Updating Unix hosts by pushing files

Hello Nicolas Schmeltz,

in a DMZ
if this (contrary to the usual meaning) is indeed a segment without Internet connection (i.e. an insular LAN segment) I'd rather read from the regular LAN than allowing writes - just my 2 cents though.
Anyway, savupdate expects a certain structure and makes some consistency checks so you can't feed it just a list of files. [The following is mainly speculation as we update using the preferred method]. It seems that savupdate would accept the .../savi/sav/ directory using vdlmnfst.dat to check its consistency, but it doesn't expect this file to be larger than about 16k (this suggests that this "simple" IDE updating is a deprecated feature).
As per chapter 15.4 of the v9 configuration guide you should use (a copy of) /opt/sophos-av/update/cache/ as source (please note you need a setting to be able to update different distros).

[sending] /data/sophos/savlinux
what are the contents of savlinux (why delete BTW)? Doesn't seem to be a full copy of a CID (or the cache) otherwise savupdate should be able to use it.

clean the cache
it will be rebuilt on the next update. Admittedly 250+MB isn't nothing (I remember the time when a 120MB HDD was considered obscene [;)]) and economy is elegance but then it's also not an enormous amount - so why do you want to clear it?

Christian

Hello Christian,

Thanks for your answer.

QC said:

in a DMZ
if this (contrary to the usual meaning) is indeed a segment without Internet connection (i.e. an insular LAN segment) I'd rather read from the regular LAN than allowing writes - just my 2 cents though.
Anyway, savupdate expects a certain structure and makes some consistency checks so you can't feed it just a list of files. [The following is mainly speculation as we update using the preferred method]. It seems that savupdate would accept the .../savi/sav/ directory using vdlmnfst.dat to check its consistency, but it doesn't expect this file to be larger than about 16k (this suggests that this "simple" IDE updating is a deprecated feature).
As per chapter 15.4 of the v9 configuration guide you should use (a copy of) /opt/sophos-av/update/cache/ as source (please note you need a setting to be able to update different distros).

[sending] /data/sophos/savlinux
what are the contents of savlinux (why delete BTW)? Doesn't seem to be a full copy of a CID (or the cache) otherwise savupdate should be able to use it.

The network topography is not in my scope, but I just can say that some servers can only be reached in this way. As we have a lot of servers to maintain, I cannot change this historically way to update them...

savlinux contents is the files of sophos to be installed (I used --delete to remove files which are no more present in a new version)

I updated the software yesterday, fron Product version 5.19 to 5.21 - Engine v. 3.63 to 3.64, and the update works again in the way I explained.

QC said:

clean the cache
it will be rebuilt on the next update. Admittedly 250+MB isn't nothing (I remember the time when a 120MB HDD was considered obscene [;)]) and economy is elegance but then it's also not an enormous amount - so why do you want to clear it?

Hello Nicolas,

The network topography is not in my scope
just felt like I should mention it.

Product version 5.19 to 5.21 - Engine v. 3.63 to 3.64
Hm, maybe I'm dense - 3.64 is the current engine. The product should be 9.11.1 (or maybe an earlier version but definitely 9.x)  though. 5.xx looks like Detection Data, but their current version is 5.26.

savlinux
this would be the appropriate source for updating - assuming this is a copy of /Cache/Primary/ (if a Linux machine downloads from Sophos) or \CIDs\Sxxx\savlinux\ (if using SUM/SEC on Windows) - as it will update detection data and software as well

clearing the cache
if I understand correctly you're updating manually, correct? An update compares the cache to the source, downloading or copying what's not in the cache. The actual update is done from the cache, afterwards the cache is AFAIK not used.

Christian

Hello Nicolas,

The network topography is not in my scope
just felt like I should mention it.

Product version 5.19 to 5.21 - Engine v. 3.63 to 3.64
Hm, maybe I'm dense - 3.64 is the current engine. The product should be 9.11.1 (or maybe an earlier version but definitely 9.x)  though. 5.xx looks like Detection Data, but their current version is 5.26.

savlinux
this would be the appropriate source for updating - assuming this is a copy of /Cache/Primary/ (if a Linux machine downloads from Sophos) or \CIDs\Sxxx\savlinux\ (if using SUM/SEC on Windows) - as it will update detection data and software as well

clearing the cache
if I understand correctly you're updating manually, correct? An update compares the cache to the source, downloading or copying what's not in the cache. The actual update is done from the cache, afterwards the cache is AFAIK not used.

Christian

Hello Christian,

In fact I receive updates from our Windows team. I get the update files in CIDs\S000\savlinux and CIDs\S000\EESAVUNIX shares.

On the Unix side, we push the (less) data (as possible) to update / upgrade the signature files / the software.

I'm sorry because I'm not familiar with this Sophos software for now, but the versions I've found :

#>cat /opt/sophos-av/engine/savVersion

9.11.0.4.3

#>/opt/sophos-av/bin/savscan -v

SAVScan virus detection utility

Copyright (c) 1989-2016 Sophos Limited. All rights reserved.

System time 03:02:55 PM, System date 03 May 2016

Product version : 5.19.0

Engine version : 3.63.0

Virus data version : 5.25

User interface version : 2.03.063

Platform : Linux/AMD64

Released : 08 March 2016

AVScan virus detection utility

Copyright (c) 1989-2016 Sophos Limited. All rights reserved.

System time 03:02:55 PM, System date 03 May 2016

Product version : 5.19.0

Engine version : 3.63.0

Virus data version : 5.25

User interface version : 2.03.063

Platform : Linux/AMD64

Released : 08 March 2016

So I assume that we can update signatures with this sources.

clearing the cache

We use a crontabed batch to update.

 I understand that we can safely add a command to clean up the /opt/sophos-av/update/cache/Primary/ directory

Thanks for your help.

Nicolas