Installing and configuring Compliance Content add-ons

This topic was edited by a BMC Contributor and has not been approved.  More information.

This topic guides you through the installation and configuration of BMC Server Automation Compliance Content add-ons. The topic contains the following sections:

Overview of Compliance Content add-ons

  Click here to read an overview of the benefits of using Compliance Content in your environment.

Technical and operational standards exist to protect sensitive data held in the data center. To achieve accreditation, the data center must prove compliance with existing standards. BMC Server Automation Compliance Content libraries provide you with add-on content for BMC Server Automation, containing rule sets to automatically analyze compliance for every server in the data center. These sets of rules are based on the following standards and policies:
  • Health Insurance Portability and Accountability Act (HIPAA)
  • Defense Information Systems Agency--Security Technical Implementation Guides (DISA STIG)
  • Sarbanes-Oxley (SOX) Act
  • Payment Card Industry (PCI) Data Security Standard (DSS) requirements developed by the PCI Security Standards Council
  • Center for Internet Security (CIS) benchmarks

Results from analyses performed based on Compliance Content component templates can be used both to document the current situation and as a basis for bringing non-compliant servers into full compliance with the standard. Using BMC Server Automation Compliance Content, you can

  • Discover relevant target servers and analyze those servers for compliance with major regulatory standards and best-practice policies
  • Remediate compliance failures that were discovered by deploying BLPackages
  • Generate reports with summaries of compliance details, similar to policy audit sheets

For more information about using Compliance Content add-ons to analyze and remediate compliance with standard policies, see Compliance Content analysis and remediation.

Notes

The pre-defined component templates provided in BMC Server Automation Compliance Content libraries reflect a generic interpretation of the compliance standards, and cannot take into account the specific situation within your organization. Therefore, certification cannot be assumed and is not implied based solely on successfully complying with the rules within these templates. Additional measures, such as manual compliance checks, may be required to achieve certification.

The Payment Card Industry (PCI) Data Security Standard templates are provided in a separate group of templates for each version of PCI — PCI version 1, PCI version 2, and PCI version 3.

Warning

BMC Regulatory Compliance Templates (Policies) provided by BMC comes with remediation actions for many of the standard checks where rule check fails and corrective action may be necessary to get servers to desired state. It is recommended by BMC for customers to carefully review all the shipped remediation actions. BMC supplies Auto remediation flag and by default is set to false to ensure no changes on the managed servers are performed when certain compliance rules check fail. If auto remediation flag is set to true then BSA as part of remediation package deploy job will make changes to servers. It is the responsibility of customer to ensure and control remediation actions including auto remediation actions performed in their environment.

To install Compliance Content add-ons

The following sections dicuss how to install the Compliance Content add-ons.

Note

If you installed BMC Server Automation using the unified product installer, the Compliance Content add-ons are installed by the unified product installer, and you do not have to install them separately.

Overview of the Compliance Content installation process

For the installation of BMC Server Automation Compliance Content libraries on the Application Server, you can choose between a direct installation procedure using an interactive installation wizard or a silent (unattended) installation procedure.

During installation, the installer performs the following actions:

  • Imports groups of out-of-the-box component templates that contain compliance rules for regulatory standards and best-practice policies (HIPAA, SOX, DISA, PCIv2, PCIv3, and CIS).
  • Imports corresponding groups of remediation BLPackages into the Depot, for use in remediating compliance failures against SOX, HIPAA, DISA, PCIv2, PCIv3, or CIS.
  • Imports a group of out-of-the-box batch-type Scale Jobs that can be used for compliance analysis on UNIX and Linux platforms, especially in environments with large numbers of servers.
  • Installs various out-of-the-box configuration objects (configuration files and extended objects) that support the provided compliance rules.
  • Creates a custom property class for each policy type and defines a Default instance for the property class.

Notes

  • Note that the properties from the imported object overwrite the values defined for those properties at the target. However, for any property that you need to keep the local value at the target server, you must restore the property value after the import. For example, the STAGING_DIR property in the built-in Server property class.
  • When you upgrade to the latest version, the template customizations are lost. Ensure that you keep a backup of the customized templates and remediation packages associated with the templates.

Requirements and supported resources for Compliance Content

Before beginning the installation of Compliance Content libraries for BMC Server Automation, verify that all requirements are met on the BMC Server Automation Application Server. For the list of requirements, see Compliance Content support and requirements. For details about the operating systems supported by Compliance Content component templates of each policy type, see Compliance policy standards supported by BMC Server Automation templates.

To install Compliance Content libraries directly

Prior to performing the procedure, ensure that you have logged on as a user with administrator privileges to the computer that hosts the Application Server. On a UNIX computer, log on as root. If you are not permitted to log on as root, use the su command to run as root after logging on as a non-root user. Alternatively, use the sudo command.

  Procedure Example screen

1

In the temporary folder where you stored the BMC Server Automation installers that you downloaded from the EPD site, locate the Compliance Content installation executable file. This file has a name (for example, Content86-WIN for Microsoft Windows or Content86-LIN for Linux), depending on the exact version number and operating system.

Run the Compliance Content installation executable file to launch the Compliance Content installation wizard.

2

Click Next on the Welcome page.

3

Select I agree to the terms of the license agreement, and then click Next.
4 Choose a profile and specify a BMC Server Automation user and password for loading the compliance content, and then click Next.
5

Accept the detected Application Server host name where compliance content will be loaded, and then click Next.

  Click here if you are installing content in a multi-Application Server environment.

In a multi-server environment, to load content on multiple Application Servers within the same environment (connected to the same BMC Server Automation core database), select the check box that indicates a multi-server environment before you click Next. Then in the next window, enter the names or IP addresses of any additional application servers, one in each row, and click Next.

To successfully install content in a multi-server environment, the system user running the installer must have Network Shell write access to the application servers. For example, if you are logged onto the OS and you started the Compliance Content installer as Administrator, you need to have an entry such as the following in the users.local file on all of the Application Servers targeted by the installer: Administrator rw,map=Administrator

6 To view the variety of component templates that are installed by the Compliance Content installer or to select which ones to install, choose a Custom installation, and then click Next.
7 From the tree display select the policies and operating systems for which you want component templates for the analysis of regulatory compliance, and then click Next.
8

Accept the default location for the temporary directory where compliance content will be extracted or specify a different location, and then click Next.

The default directory is C:\Program Files\BMC Software\Content on Windows or /opt/bmc/Content on Linux or UNIX.

9 On the Preview page click Install.
10

After installation has completed (this might take some time, depending on how many component templates you selected to install), you can optionally click View Log to open the installation log.

To exit the installation wizard, click Done.

  Click here to view the location of the installation log file.

An installation log file named content_install_log.txt is created in the following directory:

  • On Linux: /tmp
  • On Solaris UNIX: /var/tmp
  • On Windows: %USER_HOME%\Local Settings\Temp (for example: C:\Documents and Settings\Administrator\Local Settings\Temp)
11 To verify that the Compliance Content libraries have loaded successfully, open the Component Templates folder in the BMC Server Automation console and browse through the newly created subfolders of component templates for the various policies.

Back to top

To perform a silent installation of Compliance Content libraries

Note

You can use silent mode to perform the installation in a headless environment (a system that has no display device, keyboard or mouse). However, if your Linux or UNIX environment has the DISPLAY variable set to export your display to a remote system, make sure that the remote system has an X Window server installed and configured.

  1. Log on as a user with administrator privileges to the computer that hosts the BMC Server Automation Application Server.
    On a UNIX computer, log on as root. If you are not permitted to log on as root, use the su command to run as root after logging on as a non-root user. Alternatively, use the sudo command.

    Note

    In a multi-server environment, to load content on multiple BMC Server Automation Application Servers within the same environment (that is, connected to the same BMC Server Automation core database), select the check box that indicates a multi-server environment before you click Next. Then in the next window, enter the names or IP addresses of any additional application servers, one in each row, and click Next.

    To successfully install content in a multi-server environment, the system user running the installer must have Network Shell write access to the application servers. For example, if you are logged onto the OS and you started the Compliance Content installer as root, you need to have an entry such as the following in the users.local file on all of the Application Servers targeted by the installer:
    root rw,map=root

  2. Download the appropriate content setup file from the BMC Software web site to a temporary directory on the BMC Server Automation Application Server.
    Depending on your operating system, select one of the following files:
    • For Windows: Content86-WIN.exe
    • For Linux: Content86-LIN.bin
    • For Solaris UNIX: Content86-SOL.bin

  3. Create an Options file (for example, OptionsFile.txt ), and ensure that the following lines are included in this text file:
    -P installLocation=installation directory
    -J BLADELOGIC_PROFILES=profileName
    -J BLADELOGIC_PROFILES_TYPES=profileAuthenticationType
    -J USER_PROFILE_NAME=profileName
    -J USER_ACCOUNT_NAME=userAccount
    -J USER_ACCOUNT_PASSWORD=encryptedPassword
    -J USER_ROLE=userRole
    -J CONTENT_APPSERVER_LIST=applicationServerList
    -J INSTALL_policy_TEMPLATES=true (for all templates of a policy)
    -A templateFeatureID (to choose exact templates)
    Where
    • The default path to the CONTENT_HOME installation directory (the value of the -P attribute) is C:\Program Files\BMC Software\Content on Windows or /opt/bmc/content on UNIX. This directory is used temporarily, and is automatically deleted after installation is complete.
    • For a silent installation, you can only specify one existing profile and its authentication type in the BLADELOGIC_PROFILES and BLADELOGIC_PROFILES_TYPES properties. Specify the same profile in the USER_PROFILE_NAME property. 

      You cannot create a new profile during a silent installation, as is possible during the interactive direct installation. Therefore, ensure that you already have an appropriate profile defined. To ensure that profiles are defined, check for the existence of the authenticationProfiles.xml file within the BMC Server Automation installation directories and review its contents. For more information about setting up an authentication profile, see Setting up an authentication profile.
    • The USER_ROLE property is necessary only if the user that you specified is assigned to more than one role.
    • The password for the BMC Server Automation user account must be encrypted . To generate an encrypted password, invoke the blenc utility through any Network Shell prompt. The blenc utility prompts you for your password and then generates and outputs a corresponding encrypted password.
    • The list of application servers can contain multiple BMC Server Automation Application Server names or IP addresses (IPv4 or IPv6) if you are working in a multi-server environment. Use commas to separate Application Server names. 

      To successfully install content in a multi-server environment, the system user running the installer must have Network Shell write access to the application servers.
    • For each policy type, you can choose between installing all component templates of the policy using the -J INSTALL_<policy>_TEMPLATES=true line (where the policy can be DISA, HIPAA, PCI, PCIv2, PCIv3, SOX or CIS), or you can choose the exact component templates to install using multiple -A lines. 

      Template feature IDs specified in -A lines have the naming convention featurePolicyOSTemplate (for example, featureSoxAixTemplate).

        Click here to expand the full list of template feature IDs
      Policy/Benchmarks Operating System Template feature ID (used in silent installation)
      Center for Internet Security (CIS) Red Hat Enterprise Linux 5.x featureCisRHEL5Template
      Red Hat Enterprise Linux 6.x featureCisRHEL6Template
      Red Hat Enterprise Linux 7.x featureCisRHEL7Template
      Windows Server 2003 for Domain Controllers featureCisWin03DCTemplate
      Windows Server 2003 for Member Servers featureCisWin03MSTemplate
      Windows Server 2008 featureCisWin08Template
      Windows Server 2008 R2

      featureCisWin08R2Template

      Windows Server 2012 featureCisWin12Template
      Windows Server 2012 R2 featureCisWin12R2Template
      AIX 6.1/5.3 featureCisAix61Template
      AIX 7.1 featureCisAix71Template
      Oracle Solaris 11.1 featureCisSolaris11_1Template
      SUSE 10 featureCISSuse10Template
      SUSE 11 featureCISSuse11Template
      Defense Information Systems Agency (DISA) Windows Server 2003 DC featureDisaWin03DCTemplate
      Windows Server 2003 MS featureDisaWin03MSTemplate
      Windows Server 2008 DC featureDisaWin08DCTemplate
      Windows Server 2008 MS featureDisaWin08MSTemplate
      Windows Server 2008 R2 DC featureDisaWin08R2DCTemplate
      Windows Server 2008 R2 MS featureDisaWin08R2MSTemplate
      Windows Server 2012 DC featureDisaWin12DCTemplate
      Windows Server 2012 MS featureDisaWin12MSTemplate
      Red Hat Enterprise Linux 5 featureDisaRedhat5Template
      Red Hat Enterprise Linux 6 featureDisaRedhat6Template
      AIX 6.1 featureDisaAix61Template
      Solaris 10 x86 featureDisaSolaris10x86Template
      Solaris 10 SPARC featureDisaSolaris10SparcTemplate
      Solaris 11 x86 featureDisaSolaris11x86Template
      Solaris 11 SPARC featureDisaSolaris11SparcTemplate
      Payment Card Industry (PCIv3) Windows Server 2012 featurePciv3Win12Template
      Windows Server 2012 R2 featurePciv3Win12R2Template
      Windows Server 2008 R2 featurePciv3Win08R2Template
      Red Hat Enterprise Linux 6 featurePciv3LinuxTemplate
      Red Hat Enterprise Linux 7 featurePciv3Linux7Template
      AIX 6.1/5.3 featurePciv3Aix61Template
      AIX 7.1 featurePciv3Aix71Template
      SUSE 10 featurePciv3Suse10Template
      SUSE 11 featurePciv3Suse11Template
      Payment Card Industry (PCIv2) Red Hat Enterprise Linux 5.x featurePciv2LinuxTemplate
      Windows Server 2008 featurePciv2Win08Template
      Payment Card Industry (PCI)   HPUX 11i v1, 11i v2, 11i v3 featurePciHpuxTemplate
      Solaris 8-9 featurePciSolarisTemplate
      Solaris 10 featurePciSolaris10Template
      Windows Server 2003 featurePciWin03Template
      Sarbanes-Oxley (SOX) Act AIX 5.2 ,5.3 featureSoxAixTemplate
      HPUX 11i v1, 11i v2, 11i v3 featureSoxHpuxTemplate
      RedHat Linux RHEL ES/AS 3, 4.x, 5.x featureSoxLinuxTemplate
      Solaris 8-9 featureSoxSolarisTemplate
      Solaris 10 featureSoxSolaris10Template
      SuSE 9-10 featureSoxSuseTemplate
      Windows Server 2003 featureSoxWin03Template
      Health Insurance Portability and Accountability Act (HIPAA) AIX 5.2, 5.3 featureHipaaAixTemplate
      HPUX 11i v1, 11i v2, 11i v3 featureHipaaHpuxTemplate
      RedHat Linux RHEL ES/AS 3, 4.x, 5.x featureHipaaLinuxTemplate
      Red Hat Enterprise Linux 5.x featureHipaaRHEL5Template
      Red Hat Enterprise Linux 6.x featureHipaaRHEL6Template
      Red Hat Enterprise Linux 7.x featureHipaaRHEL7Template
      Solaris 8-9 featureHipaaSolarisTemplate
      Solaris 10 featureHipaaSolaris10Template
      SuSE 9-10 featureHipaaSuseTemplate
      Windows Server 2003 featureHipaaWin03Template
      Windows Server 2008 featureHipaaWin08Template
      Windows Server 2012 featureHipaaWin12Template

      Examples

      An Options file with the following lines installs all HIPAA templates, and two individual SOX templates:
      -P installLocation=C:\Program Files\BMC Software\Content
      -J BLADELOGIC_PROFILES=defaultProfile
      -J BLADELOGIC_PROFILES_TYPES=SRP
      -J USER_PROFILE_NAME=defaultProfile
      -J USER_ACCOUNT_NAME=BLAdmin
      -J USER_ACCOUNT_PASSWORD=facfe8dfd0743920d8d901de05557886
      -J CONTENT_APPSERVER_LIST=AUS-LORA-10.bmc.com
      -J INSTALL_HIPAA_TEMPLATES=true
      -A featureSoxAixTemplate
      -A featureSoxLinuxTemplate

      An Options file with the following lines performs a full install:
      -P installLocation=<installationDirectory>
      -J BLADELOGIC_PROFILES=<profileName>
      -J BLADELOGIC_PROFILES_TYPES=<profileAuthenticationType>
      -J USER_PROFILE_NAME=<profileName>
      -J USER_ACCOUNT_NAME=<userAccount>
      -J USER_ACCOUNT_PASSWORD=<encryptedPassword>
      -J USER_ROLE=<userRole>
      -J CONTENT_APPSERVER_LIST=<applicationServerList>
      -J INSTALL_DISA_TEMPLATES=true
      -J INSTALL_CIS_TEMPLATES=true
      -J INSTALL_HIPAA_TEMPLATES=true
      -J INSTALL_PCI_TEMPLATES=true
      -J INSTALL_PCIv2_TEMPLATES=true
      -J INSTALL_PCIv3_TEMPLATES=true

      -J INSTALL_SOX_TEMPLATES=true

      An Options file with the following lines performs a custom install that includes only the DISA Linux templates:
      -P installLocation=<installationDirectory>
      -J BLADELOGIC_PROFILES=<profileName>
      -J BLADELOGIC_PROFILES_TYPES=<profileAuthenticationType>
      -J USER_PROFILE_NAME=<profileName>
      -J USER_ACCOUNT_NAME=<userAccount>
      -J USER_ACCOUNT_PASSWORD=<encryptedPassword>
      -J USER_ROLE=<userRole>
      -J CONTENT_APPSERVER_LIST=<applicationServerList>
      -A featureDisaLinuxTemplate

  4. Run the silent installation using a command in this format:
    <full path to Setup file-i silent -DOPTIONS_FILE=<full path to Options file>
    For example:
    # ./Content87-LIN.bin -i silent -DOPTIONS_FILE=/tmp/OptionsFile.txt 

    Note

    An installation log file named content_install_log.txt is created in the following directory:

    • On Linux: /tmp
    • On Solaris UNIX: /var/tmp
    • On Windows: %USER_HOME%\Local Settings\Temp (for example: C:\Documents and Settings\Administrator\Local Settings\Temp )

Back to top

To determine the version of content currently installed

Check the content.version file, which is created in the ../fileserver/Content folder.

The content of the content.version file looks like this:

featureCis=8.6.215
featureSox=8.6.215

To configure Compliance Content add-ons

The following topics presents information about configuration necessary for the Compliance Content add-ons. Perform these configuration tasks after installing the Compliance Content add-ons.

Task Benefit
Configuring properties for Compliance Content templates During the installation of Compliance Content libraries, various editable properties related to Compliance Content are defined. This topic describes how to review these properties.
Modifying out-of-the-box component templates During the installation of Compliance Content libraries, groups of out-of-the-box component templates are saved in BMC Server Automation. This topic describes how to refine these templates according to your needs.
Controlling the frequency of cache refresh Target data used during the execution of Compliance Jobs is cached on the target servers and the cache is refreshed at a default frequency. This topic describes how to control this frequency of cache refresh.

Where to go from here

If you encounter problems during the installation process, check the installation log for messages and consult Troubleshooting the installation of Compliance Content add-ons for further troubleshooting information. 

Was this page helpful? Yes No Submitting... Thank you

Comments