Armadito for GLPI¶

Prerequisites¶

• Git client
• GNU make
• C compiler
• Perl > 5.8

$ sudo apt-get install libmodule-install-perl cpanminus

Instructions¶

Get the last version of Armadito Agent sources on github :

$ git clone -b DEV https://github.com/armadito/armadito-agent

To install all dependencies automatically :

$ cpanm --quiet --installdeps --no-test .

Then, at root of project’s sources :

$ perl Makefile.PL
$ make
$ make test
$ make install

Prerequisites¶

• Git client
• Perl > 5.8 (Strawberry Perl or something else)
• Perl module inc::Module::Install

$ cpan install inc::Module::Install
$ cpan install App::Cpanminus

Instructions¶

Get the last version of Armadito Agent sources on github :

$ git clone -b DEV https://github.com/armadito/armadito-agent

To install all dependencies automatically :

$ cpanm --quiet --installdeps --no-test .

Then, at root of project’s sources :

$ perl Makefile.PL
$ dmake
$ dmake test
$ dmake install

Ubuntu with PPA¶

Currently available for :

• xenial (16.04LTS)
• trusty (14.04LTS)

To install :

$ sudo add-apt-repository ppa:armadito/armadito-av
$ sudo apt-get update
$ sudo apt-get install libarmadito-agent-perl

After installation, you can enroll your computer :

$ sudo armadito-agent -t "Enrollment" -k "AAAAE-AAAAD-AAAAF-AAAAZ-AAAA5"

For further informations about PPA, see Launchpad.net

About Enrollment Key(s)¶

In both cases, installation can be done without providing a good enrollement key, while it is not recommended. Administrators should be able to fastly generate enrollment key(s) from Armadito plugin for GLPI from menu General > Enrollment Keys.

If you installed without a valid enrollment key, no worry, you will still be able to enroll later.

Download Installer¶

Offline or Online : https://github.com/armadito/armadito-agent/releases

Offline installer¶

Offline installer’s size is bigger (~80MB) because it includes a strawberry perl distribution and all perl dependencies.

Batch example :

@ECHO OFF
set version=0.10.1
set programpath=%~dp0\..

%programpath%\out\Armadito-Agent-%version%-Setup-Offline.exe ^
 /SP- /VERYSILENT /LOG=%programpath%\out\setuplog.txt /KEY=AAAAE-AAAAD-AAAAF-AAAAZ-AAAA5

Online installer¶

Whereas Online installer is smaller (~0.5MB) but dependencies are downloaded at installtime on a cpan mirror. Furthermore, it allows agent to use already installed local perl distribution. Note that you can use a custom cpan mirror with that installer. CPAN proxy configuration has also been simplified.

@ECHO OFF
set version=0.10.1
set programpath=%~dp0\..

%programpath%\out\Armadito-Agent-%version%-Setup-Online.exe ^
 /SP- /VERYSILENT /LOG=%programpath%\out\setuplog.txt /KEY=AAAAE-AAAAD-AAAAF-AAAAZ-AAAA5 /PERLPATH=C:\strawberry

Board¶

The focus of this board is mainly about armadito agents management. That submenu is the main board of the plugin. Like all plugins’ boards, it will be fully configurable.

For now, there is three charts :

• AntivirusChart : shows antiviruses repartition of enrolled agents.
• ComputersChart : shows armadito agents repartition in comparison to GLPI computers.
• LastContactsChart : shows agents connexions of last hours

Agents¶

This submenu should be used frequently because it is the main interface for managing agents. Basically, it is a configurable list of enrolled agents.

The first thing to understand is that you can easily search and select group of agents by this web page. It uses one of the most powerful features provided by GLPI project’s core for manipulating objects you have in the web console. It is implemented and used in GLPI since a long time. It allows you to perform simple to very complex database requests. Then, once you have selected some agents, you can perform what GLPI calls “massive actions” on them.

Example :

You want to deploy an on-demand scan on agents that have Kaspersky installed.

1 - You configure the search engine in order that only agents with Antivirus Name containing “Kaspersky” are selected.

2 - You select all agents that are now listed

3 - You click on action and select Scan

4 - You select a scan configuration (previously created)

5 - You select a job priority and that’s all.

Antiviruses¶

This submenu is a configurable list of all antiviruses enrolled until now. Some massive actions could be added here in future versions.

Enrollment Keys¶

This submenu is where you can manage your enrollment keys. You can create/revoke enrollment keys. Before doing anything else in the plugin, you have to create one or more enrollment key(s).

If you are not new to GLPI, you probably found by yourself how to add a new key. Indeed, the procedure is quite simple :

1 - Click on “+” button on the top at left

2 - Select an expiration date and the usage counter

3 - Validate form by clicking on add button

To revoke enrollment keys :

1 - Select one or more keys

2 - Select “put in dustbin” Action and validate

Usage counter is decremented at each newly enrolled agent. It can be really helpful if you want to keep a true control of enrollment process in your infrastructure.

Configuration¶

That menu regroup configurations for the whole plugin. It allows you to rapidly check what configuration variables are available.

• Configuration

Board¶

That board has been implemented to simplify the way you can visualize your antiviruses. Each agent send regularly databases updates statuses. The provided charts are here to help you detecting which agents/antiviruses might have problems updating their databases.

The plugin provides some default charts but we really think that ussers feedback will help improve this kind of board. Users feedback should give an idea of what are the best indicators, of what really need administrators. All ideas are of course welcomed.

For now, there is three charts :

• UpdateStatusChart : shows databases updates statuses repartition
• MostCriticalUpdatesChart : shows top 10 agents with most critical updates
• LastUpdatesChart : shows databases updates of last hours

States¶

Similar to General > Agents, this submenu allows you to search and select agents. But this time, it is focused on databases updates management. And it gives you a simple way to be sure that everything is going well, that every antiviruses’ databases are up-to-date. Most antiviruses basically split their database updates into multiple sub parts (or modules). Also, a link inside each row allows you to check databases updates in details.

Furthermore, you probably want to be sure that antiviruses’ real time protection is activated. Also, a section called “AV Details” refers to every statuses information related to an installed Antivirus. It includes real time protection status for example. With some Antiviruses, it means a lot of details. It is why we called this menu “States”. It does not only consider databases updates.

AV Configurations¶

This part is about controlling your antiviruses’ configuration. It implies a large data set to store into GLPI database. Because GLPI uses MySQL, the implementation on how are stored configurations is very specific. To be able to gather data from big infrastructures, a custom Entity–attribute–value model has been implemented. Indeed, we think that most configurations over a same IT infrastructure are most of the time very similar, even sometimes identical. Also, it is not worth to store identical data multiple times. It leads to a great reduction of database size usage.

Board¶

It is here possible to know which antivirus detects more viruses in your IT infrastructure. While it is not the initial purpose, it could be used as a realtime antiviruses comparison tool. You can also detects what kind of virus has spread the most.

For now, there is three charts :

• AlertsByVirusNameChart : shows alerts repartition by threat name
• LastAlertsChart : shows alerts traffic of last hours
• AlertsByAntivirusChart : shows alerts repartition by antivirus name

Alerts¶

That section is where centralized alerts can be monitored. For example, you can search for some specific alerts coming from multiple antiviruses, from multiple operating systems. Furthermore, you can manipulate these alerts by removing/restoring them as you wish.

More features will be easy to add because of the way “massive actions” are implemented in GLPI. We could later imagine features like sending a group of alerts by email, etc.

Board¶

Deployed scan results are stored in GLPI database. Also, some charts gives an overview of what has been successful or not. Scan durations can be compared to each other. It leads to a better management of future scans, because you are able to know how long a specific scan take in your infrastructure.

For now, there is three charts :

• ScanStatusChart : shows deployed scans statuses’ repartition
• LongestScansChart : shows top ten longest scans
• AverageDurationsChart : shows average duration by scan configuration

Scans¶

This submenu gives details about deployed scans. It includes a link to the scan configuration used. It gives you once again a search engine for selecting scans. Furthermore, it can be useful to know which kind of scan leads to more threat detections.

Configurations¶

This part is important because it is needed for deploying a new scan. It’s the single place where you set AV specific’s scan options. You can select an enrolled Antivirus, define where to scan and with which parameters.

Example :

You want to create an on-demand scan configuration for agents that have ArmaditoAV installed :

1 - You click on “+” on the top at left

2 - You fill form according to your needs

3 - You validate

Board¶

Once again, you want to be sure that all is working fine on your agents. Also, you could see which jobs takes too long.

For now, there is three charts :

• JobStatusChart : shows job statuses’ repartition
• LongestJobRunsChart : shows top ten longest jobs executions
• AverageDurationsChart : shows average job execution duration by kind of jobs

Jobs¶

You probably want to know regularly what jobs fails and with which error message. It is possible by this submenu. It is another search and select menu. Some columns includes hyperlinks for more details about a job, a scan or something else.

Board¶

Schedulers¶