Title.

Assuria Auditor changes in 2006

Introduction

Assuria have delivered a significant number of updates and enhancements to Assuria Auditor during 2006.  Many of the updates and enhancements are “under the covers” and not always visible to users. 

The purpose of this Bulletin is to highlight the changes that were made during 2006.

New Agents

Red Hat Enterprise Linux

Red Hat Enterprise Linux Agent.  This agent has been validated on RHEL 3/X86, RHEL4/X86 and RHEL4/X64.

SUN Solaris 10 SPARC

New Sun Solaris 10 Agent released.  This agent is for SUN SPARC systems.

SUN Solaris 10 X86

A SUN Solaris 10 agent for Intel X86 systems is in the final stages of testing.  A BETA version is available on request from Assuria.

SuSE Enterprise LINUX

A SuSE Enterprise LINUX agent is in development, a BETA can be made available on request.

Security Content

Assuria has released 14 Xpress Updates during 2006 these added and updated over 400 checks. The XPU’s included 374 new checks.  This new Security and Updated content has been delivered for the following platforms:

• IBM AIX (8 XPUs)
• Microsoft Windows 2000 (14 XPUs)
• Microsoft Windows 2003 (14 XPUs)
• RHEL (13 XPUs)
• Sun Solaris 7 (11 XPUs)
• Sun Solaris 8 (14 XPUs)
• Sun Solaris 9 (14 XPUs)
• Sun Solaris 10 (7 XPUs)
• HP HP-UX (10 XPUs)

Transition of Assuria Auditor to Assuria Limited

Licence Keys

As part of the transition program to Assuria support for ISS System Scanner Assuria has updated the licensing and code signing so that the Assuria Auditor console will accept Assuria generated licence keys as well as ISS generated keys (in XPU#48).

Code, Check and policy signatures

All Assuria developed program code, checks and policies are digitally signed by Assuria to ensure that only Assuria generated code is executed.

The following agents will now accept agent components digitally signed by either Assuria or ISS.

• HPUX 10.20, 11.00, 11.11 and 11.23 (in XPU#53)
• Red Hat Linux Enterprise 3 & 4 (in XPU#53)
• Microsoft Windows 2000 Professional and Server (in XPU#53)
• Microsoft Windows 2003 Server (in XPU#53)
• IBM AIX (in XPU#51)
• Sun Solaris 8 (in XPU#51)
• Sun Solaris 9 (in XPU#51)
• Sun Solaris 10 (in XPU#51)

New / Updated features

Updated Console features

• The console now reports available updates in descending numeric (ie. latest first) order (in XPU#48).

• Provision of HTML formatted readme for X-Press Updates (in XPU#48)
• Updates to support information in the console
• Updated HELP
• Multiple bug fixes.

New and Renamed agents

Some customers often add new, or rename existing agents on their network. This new feature adds functionality so that when a new or renamed agent is detected the Agent component of the security tree in the Assuria Auditor Console is now highlighted.

To configure an agent select Maintenance, New and Renamed agents from the Assuria Auditor console menu.

Notification of new and renamed agents added to the following agents:

• Microsoft Windows 2000 Professional and Server (in XPU#48)
• Microsoft Windows 2003 Server (in XPU#48)

Agents already with this feature are:

• Solaris
• HP-UX

XPU Integrity

The XPU Integrity Policy allows security administrators to ensure that all updates have been applied to their agents correctly. All updated files are scanned against, their actual and expected file size and CRC checksum to ensure that they are the correct versions. Any incorrect files are highlighted in the accompanying report. This feature is intended to aid administrators ensure systems are correctly updated.

New XPU integrity functionality in the following agents

• IBM AIX (in XPU#51)
• Sun Solaris 8 (in XPU#51)
• Sun Solaris 9 (in XPU#51)
• Sun Solaris 10 (in XPU#51)
• Microsoft Windows 2000 Professional and Server (in XPU#48)
• Microsoft Windows 2003 Server (in XPU#48)

Software package Baseline

The Package Baseline Policy will create a record of the current software packages installed on a server with the agent installed via PackageAdd on SUN Solaris and    on IBM AIX. The user may update the package baseline as many times as they wish before they have a baseline which meets their security policy.

The Policy packages can be periodically run to check the packages installed on the Agent server against the baseline. Any packages that have been added, deleted or amended (re-installed) will show up in this policy.

New package baseline functionality in the following agents

• IBM AIX (in XPU#51)
• Sun Solaris 8 (in XPU#51)
• Sun Solaris 9 (in XPU#51)
• Sun Solaris 10 (in XPU#51)

Anti-virus keys

The user configuration virus keys have been updated on windows platforms to include:

• McAfee Security Center (in XPU#53)
• AVG AntiVirus (in XPU#53)
• Trend Micro OfficeScan Client (in XPU#54)
• Trend Micro ServerProtect (in XPU#54)

Policy Navigators

The policy navigators for the following platforms have been restructured to better reflect the architecture classes:

• Solaris 7 (in XPU#50)
• Solaris 8 (in XPU#50)
• Solaris 9 (in XPU#50)
• Solaris 10 (in XPU#50)