LevelBlue Knowledge Base » Knowledgebase » Legacy Products » DLP

DLP Discover 6.4 release

Andrew Davies — Mon, 13 Mar 2017 13:48:06 GMT

This article applies to:

DLP Discover

Information:

Trustwave DLP Discover v6.4 is now available.

This release of DLP Discover provides expanded repository scanning, remediation, and credit card BIN list capabilities along with improved agent functionality.

Expanded Repository Scanning

The following cloud services are now supported as targets in Scanner scan policies.

Dropbox Business
Google Drive and Gmail
Microsoft Office 365 Exchange (using on premise or Azure Active Directory)
Microsoft Office 365 SharePoint

Enhanced Remediation

Manual remediation is now available for Scanners with policy-based remediation rules and protection policy rules, providing more remediation flexibility. DLP Discover console administrators can now manually delete remediated risk events detected by an agent after a scan.

Improved Credit Card BIN Settings

Users can now specify the lengths of credit card numbers in a scan policy’s "Include BIN" list for better coverage of card types.

Agent Host Information

DLP Discover agents collect and report local host system resource and version information to the Console for improved host scan debugging.

For full details, see the DLP Discover v6.4 Release Notes and related documentation.

The software is now available on the production DLP Discover software distribution server (for automatic updates). Documentation is now available on the support portal.

Changing the UI timeout value

Andrew Davies — Wed, 11 Jan 2017 12:27:21 GMT

This article applies to:

DLP Versions up to 9.7.1

Question:

How can I change the timeout value of the Browser UI, or set it to never time out?

Procedure:

The timeout is configurable.

Note: In a collector/console configuration, only make changes on the console.

To set the timeout

Change timeouts for both tomcat and josso.

The tomcat timeout can be changed in:
/opt/tomcat/webapps/aup-reports/WEB-INF/web.xml

For version 9.1.0-3 use:
/opt/tomcat/webapps/josso/WEB-INF/classes/josso-gateway-config.xml.ldap
/opt/tomcat/webapps/josso/WEB-INF/classes/josso-gateway-config.xml.jdbc

The line default is:
<session-timeout>28</session-timeout>

You can change it to any value you like. The time is in minutes.
The josso timeout can be changed in:
/opt/tomcat/webapps/josso/WEB-INF/classes/josso-gateway-config.xml

The line default is: <maxInactiveInterval>30</maxInactiveInterval>

Important Note: the josso timeout must be greater than the tomcat timeout.
Restart tomcat.

To turn off the timeout

Edit the tomcat configuration file(s) and change the 'session-timeout' to 0. The container ensures the default behavior of sessions is never to time out when it is set to 0.
Edit the josso configuration file and change the 'maxInactiveInterval' to -1.
Restart tomcat.

Removing and Replacing the APEDB

Andrew Davies — Wed, 28 Dec 2016 18:25:05 GMT

This article applies to:

DLP Protect Email

Question:

How do I remove and replace the APE DB?

Background:

The Console shows errors in /var/log/messages about the APEDB or the APESVC that indicate the service cannot start.

Procedure:

Stop services. On the Console, enter the following commands:

service namesvc stop
service apesvc stop
service cfgsvc stop
Delete the files related to the database:

rm -rf /opt/vericept/var/apedb/*
rm -rf /opt/vericept/var/aperesults/*
rm -f /opt/vericept/var/ns.db
rm -f /opt/vericept/var/tmp/cfg_ior_repository.txt
rm -f /opt/vericept/var/tmp/interceptor_ref.cache
Start the services that were stopped and restart the Vericept service:

service namesvc start
service apesvc start
service cfgsvc start
service vericept restart
On each Protect device, restart services:

service ecsd restart
service cachemgr restart
service vericept restart
Test the Reconsider function.

Notes:

If you have questions or concerns about this procedure, contact Trustwave TAC.
This process often leaves Events in an unexpected state, and they cannot be acted on or archived. If this problem occurs, contact TAC for assistance.

Using other SQL versions for the Trustwave Discover database

Andrew Davies — Thu, 07 Jul 2016 18:08:55 GMT

This article applies to:

DLP Discover 5.x and greater

Question:

Which is the best database to use with Discover?
I experienced corruption in the Scan database. Do I have any other database software options?

Response:

Discover 5.x and earlier uses the Microsoft SQL Compact database engine for the Scan database. Occasionally the Compact database experiences corruption.

As of V6.0 the Compact engine is no longer supported and a new version of SQL must be installed and used.

Discover can also use other Microsoft database server software, including free and licensed versions. If you experience corruption with the default compact engine, you may wish to install a different version.

Supported Database Software

Trustwave Discover supports connecting to the following databases and inherits their known limitations.

The most important limitation with regard to Discover is the maximum database size.

Microsoft SQL Server Compact 4.0 supports a maximum database size of 4 GB.
Microsoft SQL Server Express 2008 supports a maximum database size of 4 GB.
Microsoft SQL Server Express 2008 R2 supports a maximum database size of 10 GB.
Microsoft SQL Server Express 2012 supports a maximum database size of 10 GB.
Microsoft SQL Server 2008 Standard, 2008 R2, and 2012 Standard (Licensed versions) do not have an artificial limit on database size. These versions require a paid license from Microsoft.

Discover 6.1 supports SQL Server 2014.

Procedure:

To install SQL Express (free versions of SQL Server) and configure Discover to use it:

To install a better SQL Server database:
1. Choose a SQL Server version:
  - SQL Server 2012 Express: https://www.microsoft.com/en-us/download/details.aspx?id=29062
  - SQL Server 2014 Express: https://www.microsoft.com/en-us/download/details.aspx?id=42299
  - On either page, click Download.
2. Select a download based on whether the system is 64-bit or 32-bit:
  - ENU\x64\SQLEXPRWT_x64_ENU.exe
  - ENU\x86\SQLEXPRWT_x86_ENU.exe
  - The "WT" downloads ("with tools") include the Management Studio for troubleshooting
3. Download, and run the installer. You can accept default settings.
Configure Discover to use the SQL Server to store its database instead of the default compact SQL server
1. In the Discover interface, navigate to “Settings | Scan Storage”
2. Click Scan Database Connection
3. Select SQL Server Express 2012 (or 2014) from the Type dropdown
4. The Server name will pre-populate with <Local System Name>\sqlexpress . If you used a different name for the instance when installing SQL Express, enter it.
5. Select Use Windows Authentication unless you chose to enable SQL Server Authentication during the installation.
6. Click OK.
Discover will then restart to complete this configuration change.

Notes:

If you experience database corruption, please open an issue in the Trustwave TAC portal https://login.trustwave.com/

Login unsuccessful. An internal error was encountered.

Andrew Davies — Fri, 01 Jul 2016 13:34:47 GMT

This article applies to:

DLP 9.6.x
The concepts presented may work for other versions

Symptoms:

Failure at first login
Error : Login unsuccessful. An internal error was encountered. Please refer to the Vericept log file for more information.

Resolution:

To resolve this issue, check the hostname in all the places it is configured.

The hostname MUST be the FQDN (fully qualified domain name) of the server.

Follow all steps even if you don't find any errors with the hostname.

Make sure that you are logged in as the root user or have root privileges.

1. Check the ‘hostname’

# hostname
7-37-con-93.dentac.trustwave.com
root@7-37-con-93:~
# hostname -f
7-37-con-93.dentac.trustwave.com

If the hostname is not the FQDN of the server, set it to the FQDN using the following command:

# hostname <FQDN>

2. Check/etc/sysconfig/network

Check for both HOSTNAME and DHCP_HOSTNAME

# cat  /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=7-37-con-93.dentac.trustwave.com
NETWORKING_IPV6=no
GATEWAY=10.40.209.12

If you need to make changes in this file, edit it using vi:

# vi /etc/sysconfig/network

3. Check/etc/sysconfig/network-scripts/ifcfg-eth0

Check for both HOSTNAME and DHCP_HOSTNAME

# cat /etc/sysconfig/network-scripts/ifcfg-eth*

If you need to make changes in this file, edit it using vi:

# vi /etc/sysconfig/network-scripts/ifcfg-eth0

4. Check /etc/hosts

The below example shows a correct entry for the host "7-37-con-93" in domain "dentac.trustwave.com":

cat /etc/hosts
#<IP ADDRESS>   <FQDN>    <shorthostname>
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1      localhost.localdomain               localhost
::1            localhost6.localdomain6             localhost6
192.168.1.31   7-37-con-93.dentac.trustwave.com    7-37-con-93

If you need to make changes in this file, edit it using vi:

#vi /etc/hosts

5. Recreate the SSL Certificates and reset Josso.

Below is an example of the procedure to generate self-signed SSL certificates from a root prompt:

#cert-regen
Re-generating system SSL certificates...
The following information will be used to locally generate security certificates for this system and no information will be sent to Trustwave. The information supplied can be viewed by users who have access to the Trustwave device.
Enter your email (e.g. "support@trustwave.com"): <email>
Enter your organizational unit (e.g. "Information Security"): <org>
Enter your country (e.g. "US"): <CO>
Enter your locale (e.g. "Denver"): <City>
Enter your organization (e.g. "Trustwave Corp."): <Company>
Enter your state (e.g. "Colorado"): <State>
Re-generating...
https:80, 443
SSL Certificate Generation
Note: A self signed certificate will be generated automatically if you do
not provide one, but this may cause warnings in your web browser.
Do you have a signed ssl certificate for use with this device? [y/N] n

maggd client
maggd server
management server
management client
Updating trusts...
Re-generation of SSL certificates complete.
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
Stopping postdblogger: [ OK ]
Stopping dblogger: [ OK ]
Stopping maggd: [ OK ]
Stopping indexd: [ OK ]
Stopping indexqd: [ OK ]
Stopping dsd: [ OK ]
Starting dsd: [ OK ]
Starting indexqd: [ OK ]
indexqd is already running.
Starting indexd: [ OK ]
Starting maggdctl: maggd started [ OK ]
Starting dblogger: [ OK ]
Starting postdblogger: [ OK ]
Stopping tomcat-dlp: [ OK ]
Starting tomcat-dlp: [ OK ]

root@7-37-con-93:~# configure-josso.pl -r

Single Sign-On Authentication Configuration

Josso Configuration Recovery - now restoring configuration files back
to original configuration.

rm /etc/httpd/conf/httpd.conf.prev
mv /etc/httpd/conf/httpd.conf.orig /etc/httpd/conf/httpd.conf
rm /opt/tomcat/conf/server.xml.prev
mv /opt/tomcat/conf/server.xml.orig /opt/tomcat/conf/server.xml
rm /opt/vericept/josso-agent-config.xml.prev
mv /opt/vericept/josso-agent-config.xml.orig/opt/vericept/josso-agent-config.xml

What is your company's top or root domain name for this system?
(for example: vericept.com or vericept.com.US
please do not include any subdomain name such as denver.vericept.com)
Top or root domain name => dentac.trustwave.com
You have entered [dentac.trustwave.com]. Is this correct? [y/N] y

What is the fully qualified domain name for this system?
(for example: collector1.vericept.com or console.denver.vericept.com)
Fully qualified domain name [7-37-con-93.dentac.trustwave.com]=>
You have chosen the default value[7-37-con-93.dentac.trustwave.com]. Is this correct? [y/N] y

What is the fully qualified domain name of the authentication server?

(If this machine is a standalone Vericept system, it would be the
hostname of this system. The same should be used if this is the
console in a cluster configuration.
If this is a collector for a
cluster, it will usually be your console system. However, you can enterthe
FQDN of this collector if it is out of the scope or a satellitecollector, i.e.
the collector is in a different top/root domain from the console.)
Authentication server [7-37-con-93.dentac.trustwave.com] =>
You entered '7-37-con-93.dentac.trustwave.com' - is this correct? [y/n]y
Verifying SSH connectivity to 7-37-con-93.dentac.trustwave.com ... okay.
Stopping httpd:[ OK ]
Starting httpd:[ OK ]
Deleting old certificate entry for 'VericeptConsole' alias ... done.
This machine is a server - importing certificate from
/etc/httpd/conf/server.crt
Certificate was added to keystore
[Storing /usr/lib/jvm/jre/lib/security/cacerts]

Will User Authentication be done using
[1] A Database server (Note: it must be already configured forJosso support)
[2] An Active Directory server

Authentication type [1 or 2] => 1

Loading setting defaults for reviewer database from existing
Vericept product configuration (/opt/vericept/etc/vconfig.xml).

# configure-services.pl
Web Services Configuration

Device role: master
FQDN from JOSSO: 7-37-con-93.dentac.trustwave.com
Setting service host: 7-37-con-93.dentac.trustwave.com

service tomcat6 restart
Stopping tomcat6: [ OK ]
Starting tomcat6: [ OK ]

Notes:

If you have any issues while following the above procedures, collect the logs and create a case with TAC.

Collecting Logs

The following command gathers the logs required. Note that this is a single command line wrapped with the \ character for readability.

tarczvf /home/vericept/$(hostname)_$(date '+%F').tar.gz \
/etc/sysconfig/ \
/etc/resol* \
/etc/host* \
/opt/vericept/var/tmp \
/opt/vericept/var/log \
/opt/vericept/var/aperesults \/opt/vericept/var/emailcontrol \ 
/opt/vericept/etc \
/var/log \
/opt/tomcat/logs \
--exclude "opt/vericept/etc/reporting" \
--exclude "/opt/vericept/var/log/mrm" \
--exclude "/opt/vericept/etc/VF6" \
--exclude "/opt/vericept/etc/webapps" \
--exclude "/opt/vericept/etc/db" \
--exclude "/opt/vericept/var/tmp/pem" \
--exclude "/opt/vericept/var/archives" \
&& echo . && echo "The File Is At" && echo $(ls/home/vericept/*.tar.gz) 

Scanning files on a SCP server or Linux share

Andrew Davies — Tue, 29 Mar 2016 14:49:34 GMT

This article applies to:

Trustwave DLP Discover 2.x through 5.1 only
For version 6.0 see the note below

Question:

I have files on a Linux share; how do I scan them?
I have files that I can only reach via SCP; how can I scan them?

Procedure:

You can run a Discover scan on a Linux machine via SSH/SFTP.

To do so, you can use a third party tool called SFTP Net Drive tool.

You can use this tool to create the SFTP connection between your Windows machine and the Linux server.

By default, the Net Drive tool creates a Z: drive.

On the Linux machine it maps to the Home directory of the user for the userid defined for the log-in.

Once this drive is configured, in Discover you can create a scan target for the Z: drive.

Notes:

This article provides a reference to a possible solution using third party software.

Trustwave TAC does not support the SFTP Net Drive tool. You implement this solution on your own responsibility and at your own risk.

Please be aware of any licensing issues and requirements to use the software.

Discover version 6.0 provides Linux Agents that allow you to scan a Linux machine with the Agent, replacing the procedure above.

Uninstalling DLP 9.6.3 and newer versions

Andrew Davies — Mon, 29 Feb 2016 18:24:19 GMT

This article applies to:

DLP Monitor 9.6.3 and newer versions

Question:

The "vinstall -u" parameter no longer works
How do I uninstall so I can cleanly reinstall?

Procedure:

As of version 9.6.3 the vinstall script is changed to twdlp-install and it no longer supports the "-u" or uninstall parameter, so the process must be done manually.

In version 9.6.3 and above, to uninstall follow these steps from a root prompt:

yum erase 'twdlp*' -y
yum erase java-1.7.0-openjdk -y
yum install java-1.7.0-openjdk -y
service postgresql stop
yum erase postgresql-server -y
rm -rf /var/lib/pgsql/*
yum install postgresql-server -y
rm -rf /opt/tomcat
rm -rf /opt/vericept
rm -rf /opt/vericept.bak

Restart the system.

For previous versions, mount the ISO of the version you are running and run "vinstall -u" from it.

Notes:

These processes leave the system ready for a DLP reinstall. Some packages are left installed.
These steps do not leave a clean OS ready for another product.
The DLP OS install is specific for DLP and not a "generic" Linux install.

Functional differences between DLP Discover for SME and DLP Discover Admin

Andrew Davies — Mon, 12 Oct 2015 16:54:44 GMT

This article applies to:

DLP Discover (all versions)

Question:

How is the SME license different from the Admin license?
What functionality is missing from the DLP Discover for SME license?

Information:

Trustwave DLP Discover for SME is designed to help small and medium enterprises identify cardholders' data within their environments, by providing a subset of DLP Discover functionality. Because DLP Discover for SME is limited to the discovery of sensitive data, it operates with the following restrictions:

Scans for only two cardholder data (CHD) risk categories: PCI-DSS and Credit Card Number Only.
Scans local drives, network drives, and database targets.
Risk categories cannot be customized.
Scan policies cannot be created.
No remediation is available for content risks.
Scans are limited to fifteen (15) per year. Thus, a two-year term license permits up to 30 scans.

Customers can upgrade to the full version of DLP Discover to access additional content categories, unlimited scanning, and remediation functionality.

Organizational functionality is not available for Discover for SME.

ID Matching accuracy and coverage

Andrew Davies — Thu, 07 May 2015 18:21:20 GMT

This article applies to:

DLP Monitor 9.X

Question:

What is the best setting for "Age Limit for Identity Match entries (in days)"?
How does this "Age Limit" setting affect account accuracy and the percentage of events that are associated with accounts?

Information:

The ID Match process receives logon events from domain controllers, and tracks DHCP changes by reading DHCP logs from a share. This information is held in a database table on the Collectors. The data is held in the table for the time defined in "Age Limit for Identity Match entries (in days)" which is entered on the ID Match tab in the Collector User Interface. Old entries are removed nightly by a process that runs at 2:15 AM.

A logon event is not generated when a workstation is unlocked (unless domain controllers are configured for it). This event is normally only generated with a network logon, and usually only required after a shutdown or reboot, depending on the configuration.

When a captured raw session becomes an Event, the database table is queried using the IP address from the Event and time of the event. The table is queried for that IP address, and the entry used will have the most recent logon date/time prior to the Event date/time.

Keeping data in the ID Match table longer will create more Events with Account ID information. However keeping this data longer has an accuracy trade-off. The data in the tables is only accurate if all domain controllers send all logon data to the Collector and all DHCP changes are also tracked and sent. If any logon data is missing, an event could be associated with the Account ID of the previous person to use the IP address.

For example, user JohnD logs in to his laptop and receives the IP 10.1.1.2 which is used for a few days until JohnD shuts down for the weekend. The DHCP lease on the IP expires and JohnD logs in on Monday getting a different IP. SamH logs in some days later and receives the 10.1.1.2 IP, but due to a network issue the Collector does not receive the SamH logon data. If the original JohnD logon data has been retained, any Event created by SamH on the 10.1.1.2 IP address will be attributed to the JohnD account.

Generally, the longer the data is retained in the ID Match table, the less accurate it becomes. The shorter the retention period, the lower the percentage of Events with Account IDs.

Conclusion:

When setting the "Age Limit for Identity Match entries (in days)" in the Collector UI, consider which is most important - accuracy, or associating an Account ID with every event.

For accuracy, set a shorter limit.
To ensure that more events have associated IDs, set a longer limit.
Review the results and fine-tune the setting as required.

Modifying an existing CANDL category in Edge

Andrew Davies — Thu, 07 May 2015 18:20:50 GMT

This article applies to:

Edge (all versions)

Question:

How can I modify an existing CANDL category in Edge?

Procedure:

To edit a user created CANDL category:

From Edge server, select the Configuration tab.
Under Advanced Users Only, select Policy Settings.
Under Advanced Users Only, select Categories.
Select New Category.
In the sentence "To continue on to step 2, click on the base category ...", click the link "base category".
Click the user category you want to edit.
Select the Rule tab.
Edit the CANDL rule directly in the CANDL Ruleset dialog box.
After editing is complete, click Apply.
Select the Certification tab.
Click Certify and Save.

Notes:

This procedure works only for a user created CANDL category. The standard categories are encrypted and cannot be edited.

Troubleshooting issues with loading CANDL files via command line or the Web UI

Andrew Davies — Thu, 07 May 2015 18:19:38 GMT

This article applies to:

DLP Monitor versions 9.1 and newer

Question:

Troubleshooting issues with loading CANDL files via command line or the Web UI

Information:

Usually when a Java exception is thrown when loading, it means there was a problem running the /opt/vericept/bin/cat_label_import.pl script. This script is the logic that populates the database with a category's information (such as category key and label, sensitivity, and so on). This script gets its information from two files:

/opt/vericept/etc/custom/cat-label
/opt/vericept/etc/cat-label

These files contain data for all uploaded categories.

The most likely reason for a failure in this script is that the /opt/vericept/etc/custom/cat-label file contains an entry that is invalid for the database. This inappropriate entry would cause all subsequent upload attempts to fail.

Some common items that could be problematic for insertion into the database are:

category key (max length 64 characters)
category label (max length 32 characters)
sensitivity (max length 8 characters)

Another likely cause for failure is the permission setting on the script and data files. These should all be owned by the vericept user and group:

/opt/vericept/bin/cat_label_import.pl
/opt/vericept/etc/custom/cat-label
/opt/vericept/etc/cat-label

Why do events in Edge sometimes show the user as "none"?

Andrew Davies — Thu, 07 May 2015 16:36:22 GMT

This article applies to:

Edge (all versions)

Question:

Why do events in Edge sometimes show up as user=none?

Information:

In the Events Browser reports, the "User" column may or may not have a username. Although this can be confusing initially, the reasons are as follows (based on features):

User Visibility:

There will always be a username associated with the event. The purpose of user visibility is to show who logged in or out.

Device Visibility/Control:

Network Drive Added events will always have a username. These events can only happen after a user logs in.
Network Drive Removed events will display "none" for username.
Removable Drive Added events can display a "User" with three possibilities. The difference is due to the ways Device Control can block a device.
- If the device is blocked at the System restriction level, the user will show as "**".
- If the device is blocked at the Device restriction level, the user will show as "none". The difference between these two types is that System and Device restriction are different filter drivers. From the value in this field you can distinguish which filter driver is doing the blocking.
- Finally, if the device is blocked at the User restriction level, the username will appear.
Removable Drive Removed events will show "none" for username.
Removable Media Added can display the same values as "Removable Drive Added" above.
Removable Media Removed events will show "none" for the username.

Content Visibility:

"Files Added", "Files Modified", and "Files Removed" events will all show "none".

Content Control:

"File Opened" and "File Saved" events which are blocked at the user level will have a username.

End of Support dates for Entrust Products

Andrew Davies — Thu, 07 May 2015 15:04:31 GMT

This article applies to:

Entrust Entelligence Messaging 7.x
Entrust Entelligence Messaging 8.x
Entrust Entelligence Messaging 9.x
Boundary Encryption Plug-in 8.x
Boundary Encryption Plug-in 9.x

Question:

How long are the versions of Entrust Entelligence Messaging and Boundary only plugin supported?

Information:

The table below shows the end dates for standard and extended support for each product version.

Product Name	Version	Mandatory Upgrade	Generally Available	Standard Support Retired	Extended Support Retired
Boundary Encryption Plug-in	8.0		2005/11/16	2009/11/30	2011/11/30
Boundary Encryption Plug-in	8.1		2008/03/27	2010/03/27	2012/03/27
Boundary Encryption Plug-in	9.0		2009/03/23	2012/03/23	2014/09/22
Boundary Encryption Plug-in	9.1		2009/03/23	2012/03/23	2014/09/22
Messaging Server	8.0	8.1	2005/09/21	3 years from date shipped to customer
Messaging Server	8.1		2006/03/27	2009/09/30
Messaging Server	9.0		2007/08/17	2010/08/17
Messaging Server	9.1	No	2008/06/13	2011/06/13
Messaging Server	9.2	No	2009/03/23	2012/07/28
Messaging Server	9.3	No	2011/07/28	2014/07/28

Regenerating a certificate after fixing the Heartbleed vulnerability

Andrew Davies — Tue, 22 Apr 2014 18:27:32 GMT

For the DLP Monitor and Protect products, the official response to the OpenSSL vulnerability known as "Heartbleed" is as follows:

In response to the recent OpenSSL vulnerability CVE-2014-0160, Trustwave engineering performed an exhaustive evaluation of the OpenSSL components used in all of our products. The DLP Enterprise software itself is not vulnerable to the OpenSSL Heartbleed vulnerability (CVE-2014-0160) directly, but as it is sold to run on Red Hat Enterprise Linux, it is possible the operating system has incorporated a vulnerable version of OpenSSL. The RHEL Version that was impacted by Heartbleed was version 6.5.
Trustwave maintains a Red Hat satellite server that provides updates to our customers. The satellite server was updated with the patch that fixes Heartbleed for RHEL 6.5 and customers are encouraged to upgrade the OS to this patch level. Customers will receive this patch automatically as long as they haven’t disabled updates from our satellite server. It is recommended that the server be rebooted once the update has been received, to ensure the patch installation is completed. Trustwave will continue to monitor this vulnerability and provide an update if the situation changes.

If your organization maintains the DLP OS using updates from the Trustwave satellite server you will only need to keep the OS updated.

If your organization uses another method for the RHEL OS updates, then you should fix the OpenSSL vulnerability and then regenerate the DLP certificates used in the browser interface. Here are the steps to perform that certificate regeneration, please feel free to contact Trustwave TAC for assistance with the following:

On the Console log in as "root" user via an SSH and run the following commands:
cert-regen
configure-josso.pl
configure-services.pl
service tomcat restart
On every Collector log in as "root" user and run the following commands:
configure-josso.pl
configure-services.pl
service tomcat restart
Log into the Console browser interface and go to Administration->Collector Management
1. Click to select all Collectors
2. Select "Fetch SSL certificate..." in the "Status" drop-down and click "Go" to fetch the SSL certs from each Collector.
Log into each Collector's browser interface and go to Administration->Setup->Device Role:
- Click the "Fetch Console Certificate" button and then click the "Save" button.

Please feel free to contact Trustwave TAC for assistance.

What versions of Entrust EMS are no longer supported by Entrust and Trustwave TAC?

Craig Hill — Tue, 29 Oct 2013 07:35:01 GMT

This article applies to:

Entrust EMS 9.0 and above

Question:

What versions of Entrust EMS are supported by Entrust and Trustwave TAC?
What versions of Entrust EMS are no longer supported by Entrust and Trustwave TAC?

Information:

The following table shows the versions, release date and date for discontinued support.

Product Version	Product Release Date	Product Support Ends
9.3	2011/07/28	2014/07/28 (Current)
9.2	2009/03/23	2012/07/28 (Discontinued)
9.1	2008/06/13	2011/06/13 (Discontinued)
9.0	2007/08/17	2010/08/17 (Discontinued)

Upgrading to EMS 9.3 will require the appliance to be at version 9.2-3.

Changing to a non default port when scanning a database with Discover

Craig Hill — Wed, 10 Jul 2013 15:44:06 GMT

This article applies to:

DLP Discover

Question:

How do I set the port for Discover to connect to a database?

Procedure:

DLP Discover scans databases using the default port for the database type.

If you are not using the default port, Discover will report an error. For instance with Oracle databases you may see a TNSListener error.

To change the port, in the Server Name field add the port after the name, in the format: <SystemName>:<port>/<DB Instance>

For example: dbsystem.mycompany.com:9999/myDBinstance

Get Better Postfix Logging

Charles Creegan — Tue, 18 Jun 2013 19:12:25 GMT

This article applies to:

DLP Protect Email (all versions)

Question:

Is there any way I can get a list of sent emails?

PROCEDURE:

The script below assumes that you have changed your /etc/logrotate.conf to do a daily rotation and that you are compressing and keeping 6 or more days of logs.

Log in to your device as root

crontab -e

paste the following in (note that this text is in a scrolling region; please be sure you have copied all the text).

# created to email daily mail logs to users at 1:10am and weekly reports at 1:20am on Sundays
# They are emailed to the local user postmaster, the email addresses are set in /etc/aliases
# Once changes are made run 'postalias /etc/aliases' to update the system with the changes

0 1 * * * (zcat /var/log/maillog.1.gz ; cat /var/log/maillog ) |/usr/sbin/pflogsumm --problems_first -d yesterday -h 20 --no_no_msg_size -u20 | mail -s "`uname -n` daily mail stats for `date '+%F'`" postmaster

10 1 * * 0 (zcat /var/log/maillog.6.gz; zcat /var/log/maillog.5.gz; zcat/var/log/maillog.4.gz ; zcat /var/log/maillog.3.gz; zcat /var/log/maillog.2.gz;zcat /var/log/maillog.1.gz; cat /var/log/maillog) | /usr/sbin/pflogsumm--problems_first -h 20 --no_no_msg_size -u 20 |mail -s "`uname -n`weekly mail stats for `date --date="-7 days" +%F`" postmaster

20 1 1 * * (zcat /var/log/maillog.*.gz ; cat /var/log/maillog) |/usr/sbin/pflogsumm --problems_first -h 20 --no_no_msg_size -u 20 | mail -s" `uname -n`Monthly mail stats for `date --date="lastmonth" +%Y-%m`" postmaster

To change the time look at the following
* * * * * command to be executed
| | | | |
| | | | .---- day of week (0 - 6) (Sunday=0 or 7)OR sun,mon,tue,wed,thu,fri,sat
| | | .------- month (1 - 12) OR jan,feb,mar,apr ...
| | .---------- day of month (1 - 31)
| .------------- hour (0 - 23)
.---------------- minute (0 - 59)

Sample Report:

You can get a report that looks like the following example:

Postfix log summaries for Aug 18
Grand Totals
------------
messages
22   received
17   delivered
6    forwarded
0    deferred
0    bounced
2    rejected (10%)
0    reject warnings
0    held
0    discarded (0%)

410520   bytes received
416588   bytes delivered
5   senders
2   sending hosts/domains
5   recipients
2   recipient hosts/domains

message deferral detail: none
message bounce detail (by relay): none

message reject detail
---------------------
RCPT
Sender address rejected: Access denied (total: 2)
2<>

message reject warning detail: none
message hold detail: none
message discard detail: none
smtp delivery failures: none
Warnings: none
Fatal Errors: none
Panics: none
Master daemon messages: none

Per-Hour Traffic Summary

time           received  delivered   deferred   bounced     rejected
--------------------------------------------------------------------
0000-0100        0           0          0          0          0 
0100-0200        1           1          0          0          1 
0200-0300        0           0          0          0          0 
0300-0400        0           0          0          0          0 
0400-0500        1           1          0          0          1 
0500-0600        0           0          0          0          0 
0600-0700        0           0          0          0          0 
0700-0800        0           0          0          0          0 
0800-0900        7           4          0          0          0 
0900-1000       13          11          0          0          0 
1000-1100        0           0          0          0          0 
1100-1200        0           0          0          0          0 
1200-1300        0           0          0          0          0 
1300-1400        0           0          0          0          0 
1400-1500        0           0          0          0          0 
1500-1600        0           0          0          0          0 
1600-1700        0           0          0          0          0 
1700-1800        0           0          0          0          0 
1800-1900        0           0          0          0          0 
1900-2000        0           0          0          0          0 
2000-2100        0           0          0          0          0 
2100-2200        0           0          0          0          0 
2200-2300        0           0          0          0          0 
2300-2400        0           0          0          0          0 

Host/Domain Summary: Message Delivery 
sent cnt  bytes   defers   avg dly max dlyhost/domain
-------- -------  -------  ------- ------- -----------
1223924        0     0.1s    1.0 s  sup-domain1.com
5392664        0     0.2s    1.0 s  verincent.com

Host/Domain Summary: Messages Received 
msg cnt   bytes   host/domain
-------- -------  -----------
10   399408   sup-domain1.com
6    11112sup-protect-8-2.sup-domain1.com

Senders by message count
------------------------
6   supcon-8-2@sup-domain1.com
5   root@sup-protect-8-2.sup-domain1.com
3   alavies@sup-domain1.com
1   ALavies@sup-domain1.com
1   verincent@sup-protect-8-2.sup-domain1.com

Recipients by message count
---------------------------
6   alavies@sup-domain1.com
5   adminstrator@sup-domain1.com
3   alavies@verincent.com
2   kconnel@verincent.com
1   kconnel@sup-domain1.com

Senders by message size
-----------------------
293394   alavies@sup-domain1.com
98127   ALavies@sup-domain1.com
9920   root@sup-protect-8-2.sup-domain1.com
7887   supcon-8-2@sup-domain1.com
1192   verincent@sup-protect-8-2.sup-domain1.com

Recipients by message size
--------------------------
196739   alavies@verincent.com
195925   kconnel@verincent.com
11810   alavies@sup-domain1.com
7048   adminstrator@sup-domain1.com
5066   kconnel@sup-domain1.com

=================================================

Notes:

If you have any questions please contact TAC@trustwave.com.