers distribute agent-server comms by directing managed systems (client machines) to report to agent handler (AH) instead of epo server

AH should NOT used as:
- distributed repo. repo distribute large files (Think of newer DAT files, product updates, etc). AH use logic to communicate events back to db. These events tell mcafee agent to download new products from distributed repo. AH cache files from distributed repo but should NOT replaced distributed repo.

- slow or irregular links.

AH Functions:
1) use work queue as primary communication mode
2) check server every 10s & perform requested action eg: agent wakeup calls, product deployment, data channel messages
3) communicate with each other , for load balancing and failover

Roaming with AH:
- users roam between different sites connect to nearest AH. possible if all locations configured in mcafee agent failover list.

Repo caching
- AH cache content and product updates if mcafee agent can't access content from master repo on epo server

Q: How much bandwidth is used for communication between the database and the Agent Handler?

A: Bandwidth between the Agent Handler and the database varies based on the number of agents
connecting to that Agent Handler. However, each Agent Handler places a fixed load on the database server for:
• Heartbeat (updated every minute)
• Work queue (checked every 10 seconds)
• Database connections held open to the database (2 connections per CPU for EventParser plus 4 connections per CPU for Apache)

Q: How many agents can one Agent Handler support?

A: Agent Handlers for scalability are not required until a deployment reaches 100,000 nodes. Agent Handlers for topology or failover might be required at any stage. A good rule is one Agent Handler per 50, 000 nodes.





- Ref: ePolicy Orchestrator 5.1.0 Best Practices Guide - Rev B


- wong chee tat :)

KB66797: Ports needed by ePolicy Orchestrator for communication through a firewall

Ports needed by ePolicy Orchestrator for communication through a firewall

Technical Articles ID:  KB66797 Last Modified:  12/10/2015 Environment McAfee Agent (MA) 5.x, 4.x McAfee ePolicy Orchestrator (ePO) 5.x, 4.x Summary The following tables display the ports needed by ePO for communication through a firewall. For the purpose of this article: Bi-directional means that a connection can be initiated from either direction. Inbound means the connection is initiated by a remote system. Outbound means the connection can be initiated by the local system. Port Default Description Traffic direction Agent-server communication port 80 TCP port that the ePO server service uses to receive requests from agents. Inbound connection to the Agent Handler and the ePO server from the McAfee Agent. Inbound connection to the ePO server from the remote Agent Handler. Agent-server communication secure port Software Manager, Product Compatibility List, and License Manager port 443 TCP port that the ePO server service uses to receive requests from agents and remote Agent Handlers. TCP port that the ePO server's Software Manager uses to connect to McAfee. TCP port that the ePO server uses to connect to the McAfee software updates server (s-download.mcafee.com), McAfee license server (lc.mcafee.com), and McAfee Product Compatibility List (epo.mcafee.com). Inbound connection to the Agent Handler and the ePO server from the McAfee Agent. Inbound connection to the ePO server from the remote Agent Handler. Outbound connection from the ePO server to McAfee servers. Agent wake-up communication port SuperAgent repository port 8081 TCP port that agents use to receive agent wake-up requests from the ePO server or Agent Handler. TCP port that the SuperAgents configured as repositories that are used to receive content from the ePO server during repository replication, and to serve content to client machines. Inbound connection from the ePO server/Agent Handler to the McAfee Agent. Inbound connection from client machines to SuperAgents configured as repositories. Agent broadcast communication port 8082 UDP port that the SuperAgents use to forward messages from the ePO server/Agent Handler. Outbound connection from the SuperAgents to other McAfee Agents. Console-to-application server communication port 8443 TCP port that the ePO Application Server service uses to allow web browser UI access. Inbound connection to the ePO server from the ePO console. Client-to-server authenticated communication port 8444 TCP Port that the Agent Handler uses to communicate with the ePO server to get required information (such as LDAP servers). Outbound connection from remote Agent Handlers to the ePO server. SQL server TCP port 1433 TCP port used to communicate with the SQL server. This port is specified or determined automatically during the setup process.  Outbound connection from the ePO server/Agent Handler to the SQL server. SQL server UDP port 1434 UDP port used to request the TCP port that the SQL instance hosting the ePO database is using. Outbound connection from the ePO server/Agent Handler to the SQL server. LDAP server port 389 TCP port used to retrieve LDAP information from Active Directory servers. Outbound connection from the ePO server/Agent Handler to an LDAP server. SSL LDAP server port 636 TCP port used to retrieve LDAP information from Active Directory servers. Outbound connection from the ePO server/Agent Handler to an LDAP server. SMB Windows domain controller port 445 TCP port used for ePO console login when authenticating Active Directory users. Outbound connection from the ePO server to the domain controller (Active Directory) server. ePO (Ports/Traffic Quick Reference) ePO Server Default port Protocol Traffic direction 80 TCP Inbound connection to the ePO server 389 TCP Outbound connection from the ePO server 443 TCP Inbound/outbound connection to/from the ePO server 445 SMB Outbound connection from the ePO server 636 TCP Outbound connection from the ePO server 1433 TCP Outbound connection from the ePO server 1434 UDP Outbound connection from the ePO server 8081 TCP Outbound connection from the ePO server 8443 TCP Inbound connection to the ePO server 8444 TCP Inbound connection to the ePO server Remote Agent Handler(s) Default port Protocol Traffic direction 80 TCP Inbound/outbound connection to/from the Agent Handler  389 TCP Outbound connection from the Agent Handler 443 TCP Inbound/outbound connection to/from the Agent Handler 636 TCP Outbound connection from the Agent Handler 1433 TCP Outbound connection from the Agent Handler 1434 UDP Outbound connection from the Agent Handler 8081 TCP Outbound connection from the Agent Handler 8443 TCP Outbound connection from the Agent Handler 8444 TCP Outbound connection from the Agent Handler McAfee Agent Default port Protocol Traffic direction 80 TCP Outbound connection to the ePO server/Agent Handler 443 TCP Outbound connection to the ePO server/Agent Handler 8081 TCP Inbound connection from the ePO server/Agent Handler. If the agent is a SuperAgent repository, inbound connection from other McAfee Agents. 8082 UDP Inbound connection to agents. Inbound/outbound connection from/to SuperAgents. 8083 UDP Relay server discovery for version 4.8 agents SQL Server Default port Protocol Traffic direction 1433 TCP Inbound connection from the ePO server/Agent Handler 1434 UDP Inbound connection from the ePO server/Agent Handler McAfee Updates Default port Protocol Traffic direction 21 TCP Outbound from the ePO server to ftp://ftp.nai.com 80 TCP Outbound from the ePO server to http://update.nai.com 443 TCF Outbound from the ePO server to s-download.mcafee.com and epo.mcafee.com NOTE: These URLs are not accessible in browsers.

- wong chee tat :)

Agent Handlers in an enterprise network

In this figure, all Agent Handlers:
• Are connected to the McAfee ePO SQL database using low-latency high-speed links
• Are located close to the clients they support
• Have failover configured between Agent Handlers in other cities
• Are managed from the McAfee ePO server
The Agent Handlers in these cities have specific configurations.
• Dallas — The Agent Handler is configured with failover support to the Agent Handler in Los
Angeles.
• Los Angeles — The two Agent Handlers have load balancing configured.
• Washington DC — The Agent Handler uses specific ports to connect to the McAfee ePO server
from behind a firewall.





- Ref: ePolicy Orchestrator 5.1.0 Best Practices Guide - Rev B


- wong chee tat :)

19th April 2016 - EPO Notes

19th April 2016 EPO Notes:

repository or repo:
- contain security software packages and updates to distribute to clients (simply think of repo contains latest software updates and provides to client machines)
- types:
master repo (contain latest versions and for distribution = ePO Server)
distributed repo (contain copies from master repo's data. Think of it as local mirrors )

distributed repo mini system config:
- 800MB disk space
- 256MB ram (mini)

types of distributed repo
- superagent repo (system hosting superagents as distributed repo. mcafee agent must be installed)
- ftp repo (ftp server as repo)
- http repo (http server as repo)
- unc share repo (shared folder as repo)

replication
- automatically when global updating enabled
- running schedule replicate task automatically or manually

agent handlers
- reduce load on epo server, saving bandwidth
- move agent request closer to the requester systems

mcafee agent communicate with epo server so that settings are updated, events sending, etc. The communication is known as agent-server communication

superagent - an agent acts as a middle man between epo server and other agents in the same network broadcast segment

function of superagent -
1) caching info received from epo server or distributed repo and then distributes to agents in the network subnet. using lazy caching, superagents get data from master repo only when requested, thus saving bandwidth

2) broadcast wakeups calls to other agents


- Ref: McAfee ePolicy Orchestrator 5.1.0 Software Product Guide

- wong chee tat :)

09th Nov 2015 ePO Notes

09th Nov 2015 ePO Notes

- ePO 4.6 no support win 2012 and win 2012r2 server

- ePO 5.0 no support win 2012 r2

- ePO 5.1 / 5.3 support win2012 r2

source: KB51569

- EPO5.3.1.188 (release on 28th sept 2015)

- EPO5.3.0.400 (release on 19th may 2015)

source: KB59938

- EPO 4.6  no support SQL Server 2014 and SQL Server 2014 express

- EPO 5.0 support up to SQL server 2012
- EPO 5.1 support up to SQL server 2012
- EPO 5.3 support up to SQL server 2014

source: KB51569

- ePO server -> master repository (1 master in each ePO server)

- maintains latest versions of security softwares & updates

- link location: (\DB\software)

SITEMGR.XML file:

- Back up & restore distributed repo & source sites if need to reinstall the server

- Import distributed repo & source sites from a previous ePO install

mcafee agent

- client component providing secure comms between products and epo server

- size est 6.30MB (framepkg.exe)

- agent GUID 64 bit unique id generated during first startup of the framework service





- wong chee tat :)

Nov 04th 2015 ePO Notes

Nov 04th 2015 ePO Notes

- ePO - manage security for systems, networks, data and compliance solutions

- agent gets updates (policy, config, software deployment, etc) from ePO server and push to client machine. Also updates epo server of any issues (reporting)

- agent handler communicates apache service via default port 80 or 443 (changed be changed). connection secured via 168 bit 3DES encryption.

- apache support max 250 concurrent connections and try alternative agent handlers, else, queue max 50

- policies cached in RAM by agent handler

- super agent => agent + ability to contact all agents in same subnet.

- epo server talks to sql db only and not epo console, reducing sql connections, complexity and easier troubleshooting

- The Remote Agent Handler is basically Apache and Event Parser, excluding Tomcat and db

- cannot change client to server authenticated communication port after install

- cannot change sql server tcp port after install

- db size = installed db size + (no of client machines x size of client system properties) + (no. of events generated x event size)


- wong chee tat :)

My notes on McAfee EPO

My notes on McAfee EPO

- ePO - ePolicy Orchestrator

- ePO - manage security for systems, networks, data and compliance solutions

- agent gets updates (policy, config, software deployment, etc) from ePO server and push to client machine. Also updates epo server of any issues (reporting)

- agent handler communicates apache service via default port 80 or 443 (changed be changed). connection secured via 168 bit 3DES encryption.

- apache support max 250 concurrent connections and try alternative agent handlers, else, queue max 50

- policies cached in RAM by agent handler

- super agent => agent + ability to contact all agents in same subnet.

- epo server talks to sql db only and not epo console, reducing sql connections, complexity and easier troubleshooting

- The Remote Agent Handler is basically Apache and Event Parser, excluding Tomcat and db

- cannot change client to server authenticated communication port after install

- cannot change sql server tcp port after install

- db size = installed db size + (no of client machines x size of client system properties) + (no. of events
generated x event size)


- wong chee tat :)