Announcing Software Assistant (SWA)

[Bob E Campbell]

SWA has been released on Software Depot. You can consider SWA to be an upgrade for the security_patch_check(1M) tool adding features from the ITRC itself. Some highlights:

* analyze remote systems
* download patches and patch bundles
* detection confidence reported for security issues
* 3 text report types
* HTML report links to patch and bulletin text

Team members will be looking for comments and questions in these forums. To learn more and download SWA please visit:

http://www.hp.com/go/softwaredepot

[Bob E Campbell]

A direct link has been established for Software Assistant! Save your button-clicking finger by using http://www.hp.com/go/swa.

[Geoff Wild]

Thanks Bob!

This looks very interesting indeed.

I will D/L and test on Monday.

Rgds...Geoff

[John Payne_2]

I've been using it for several months now, it really is a good product. I really like the "analyze remote systems" feature.

John

[John Payne_2]

(Back to the top)

John

[Denver Osborn]

Bob,

How does swa-get download the recommended patches? Can it download all recommended patches as a single gzipped tarball?

Thanks,
-denver

[Bob E Campbell]

Oh boy... time to start writing that white paper...

Once an SWA analysis has been performed, the patches and QPK bundles identified, the "swa get" command downloads to a staging directory (the software cache) if not already found. Once the cache is full it automatically copies the content into the specified depot.

The actual download can be controlled via a number of mechanisms, including the use of an external command such as curl. By default it is from the HP FFS servers via https.

We envisioned a central server with lots of disk space keeping a fairly large cache around, but are considering an option to download and place into the depot patch by patch for those that do not want to keep anything in the software cache (single-system model).

[Ivan Krastev]

Sounds good this remote analyze - will test it soon.


regards,
ivan

[Bob E Campbell]

D'Oh! Monday morning without enought caffeine....

The SWA catalog is downloaded via https, the patches and bundles are then grabbed via ftp. The downloads are validated by the MD5 sums found in the catalog.

I should never post until after dinner...

[Doug Burton]

I like it so far. Nice little web page by just running "swa report -r action" made the text and html output.

Open the web page and click on an "Issue" number and it takes you to the technical knowledge base document. Like I said, nice.

[Geoff Wild]

Strange thing for - no man page installed....

It would be nice instead of having to do a -a for all items you want but to also have a -e (exclude).

IE - we don't use QPK's here - as we get custom patch bundles from HP.

So I ran it like so:

/opt/swa/bin/swa report -r action -a SEC -a PCW -a PW -a CRIT

Came up with an interesting report on my recently patched ia64 test workstation.

Rgds...Geoff

[Bob E Campbell]

Man pages should be installed, but MANPATH will not update for your shell unless you source /etc/MANPATH. They are found under /opt/swa/share/man.

The PW analyzer includes both critical and non-critical warnings, so the "-a PCW" is redundant (lots of discussions, but that is where we ended up).

The default analyzers QPK (Quality Pack update available), PCW (installed, active patch with critical warning), and SEC (applicable security bulletin) make a pretty short list. Give it a couple of weeks and let me know if you still think that an exclude option is important. Be aware that you can set your own defaults via options files. Look at the "Extended -x Options" section of the swa-report(1M) man page.

Bob

[Steven E. Protter]

Shalom,

Seems the attempt has been made to replace certain features I currently provide manually.

It would seem that Internet Access is required to run the swa get section, thereby requiring some kind of secondary exposure to use the tool.

What I mean is that your swa server needs Internet access to get the patches and bundles and remote access to other systems to analyze their needs and create bundles.

That causes problems with our security model. We would need to be able to gather information on systems on closed networks, provide it to the Internet exposed server, build the patch set and carry it back on USB key or whatever to get it to the closed system.

I'm not sure this tool can do that, but I'm going to have to play with it to be sure.

SEP

[Steven E. Protter · Accepted solution]

Doh!

I just realized I used the swainv tool to perform the task I just complained was impossible in my prior post.

Doh!

I'll stop typing now.

:-)

SEP

[Bob E Campbell]

Sneaker-net was built into the tool from the get go. The one area that the team did not agree on has some workarounds and will be addressed in a future release.

A by-product of the "report" major mode is the analysis file. All downloads and reports are generated from this file. By using media to relocate this file to an accessible machine the "get" major mode can then be used to create a depot. At that point it is a simple SD exercise to put the depot back onto media.

The other option is to move an inventory file from the secured box to the unsecured server. These files are cached, with the filename using the cksum of the target string. Unlike analysis files, we do not have the ability to override the cache naming convention so while doable the inventory export is not yet "friendly". I am assuming that this will be a popular enhancement.

Oh, the inventory format is generated by the same script (newer revision) used today for ITRC patch analysis (swainv, name makes sense now...huh ;-).

Bob

[Bob E Campbell]

I just realized that the swainv discussion is likely to become a FAQ. If you will post a question on using swainv with SWA I promise to answer it in all of its gory detail.

Note that if you have SSH access to the closed system from the open you could simply use the command line:

# swa report -s ssh://safebox

or similar. The need for that swainv posting is really about air-gap security.

[Bob E Campbell]

Sorry Steve and Denver, I thought I had assigned you both 5 points but must have clicked something wrong. I caught Steve next time, Denver you just have to post again.

I suppose I should close this announcement thread out but will give it a few days. Consider posting questions to new threads to help those who follow you.