BalaBit Shell Control Box 3 LTS Administrator Guide

4.3.1.1. Procedure – Configuring the management interface

Purpose: 

To activate the interface, complete the following steps.

Steps: 

1. Navigate to Basic Settings > Network > Interfaces.

   Figure 4.7. Configuring the management interface

   
   

2. In the Management interface field, select Enable management interface.

3. Into the Address field, enter the IP address of SCB's management interface.

4. Into the Netmask field, enter the netmask related to the IP address.

5. Warning

   After clicking Commit, the web interface will be available only via the management interface — it will not be accessible using the current (external) interface, unless the Management enabled option is selected for the external interface. Ensure that the Ethernet cable is plugged and the management interface is connected to the network; this is indicated by a green check icon in the Basic settings > Networks > Ethernet links > HA interface > Link field. When using High Availability, ensure that the management interface of both SCB units is connected to the network. The HA interface section indicates if a link is detected on the high availability interface.

   Click Commit.

4.3.1.2. Procedure – Routing management traffic to the management interface

Purpose: 

For security reasons — and also to reduce network usage on the external and internal interfaces — it is recommended to direct all management-related traffic of SCB towards the management network interface. Such traffic includes access to the web interface, backups and archiving, syslog messages , and e-mail or SNMP alerts sent to the administrator.

	Warning
	Complete the following procedure only if the management interface is configured; otherwise the data sent by SCB will be lost. For details on configuring the management interface, see Procedure 4.3.1.1, Configuring the management interface.

Steps: 

1. To add a new routing entry, navigate to Basic Settings > Network > Interfaces and in the Routing table field, click .

   Figure 4.8. Routing

   
   

2. Enter the IP address of the backup server (as set in Procedure 4.3.5.1, Creating configuration and data backups) into the Address field.

3. Enter the related netmask into the Netmask field.

4. Enter the IP address of the gateway used on that subnetwork into the Gateway field.

5. Click Commit.

6. Repeat Steps 1-5 and create a routing entry for other backup servers if needed.

7. Repeat Steps 1-5 and create a routing entry for the syslog server (as set in Section 4.3.3, System logging, SNMP and e-mail alerts).

8. Repeat Steps 1-5 and create a routing entry for the SMTP server (as set in Section 4.3.3, System logging, SNMP and e-mail alerts).

4.3.2.1. Procedure – Configuring a time (NTP) server

Purpose: 

To retrieve the date automatically from a time server, complete the following steps.

Steps: 

1. Select your timezone in the Timezone field.

2. Enter the IP address of an NTP time server into the Address field.

3. Click Commit.

4. Click the and icons to add new servers or delete existing ones.

4.3.3.1. Procedure – Configuring system logging

Purpose: 

SCB can send its system log messages to remote syslog servers. To configure logging to a remote server, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Management.

2. Click in the Syslog receivers field to add a new syslog server.

3. Enter the IP address and port of the syslog server into the respective fields.

4. Select the network protocol used to transfer the messages in the Protocol field. The legacy- prefix corresponds to the legacy BSD-syslog protocol described in RFC3164, while the ietf- prefix corresponds to the new IETF-syslog protocol described in RFC5424. Note that not every syslog server supports the IETF protocol yet.

   Select TCP+TLS to send the log messages using a TLS-encrypted connection.

   Tip

   Transferring the syslog messages using TCP ensures that the server receives them. Transferring the syslog messages using TLS encryption ensures that third parties cannot read the messages. However, not every syslog server accepts encrypted connections. The syslog-ng Premium Edition and Open Source Edition applications, and the syslog-ng Store Box (which is a log-collector appliance similar to SCB) support both encrypted connections and the new IETF-syslog protocol as well. For details on these products, see syslog-ng Premium Edition and syslog-ng Store Box.

5. To display separate hostnames for syslog messages sent by the nodes of a SCB HA cluster, select the Include node ID in hostname in boot firmware messages option. The node ID included in the hostname filed of the syslog message is the MAC address of the node's HA interface. (Messages of the core firmware are always sent by the master node.)

6. If you have selected the TCP+TLS protocol, complete the following steps. Otherwise, click Commit.

   1. If you want SCB to verify the certificate of the syslog server, select Required trusted in the Server key check field and proceed to the next step.

      If you want SCB to simply accept any certificate shown by the server, select Optional untrusted in the Server key check field.

      Note

      Alternatively, you can use the following, less strict options to check the certificate of the server: Optional trusted: If the server sends a certificate, SCB checks if it is valid (not expired) and that the Common Name of the certificate contains the domain name or the IP address of the server. If these checks fail, SCB rejects the connection. However, SCB accepts the connection if the server does not send a certificate. Required untrusted: SCB requests a certificate from the server, and rejects the connection if no certificate is received, if the certificate is not valid (expired), or if the Common Name of the certificate does not contain the domain name or the IP address of the server.

   2. Click the icon in the CA X.509 certificate field. A popup window is displayed.

      Click Browse, select the certificate of the Certificate Authority (CA) that issued the certificate of the syslog server, then click Upload. Alternatively, you can paste the certificate into the Copy-paste field and click Upload.

      SCB will use this CA certificate to verify the certificate of the server, and reject the connections if the verification fails.

   3. If the syslog server requires mutual authentication, that is, it expects a certificate from SCB, generate and sign a certificate for SCB, then click the icon in the Client X.509 certificate field to upload the certificate. After that, click the icon in the Client key field and upload the private key corresponding to the certificate.

   4. Click Commit.

7. Click the and icons to add new servers or delete existing ones.

   	Note
   	To reduce the risk of the syslog server not receiving log messages from SCB because of a network outage or other problem with the syslog server, SCB buffers up to 10 Megabytes of log messages to its hard disk in case the syslog server becomes unaccessible.

4.3.3.2. Procedure – Configuring e-mail alerts

Purpose: 

To configure e-mail alerts, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Management > Mail settings.

2. Enter the IP address or the hostname of the mail server into the SMTP server address field.

   Figure 4.11. Configuring e-mail sending

   
   

3. Enter the e-mail address of the administrator into the Administrator's e-mail address field. SCB sends notifications related to system-events (but not alerts and reports) to this address.

4. Enter the e-mail address of the administrator into the Send e-mail alerts to field. SCB sends monitoring alerts to this address.

5. Enter the e-mail address the person who should receive traffic reports from SCB into the Send reports to field. For details on reports, see Section 6.3, Reports.

6. Click Commit.

7. Click Test to send a test message.

   If the test message does not arrive to the server, check if SCB can access the server. For details, see Section 4.5.4, Troubleshooting SCB.

8. Navigate to Basic Settings > Alerting & Monitoring and select in which situations should SCB send an e-mail alert. For details, see Section 4.3.4, Configuring system monitoring on SCB.

9. Click Commit.

4.3.3.3. Procedure – Configuring SNMP alerts

Purpose: 

SCB can send alerts to a central monitoring server via SNMP (Simple Network Management Protocol). To configure SNMP alerts, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Management > SNMP trap settings.

2. Enter the IP address or the hostname of the SNMP server into the SNMP server address field.

   Figure 4.12. Configuring SNMP alerts

   
   

3. Select the SNMP protocol to use.

   • To use the SNMP v2c protocol for SNMP queries, select SNMP v2c, and enter the community to use into the Community field.

   • To use the SNMP v3 protocol, select SNMP v3 and complete the following steps:

     Figure 4.13. Configuring SNMP alerts using SNMPv3

     
     

   1. Enter the username to use into the Username field.

   2. Enter the engine ID to use into the Engine ID field. The engine ID is a hexadecimal number at least 10 digits long, starting with 0x. For example 0xABABABABAB.

   3. Select the authentication method (MD5, SHA1) to use from the Authentication method field.

   4. Enter the password to use into the Authentication password field.

   5. Select the encryption method (Disabled, DES, AES) to use from the Encryption method field.

   6. Enter the encryption password to use into the Encryption password field.

4. Click Commit.

5. Navigate to Basic Settings > Alerting & Monitoring and select in which situations should SCB send an SNMP alert. For details, see Section 4.3.4, Configuring system monitoring on SCB.

6. Click Commit.

4.3.3.4. Procedure – Querying SCB status information using agents

Purpose: 

External SNMP agents can query the status information of SCB. To configure which clients can query this information, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Management > SNMP agent settings.

   Figure 4.14. Configuring SNMP agent access

   
   

2. The status of SCB can be queried dynamically via SNMP. By default, the status can be queried from any host. To restrict access to these data to a single host, enter the IP address of the host into the Client address field.

3. Optionally, you can enter the details of the SNMP server into the System location, System contact, and System description fields.

4. Select the SNMP protocol to use.

   • To use the SNMP v2c protocol for SNMP queries, select SNMP v2c agent, and enter the community to use into the Community field.

   • To use the SNMP v3 protocol, select SNMP v3 agent and complete the following steps:

   1. Click

   2. Enter the username used by the SNMP agent into the Username field.

   3. Select the authentication method (MD5, SHA1) to use from the Auth. method field.

   4. Enter the password used by the SNMP agent into the Auth. password field.

   5. Select the encryption method (Disabled, DES, AES) to use from the Encryption method field.

   6. Enter the encryption password to use into the Encryption password field.

   7. To add other agents, click .

5. Click Commit.

4.3.4.1. Procedure – Configuring monitoring

Purpose: 

To configure monitoring, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Alerting & Monitoring.

2. The default threshold values of the parameters are suitable for most situations. Adjust the thresholds only if needed.

3. Click Commit.

4. Navigate to Basic Settings > Management and verify that the SNMP settings and Mail settings of SCB are correct. SCB sends alerts only to the alert e-mail address and to the SNMP server.

   	Warning
   	Sending alerts fails if these settings are incorrect.

4.3.4.3. Procedure – Preventing disk space fill up

Purpose: 

To prevent disk space from filling up, complete the following steps:

Steps: 

1. Navigate to Basic Settings > Management > Disk space fill up prevention.

2. Set the limit of maximum disk utilization in percents in the respective field. When disk space is used above the set limit, SCB disconnects all clients. Entering 0 turns the feature off. The default value is 0.

3. Optional step: Enable the Automatically start archiving option to automatically start all configured archiving/cleanup jobs when disk usage goes over the limit.

   	Note
   	If there is no archiving policy set, enabling this option will not trigger automatic archiving.

4. Navigate to Basic Settings > Alerting & Monitoring > System related traps and enable alert Disk usage is above the defined ratio.

5. Click Commit.

4.3.5.1. Procedure – Creating configuration and data backups

Purpose: 

To configure automatic configuration backups, complete the following steps:

Figure 4.16. Configuring backups and archiving

Steps: 

1. Create a backup policy.

   1. Navigate to Policies > Backup & Archive/Cleanup and click in the Backup policies section to create a new backup policy.

   2. Enter a name for the backup policy (for example config-backup).

   3. Enter the time when the backup process should start into the Start time field in HH:MM format (for example 23:00).

   4. Enter the IP address or the hostname of the remote server into the Target server field (for example backup.example.com).

   5. Figure 4.17. Configuring backups and archiving

      
      

      SCB can access the remote server via different protocols. Select the one to use from the available protocols:

      • Rsync over SSH: Execute the rsync command via the Secure Shell protocol. Note that the backup server must run rsync version 3.0 or newer.

      • SMB/CIFS: Server Message Block protocol used on Microsoft Windows Network.

        Warning

        The CIFS implementation of NetApp storage devices is not compatible with the CIFS implementation used in SCB, therefore it is not possible to create backups and archives from SCB to NetApp devices using the CIFS protocol (the operation fails with a similar error message: /opt/scb/mnt/14719217504d41370514043/reports/2010": Permission denied (13) '2010/day/' rsync: failed to set times on). To overcome this problem, either: use the NFS protocol to access your NetApp devices, or use a backup device that has a CIFS implementation compatible with SCB, for example, Windows or Linux Samba.

      • NFS: Network File System protocol.

        	Warning
        	When using the NFS protocol to create backups or archives, ensure that the files on the remote server are readable for the www-data user as well, because SCB uses this user to access remote backups and archives if needed.

   6. Provide the protocol-specific parameters for the selected method. The protocol-specific parameters are described in Section 4.3.5.4, Parameters of the backup protocols.

   7. To receive e-mail notification of the backup, select the Send notification on errors only or the Send notification on all events option. Notifications are sent to the administrator e-mail address set on the Management tab, and include the list of the files that were backed up.

      	Warning
      	Starting with SCB 3.0, the notification e-mail does not include the list of backed up file. To include the list of files in the e-mail, select Send notification on all events and disable the Omit file list option. However, note that if list is very long (for example, SCB stores over 20000 audit trails), the SCB web interface might become unaccessible.

      	Note
      	This e-mail notification is different from the one set on the Alerting & Monitoring tab. This notification is sent to the administrator's e-mail address, while the alerts are sent to the alert e-mail address (see Section 4.3.4, Configuring system monitoring on SCB).

   8. Click Commit.

   Expected outcome: 

   A backup policy is created.

2. To use this policy to create configuration backups, navigate to Basic Settings > Management > System backup, and select the backup policy you want to use for backing up the configuration of SCB in the System backup policy field.

   Figure 4.18. Configuring system backups

   
   

   To use this policy to create data backups, navigate to Connections, select the connection you want to backup, and select a backup policy in the Backup policy field.

3. Click Commit.

   	Tip
   	To create an immediate backup of SCB's configuration to your machine (not to the backup server), select Basic Settings > System > Export configuration. Note that the configuration export contains only the system settings and configuration files (including changelogs). System backups includes additional information like reports and alerts, and also the connection database.

4.3.5.2. Procedure – Archiving the collected data

Purpose: 

To configure data archiving, complete the following steps.

Steps: 

1. Create an archive policy.

   1. Navigate to Policies > Backup & Archive/Cleanup and click in the Archive/Cleanup policies section to create a new archive policy.

   2. Figure 4.19. Configuring backups and archiving

      
      

      Enter a name for the archive policy.

   3. Enter the time when the archive process should start into the Start time field in HH:MM format (for example 23:00).

   4. To archive the data collected on SCB more than once a day, click and enter the time for the other archive process. Repeat this step as needed.

      	Note
      	In case an archive process is not finished before the next one starts, the next archive process waits for the previous process to be completed. Only closed audit-trail files are archived, for which Retention time in days has already elapsed.

   5. SCB can access the remote server via different protocols. Select the one to use from the available protocols:

      • Only cleanup, no archiving: Do not archive data to a server, simply delete the data that is older than Retention time in days.

        	Warning
        	No archiving permanently deletes all audit trails and data that is older than Retention time in days without creating a backup copy or an archive. Such data is irrecoverably lost. Use this option with care.

      • SMB/CIFS: Server Message Block protocol used on Microsoft Windows Network.

        Warning

        The CIFS implementation of NetApp storage devices is not compatible with the CIFS implementation used in SCB, therefore it is not possible to create backups and archives from SCB to NetApp devices using the CIFS protocol (the operation fails with a similar error message: /opt/scb/mnt/14719217504d41370514043/reports/2010": Permission denied (13) '2010/day/' rsync: failed to set times on). To overcome this problem, either: use the NFS protocol to access your NetApp devices, or use a backup device that has a CIFS implementation compatible with SCB, for example, Windows or Linux Samba.

      • NFS: Network File System protocol.

        	Warning
        	When using the NFS protocol to create backups or archives, ensure that the files on the remote server are readable for the www-data user as well, because SCB uses this user to access remote backups and archives if needed.

   6. Enter the IP address or the hostname of the remote server into the Target settings > Target server field (for example backup.example.com).

   7. Fill the Retention time in days field. Only audit data older than this value is archived to the external server.

      	Note
      	The archived data is deleted from SCB. Connection metadata is not deleted. Log files are not deleted at this point, but are rotated on a weekly basis.

      	Note
      	Starting with SCB 3.0, data about archived connections can be automatically deleted from the connection database. For details, see Procedure 5.1.12, Configuring cleanup for the SCB connection database.

   8. SCB organizes the audit trails into directories based on the date or the protocol. The subdirectories are created directly into the archive directory. Select one of the following directory structures:

      • Protocol/Connection/Archive Date/

      • Archive Date/Connection/Protocol/

      • Connection Date/Protocol/Connection/

      • Archive Date/

      • Connection Date/

      For example, Protocol/Connection/Archive Date template will have create subdirectories for the audited protocols (that is, ssh, rdp, telnet, vnc), for the name of the connection policy, and finally, for the date (YEAR-MONTH-DAY in YYYY-MM-DD format).

      	Note
      	Connection Date refers to the time the connection started, while Archive Date to the time it was archived. The difference between the two dates depends on the retention time set for the archiving policy.

   9. Provide the protocol-specific parameters for the selected method. The protocol-specific parameters are described in Section 4.3.5.4, Parameters of the backup protocols.

   10. To receive e-mail notification of the backup, select the Send notification on errors only or the Send notification on all events option. Notifications are sent to the administrator e-mail address set on the Management tab, and include the list of the files that were backed up.

       	Note
       	This e-mail notification is different from the one set on the Alerting & Monitoring tab. This notification is sent to the administrator's e-mail address, while the alerts are sent to the alert e-mail address (see Section 4.3.4, Configuring system monitoring on SCB).

   11. Click Commit.

   Expected outcome: 

   An archive policy is created.

2. To use this policy to archive the data of a connection policy, navigate to the connection (for example to SSH Control > Connections, select the connection to archive the recorded audit trails from, and select the archive policy you want to use in the Archive/Cleanup policy field.

3. Click Commit.

   	Tip
   	To start the archiving process immediately, click Archive now. The Archive now functionality works only after the archiving has been configured.

4.3.5.3. Procedure – Encrypting configuration backups with GPG

Purpose: 

The configuration file of SCB during system-backups, upload the public-part of a GPG key. To enable GPG-encryption, complete the following steps:

	Warning
	The regular backups of SCB contain other information (for example databases), but only the configuration file is encrypted. Note that system-backups do not contain data like audit-trails.

Steps: 

1. Navigate to Basic > System > Management > System backup.

2. Select Encrypt configuration.

3. Select .

   • To upload a key file, click Browse, select the file containing the public GPG key, and click Upload. SCB accepts both binary and ASCII-armored GPG keys.

   • To copy-paste the key from the clipboard, paste it into the Key field and click Set.

   	Note
   	The GPG key you upload must be permitted to encrypt data. Keys that can be used only for signing cannot be used to encrypt the configuration file.

4. Click Commit.

4.4.6.1. Procedure – Modifying group privileges

Purpose: 

To modify the privileges of an existing group, complete the following steps:

Steps: 

1. Navigate to AAA > Access Control.

2. Find the group you want to modify and click Edit. The list of available privileges is displayed.

3. Select the privileges (pages of the SCB interface) to which the group will have access to and click Save.

   Figure 4.30. Modifying group privileges

   
   

   	Warning
   	Assigning the Search privilege to a user on the AAA page automatically enables the Search in all connections privilege, and grants the user access to every audit trail, even if the user is not a member of the groups listed in the Access control option of the particular connection policy.

4. Select the type of access (read or read & write) from the Type field.

5. Click Commit.

4.4.6.2. Procedure – Creating new usergroups for the SCB web interface

Purpose: 

To create a new group, complete the following steps:

Steps: 

1. Navigate to AAA > Access Control and click .

2. Enter a name for the group. For details on how you should name your groups, see Section 4.4.6.4, How to use usergroups.

3. Click the icon located next to the name of the group. The list of available privileges is displayed.

4. Select the privileges (pages of the SCB interface) to which the group will have access to and click Save.

5. Select the type of access (read or read & write) from the Type field.

6. Click Commit.

4.5.1.1. Procedure – Disabling controlled traffic

Purpose: 

To temporarily disable some or all of the controlled traffic to the protected servers, complete the following steps:

Figure 4.35. Disabling the controlled traffic

	Warning
	Disabling traffic that way is only temporary; connections will be enabled again after committing any other change from the SCB web interface. For details on how to permanently disable a type of traffic, see Procedure 4.5.1.2, Disabling controlled traffic permanently.

	Note
	Disabling the traffic affects only the traffic configured in the Connection policies, other traffic can pass SCB even if the all traffic is disabled. For details on configuring Connection policies, see Chapter 5, Configuring connections.

Steps: 

1. Navigate to the Basic Settings > System > Traffic control.

2. • To disable SSH traffic, click Stop in the SSH traffic field. Note that this also stops all other traffic forwarded in SSH, for example X11.

   • To disable RDP traffic, click Stop in the RDP traffic field.

   • To disable Telnet and TN3270 traffic, click Stop in the Telnet traffic field.

   • To disable VNC traffic, click Stop in the VNC traffic field.

   • To disable all types of traffic, click Stop in the All traffic field.

   The System monitor displays the status of all types of traffic.

4.5.1.2. Procedure – Disabling controlled traffic permanently

	Note
	Disabling the traffic affects only the traffic configured in the Connection policies, other traffic can pass SCB even if the all traffic is disabled. For details on configuring Connection policies, see Chapter 5, Configuring connections.

Steps: 

1. Figure 4.36. Disabling the controlled traffic persistently

   
   

   Navigate to the Global Options page of the traffic type you want to disable, for example to SSH Control > Global Options to disable SSH traffic.

2. Set the Traffic field to disabled.

3. Click Commit.