Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation
and Upgrade
NN42200-301
.
Document status: Standard
Document version: 01.02
Document date: 31 July 2008
Copyright © 2008, Nortel Networks
All Rights Reserved.
Printed in the United States of America.
The information contained in this document is the property of Nortel
Networks. Except as specifically authorized in writing by Nortel Networks, the holder of this document shall keep
the information contained herein confidential and shall protect same in whole or in part from disclosure and
dissemination to third parties and use same for evaluation, operation, and maintenance purposes only. Changes
or modifications to the Meridian SL-100 without the express consent of Nortel Networks may void its warranty
and void the user’s authority to operate the equipment.
Information is subject to change without notice. Nortel Networks reserves the right to make changes in design or
components as progress in engineering and manufacturing may warrant.
*Nortel Networks, the Nortel Networks logo, the Globemark, Unified Networks, DMS, MAP, Meridian, MSL, Nortel,
Northern Telecom, NT, SL-100, and SuperNode are trademarks of Nortel Networks.
Features 5
Other changes
5
Purpose 7
CS 2100 virus scanner overall strategy
7
Acquiring the anti-virus scanner package 9
Prerequisites 9
Procedure steps 9
Copying the anti-virus scanner package 9
Procedure steps 10
Installing the anti-virus scanner package 10
Procedure steps 10
Downloading virus definition files 11
Procedure steps 11
Executing anti-virus scanner software 14
Procedure steps 14
Removing the anti-virus scanner software 15
Procedure steps 16
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Contents
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
The following sections detail what’s new in
(NN42200-301) for release 9.1 (SE09.1):
"Features" (page 5)
"Other changes" (page 5)
There are no feature changes that affect this document for this release. This
is the first release of this document.
There are no other changes that affect this document for this release..
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
New in this release
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Unix and Windows STIG require Communication Server 2100 (CS 2100)
SE09.1 Federal system components to have a DoD approved anti-virus
program installed and run routinely to protect systems from virus infection.
The McAfee anti-virus command-line scanner v5.10 (scan engine v5.1.00) is
chosen by Nortel for this purpose. This document describes the Unix/Linux
installation and upgrade procedures of the McAfee anti-virus command-line
scanner for the CS 2100 SE09.1 Federal system.
The following is Nortel’s general strategy for the virus scanner.
The customer’s IS department is responsible for scanner installation
and to ensure virus definition files are up to date. Nortel is providing
these virus scanner installation/update instructions to the customer as a
general guideline. Nortel resumes no responsibility of supporting virus
scanner related problems or maintaining the up-to-date virus definition
files for the customer. Customers should contact virus scanner program
vendor (McAfee) directly for any scanner related questions or problems.
Nortel recommends customers to install the virus scanner to the
following CS 2100 SE09.1 Federal system components to mitigate the
JITC test findings. The following system components which are the only
ones that have new files generated/created are the only ones that need
a virus scanner installed for protection:
— CMT/IEMS (Solaris)
— CBM (Solaris)
— MG9K-EM (Solaris)
— STORM (Solaris)
Nortel suggests NOT to install and run the scanner directly on the
SAM21 Call Agent, Shelf Controller, CICM, or CICM-EM due to the
potential system performance and stability impact. Nortel recommends
running the scanner on STORM on behalf of Call Agent and Shelf
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Introduction
Controller since STORM serves as the central point for patches and
software distribution to these components.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
This chapter describes how to install anti-virus scanner software on the CS
2100 to protect the system from virus infection.
Download the anti-virus scanner package and burn it onto a CD-ROM.
Tested Hardware: Solaris 8 and Linux Red Hat 8
Tested Software Load: CS 2100 SN10
From a customers PC, download and save the platform-specific
scanner package (for example,
[for
Solaris] or
[for Linux]) that is licensed
by the customer.
After the scanner package is saved on the PC, burn it onto a
CD-ROM. The package contains all the virus scanner application
files, virus definition files and license file.
Copy the anti-virus scanner package onto the target system and untar it.
For duplex (HA) systems, put the scanner package on the "Active Unit".
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Installing the anti-virus scanner
Telnet to the active unit or access via a console port and login as
.
Insert the CD previously created into the CD-ROM drive and copy
the scanner package to the
directory.
where
refers to the target platform, either SunOS or Linux.
Change directory to
package).
and list the tar file name (scanner
Untar the software pacakge.
Install the anti-virus scanner package on the target system.
Change directory to
.
Nortel suggests installing the virus scanner into the default
directory (
) for every system but STORM.
For STORM, the suggested directory to install the virus scanner is
due to disk space concern.
Answer the prompts during the install as follows:
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Downloading virus definition files
Press
to use the default (
for most
systems) or specify a different installation directory (for example,
for STORM)
Download the latest virus definition files.
Change directory to the virus scanner’s installation directory.
or
for
STORM
Download the latest
file (virus definition file) by
entering the following URL in a web browser.
ftp://ftp.nai.com/pub/antivirus/datfiles/4.x
Use command line FTP with anonymous user login to
download the file.
For example:
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Installing the anti-virus scanner
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Downloading virus definition files
1340 delta.ini
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Installing the anti-virus scanner
The latest
file (where
are number digits)
contains the most recent virus definition files. Extract them using
the following command.
Execute the anti-virus scanner software on directories and files either
manually or automatically.
It is suggested to have at least 1GB disk space allocated to
to accommodate
virus report writing. Run the virus scanner manually the first time to assess the
disk space needed on
before automating this process as a cron job. Using
a directory other than
that has more than 1GB of disk space is another
alternative.
Run the following commands to manually execute the anti-virus
scanner.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Removing the anti-virus scanner software
The above command scans directory1, directory2, file1 and
file2 recursively in verbose mode (-rv), and outputs any error
messages and the scanner summary (-summary) report to
To automate the anti-virus scanner software, setup a cron job to
execute at a particular time.
The above command brings up the system default text editor [for
example, vi] for root to add a cron job.
The following example shows how to schedule the scanner to run
at 3:00 AM every Sunday to scan
then write its output,
error messages, and the summary report to
.
Running this at off-peak hours is highly recommended.
After adding the entry in the crontab file using the editor, save it and
verify it using the following command.
The newly added scanner entry should be listed in the output.
If this is a duplex (HA) system, follow the instructions in Nortel Installation Method
(IM) 24-0108 "IEMS CMT MG9KEM commissioning", Procedure 37 for HA Cluster
Replication. For more information, see "HA Cluster Replication (Cloning)" (page
19).
Remove the anti-virus scanner software by performing the following uninstall
procedure.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Installing the anti-virus scanner
Indicate active or inactive to uninstall scanner for an N240 HA
system. Then run the uninstall command.
and answer with "y"
After the scanner is uninstalled, perform steps for cloning the N240
HA system. For more information, see "HA Cluster Replication
(Cloning)" (page 19).
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
gives a list of all the available command-line options.
Try to download the scanner program again fresh and install it with all
the DEFAULT options. Check if a symbolic link is created afterwards in:
. If no
error during the installation and the symbolic link is created, then installation
is successful.
DoD requires the virus definitions to be no older than 14 days. Which
means virus definitions should be updated at least every 2 weeks. Follow
the procedure, "Downloading virus definition files" (page 11)to get the most
up-to-date virus definitions. McAfee releases a .tar file that contains most
recent virus definition files on a daily basis.
Yes, via the -v or -verbose command line option. The verbose output gives
all the filenames and their paths scanner scans.
No, there is no way to create a file with directories and filenames to scan
and pipe it to the scanner. Currently, only files or directories can be specified
at the command line. Also, the directory scan, scans all subdirectories and
files recursively (with the –r option), but it does NOT follow symbolic links.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Frequently Asked Questions
Scanner does not scan certain files. For example, unix/linux block, character
or FIFO special file are exempted from being scanned. An error message is
reported in verbose mode for those files. This is okay. If the virus definition
files are too old, an error message saying the program is xxx days/months
old is displayed which is a reminder to update the virus definition file.
If a virus-infected file is found, it is quarantined and removed from the
scanner. The summary report also reports the name and number of files
infected.
For example:
The above example tells that 26107 total files are scanned in
directory. 26104 out of them are clean files (no virus infected). Every file in
is scanned (Not scanned 0) and no viruses were found (Possibly
Infected 0). The discrepancy of 3 (26107-26104) means some of the files
were skipped from being scanned (for example, symbolic links, unix/linux
special files) which explains that one Non-critical Error(s).
Follow the new installation procedures described above to update the
scanner. Back up all the scanner program files first before upgrading. Be
sure NOT to remove any existing .dat files generated from the previous
installation, but DO allow new installation to overwrite the old files.
Yes, there is an internal Nortel tool called
which can be customized
for this purpose. However, it is the customer’s responsibility to write a tool
for automating this process.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
This section only needs to be completed on a HA Cluster configuration for
IEMS, CMT or MG9K EM. If only a simplex server configuration is installed,
ignore these procedures.
Ensure no provisioning activities are in progress, or are scheduled to take place
during this procedure. This includes Integrated EMS Security Administration
actions that involve changes to security database, for example, adding or
changing user account/group information.
Perform this procedure to complete the HA Cluster replication. A serial
console is required to perform this section. Also, Tera Term Pro installed
on a PC is required.
1
Telnet to Unit 0.
Login as
2
using password
.
Ensure all applications are running:
The exception is the IEMS-based server
application CEM for Packet MSC. PMSC
uses the CNM based CEM. The CEM, if
listed, should not be running. If CEM is
present and running, execute the servstop
CEM command to stop it and deregister
CEM.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Appendix HA Cluster Replication (Cloning)
3
Switch to unit 1. If this is a new install of the server or the existing server was powered
down to install IEMS on an existing CMT apply power to Unit 1 at the EBIP. Press the
power button on the front on Unit 1.
4
Once connected and the system is powered on (if currently off) use Tera Term Pro to
access the Unit 1 server.
Launch the emulation software and connect to the server.
Press
.
Press the
key in combination with the
Press the
key in combination with the
key.
key.
(example response) 5
Display the MAC Address for Unit 1.
6
Record the MAC address (Ethernet
address):
7
Leaving the Tera Term window connected
to
open. Open a new telnet session
to
. Login as
with password
.
8
Connected to
, switch to the root user.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Appendix
9
Connected to
process.
, start the cloning
10
Connected to
address of Unit 1.
, enter the MAC
HA Cluster Replication (Cloning)
Verify the MAC Address is correct before
hitting enter.
0:3:ba:28:2b:23
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Appendix HA Cluster Replication (Cloning)
11
At
12
Watch the console of
for the progress on the data replication. The imaging of unit 1
may take
depending on data and which applications are installed. At the
end unit 1 will reboot and become the "Stby" unit automatically.
13
After ~ 45 minutes you can check the status in the window to see if the replication is
to get the login prompt on both units.
complete -
14
Login to
of
.
as root and check the status
15
Login to
of
.
as root and check the status
16
Test the HA Cluster by performing the
following command on unit 0:
17
Login to
of
.
as root and check the status
18
Login to
of
.
as root and check the status
start the imaging process.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Appendix
19
HA Cluster Replication (Cloning)
Verify all applications are running on unit 1.
The exception is the IEMS-based server
application CEM for Packet MSC. PMSC
uses the CNM based CEM. The CEM, if
listed, should not be running. If CEM is
present and running, execute the servstop
CEM command to stop it and deregister
CEM.
20
Repeat the IEMS Application Verification
procedure to ensure you can access the
IEMS GUI.
21
Exit all windows.
22
End of Procedure.
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.
Appendix HA Cluster Replication (Cloning)
Communication Server 2100 Defense Switched Network
Anti-Virus Scanner Installation and Upgrade
NN42200-301 01.02 Standard
SE09.1 31 July 2008
Copyright © 2008, Nortel Networks
.