Endpoint Protection

Hello all

I've successfully installed SAV for Linux 1.0.14.13 on Ubuntu 12.04.2 x64 and it's running OK.  Next step is to push reporting information to our SEP 12.x Management Console!

I follow the instructions in the readme file:

Install a SAVFL MR10 or later package on the client.

SAV for Linux client is already installed.

Make sure that Perl 5.8.0 or later and the related Perl module package
(for example, perl-libwww-perl for RedHat/SuSe Linux) are installed on the client.

I run perl -v and my Ubuntu 12.04.2 x64 box tells me I have perl 5, version 14, subversion 2 (v5.14.2) installed

Next I run sudo apt-get install libwww-perl on my Ubuntu client, no problems.

I copy SAVFL_reporting-1.0.10-44.tar.gz to my Ubuntu box and unzip it, then I attempt to install it using the command:

sudo dpkg -i  savreporter-*.all.deb

And this is where it fails.  I get the following error:

dpkg: error processing savreporter-1.0.10-44.all.deb (--install):

 parsing file '/var/lib/dpkg/tmp.ci/control' near line 10 package 'savreporter':

 duplicate value for `Depends' field

Errors were encountered while processing:

 savreporter-1.0.10-44.all.deb

Please assist me.

Thank you

Have you read thru the article by Symantec's Mick2009 in regards to SAVFL Reporter:

https://www-secure.symantec.com/connect/articles/sav-linux-somewhat-illustrated-guide-part-4-savfl-reporter

Hi Abbers,

I believe you had a similar issue in the past - 

https://www-secure.symantec.com/connect/forums/cannot-install-sav-linux-1014x-ubuntu-12042-x64-kernel-35x

Symantec Antivirus for Linux requires 32-bit libraries that are not installed on the 64-bit version of Ubuntu 9.10 or 10.04.  It should work if you install the 32-bit libraries by running the following command via a terminal.

"sudo apt-get install ia32-libs"

One known Ubuntu issue that you will run into (and how to fix it):

Symantec AntiVirus for Linux Savtray GUI Does not appear in Ubuntu with Unity
http://www.symantec.com/docs/TECH199921 
 

Also- this series of articles may help you make the best use of SAV for Linux! 

• SAV for Linux Scanning Best Practices: A (Somewhat) Illustrated Guide covers the importance of auto-protect scanning, necessary scan exclusions and how to test them
• SAV for Linux: A (Somewhat) Illustrated Guide Part 2 provides examples of the various different ways in which SAVFL can be configured (by command line, by GRC.DAT and by xsymcfg).
• SAV for Linux: A (Somewhat) Illustrated Guide Part 3 focuses on how to keep SAV for Linux up-to-date.
• SAV for Linux: A (Somewhat) Illustrated Guide Part 4: SAVFL Reporter illustrates how to get some data and events from those isolated, unmanaged SAVFL clients into the Symantec AV's central management and reporting tool, the Symantec Endpoint Protection Manager (SEPM). 

It is absolutely crucial to get those Linux machines protected.  Here's yesterday's example why, from Security Response:

When Web Servers Serve Evil
https://www-secure.symantec.com/connect/blogs/when-web-servers-serve-evil

Hope that helps!!

Thanks Brian81, I looked through the article, but didn't see anything relevant to my error message.

Hello,

This issue is resolved in versions of SAV for Linux Reporter higher than the MR10 initial release.  Use MR11 or later to overcome this issue.

If that is not possible, a workaround is to follow these steps: (requires dpkg-deb be installed)

1. dpkg-deb -x savreporter-1.0.10-44.all.deb savreporter
2. dpkg-deb -e savreporter-1.0.10-44.all.deb savreporter/DEBIAN
3. Edit savreporter/DEBIAN/control and remove both Depends: lines and replace them with
   Depends: sav (>= 1.0.10), perl (>= 5.8.0)
4. dpkg-deb -b savreporter savreporter-custom.all.deb

Once this is complete, there will be a new savreporter-custom.all.deb file that can be installed using dpkg -i.

Hope that helps!!

Thank you Mithun, I was indeed using an older version of savreporter 1.0.10-44 that I mistakenly downloaded from here:

http://www.symantec.com/business/support/index?page=content&id=DOC3474

I switched to using the newer version of savreporter 1.0.14-13 that shipped with SEP 12.1 RU2 and savreporter installed without issue.

Many thanks for your assistance.