Macintosh Host Checker

[firewall72_]

Hello,

I've been playing around with Host Checker for our Mac's. The process approach for AV has worked, but it only can detect if the AV process is running. I was wondering what other people were doing with HC for Macintosh. All feedback welcome.

Thank you.

John

[azpcox_]

I just look for a process called finder. One other group also looks for specific additional files and apps on Company owned Macs and role map into a "limited" Network Connect policy that only allows the end users to RDP to internal desktops.

[firewall72_]

Hi,

Thanks for the response. Anyone else? I have a client looking to permit company and non company equipment. The requirement is that we check for Virex and Norton.

Rgds,

John

[steamrunner_]

We just do similar to azpcox's reply. We look for the process called "coreservicesd", and then specific items related to our own machines. Not exactly secure, but (along with authentication) it's good enough for what we need. All you need to do is ID the process names for Virex or Norton and off you go...

SB

[Stephen_]

So Far, I've only investigated ClamAv, but I would be interrested if you come up with a service check for Norton or any others...

For ClamAv, I look for:

Process Name: ClamXavSentry

File: /usr/local/clamXav/share/clamav/daily.cvd - File modified less than 14 days ago.

We only have two MAC users, but so far it seems to work....

-Stephen