Endpoint Protection

Overview

The Symantec Endpoint Protection client for Linux provides Virus and Spyware protection and Auto-Protect features for supported Linux operating systems.

It can be deployed using the Web link and email or Save package method from the Symantec Endpoint Protection Manager. Two types of client setup packages can be imported into and exported from the SEPM:

• RPM (Red Hat, SUSE, Oracle, etc.)
• DPKG (Debian, Ubuntu, etc.)

The SEPM will add the sylink.xml and serdef.dat for the selected group to the install package and will compress all of the files into a single .zip (default compression format).

It can be updated from a LiveUpdate server (internal or external), or using the Intelligent Updater file.

The installation is now in the form of a single install script which can install all components on the client at once.

Note: You must have superuser privileges to perform the steps describe below on the Linux operating system.

Minimum System requirements

Hardware:

• Intel Pentium 4 (2 GHz) or higher processor
• 1GB of RAM
• 5 GB of available hard disk space

Operating systems:

• CentOS 6U4, 6U5; 32-bit and 64-bit
• Debian 6.0.5 Squeeze; 32-bit and 64-bit
• Fedora 16, 17; 32-bit and 64-bit
• Novell Open Enterprise Server (OES) 2 SP2 and 2 SP3 running SUSE Linux Enterprise Server (SLES) 10 SP3; 32-bit and 64-bit
• Novell Open Enterprise Server (OES) 11 and 11 SP1 running SUSE Linux Enterprise Server (SLES) 11 SP1 and SP2; 64-bit
• Oracle Linux 5U8, 5U9, 6U2, 6U4; 64-bit
• Red Hat Enterprise Linux Server (RHEL) 5U7 - 5U10, 6U2 - 6U5; 32-bit and 64-bit
• SUSE Linux Enterprise Server (SLES) 10 SP3, 10 SP4, 11 SP1 - 11 SP3; 32-bit and 64-bit
• SUSE Linux Enterprise Desktop (SLED) 10 SP3, 10 SP4, 11 SP1 - 11 SP3; 32-bit and 64-bit
• Ubuntu Server 11.10, 12.04, 12.04.2, 13.04; 64-bit
• Ubuntu Desktop 11.10, 12.04, 12.04.2, 13.04; 64-bit

For a list of supported kernels, see:

http://entced.symantec.com/sep/12.1.5/​doc_sep_linux_sys_req

Graphical desktop environments:

• KDE
• Gnome

Other environmental requirements:

• Oracle Java 1.5 or later; Java 7 or later recommended.
  This installation requires superuser privileges.
• Unlimited Strength Java Cryptography Extension (JCE)
  You must install the Unlimited Strength Java Cryptography Extension policy files to match your version of Java. This installation requires superuser privileges.
  You can download the installation files under Additional Resources from the following Oracle website:
  http://www.oracle.com/technetwork/java/javase/downloads/​index.html
• i686-based dependent packages on 64-bit computers
  Many of the executable files in the Symantec Endpoint Protection package are 32-bit programs. For 64-bit computers, you must install the i686-based dependent packages before you install the Symantec Endpoint Protection package.
  If you have not already installed the i686-based dependent, you can install them with the following command. This installation requires superuser privileges, which the following command demonstrates with sudo:
  sudo yum install glibc.i686 libgcc.i686 libX11.i686

Preparing the Linux operating system

Make sure to have the following files ready on the Linux system:

• UnlimitedJCEPolicyJDK7.zip
• SymantecEndpointProtection.zip

Make sure the Linux system meet the minimum requirements described above.

Installation steps

The client install package includes a pre-check to determine whether or not Oracle Java is installed, whether its version is equal to or greater than 1.5, and that the Java Cryptography Extensions (JCE) is installed. If any of these items fail the pre-check test, the installation will terminate. This check also determines whether or not Java is installed with root permissions and will result in a failure if it is not.

Proxy configuration

Troubleshooting

Command-line

Browse to /opt/Symantec/symantec_antivirus, and then run the desired command:

Management

• Import sylink communication settings file

sav manage -i [sylink.xml]

• Display current profile serial number

sav manage -p

• Display the current SEPM

sav manage -s

• Display the current group name

sav manage -g

• Invoke a heartbeat request to the SEPM

sav manage -h

• Display the current location name

sav manage -o

• Display the last connection time to the SEPM

sav manage -t

• Display the license status

sav manage -l

• Roll back definitions to the previous set (if one is available)

sav definitions -r

• Use the newest definitions

sav definitions -u

• Export client logs

sav log -e [file] -f <start_id> -t <end_id>

LiveUpdate

• Start LiveUpdate

sav liveupdate –u

Information

• Display the status of Auto-Protect

sav info -a

• Display the virus definitions version

sav info -d

• Display the current product version

sav info -p

• Display the current scan engine version

sav info -e

• Determine if a scan is in progress

sav info -s

Logs location

Installation log: /root

• sepfl-install.log
• sep-install.log
• sepap-install.log
• sepui-install.log
• sepjlu-install.log

LiveUpdate log : /opt/Symantec/LiveUpdate    

• liveupdt.log

Uninstallation steps

References

Supported Linux kernels for Symantec Endpoint Protection

http://www.symantec.com/docs/TECH223240

Intelligent Updater file for Symantec Endpoint Protection 12.1.5, see Unix Platforms

http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=sep

Related article

SEP 12.1 RU5 for Linux uses significant amount of memory
http://www.symantec.com/docs/TECH225299