Installing and configuring Compliance Content add-ons

This topic guides you through the installation and configuration of TrueSight Server Automation Compliance Content add-ons. The topic contains the following sections:

Overview of Compliance Content add-ons

To install Compliance Content add-ons

The following sections discuss how to install the Compliance Content add-ons.

Overview of the Compliance Content installation process

For the installation of TrueSight Server Automation Compliance Content libraries on the Application Server, you can choose between a direct installation procedure using an interactive installation wizard or a silent (unattended) installation procedure.

During installation, the installer performs the following actions:

• Imports groups of out-of-the-box component templates that contain compliance rules for regulatory standards and best-practice policies (HIPAA, SOX, DISA, PCIv2, PCIv3, and CIS).
• Imports corresponding groups of remediation BLPackages into the Depot, for use in remediating compliance failures against SOX, HIPAA, DISA, PCIv2, PCIv3, or CIS.
• Imports a group of out-of-the-box batch-type Scale Jobs that can be used for compliance analysis on UNIX and Linux platforms, especially in environments with large numbers of servers.
• Installs various out-of-the-box configuration objects (configuration files and extended objects) that support the provided compliance rules.
• Creates a custom property class for each policy type and defines a Default instance for the property class.

Requirements and supported resources for Compliance Content

Before beginning the installation of Compliance Content libraries for TrueSight Server Automation, verify that all requirements are met on the TrueSight Server Automation Application Server. For the list of requirements, see Compliance Content support and requirements. For details about the operating systems supported by Compliance Content component templates of each policy type, see Compliance policy standards supported by TrueSight Server Automation templates.

To install Compliance Content libraries directly

Prior to performing the procedure, ensure that you have logged on as a user with administrator privileges to the computer that hosts the Application Server. On a UNIX computer, log on as root. If you are not permitted to log on as root, use the su command to run as root after logging on as a non-root user. Alternatively, use the sudo command.

To perform a silent installation of Compliance Content libraries

1. Log on as a user with administrator privileges to the computer that hosts the TrueSight Server Automation Application Server.
   On a UNIX computer, log on as root. If you are not permitted to log on as root, use the su command to run as root after logging on as a non-root user. Alternatively, use the sudo command.

   Note

   In a multi-server environment, to load content on multiple TrueSight Server Automation Application Servers within the same environment (that is, connected to the same TrueSight Server Automation core database), select the check box that indicates a multi-server environment before you click Next. Then in the next window, enter the names or IP addresses of any additional application servers, one in each row, and click Next.

   To successfully install content in a multi-server environment, the system user running the installer must have Network Shell write access to the application servers. For example, if you are logged onto the OS and you started the Compliance Content installer as root, you need to have an entry such as the following in the users.local file on all of the Application Servers targeted by the installer:
   root rw,map=root

2. Download the appropriate content setup file from the BMC Software web site to a temporary directory on the TrueSight Server Automation Application Server.
   Depending on your operating system, select one of the following files:
   • For Windows: Content86-WIN.exe
   • For Linux: Content86-LIN.bin

   • For Solaris UNIX: Content86-SOL.bin

3. Create an Options file (for example, OptionsFile.txt ), and ensure that the following lines are included in this text file:
   -P installLocation=installation directory
   -J BLADELOGIC_PROFILES=profileName
   -J BLADELOGIC_PROFILES_TYPES=profileAuthenticationType
   -J USER_PROFILE_NAME=profileName
   -J USER_ACCOUNT_NAME=userAccount
   -J USER_ACCOUNT_PASSWORD=encryptedPassword
   -J USER_ROLE=userRole
   -J CONTENT_APPSERVER_LIST=applicationServerList
   -J INSTALL_policy_TEMPLATES=true (for all templates of a policy)
   -A templateFeatureID (to choose exact templates)
   Where
   • The default path to the CONTENT_HOME installation directory (the value of the -P attribute) is C:\Program Files\BMC Software\Content on Windows or /opt/bmc/content on UNIX. This directory is used temporarily, and is automatically deleted after installation is complete.
   • For a silent installation, you can only specify one existing profile and its authentication type in the BLADELOGIC_PROFILES and BLADELOGIC_PROFILES_TYPES properties. Specify the same profile in the USER_PROFILE_NAME property. 
     
     You cannot create a new profile during a silent installation, as is possible during the interactive direct installation. Therefore, ensure that you already have an appropriate profile defined. To ensure that profiles are defined, check for the existence of the authenticationProfiles.xml file within the TrueSight Server Automation installation directories and review its contents. For more information about setting up an authentication profile, see Setting up an authentication profile.
   • The USER_ROLE property is necessary only if the user that you specified is assigned to more than one role.
   • The password for the TrueSight Server Automation user account must be encrypted . To generate an encrypted password, invoke the blenc utility through any Network Shell prompt. The blenc utility prompts you for your password and then generates and outputs a corresponding encrypted password.
   • The list of application servers can contain multiple TrueSight Server Automation Application Server names or IP addresses (IPv4 or IPv6) if you are working in a multi-server environment. Use commas to separate Application Server names. 
     
     To successfully install content in a multi-server environment, the system user running the installer must have Network Shell write access to the application servers.

For each policy type, you can choose between installing all component templates of the policy using the -J INSTALL_<policy>_TEMPLATES=true line (where the policy can be DISA, HIPAA, PCI, PCIv2, PCIv3, SOX or CIS), or you can choose the exact component templates to install using multiple -A lines. 

Template feature IDs specified in -A lines have the naming convention featurePolicyOSTemplate (for example, featureSoxAixTemplate).

1. Run the silent installation using a command in this format:
   <full path to Setup file> -i silent -DOPTIONS_FILE=<full path to Options file>
   For example:
   # ./Content87-LIN.bin -i silent -DOPTIONS_FILE=/tmp/OptionsFile.txt 

   Note

   An installation log file named content_install_log.txt is created in the following directory:

   • On Linux: /tmp
   • On Solaris UNIX: /var/tmp
   • On Windows: %USER_HOME%\Local Settings\Temp (for example: C:\Documents and Settings\Administrator\Local Settings\Temp )

To determine the version of content currently installed

Check the content.version file, which is created in the ../fileserver/Content folder.

The content of the content.version file looks like this:

featureCis=8.6.215
featureSox=8.6.215

To configure Compliance Content add-ons

The following topics presents information about configuration necessary for the Compliance Content add-ons. Perform these configuration tasks after installing the Compliance Content add-ons.

Where to go from here

If you encounter problems during the installation process, check the installation log for messages and consult Troubleshooting the installation of Compliance Content add-ons for further troubleshooting information.