|
|
|
In This Section: |
The information and procedures in this section are relevant for Endpoint Security VPN and Check Point Mobile for Windows remote access clients.
Network and Firewall administrators can use different tools to control computers inside their organization. For example, to disable dangerous components such as Java and ActiveX controls in browsers, install Anti-Virus, and make sure they are run correctly.
For remote users who access the organization from outside of the LAN, the administrator cannot enforce control of the computer with the same tools. For example, suppose the remote user has ActiveX enabled, and connects to a website containing a malicious ActiveX control which infects his or her computer. When the remote user connects to the organization's LAN, the LAN becomes vulnerable as well.
A properly configured Desktop Security Policy, cannot protect against this type of attack, because the attack does not target a vulnerability in the access control to the user's machine. Instead it takes advantage of the vulnerable configuration of applications on the client.
Secure Configuration Verification (SCV) ,makes sure that remote access client computers are configured in accordance with the enterprise Security Policy. Use SCV to:
SCV does not replace the Desktop Security Policy, but works with it.
SCV uses SCV checks, which are DLLs (plug-ins) on the client, that are invoked and enforced according to the policy that you configure on the Security Management Server. SCV checks include sets of conditions that define a securely configured client system. Checks can include, for example, the user's browser configuration, the version of the Anti-Virus software installed on the desktop computer, and the operation of the personal firewall policy. These security checks are performed at pre-defined intervals by the remote access client. Based on the results of the SCV checks, the Security Gateway decides whether to allow or block connections from the client to the LAN.
Check Point's SCV solution comes with many predefined SCV checks for the operating system and user's browser, and also allows OPSEC partners, such as Anti-Virus software manufacturers, to add SCV checks for their own products.
SCV checks are performed through special DLLs which check elements of the client's configuration and return the results of these checks. An SCV application registers its SCV DLLs in the system registry.
The first step in configuring SCV is for the administrator to install the applications that provide the SCV checks on the client. During installation, these applications register themselves as SCV plug-ins and write a hash value of their SCV DLLs to prevent tampering.
An SCV Policy is a set of rules or conditions based on the checks that the SCV plug-ins provide. These conditions define the requested result for each SCV check, and on the basis of the results, the client is classified as securely configured or non-securely configured. For example, an administrator who wishes to disallow a file-sharing application would define a rule in the SCV Policy verifying that the file-sharing application process is not running.
Note - The SCV check described in this example is among the pre-defined SCV checks included with Security Management Server. This check must be configured to test for the specific process.
When the client downloads its Desktop Policy from the Policy Server, it downloads its SCV Policy at the same time.
After downloading the SCV Policy, the client confirms that the SCV DLL's specified in the SCV Policy have not been tampered with by calculating their hash values and comparing the results with the hash values specified for the DLLs when they were installed.
At regular intervals (default is every 15 seconds), the client performs the SCV checks specified in the SCV Policy by invoking the SCV DLLs, and compares the results to the SCV Policy. The SCV Policy can be configured to display a popup notification on non-securely configured clients and/or send a log to the Security Management Server.
The client can determine whether the client is securely configured. Once all the organization's clients have been configured according to the previous steps, the administrator specifies the actions to be taken on the Security Gateway based on the client's SCV status. For example, the administrator can specify that non-securely configured clients cannot access some or all of the resources on the corporate LAN, protecting the organization from the dangers associated with the client's poor security configuration.
The administrator can choose whether to enforce SCV for remote clients. If SCV is enforced, only securely configured clients are allowed access under the rule. If SCV is not enforced, all clients are allowed access under the rule.
In simplified mode, this is configured globally. In traditional mode, this is configured individually for each rule.
When the client connects to a Security Gateway, an IKE negotiation takes place between the client and the Security Gateway. If the Security Gateway Security Policy requires an SCV check to be made, the Security Gateway holds the connection while it checks if the client is securely configured (checked by SCV). If the Security Gateway already knows the client's SCV status (i.e., the SCV status was checked in the last 5 minutes), then:
If the Security Gateway does not know the client's SCV status, it initiates an SCV check by sending an ICMP unreachable error message containing an SCV query to the client. When a client gets this SCV query, it tries to determine its SCV status. In Connect mode, the client also connects to a Policy Server to download an updated SCV Policy. In parallel, when the client gets the SCV query, it starts sending SCV status replies to the Security Gateway via UDP port 18233 every 20 seconds for 5 minutes. These replies are used as a keep-alive mechanism, in order to keep the user's connection alive in the Security Gateway state tables while the client is trying to determine its SCV status. The keep alive packets also allow the user to open subsequent connections in the 5 minute period in which they are sent without a need for further SCV queries. When the client determines its SCV status, it sends an SCV reply containing the status back to the Security Gateway via UDP port 18233. When the Security Gateway receives the SCV status of the user, it decides how to handle the user's connection.
The default SCV checks (plug-ins) are part of the Endpoint Security VPN and Check Point Mobile for Windows installation:
Operators to check the operating system's version on Windows NT.
service_pack_major_version_number_2k [0]
service_pack_minor_version_number_2k [0]
service_pack_version_operand_2k [">="]
major_os_version_number_xp [4]
os_version_operand_xp [">="]
service_pack_major_version_number_nt [0]
To check the service pack versions
service_pack_major_version_number_nt [0]
service_pack_minor_version_number_nt [0]
To check the operating system service pack
service_pack_version_operand_nt [">="]
To check the major version required
major_os_version_number_2k [4]
major_os_version_number_xp [4]
os_version_operand_xp [">="]
SCV checks can be written by third party vendors using Check Point's OPSEC SCV SDK. For details, see the the Remote Access Clients for Windows Administration Guide for your release:
A network administrator can easily enable a set of specific SCV checks (e.g. only check that the user's client is enforcing a security policy) or as many SCV checks as required (e.g. all of the above SCV checks). The SCV checks are performed independently by the SCV Dynamic Link Libraries, and the client checks their status through the SCV plugins every 15 seconds, and determines whether the user is securely configured or not. If one or more of the tests fails, the client is considered to be non-securely configured.
Note - To enforce a specific SCV check, set the parameters of the check in the SCVNames section, and include the name of the check in SCVPolicy.
The following sections describe things that are important to know before configuring SCV.
The file $FWDIR/conf/local.scv on the Security Management Server contains a sample of a basic SCV policy for checks that are supplied with any SCV installation. You can review this file to help you decide which SCV tests to perform. If you need additional SCV checks for OPSEC products, such as Anti-Virus and Endpoint Security SCV checks, visit: http://www.opsec.com.
To implement SCV effectively, it is suggested that you consider not to allow your remote users to have administrative privileges on their desktops. Giving the users administrative privileges can allow them to change system settings and cause SCV tests to fail. A desktop which fails an SCV check is a potential security threat to the organization.
For example, as an administrator you may want to configure the user's browser not to allow him to download Java applets from websites. A normal user will not be able to download these applets, but a user with administrative privileges can override the browser's configuration. A properly defined SCV policy can indicate that the browser's configuration had changed and trigger a proper action on the Security Gateway side. However, if the user is allowed by the Security Gateway to pass to the LAN - either by a wrong configuration of the SCV policy or lack of enforcement of the user's SCV status on the Security Gateway side - then the user's desktop will become a potential security risk to the LAN.
The SCV policy itself is protected. Users can not change the SCV policy definition files they receive, even if they have administrative rights. The SCV policy files supplied to the client are signed before arriving to the client and checked against their signature by the client. If the signatures do not match, the SCV check fails.
Configuring SCV involves setting it up on the server, setting it up on the client, and configuring SCV policy.
To configure SCV settings in Global Properties:
The SCV Policy is configured by the administrator in the text file $FWDIR/conf/local.scv. This file can be edited either manually by the administrator using a text editor or using a tool called SCVEditor, available at: http://www.opsec.com. The local.scv file is a policy file, containing sets, subsets and expressions.
Note - In general, you can use the pre-defined checks (in the SCVNames section of the local.scv file) as templates and list the modified checks in the SCV Policy section, without writing new SCV subsets.
Each set has a certain purpose which was predefined for it. For example, one set can be used to define certain parameters, another could specify certain actions that should take place in a certain event etc. Sets are differentiated by their names and hierarchy in a recursive manner. Each set can have a sub-set, and each sub-set can have a sub-set of its own and so on. Subsets can also contain logical expressions. Sets and sub-sets with more than one sub-sets/conditions are delimited by left and right parentheses (), and start with the set/sub-set name. Differentiation between sub-sets/expressions with the same hierarchy is done using the colon :. For example:
|
In the example above the set named SetName has two subsets: SubSetName1 and SubSetName2. SubSetName1 has two conditions in it (ExpressionName1_1 and ExpressionName1_2). SubSetName2 has one condition (ExpressionName2_1) and one subset (SubSetName2_1) in it. SubSetName2_1 has one condition as well (ExpressionName2_1_1).
Expressions are evaluated by checking the value of the expression (which corresponds to an SCV check) and comparing it with the value defined for the expression (the value in the parentheses). For example, in the browser monitor SCV check provided with the client, you can specify the following expression:
|
This expression checks whether the version of the Internet Explorer browser installed on the client is 5.x. If the (major) version is 5, this expression is evaluated as true, otherwise it is evaluated as false. The name of the expression (e.g. "browser_major_version") is determined by the SCV application and is supplied by manufacturer.
If several expressions appear one after the other, they are logically ANDed, meaning that only if all expressions are evaluated as true, then the value of all of them taken together is true. Otherwise (if even one of the expressions is false), the value of all of them is false. For example:
|
These expressions are ANDed. If the version of Internet Explorer is 5 AND the minor version is 0 (i.e. version 5.0), then the result is true, otherwise it is false. If the version of Internet Explorer is, for example, 4.0, then the first expression is false and the second one is true, and the result of both of them is false.
Sometimes, some expressions can influence the way in which others are evaluated. For example:
|
These expressions are ANDed, but the third expression influences the way that the first and second ones are evaluated. In the example above, if the version of Internet Explorer is greater than or equal to (">=") 5.0, then the result is true, otherwise it is false. If the version of Internet Explorer is, for example, 4.5, then the result is false, if the version is 5.1 or higher than the result is true.
As mentioned earlier, subsequent expressions are automatically ANDed. However, sometimes it is necessary to perform a logical OR between expressions, instead of logical AND. This is done by using labels:
The begin_or (orX) label - this label starts a section containing several expressions. The end of this section is marked by the end (orX) label (X should be replaced with a number which differentiates between different sections OR sections). All of expressions inside this section are logically ORed, producing a single value for the section. For example:
|
This section checks whether the version of Internet Explorer is 5 OR 6 - if it is then the result is true, otherwise it is false.
The begin_and (andX) label - this label is similar to the begin_or (orX) label, but the expressions inside are evaluated and logically ANDed. The end of this section is marked by the end (andX) or the end (orX) label. As mentioned earlier, simple subsequent expressions are automatically ANDed. The reason that this label exists is to allow nested ANDed sections inside ORed sections. For example, if an administrator considers old browsers as secure since they do not have a lot of potentially unsafe components, and new browsers as secure, since they contain all the latest security patches, he can define the following SCV rules:
|
In the example above, the first AND section checks whether the version of IE >= 5.0, the second AND section checks whether the version of IE is <=3.0 and they are ORed. The entire example is evaluated as true only if the version of IE is larger than (or equal to) 5.0 OR lower than (or equal to) 3.0.
There are several expressions and labels which have special meaning:
The word type should be replace by the type of log to send, such as log/alert. Alert means sending a log to the Security Management Server, while log means sending the log to the remote client's diagnostic tool.
For example:
|
In this example, if the user's IE browser's version is lower than 5.0, an alert is sent to the Security Management Server machine and a popup message is shown to the user with indication of the problem.
The local.scv policy files contains one set called SCVObject. This set must always be present and contains all the subsets which deal with the SCV checks and parameters. Currently SCVObject has 3 subsets:
In this section the administrator specifies the names and different checks for the SCV products. Here is a general definition of an SCV check subset of SCVNames:
|
The test section begins with the name of the SCV check (SCVCheckName1). SCVCheckName1 defines the name of the set of tests. It is defined in the SCV application and should be provided by the SCV manufacturer. The type (plugin) expression specifies that the test is performed by an SCV DLL plugin. The parameters subset is where the SCV rules and actions are defined. The type (plugin) expression and the parameters subset should always be specified when defining a subset of SCV checks (such as SCVCheckName1).
This section defines the names of the SCV checks that should be enforced (the names are part of the SCV check names specified in SCVNames). This section's general structure is:
|
Note - there is a space between the colon (:) and the opening brace.
To enforce a specific SCV check:
This section includes global parameters for SCV.
:SCVGlobalParams ( :disconnect_when_not_verified (false) :block_connections_on_unverified (false) :not_verified_script ("myscript.bat") :not_verified_script_run_show (true) :not_verified_script_run_admin (false) :not_verified_script_run_always (false) :allow_non_scv_clients (false) ) |
Typically, an administrator might need to change only a few of the common parameters (SCV checks) contained in the SCV policy file.
Anti-Virus monitor
Parameters:
Type (“av_type”)Type of Anti-Virus. For example, “Norton”, “VirusScan”, “OfficeScan”, or “ZoneLabs”.
Signature(x)Required Virus definition file signature. The signature’s format depends on the Anti-Virus type. For example, on Norton Anti-Virus the signature maybe be “>=20031020”. (The format for Norton’s AV signature is “yyyymmdd”).
For TrendMicro Officescan, the signature may be “<650”
For McAfee’s VirusScan, use signature (“>404291”) for a signature greater than 4.0.4291
For Zone Labs, use signature (“>X.Y.Z”) where X = Major Version, Y = Minor Version, and Z = Build Number of the .dat signature file.
AntiVirusMonitor does not support “begin_or” and the “begin_and” syntax.
BrowserMonitor
Parameters:
browser_major_version (5)Major version number of Internet Explorer. If this field does not exist in the local.scv file, or if this value is 0, the IE’S version will not be checked as part of the BrowserMonitor check.
browser_minor_version (0)Internet Explorer’s minor version number.
browser_version_operand (“>=”)The operator used for checking the Internet Explorer’s version number.
browser_version_mismatchmessage (“Please upgrade your Internet Browser.”)Message to be displayed in case of a non-verified configuration for the Internet Explorer’s version.
intranet_download_signed_activex (enable)The maximum permission level that IE should have for downloading signed ActiveX controls from within the local Intranet.
intranet_run_activex (enable)The maximum permission level that IE should have for running signed ActiveX controls from within the local Intranet.
intranet_download_files (enable)The maximum permission level that IE should have for downloading files from within the local Intranet.
intranet_java_permissions (low)The maximum security level that IE Explorer should have for running java applets from within the local Intranet.
(low) means a low security level.
trusted_download_signed_activex (enable)The maximum permission level that IE should have for downloading signed ActiveX controls from trusted zones.
trusted_run_activex (enable)The maximum permission level that IE should have for running signed ActiveX controls from trusted zones.
trusted_download_files (enable)The maximum permission level that IE should have for downloading files from trusted zones.
trusted_java_permissions (medium)The maximum security level that IE should have for running java applets from trusted zones.
internet_download_signed_activex (disable)The maximum permission level that IE should have for downloading signed ActiveX controls from the Internet.
Internet_run_activex (disable)The maximum permission level that IE should have for running signed ActiveX controls from the Internet.
internet_download_files (disable)The maximum permission level that IE should have for downloading files from the Internet.
internet_java_permissions (disable)The maximum security level that IE should have for running java applets from the Internet.
restricted_download_signed_activex (disable)The maximum permission level that IE should have for downloading signed ActiveX controls from restricted zones.
restricted_run_activex (disable)The maximum permission level that IE should have for running signed ActiveX controls from restricted zones.
restricted_download_files (disable)The maximum permission level that IE should have for downloading files from restricted zones.
restricted_java_permissions (disable)The maximum security level that IE should have for running java applets from restricted zones.
send_log (type)Determines whether to send a log to Security Management Server for specifying that the client is not “SCVed.”
This SCV check does not support the “begin admin/end admin” parameter section.
The (type) section should be replaced by (log) or (alert)
internet_options_mismach_message (“Your Internet browser settings do not meet policy requirements”)Mismatch message for the Internet Explorer settings.
BrowserMonitor can be configured to check only Internet Explorer’s version, or only the browser’s settings for a certain zone. For example, if none of the following parameters appear:
restricted_download_signed_activexrestricted_run_activexrestricted_download_filesrestricted_java_permissionsthen BrowserMonitor will not check the restricted zones’ security settings. In similar fashion, if the parameter “browser_major_version” does not appear or is equal to zero, then IE’s version number is not checked.
BrowserMonitor does not support the “begin_or” and the “begin_and” syntax, and does not support the admin parameters.
For the script for checking Internet Explorer Service Pack, see Script for Internet Explorer Service Pack below.
Groupmonitor
Parameters
“builtin\administrator” (false)A name of a user group. The user has to belong to this group in order for the machine configuration to be verified.
securely_configured_no_active_user (true)Specifies whether the machine’s configuration may be considered verified when no user is logged on. The default value is false.
HotFixMonitor
Parameters
HotFix_Number (true)A number of a system Hotfix to be checked. In order for the machine to be verified, the Hotfix should be installed, for example: “823980(true)” verifies that Microsoft’s RPC patch is installed on the operating system.
HotFix_Name (true)The full name of a system HotFix to be checked. In order for the machine to be verified, the HotFix should be installed, for example: “KB823980(true)” verifies that Microsoft’s RPC patch is installed on the operating system.
Not all the mentioned fields for HotFixMonitor need to appear in the local.scv file. Some of them may not appear at all, or may appear more than once. These fields may also be ORed and ANDed. In this way, multiple Hotfixes can be checked, and the results ORed or ANDed for extra flexibility.
HWMonitor
Parameters
cputype (“GenuineIntel”)The CPU type as described in the vendor ID string. The string has to be exactly 12 characters long. For example: “GenuineIntel”, or “AuthenticAMD”, or “aaa bbb ccc ” where spaces count as a character.
cpufamily(6)The CPU family.
cpumodel(9)The CPU model.
HWMonitor does not support the “begin_or” and the “begin_and” syntax.
OsMonitor
Parameters
enforce_screen_saver_minutes_to_activate (3)Time in minutes for the screen saver to activate. If the screen saver does not activate within this time period, then the client is not considered verified. In addition, the screen saver must be password protected.
screen_saver_mismatchmessage (“Your screen saver settings do not meet policy requirements”)Mismatch message for the screen saver check. The screen saver will not be checked if the property “enforce_screen_saver_minutes_to_activate” does not appear, or if the time is set to zero.
send_log (type)Determines whether to send a log to Security Management Server for specifying that the client is not “SCVed.”
This SCV check does not support the “begin admin/end admin” parameter section.
The (type) section should be replaced by (log) or (alert)
major_os_version_number_9x (4)Specifies the major version required for 9x operating systems to be verified.
minor_os_version_number_9x (10)Specifies the minor version required for 9x operating systems to be verified.
os_version_operand_9x (“>=”)Operator for checking the operating system’s version on 9x.
service_pack_major_version_number_9x (0)Specifies the major service pack’s version required for 9x operating system’s to be verified.
service_pack_minor_version_number_9x (0)Specifies the minor service pack’s version required for 9x operating systems to be verified.
service_pack_version_operand_9x (“>=”)Operator for checking the operating system’s service pack on 9x.
major_os_version_number_nt (4)Specifies the major version required for Windows NT operating systems to be verified.
minor_os_version_number_nt (10) Specifies the minor version required for Windows NT operating systems to be verified.
os_version_operand_nt (“>=”)Operator for checking the operating system’s version on Windows NT.
service_pack_major_version_number_nt (0)Major service pack version required for Windows NT operating systems to be verified
service_pack_minor_version_number_nt (0)Minor service pack version required for Windows NT operating systems to be verified
service_pack_version_operand_nt (“>=”)Operator for checking the operating system’s service pack on Windows NT
major_os_version_number_2k (4)Specifies the major version required for Windows 2000 operating systems to be verified.
minor_os_version_number_2k (10)Specifies the minor version required for Windows 2000 operating systems to be verified.
os_version_operand_2k (“>=”)Operator for checking the operating system’s version on Windows 2000
service_pack_major_version_number_2k (0)Specifies major service pack version required for Windows 2000 operating systems to be verified.
service_pack_minor_version_number_2k (0)Specifies minor service pack version required for Windows 2000 operating systems to be verified.
service_pack_version_operand_2k (“>=”)Operator for checking the operating system’s service pack on Windows 2000
major_os_version_number_xp (4)Specifies the major version required for Windows XP operating systems to be verified.
minor_os_version_number_xp (10)Specifies the minor version required for Windows XP operating systems to be verified.
os_version_operand_xp (“>=”)Operator for checking the operating system’s service pack on Windows XP
service_pack_major_version_number_xp (0)Specifies the major service pack version required for Windows XP operating systems to be verified.
service_pack_minor_version_number_xp (0)Specifies the minor service pack version required for Windows XP operating systems to be verified.
service_pack_version_operand_xp (“>=”)Operator for checking the operating system’s service pack on Windows XP.
os_version_mismatches (“Please upgrade your operating system”)Message to be displayed in case of a non-verified configuration for the operating system’s version/service pack. The operating system’s version and service pack will not be checked if none of the parameters appear in the scv file.
:major_os_version_number_2003 (5)Specifies the major version required for Windows 2003 operating systems to be verified.
:minor_os_version_number_2003 (2)Specifies the minor version required for Windows 2003 operating systems to be verified.
:os_version_operand_2003 ("==")Operator for checking the operating system’s service pack on Windows 2003
:service_pack_major_version_number_2003 (0)Specifies the major service pack version required for Windows 2003 operating systems to be verified.
:service_pack_minor_version_number_2003 (0)Specifies the minor service pack version required for Windows 2003 operating systems to be verified.
:service_pack_version_operand_2003 (">=")Operator for checking the operating system’s service pack on Windows 2003
OsMonitor can be configured to check only the screen saver’s configuration, or only the operating system’s version and service pack. For example, if none of the following parameters appear:
major_os_version_number_xpminor_os_version_number_xpos_version_operand_xpservice_pack_major_version_number_xpservice_pack_minor_version_number_xpservice_pack_version_operand_xpthen OsMonitor will not check the system’s version and service pack on Windows XP platforms.
Similarly, if the parameter “enforce_screen_saver_minutes_to_activate” does not appear, then the screen saver’s configuration is not checked.
OSMonitor does not support the “begin_or” and the “begin_and” syntax.
ProcessMonitor
Parameters
ProcessName.exe (true)A process the administrator would like to check. If the value is true, the process needs to be running for the machine to be verified. If the value is false, the process should not be running for the machine to be verified.
ProcessMonitor can also be used to check for the existence/exclusion of more than one process. The fields may be ANDed or ORed for flexibility.
RegMonitor
Parameters
PredefinedKeys (HIVE)Specify the registry hive from one of the following choices:
HKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSIf one of the hives is not specified, then HKEY_LOCAL_MACHINE is used.
To configure a check for HKEY_CLASSES_ROOT, use HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes.
value (registry_value_path)The path of a registry DWORD, under the hive specified by the predefined keys will be checked. The value should be an operator followed by a number, e.g. “Software\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\PatternVer>=414”
The syntax for the value parameter is:
:value (“pathOPval”)
For example:
:value (“Software\...\PaternVer>=414”)
string (registry_string_path)The path of a registry string, under the hive specified by the predefined keys will be checked. The string’s value is compared to the given value, in the way that DWORDs are compared.
keyexist (registry_key_path)The path of a registry key to check if the key exists, under the hive specified by the predefined keys will be checked. The key must exist if the machine is to be verified.
keynexist (registry_key_path)The path of a registry key to be checked for exclusion, under the hive specified by the predefined keys will be checked. For the machine to be verified, the key should not exist.
allow_no_user (default: true)This parameter is valid only when a user is logged in to the machine.
Since SC services and SCV checks run also when no user is logged on, a decision should be taken if the check passed or failed.
If no user is logged on to the machine, and a running RegMonitor check is configured to monitor HKEY_CURRENT_USER, the behavior is according to the flag allow_no_user.
If allow_no_user is true, the check will PASS.
If allow_no_user is false, the check will FAIL.
This attribute is not, by default, included in the local.scv file. If the attribute does not exist in the file, then the default setting used is also true.
Configuring this attribute is done via local.scv. For example:
:
|
Not all the mentioned fields for RegMonitor need to appear in the local.scv file. Some of them may not appear at all, or may appear more than once. These fields may also be ORed and ANDed. In this way, multiple registry entries can be checked, and the results ORed or ANDed for extra flexibility.
You can use these logical comparison operators when working with RegMonitor in the SCV policy. Other logical operations are not supported:
Logical Operator |
Meaning |
|
|---|---|---|
= |
Equals |
|
!= |
Does not equal |
|
> |
Greater than |
|
< |
Less than |
|
>= |
Greater than or equal to |
|
<= |
Less than or equal to |
|
Script for Internet Explorer Service Pack
RegMonitor can be configured to check the version and service pack of Internet Explorer. The script looks as follows:
|
SCVMonitor
Parameters
scv_version(“>=541000076”)Represents the SCV product’s build number. This is the version of the DLLs in charge of the SCV checks. This number differs from the build number of the client. SCV products can be upgraded, and maybe updated without updating the client.
The string is an operator followed by the DLL’s version number in the format “vvshhhbbb”. For example, if you want the DLL version to be at least 54.1.0.220, the syntax should be:
scv_version (“>=541000220”)
SCVMonitor does not support the “begin_or” and the “begin_and” syntax.
ScriptRun
Parameters
exe (“VerifyScript.bat”)Runs an executable. Supply the name of the executable, and the full path to the executable.
run_as_admin (“no”)Determines whether the verification script is run with administrator privileges. The default is “no”. The only other value is “yes”.
run_timeout (10)Time (in seconds) to wait for the executable to finish. If the executable does not finish within the set time, the process is considered as a failure, and the machine categorized as “not verified”. The default value is zero, which is the same as “no timeout”.
ScriptRun does not support the “begin_or” and the “begin_and” syntax.
user_policy_scv
Parameters
logged_on_to_policy_server (true/false)Specifies whether the user has to be logged on to a Policy Server to be considered SCVed.
policy_refresh_rate (“168”)Time, in hours, for which the desktop policy remains valid. After 168 hours the desktop policy is not considered valid, and the user is no longer SCVed. If this parameter is not specified, the policy is not checked for freshness.
mismatchmessage (“Place a message here”)The message displayed when the user_policy_scv check fails.
dont_enforce_while_connecting If this parameter is present, the user is considered SCVed while connecting to the Security Gateway. The user is considered SCVed only for the duration of the connect process.
SCVGlobalParams
Parameters
For all boolean parameters (true or false), the values should not be enclosed in quotation marks.
disconnect_when_not_verified (true/false)If “true”, the Remote Access client will disconnect from the site when the Desktop is not SCVed.
block_connections_on_unverified (true/false)If “true”, the Remote Access client will drop all open connections when the Desktop is not SCVed.
Note - This parameter, if true, blocks all connections to the machine, not just those connections to and from the VPN site.
ip_forwarding_mismatchmessage (“Message string placed here”)The value is a string displayed when ip forwarding is enabled. For example: ip_forwarding_mismatchmessage (“Please....etc”)
This is relevant only if ip forwarding is part of the SCV checks, that is, if the parameter is defined as True.
not_verified_script (“script_name.bat”) The name of executable that will be run when the Desktop is not SCVed. The next three parameters provide more options related to the running of the executable.
not_verified_script_run_show (true/false) If “true”, the executable’s progress will be displayed in an onscreen window.
not_verified_script_run_admin (true/false) If “true”, the executable will run with administrator privileges.
not_verified_script_run_always (true/false) If “true”, the executable will run every time the Desktop is not SCVed. If “false”, it will run once per the Remote Access client session.
:allow_non_scv_clients (true/false)If “true”, the client will send a verified state to the enforcing Security Gateway even if the OS does not support SCV.