Considerations for deploying the application when using Kaspersky Security Center 15 Linux

If you are planning to use Kaspersky Security Center 15 Linux to manage Kaspersky Security for Virtualization 5.2 Light Agent, the process of installing the application in a virtual infrastructure includes the following steps:

Expand all | Collapse all

1. Installing Kaspersky Security management web plug-ins

   The web plug-ins provide an interface for managing Kaspersky Security with Kaspersky Security Center Web Console. Kaspersky Security Center 15 Linux does not support Kaspersky Security Center Administration Console and management MMC plug-ins.

   How to install Kaspersky Security web plug-ins

   1. In the Kaspersky Security Center Web Console main window, select Console settings → Web plug-ins.

      The list of installed web plug-ins opens.

   2. Click the Add button.

      A list of all available Kaspersky web plug-ins opens. The list is updated automatically as new web plug-in versions are released.

   3. Find the required web plug-in in the list and click the plug-in name. Install the following plug-ins, in this order:
      • Kaspersky Security for Virtualization 5.2 Light Agent—Protection Server—Protection Server management web plug-in
      • Kaspersky Security for Virtualization 5.2 Light Agent for Windows—Light Agent for Windows management web plug-in
      • Kaspersky Security for Virtualization 5.2 Light Agent for Linux—Light Agent for Linux management web plug-in
   4. In the web plug-in description window that opens, click Install plug-in.
   5. Wait for the installation process to finish and click OK in the information window.

   Newly installed plug-ins are displayed in the list of installed web plug-ins.

2. Installing Integration Server and Integration Server Console.

   Installing and running Integration Server and Integration Server Console requires a device with a Windows OS. The installation process should be run under a local administrator account.

   You will need a ksvla-components_5.2.X.X_mlg.exe file, where 5.2.X.X is the application version number. The file is available from the Kaspersky website, in the Kaspersky Security for Virtualization | Light Agent section (Build → Kaspersky Security Components Installation Wizard).

   How to install Integration Server and Integration Server Console

   1. Extract files required for installing Integration Server and Integration Server Console by running:

      ksvla-components_5.2.X.X_mlg.exe -layout [folder] --accept-EulaAndPrivacyPolicy=yes

      where:

      • 5.2.X.X is the solution version number.
      • [folder] is the path to the folder to extract the Integration Server and Integration Server Console installation files into. In the absence of a path, the files will be extracted into the data subfolder inside the folder containing ksvla-components_5.2.X.X_mlg.exe.
      • accept-EulaAndPrivacyPolicy=yes means that you accept the terms of the Kaspersky Security End User License Agreement between you and Kaspersky and the Privacy Policy that describes processing and transmission of data. By setting this parameter to yes, you confirm the following:
        • You have fully read, understood and accept the terms and conditions of the Kaspersky Security End User License Agreement.
        • You have fully read and understood the Privacy Policy, you are aware and agree that your data will be handled and transmitted (including to third countries) as described in the Privacy Policy.

        Accepting the terms of the End User License Agreement and Privacy Policy is a prerequisite for installing Integration Server and Integration Server Console. You can read the text of the End User License Agreement and the Privacy Policy by executing the following command:

        ksvla-components_5.2.X.X_mlg.exe --lang=<language ID> --show-EulaAndPrivacyPolicy

        The text of the End User License Agreement and the Privacy Policy is output to the license_<language ID>.txt file in the tmp folder.

      Running the command creates two subfolders with files inside the specified folder. The AttachedContainer subfolder contains, among others, files required for installing Integration Server and Integration Server Console:

      • viis_service.msi
      • viis_console.msi
   2. Start the Integration Server installation process by running:

      viis_service.msi ADMIN_VIIS_PASSWORD=<password>

      where:

      • <password> is the password of the Integration Server administrator account (admin). The admin account is used for connecting Integration Server Console to Integration Server.

        A password must be no longer than 60 characters. You can use only letters of the Latin alphabet (uppercase and lowercase letters), numerals, and the following special characters: ! # $ % & ' ( ) * " + , - . / \ : ; < = > _ ? @ [ ] ^ ` { | } ~. For security purposes, you are advised to set a password that is at least 8 characters long and use at least three of the four categories of characters: lowercase letters, uppercase letters, numerals, and special characters.

   3. Launch the Integration Server Console installation process by running:

      viis_console.msi

   After the installation process is completed, you can start Integration Server Console by opening Kaspersky.VIISConsole.UI.exe, which is located in %ProgramFiles(x86)%\Kaspersky Lab\Kaspersky VIISLA Console\.

   To start Integration Server Console, run:

   1. Run the following command:

      Kaspersky.VIISConsole.UI.exe /lang:<language ID>

      where:

      • Kaspersky.VIISConsole.UI.exe is a file in %ProgramFiles(x86)%\Kaspersky Lab\Kaspersky VIISLA Console\ on the device where you installed Integration Server and Integration Server Console.
      • <language ID> is the Integration Server Console language ID in the following format: ru, en, de, fr, zh-Hans, zh-Hant, ja. It is case-sensitive.
   2. Specify the following connection settings:
      • Address and port of the Integration Server to which the connection is established.

        The address can be specified as the IP address in IPv4 format or the fully qualified domain name (FQDN) of the device on which the Integration Server is installed.

        If the address is specified as a NetBIOS name, localhost or 127.0.0.1, connection to the Integration Server completes with an error.

      • The Integration Server administrator password that you set when installing Integration Server.
   3. The Console checks the SSL certificate received from the Integration Server. If the received certificate is not trusted or does not match the previously installed certificate, the Certificate verification window with the appropriate message opens. Click the link in this window to view the details of the received certificate. If there are problems with the SSL certificate, it is recommended to make sure that the utilized data transfer channel is secure.

      To continue connecting to the Integration Server, click the Consider certificate to be trusted button in the Certificate verification window. The certificate that has been received is installed as a trusted certificate. The certificate is saved in the registry of the operating system on the device hosting the Integration Server Console.

   The Integration Server Console opens.

3. The Kaspersky Security Protection Servers installation by deploying SVMs on hypervisors.

   To Install Protection Server, you need an SVM image file and an image description XML file. You can download archives that contain these files with the help of Kaspersky Security Components Installation Wizard or on the Kaspersky website in the Kaspersky Security for Virtualization | Light Agent section.

   SVMs are deployed with the help of the SVM installation wizard, which is started from Integration Server Console.

4. If you are installing the application in an infrastructure managed by a VMware vCenter Server and VMware NSX Manager, you need to configure the connection of the Integration Server to VMware NSX Manager in the Integration Server Console after completion of SVM deployment.
5. Preparing Protection Servers for operation. To prepare Protection Servers for operation, complete the following actions:
   1. Create a policy for Protection Server in Kaspersky Security Center Web Console and configure the policy settings for connecting SVMs to Integration Server.
   2. Activate the application on all new SVMs. To do this, create an application activation task in Kaspersky Security Center Web Console and start the task.
   3. Update the application databases on all new SVMs. To do this, create a Protection Server database update task in Kaspersky Security Center Web Console and start the task.
6. Installing Light Agent for Windows and/or Light Agent for Linux on virtual machines.

   The installation is performed remotely, with the help of Kaspersky Security Center Web Console, and consists of the following steps:

   1. Preparing installation packages.

      The remote installation process uses installation packages, which you need to prepare in advance.

      • Installing on Windows virtual machines requires a Light Agent for Windows installation package and a Kaspersky Security Center Network Agent installation package.
      • Installing on Linux virtual machines requires a Light Agent for Linux installation package. A separate Kaspersky Security Center Network Agent installation package is not required, as Network Agent is part of a Light Agent for Linux installation package.

      How to prepare a Light Agent for Windows installation package

      1. On a Windows device, unpack the Light Agent distribution kit by opening ksvla-components_5.2.X.X_mlg.exe, where 5.2.X.X is the application version number.
      2. Copy the WindowsAgent folder located in the unpacked folder to a ZIP archive.
      3. In the Kaspersky Security Center Web Console main window, select Device discovery and deployment → Deploy and assign → Installation packages.

         A list of installation packages available on Administration Server opens.

      4. Click the Add button.

         The New Package Wizard starts.

      5. On the first wizard page, select a method for creating an installation package: Create installation package from file.
      6. Enter a package name, click Browse and select the prepared archive.
      7. While creating an installation package, you will need to accept the terms of the End User License Agreement and the Privacy Policy. When prompted by the wizard, read the End User License Agreement between you and Kaspersky, and the Privacy Policy that describes the processing and transmission of data. To continue creating the installation package, you must confirm that you have fully read and accept the terms of the End User License Agreement and the Privacy Policy.

      The newly created installation package is displayed in the list of installation packages. You can use the installation package to install Light Agent for Windows remotely.

      How to prepare a Network Agent for Windows installation package

      1. In the Kaspersky Security Center Web Console main window, select Device discovery and deployment → Deploy and assign → Installation packages.

         A list of installation packages available on Administration Server opens.

      2. Click the Add button.

         The New Package Wizard starts.

      3. On the first wizard page, select a method for creating an installation package: Create a Kaspersky application installation package.

         A list of distribution kits available on Kaspersky servers opens.

      4. Select a Kaspersky Security Center Network Agent for Windows distribution kit and click its name.
      5. In the window on the right, review the kit details and click Download and create installation package. The process of creating a new installation package starts.
      6. While creating an installation package, you will need to accept the terms of the End User License Agreement. Click Show End User License Agreement. To continue creating the installation package, you have to confirm that you have fully read and accept the terms of the End User License Agreement.
      7. Close the kit details window.

      The newly created installation package is displayed in the list of installation packages. You can use the installation package to install Light Agent for Windows remotely.

      How to prepare a Light Agent for Linux installation package

      1. On a Windows device, unpack the Light Agent distribution kit by opening ksvla-components_5.2.X.X_mlg.exe, where 5.2.X.X is the application version number.
      2. Copy the LinuxAgent folder located in the unpacked folder to a ZIP archive.
      3. In the Kaspersky Security Center Web Console main window, select Device discovery and deployment → Deploy and assign → Installation packages.

         A list of installation packages available on Administration Server opens.

      4. Click the Add button.

         The New Package Wizard starts.

      5. On the first wizard page, select a method for creating an installation package: Create installation package from file.
      6. Enter a package name, click Browse and select the prepared archive.
      7. While creating an installation package, you will need to accept the terms of the End User License Agreement and the Privacy Policy. When prompted by the wizard, read the End User License Agreement between you and Kaspersky, and the Privacy Policy that describes the processing and transmission of data. To continue creating the installation package, you must confirm that you have fully read and accept the terms of the End User License Agreement and the Privacy Policy.

         The newly created installation package is displayed in the list of installation packages.

      8. After the Light Agent for Linux installation package is created, you need to configure the settings for connecting Network Agent, which will be installed on the virtual machine together with Light Agent for Linux, to Kaspersky Security Center Administration Server.

         To do this:

         1. On the device with Kaspersky Security Center 15 Linux installed, locate the folder that contains the files of the newly created installation package. The path to the folder is displayed in Path, in the package properties window that opens from the list of installation packages in Kaspersky Security Center Web Console.
         2. In klnagent.ini, in the KLNAGENT_SERVERS key, specify the IP address in IPv4 format or fully qualified domain name (FQDN) of the device where Kaspersky Security Center Administration Server is installed.
         3. Save klnagent.ini.

      You can use the installation package to install Light Agent for Linux remotely.

   2. Starting a remote installation task in Kaspersky Security Center Web Console.

      Specify the prepared Network Agent installation package in the properties of the Light Agent for Windows remote installation task. For more information about a remote installation task, see the Kaspersky Security Center Help.

7. Preparing Light Agents for operation.

   To prepare Light Agents for operation, Create a policy for Light Agent for Windows and/or a policy for Light Agent for Linux in Kaspersky Security Center Web Console and configure the policy settings for connecting Light Agents to SVMs: