Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 62 replies
  • Subscribers 0 subscribers
  • Views 195128 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SEC 5.2.1 and Sophos for MAC OS X Preview (9.0.3)

QC

Decided to give the Preview of Anti-Virus for Mac OS X, version 9.0.3 a try. Chose an old MacBook (running 10.4) as guinea pig. After assigning the alternate policy updating failed with a rather vacuous Error: Could not update Sophos-Anti-Virus at .... Update failed. No indication of the nature or the error and surprisingly no indication of the update location used. 

Now, the error was not unexpected - 9.0.x requires MAC OS X 10.6 minimum but perhaps a more meaningful message could be issued. Anyway I checked the update location and found that it named ESCOSXL as source folder - obviously indicating the changed requirements (though I can't figure out what the L stands for :smileyhappy:).

Admittedly pre-10.6 versions should be rare by now (I've found two 10.5 installations still in use out of about 100). But the folder name change will affect unmanaged or occasionally off-site clients (yes, Cloud is the answer :smileywink:). I've found no reference though (I'd have expected this in the Release Notes). Even as it is Preview you should be required to discover this important information on your own.

Christian   

:43783


This thread was automatically locked due to age.
Parents
  • 0

    Hi Carob,

    Thanks for the frank dialog, I really do appreciate the feedback. My goal is to find the feature set from SUM for Mac that is needed to cover the use cases for standalone users (by "standalone" I mean not managed by SEC nor managed by Sophos Cloud - sometimes "managed" means different things for different organizations).

    The pre-configuration process writes data into a file inside the installer in the Custom folder. The username and passwords you provide on the command line are encrypted in that file such that we minimize the chance of accidental disclosure.

    On-access scanning should definitely be on by default. Our product is most effective when that is true. Let me know if you don't get to the bottom of that one.

    Re: your other configuration issues, its likely that the "managed" settings are still resident on the endpoint. In the past, since day one of the product, the philosophy had been "don't delete preferences they might be useful if you reinstall" but that has turned out to be more confusing than helpful. In future versions the Remove app will turf the preferences files too. You can do it manually by deleting all files starting with "com.sophos." in the /Library/Preferences directory before you install again.

    Re: the "When a threat is found" option, which option do you think is best for your organization? By default we just do "deny access" but I could see where "cleanup" could be more appropriate. In fact the default configuration for endpoints managed by Sophos Cloud will do that for you.

    Re: my comments about SUM for Mac lacking features, yes I see your point because "lacking" is a relative term. We've continued to evolve the endpoint well beyond the configuration options offered by SUM for Mac, and we aren't prepared to maintain a Mac-specific solution. Both SEC and Sophos Cloud offer cross-product management (full policy functionality, event monitoring, reporting, etc) in ways that SUM for Mac could never sustain.

    :45067

    ---

    Bob Cook (bob.cook@sophos.com) Director, Software Development

Reply
  • 0

    Hi Carob,

    Thanks for the frank dialog, I really do appreciate the feedback. My goal is to find the feature set from SUM for Mac that is needed to cover the use cases for standalone users (by "standalone" I mean not managed by SEC nor managed by Sophos Cloud - sometimes "managed" means different things for different organizations).

    The pre-configuration process writes data into a file inside the installer in the Custom folder. The username and passwords you provide on the command line are encrypted in that file such that we minimize the chance of accidental disclosure.

    On-access scanning should definitely be on by default. Our product is most effective when that is true. Let me know if you don't get to the bottom of that one.

    Re: your other configuration issues, its likely that the "managed" settings are still resident on the endpoint. In the past, since day one of the product, the philosophy had been "don't delete preferences they might be useful if you reinstall" but that has turned out to be more confusing than helpful. In future versions the Remove app will turf the preferences files too. You can do it manually by deleting all files starting with "com.sophos." in the /Library/Preferences directory before you install again.

    Re: the "When a threat is found" option, which option do you think is best for your organization? By default we just do "deny access" but I could see where "cleanup" could be more appropriate. In fact the default configuration for endpoints managed by Sophos Cloud will do that for you.

    Re: my comments about SUM for Mac lacking features, yes I see your point because "lacking" is a relative term. We've continued to evolve the endpoint well beyond the configuration options offered by SUM for Mac, and we aren't prepared to maintain a Mac-specific solution. Both SEC and Sophos Cloud offer cross-product management (full policy functionality, event monitoring, reporting, etc) in ways that SUM for Mac could never sustain.

    :45067

    ---

    Bob Cook (bob.cook@sophos.com) Director, Software Development

Children
No Data
Unfiltered HTML