Configuring Authenticated SMB Distribution Servers

Version 11

    Purpose

     

    This document is a step by step guide on how to configure authenticated SMB Distribution Servers. in Shavlik Protect 9.x.

     

    Why use a distribution server ?

    Distribution servers can be used in a number of different scenarios:

    • Distribution servers can be used to store patches that you wish to deploy. Distribution servers can be physically located near each group of machines you are managing. The console can copy patches to the distribution servers only, rather than to each individual machine. Each machine can then download the patches it needs from the nearest distribution server. This can greatly reduce network traffic in a distributed environment and be of huge benefit in wide-area networks. This is true in both agentless environments and agent-based environments. In agentless environments, using distribution servers means the console does not need to push patches to individual machines and individual machines do not need to download patches from patch vendor. In an agent-based environment, it can keep each machine from downloading the patches it needs from the patch vendor over the Internet.
    • Distribution servers can be used to store the most up-to-date engines and XML files that are available. In a multi-console or agent-based environment, this can reduce the number of machines that need to download updated files over the Internet. If you will be configuring an agent policy that contains a threat task it is strongly recommended that you use a distribution server. The threat definition file is rather large and using a distribution server to store the file will greatly improve the download performance for your agents.
    • Distribution servers allow consoles and agents to operate in environments where they do not have Internet access but still need access to the most up-to-date engines and XML files. See What is a Disconnected Console Configuration for more information.
    • Distribution Servers can be used to store any custom patches you may have defined. This is particularly important for agent-based environments. See Preparing to Use Agents for more information.

     

    Do You Need a Distribution Server ?

    To determine if you should use one or more distribution servers with Shavlik Protect, apply the following formula:

    • If # of machines * 10Kb > available bandwidth, then you need at least one distribution server.
    Examples

    Assume available bandwidth = 500 Kb:

    • 100 machines: 100 machines * 10Kb = 1000Kb > 500Kb (need distribution server)
    • 20 machines: 20 machines * 10Kb = 200Kb < 500Kb (do not need distribution server)

     

    If You Need Distribution Servers, How Many ?

    If (using the formula above) you determine you need one or more distribution servers, you still need to determine exactly how many distribution servers are needed. Determining the number of distribution servers that are needed is very simple. The general rule is:

    • Use one distribution server for every 2500 machines

    For example, if you have 7500 machines you should plan on using three distribution servers.

     

    Affected Product(s)

     

    • Windows Server 2012
    • Shavlik Protect 9.x

     

    Resolution

    Related guides

    Configuring Authenticated HTTP Distribution Servers

    Configuring Authenticated HTTPS (SSL) Distribution Servers

     

    Create a shared folder on Windows Server

    In order to create a shared folder open the Server Manager

    Capture1.PNG

     

    On the up right corner Manage > Add Roles and Features

    Capture2.PNG

     

    Follow the wizard.

    Capture3.PNG

    Capture4.PNG

     

    Check the box File Server in File and Storage Services > File and iSCSI Services > File Server

    Capture5.PNG

     

    Continue without adding new features.

    Capture6.PNG

     

    You should have something like the following screenshot. And Install

    Capture7.PNG

     

     

    After adding the File Server role, on the Server Manager's Dashboard click on File and Storage Services

    Capture9.PNG

     

    Go in the Shares tab and create a new share.

    Capture10.PNG

     

    Choose SMB Share

    Capture11.PNG

     

    Select where you want to create the share folder.

    Capture12.PNG

     

    Name the share.

    Capture13.PNG

    Capture14.PNG

     

    Click on Customize permissions...

    Capture15.PNG

     

    In the Permissions tab we will need 2 accounts :

    • One for the Console which will need a read/write to add and delete the patchs.
    • One for the Agents which will need only to read and download the patchs.

     

    It is possible to use the Console credentials for the Agents but it is not recommended for security issue as these credentials will be copied on all Agents.

     

    In the Share tab Edit the permissions for Everyone

    Capture151.PNG

     

    And select Full Control

    Capture152.PNG

     

    And create the share.

    Capture16.PNG

     

    Add a new distribution server in Shavlik

    In order to add a new distribution server in Shavlik go in Tools > Operations

    Capture18.PNG

    Select the tab Distribution Servers

    Capture19.PNG

     

    On the top panel "Distribution Servers" click New

    Capture20.PNG

     

    Give a name to the Distribution Server and fill the path and credentials.

    The upper panel is for the Agents connexion so we will give the read only credentials.

    The lower panel for the Console so we will give the read/write credentials.

    Capture21.PNG

     

    Select the created Distribution Server, choose All engines, definitions, and patch downloads from the scroll down and click Add scheduled sync:

    Capture24.PNG

     

    Schedule when you want to sync the Distribution Server with the files on Internet.

    We recommend to sync on Wednesday and Friday as our patch release are on Tuesday and Thursday.

    Capture25.PNG

     

    To force sync click Run now for each selected tasks.

    Capture26.PNG

    There should be files in the shared folder.

    If not follow this document :

    Troubleshouting distribution server synchronization

     

    Using the Distribution Server in Agent Policy

    In order to use the Distribution Server we need to create a new Agent Policy or modify an exesting one.

    To create an Agent Policy go in New > Agent Policy

    Capture27.PNG

     

    To modify an existing Agent Policy click on the button just under Home and Agent Policies

    Capture30.PNG

     

    In the popup window select Distribution Server and select your previously created Distribution Server.

    Capture29.PNG

    Deploy or update the policy on the Agents and files will now be downloaded from the agents.