Mirtov Alexey 33d0bd4365 add english		vor 2 Jahren
..
images	a02e8ecf45 update ksc	vor 3 Jahren
updates	452f9d1dc3 update	vor 3 Jahren
README.md	33d0bd4365 add english	vor 2 Jahren
README_RU.md	33d0bd4365 add english	vor 2 Jahren
cloud-init_lin.tpl.yaml	44c65fd8d6 update	vor 3 Jahren
cloud-init_win.tpl.yaml	a02e8ecf45 update ksc	vor 3 Jahren
docker-declaration.yaml	2578d20f98 update	vor 3 Jahren
kaspersy-install-in-yc.zip	a02e8ecf45 update ksc	vor 3 Jahren
network.tf	44c65fd8d6 update	vor 3 Jahren
updates.zip	f901bdcab4 archives	vor 3 Jahren
variables.tf	2578d20f98 update	vor 3 Jahren
versions.tf	2578d20f98 update	vor 3 Jahren
virtual_machines.tf	dad11fa3a8 Update virtual_machines.tf	vor 3 Jahren

Deploying Kaspersky Antivirus in Yandex.Cloud (Compute Instance, COI)

The purpose of the demo is to deploy the Kaspersky solution and remotely install agents in Yandex.Cloud to provide antivirus protection for:

Windows and Linux VMs.
Containers in COI(Container Optimised Image).

Detailed workshop analysis in the video:

Diagram:

Description:

The following tasks will be run during the workshop:

Installing the infrastructure using Terraform (Infrastructure as a Code).
Installation, basic configuring, and running tests Kaspersky Security for Virtual and Cloud Environments (PAYG).

Preparation and prerequisites

Install and configure YC CLI.
Install Terraform.
Install additional software: RDP Client.

System requirements for target VMs

The workshop uses Kaspersky Endpoint Security 11.2.0 for Linux. See the system requirements for the OS.

Infrastructure deployment:

Download the archive with files kaspersy-install-in-yc.zip.
Go to the folder with the downloaded files.
Fill out the required parameters in the variables.tf file: 'token,cloud_id,folder_id` (see comments in the file).
Execute commands: terraform init terraform apply
After executing the commands, confirm the action and enter: Enter a value: yes

The infrastructure is ready:

Setting up KSC:

Wait for 3 minutes.
Connect to the KSC server via RDP to an external address. The IP address will be displayed in the command line output. Login: Administrator. To get a password, enter the command:
```
terraform output ksc-pass
```
Wait for KSC installation to complete (at this time, follow steps 3-5).
Terraform will save the SSH key at the following path: C:\private.pem. Remove unneeded rights from the file, leaving only the administrators group: right-click on the file → Security → Advanced → Disable Inheritance.
Add a passphrase to the SSH key using CMD:

ssh-keygen -p -f C:\private.pem 
(specify the passphrase)

Download KES 11.2 to the KSC machine: the archive updates.zip.
Create an installation package for KES 11.2:
Advanced → Remote Installation → Installation Packages → Create ins. packet.
Select the option: Create from Kasp. applications.
Specify the .kud file from C:\Users\Administrator\Desktop\kesl-11.2.0.4528
Install the management plugin by running the updates/klcfginst.msi file.
Create device groups (Managed Devices → New Group):
Linux.
Windows.
Create rules for moving devices to groups (Unassigned Devices → Configure rules):
Linux "192.168.30.0/24";
Windows "192.168.20.0/24".
Create network polling rules for the same subnets: Advanced → Device Discovery → IP ranges (be sure to right-click on IP ranges → Enable poll)

Installing antivirus software on VMs

Kaspersky antivirus software consists of two parts: the management agent and the antivirus software Kaspersky Endpoint Security for Linux (KESL), Kaspersky Security for Windows Server (KSWS). There are several ways to install the antivirus on VMs:

Remotely, using SSH or Windows credentials.
Using a local installation script (for more information, see the documentation).

Remote installation on Linux VMs, including COI installation

Create a task for automatic installation of the antivirus agent + KESL:
Create a task from the Managed Device → Linux folder (you can schedule it).
Specify SSH credentials for the certificate (user: 'yc-user`), select the KES 11.2 package and agent 12.
Wait until installation completes.
Create the tasks:
Downloading updates to the KSC repository.
KESL database update on machines.
Full check.
Go to the VM list and check that the antivirus is installed.

Remote installation on Windows VMs

Log in via RDP using the administrator account (you generated the password previously via Terraform) on the Win0 or Win1 VM, then run commands in the PowerShell to uninstall Windows Defender:

sc query WinDefend
Uninstall-WindowsFeature -Name Windows-Defender
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

Create a task for the auto-installation of the antivirus agent + KSWS:
Create a task from the Managed Device → Windows folder (you can schedule it).
Specify the Windows credentials: administrator (you generated the password previously via Terraform), then select package 11.1 and agent 12.
Wait for the agent and antivirus to be installed on the VMs.
Go to the VM list and check that the antivirus is installed.

Antivirus health check on VMs (Linux and Windows):

sudo wget https://secure.eicar.org/eicar.com.txt

The download has been blocked. In the events of this machine, check that the threat has been detected.

Log in via RDP to any Windows machine, download an instance of the eicar virus — https://secure.eicar.org/eicar.com.txt
Go to the properties of any Windows machine, make sure that the antivirus has deleted the eicar.com.txt file.

Antivirus health check in COI containers:

Learn more about scanning containers: https://support.kaspersky.com/KES4Linux/11.1.0/ru-RU/191702.htm

Container-lin has already been downloaded to the VM, and the vulnerable docker image (https://hub.docker.com/r/jerbi/eicar) is running

Create a container scanning task on the container-lin VM:
Log in to Tasks.
Create new task → KESL 11.2 → container scanning.
Make sure that the detection of a malicious container image is visible in the events.

README.md