Need to get antivirus for your Mac

I just read that Apple is now recommending antivirus software for your Mac. I'm guess it is because of people like this:
http://www.overheardinminneapolis.com/2008/11/not-if-you-stick-to-the-trusted-sites.html

Yuppie man: It’s a Mac. You can’t get a virus on a Mac.
Yuppie woman: Even with all the porn you watch?

Minneapolis, Outside The Bryant-Lake Bowl

I'll be honest with you, I've been a little bit slow to put antivirus software on my Mac. For one thing, I happen to really love my Mac and I'm not really interested in gunking it up wit too much extra software. The second reason why I have been slow to install AV is that the operating system is much more secure by default and has a natural resistance to viruses that isn't found in pre-Vista versions of Windows. I know that isn't an excuse, but dammit it's the truth! The final reason that I've been slow is that I just don't feel like antivirus software works very well. I've encountered so many virus infected machines that had up to date signatures, that I've become sour on the whole idea.

Now before you go blasting me about my responsibility to run antivirus software to protect all of the other people on the Internet let me just say: yes, I'm going to do it. Soon. I've just been reluctant. Sorry.

Full Disk Encryption for Mac is slowing me down

I finally got my hands on a full license for Full Disk Encryption for Mac, and I installed it tonight. In fact, my machine is encrypting right now as I write this post. On Windows machines, the encryption process (prot_srv) throttles itself if someone is using the computer. That is why you can deliver a computer to an end user without waiting for the encryption to end.

Unfortunately, that doesn't seem to be the case on the Mac product. I'm really feeling the pain right now. Hopefully it will be done encrypting by morning.

OS X Full Disk Encryption: How to reimage a machine

A while back I borrowed a MacBook from a co-worker so that I could get started testing Full Disk Encryption for OS X. FDE is Checkpoint's version of Pointsec for Macs. I had a 30 day evaluation license, so I applied the software and wrote a couple blog entires about it. Then I got my own MacBook and gave back the one that I borrowed.

Today that coworker came to me with a question about FDE. It seems that once you've installed FDE you can't just install OS X over the top when you're ready to reimage. He booted the MacBook from the installation CD, but when it came time to select the drive that you want to install it on, he got this error.

Let me start by apologizing for the quality of the pictures in this post. Since I don't have OS X running on any virtual machines, I can't just do a screen capture. What you're seeing is the pictures I took with my cell phone. I know, it sucks.

So I called up Checkpoint support to see if they had any ideas. First I waited on the phone for 20 minutes to talk to someone, which is unusual because I typically get a response right away when I call. I also had to deal with the problem I've been having getting my support contract bound to my support account. Even though it has been two months, they still can't seem to recognize that I have support. After I got through all of that, the support technician told me that I would probably have to decrypt the drive using my recovery file and then install OS X.

I was not satisfied with this answer, and I decided that I was going to play around a bit and see if I couldn't come up with something faster, and I did. I booted the computer from the installation CD, but this time I went up to the menu at the top, clicked on Utilities and then Disk Utility. Disk Utility showed me that the hard drive had been partitioned by FDE into a small boot loader and a large encrypted drive. I simply changed the partition scheme to one partition, named the volume Macintosh HD, and set the format to Mac OS X Extended (Journaled). The formatting process took all of 30 seconds, and when I quit Disk Utility I was able to install OS X on the hard drive again. Problem solved.

VMWare Fusion on Removable Device

A while back I made the switch to using a Macbook and put away my trusty linux laptop. One of the things I've had to get used to is VMWare Fusion. I ran into an interesting experience today that I thought I would share in case anyone else has this problem.

Lately I've been teaching a class on Pointsec for PC and in the class I make heavy use of virtual machines so that I can quickly roll back changes and be ready for the next class. So I started setting up my virtual machines on the Macbook. However, I don't want to use up my precious hard drive space with virtual drives, so I store them on a 1 TB external drive. Imagine my shock this morning when I went to fire up my virtual machines and found them to be gone!

I did a quick scan of Google but didn't find any answers. Then I started looking for an answer myself, and I figured out why it wasn't on Google. The reason I couldn't find anything on Google is that the answer is so dead simple that nobody (other than me) would ever blog about it. I opened up the removable drive and found the actual files with .vmware extensions. By the way, these are actually directories, but they appear as files. So I said "let's try something really easy. After all, everything else on my Mac is easy." I dragged the files over to the Virtual Machine Library window and voila! Since this did eat up some of my time, I thought I would write a post about it and hopefully if someone else has this problem they wont freak out for as long as I did before they stumble upon the obvious answer.

Sidewinder Admin Console Problem

In a previous post I talked about how to use wine on OS X and linux to run your Sidewinder Admin Console even though this is a windows only application. Well, something has changed.

This morning I was applying some patches and updates to my Sidewinder. I was a little bit behind, when all of a sudden my updating technique stopped working. I would log into the firewall, and it would inform me that I needed to update my client. So far so good; then it starts downloading the update. After a brief pause it tells me that it has successfully downloaded AC407.exe and asks if I want to shut down the client and install the update. Now here is where things change. In the past, I've said no to the application, opened my command prompt and gone to the ~/.wine/drive_c/Program Files/Secure Computing/Sidewinder 7 Admin Console/ac/ac_updater folder and ran the newest executable in the list. But this time around no executable is present. I tried using the find command to see if the executable had been saved in a new location, but no dice.

After trying a couple of times I went looking for new files on my system. I used the find command to see what files had changed in that directory recently:

cd ~/.wine/drive_c/Program\ Files/Secure\ Computing/
find . -newerct '5 minutes ago' -print

I found an interesting file called tempfile.pyc that appears to have been updated as I was downloading the executable. So I tried running pythonw.exe against that file, but nothing happened. I also tried to run pythonw.exe against ac_updater.pyc, which gave me an error about not being able to read the package list. Well, this is a start, but it doesn't get me much closer to getting into my admin console.

Of course, I'm going to keep looking for a way to make this work. I know that running that admin console on OS X is not supported, but I hate having to open a virtual machine to make a small change in a firewall rule.

UPDATE: I have a fix. The process that the admin console uses to update itself hasn't changed. It still tries to copy an executable to the client in the same directory, but for whatever reason it just wasn't showing up on my OS X machine. So I installed the updates on a Windows machine, and then I copied the executable over to my OS X machine and ran wine on the file. Now I'm back to running my firewall without having to use a virtual machine.

The lesson to be learned here, and something I should probably have impressed on everyone to begin with, is that you should still have a Windows machine with the admin console installed and available to you. You don't have to always use that, but if you're in a pinch you want to make sure that the supported option is available to you.

Using Sidewinder Admin Console on OS X & Ubuntu.

Anyone that knows me is probably tired of hearing how much I love the Secure Computer Sidewinder firewall. This product has recently been renamed to the Secure Computing Secure Firewall (Sidewinder). Most people that work for Secure Computing that I've spoken too are also tired of hearing me complain about the name change too. I even wrote to Secure Computing's marketing department to gripe about it, but they never wrote back.

I have very few complaints about the product, but one that really gets under my skin is that you have to run the Admin Console from a Windows machine. I run Ubuntu on my desktop and OS X on my laptop. If I need to use a Windows app I have to fire up one of my virtual machines. That's a real pain in the butt when sometimes I just want to make a minor tweak to my firewall config.

Luckily for me, the Sidewinder Admin Console is python based and runs very well on WINE. You may be wondering why I have to use wine at all if the program is written in python. Well the answer is because they don't ship plain text files, they actually ship compiled python which was compiled on Windows and wont work with the python built in to your OS X or linux machine. I tried, it didn't work.

But what did work for me was wine. So that's the first thing that you have to do to make this whole thing work: install wine. On the Ubuntu box it was as simple as typing sudo apt-get install wine. On the OS X machine I installed macports and XCode. Then I was able to type sudo port install wine. Ages later, the latest verion of wine was on my OS X machine.

Now for the installation of the Admin console. On the Ubuntu machine I put in my Sidewinder Management Tools CD and opened a command prompt. I navigated to /media/cdrom0/Install and ran wine setup.exe. The install wizard appeared and installed as expected. On the Mac it was equally simple. Put in the CD, open a terminal and go to /Volumes/Sidewinder 7/Install and run wine setup.exe.

Here is where things start to differ between the two systems. On the Ubuntu machine I can open the Admin Console by going to the Applications menu, navigate to Wine, Program Files, Sidewinder, and just run the admin console. On the Mac, things are a little different.

On the Mac, I have to open a terminal again in my home folder and type cd .wine/drive_c/Program Files/Secure Computing/Sidewinder 7 Admin Console/ac/lib. From this directory I have to run the following command: wine "c:\program files\secure computing\sidewinder 7 admin console\python\pythonw.exe" "c:\program files\secure computing\sidewinder 7 admin console\ac\lib\cobraclient.pyc" This will open the Admin Console for me. If I enter the same command but I'm not in the folder that I mentioned above I get an error message. I know the preview looks really blurry, try clicking on it to see the error in detail if you're interested.



If everything works right you get to see the Sidewinder Admin screen come up.



You're obviously not done yet. The Admin Console on your Management CD is a little outdated, and when you connect to your firewall you're going to have to download and apply some updates. On a Windows machine this is an automatic process, but when you're using wine you have to do things manually. Connect to your firewall and say yes to download the updates. After you've downloaded the updates the Admin Console will tell you that it is going to close and apply the updates. It does close, but it does not apply the updates, you must do that yourself.



You should be in the ac/lib directory, so you need to go up one folder and into the ac_updater folder. The full path is ~/.wine/drive_c/Program Files/Secure Computing/Sidewinder 7 Admin Console/ac/ac_updater. Now you will have several executable files numbered sequentially. Run wine on each of those executables in numerical order. After each wizard finishes running you will have to wait 30 to 60 seconds for your command prompt to come back. That is normal. I also had two of the updates write a lot of error messages: err.storage:BlockChainStream_WriteAt not enough blocks in chain to write data. However I pressed on with the next update and everything worked fine for me.



Once the updates were complete, I was able to navigate to the proper directory, run the command above and voila! Sidewinder Admin Console running perfectly on Mac OS X. For Ubuntu all I have to do is to to my Applications Menu, click on Wine, and follow the tree to my admin console. I wish that it were that easy on my Mac. However, to reduce the inconvenience of navigating to directories and entering long commands on my Mac, I wrote a batch file that will handle it for me. I still need to open terminal to run this, so it's not quite as nice as I would like, but at least I don't have to boot into a virtual machine. Here is the code for that batch file.

#! /bin/bash

cd ~/.wine/drive_c/Program\ Files/Secure\ Computing/Sidewinder\ 7\ Admin\ Console/ac/lib/

wine "c:\program files\secure computing\sidewinder 7 admin console\python\pythonw.exe" "c:\program files\secure computing\sidewinder 7 admin console\ac\lib\cobraclient.pyc" &

UPDATE: I did run into some problems with updating my client about a month later after I applied some patches, but I was able to work through it and keep running my firewall without using a virtual machine. Check out this post for the dirty details.