BalaBit Shell Control Box 2.0.2 Administrator Guide

Procedure 4.3. Configuring a time (NTP) server

1. Select your timezone in the Timezone field.

2. Enter the IP address of an NTP time server into the Address field.

3. Click Commit.

4. Click the and icons to add new servers or delete existing ones.

Procedure 4.4. Configuring system logging

SCB can send its system log messages to remote syslog servers. To configure logging to a remote server, complete the following steps:

1. Navigate to Basic Settings > Management.

2. Click in the Syslog receivers field to add a new syslog server.

3. Enter the IP address and port of the syslog server into the respective fields.

4. Select the network protocol used to transfer the messages in the Protocol field. The legacy- prefix corresponds to the legacy BSD-syslog protocol described in RFC3164, while the ietf- prefix corresponds to the new IETF-syslog protocol described in RFC5424. Note that not every syslog server supports the IETF protocol yet.

   Select TCP+TLS to send the log messages using a TLS-encrypted connection.

   Tip

   Transferring the syslog messages using TCP ensures that the server receives them. Transferring the syslog messages using TLS encryption ensures that third parties cannot read the messages. However, not every syslog server accepts encrypted connections. The syslog-ng Premium Edition and Open Source Edition applications, and the syslog-ng Store Box (which is a log-collector appliance similar to SCB) support both encrypted connections and the new IETF-syslog protocol as well. See http://www.balabit.com/network-security/syslog-ng/central-syslog-server/ and http://www.balabit.com/network-security/syslog-ng/log-server-appliance/ for details on these products.

5. To display separate hostnames for syslog messages sent by the nodes of a SCB HA cluster, select the Include node ID in hostname in boot firmware messages option. The node ID included in the hostname filed of the syslog message is the MAC address of the node's HA interface. (Messages of the core firmware are always sent by the master node.)

6. If you have selected the TCP+TLS protocol, complete the following steps. Otherwise, click Commit.

   1. If you want SCB to verify the certificate of the syslog server, select Required trusted in the Server key check field and proceed to the next step.

      If you want SCB to simply accept any certificate shown by the server, select Optional untrusted in the Server key check field.

      Note

      Alternatively, you can use the following, less strict options to check the certificate of the server: Optional trusted: If the server sends a certificate, SCB checks if it is valid (not expired) and that the Common Name of the certificate contains the domain name or the IP address of the server. If these checks fail, SCB rejects the connection. However, SCB accepts the connection if the server does not send a certificate. Request untrusted: SCB requests a certificate from the server, and rejects the connection if no certificate is received, if the certificate is not valid (expired), or if the Common Name of the certificate does not contain the domain name or the IP address of the server.

   2. Click the icon in the CA X.509 certificate field. A popup window is displayed.

      Click Browse, select the certificate of the Certificate Authority (CA) that issued the certificate of the syslog server, then click Upload. Alternatively, you can paste the certificate into the Copy-paste field and click Upload.

      SCB will use this CA certificate to verify the certificate of the server, and reject the connections if the verification fails.

   3. If the syslog server requires mutual authentication, i.e., it expects a certificate from SCB, generate and sign a certificate for SCB, then click the icon in the Client X.509 certificate field to upload the certificate. After that, click the icon in the Client key field and upload the private key corresponding to the certificate.

   4. Click Commit.

7. Click the and icons to add new servers or delete existing ones.

Procedure 4.5. Configuring e-mail alerts

1. Navigate to Basic Settings > Management.

2. Figure 4.11. Configuring e-mail sending

   
   

   Enter the IP address or the hostname of the mail server into the SMTP server address field of the Mail settings group.

3. Enter the e-mail address of the administrator into the Administrator's e-mail address field. SCB sends notifications related to system-events (but not alerts and reports) to this address.

4. Enter the e-mail address of the administrator into the Send e-mail alerts to field. SCB sends monitoring alerts to this address.

5. Enter the e-mail address the person who should receive traffic reports from SCB into the Send reports to field. For details on reports, see Section 6.3, SCB reports.

6. Click Commit.

7. Click Test to send a test message.

   If the test message does not arrive to the server, check if SCB can access the server. See Section 4.5.3, Troubleshooting SCB for details.

8. Navigate to the Alerting & Monitoring tab of the Basic page, and select in which situations should SCB send an e-mail alert. See Section 4.3.4, Configuring system monitoring on SCB for details.

9. Click Commit.

Procedure 4.6. Configuring SNMP alerts

1. Navigate to Basic Settings > Management > SNMP trap settings.

2. Figure 4.12. Configuring SNMP alerts

   
   

   Enter the IP address or the hostname of the SNMP server into the SNMP server address field of the SNMP settings group.

3. Select the SNMP protocol to use.

   • To use the SNMP v2c protocol for SNMP queries, select SNMP v2c, and enter the community to use into the Community field.

   • To use the SNMP v3 protocol, select SNMP v3 and complete the following steps:

     Figure 4.13. Configuring SNMP alerts using SNMPv3

     
     

   1. Enter the username to use into the Username field.

   2. Enter the engine ID to use into the Engine ID field. The engine ID is a hexadecimal number at least 10 digits long, starting with 0x. e.g., 0xABABABABAB.

   3. Select the authentication method (MD5, SHA1) to use from the Authentication method field.

   4. Enter the password to use into the Authentication password field.

   5. Select the encryption method (Disabled, DES, AES) to use from the Encryption method field.

   6. Enter the encryption password to use into the Encryption password field.

4. Click Commit.

5. Navigate to the Alerting & Monitoring tab of the Basic page, and select in which situations should SCB send an SNMP alert. See Section 4.3.4, Configuring system monitoring on SCB for details.

6. Click Commit.

Procedure 4.7. Querying SCB status information using agents

1. Figure 4.14. Configuring SNMP agent access

   
   

   Navigate to Basic Settings > Management > SNMP agent settings.

2. The status of SCB can be queried dynamically via SNMP. By default, the status can be queried from any host. To restrict access to these data to a single host, enter the IP address of the host into the SNMP client address field.

3. Optionally, you can enter the details of the SNMP server into the System location, System contact, and System description fields.

4. Select the SNMP protocol to use.

   • To use the SNMP v2c protocol for SNMP queries, select SNMP v2c, and enter the community to use into the Community field.

   • To use the SNMP v3 protocol, select SNMP v3 and complete the following steps:

   1. Enter the username used by the SNMP agent into the Username field.

   2. Select the authentication method (MD5, SHA1) to use from the Authentication method field.

   3. Enter the password used by the SNMP agent into the Auth. password field.

   4. Select the encryption method (Disabled, DES, AES) to use from the Encryption method field.

   5. Enter the encryption password to use into the Encryption password field.

   6. To add other agents, click .

5. Click Commit.

Procedure 4.8. Configuring monitoring

1. Navigate to the Basic Settings > Alerting & Monitoring page.

2. The default threshold values of the parameters are suitable for most situations. Adjust the thresholds only if needed.

3. Click Commit.

4. Navigate to the Basic Settings > Management page and verify that the SNMP settings and Mail settings of SCB are correct. SCB sends alerts only to the alert e-mail address and to the SNMP server.

   	Warning
   	Sending alerts fails if these settings are incorrect.

Procedure 4.9. Creating configuration and data backups

1. Create a backup policy.

   1. Navigate to Policies > Backup & Archive/Cleanup and click in the Backup policies section to create a new backup policy.

   2. Enter a name for the backup policy (e.g., config-backup).

   3. Enter the time when the backup process should start into the Start time field in HH:MM format (e.g., 23:00).

   4. Enter the IP address or the hostname of the remote server into the Target server field (e.g., backup.example.com).

   5. Figure 4.17. Configuring backups and archiving

      
      

      SCB can access the remote server via different protocols. Select the one to use from the available protocols:

      • Rsync over SSH: Execute the rsync command via the Secure Shell protocol. Note that the backup server must run rsync version 3.0 or newer.

      • SMB/CIFS: Server Message Block protocol used on Microsoft Windows Network.

      • NFS: Network File System protocol.

   6. Provide the protocol-specific parameters for the selected method. The protocol-specific parameters are described in Section 4.3.5.2, Parameters of the backup protocols.

   7. To receive e-mail notification of the backup, select the Send notification on errors only or the Send notification on all events option. Notifications are sent to the administrator e-mail address set on the Management tab, and include the list of the files that were backed up.

      	Note
      	This e-mail notification is different from the one set on the Alerting & Monitoring tab. This notification is sent to the administrator's e-mail address, while the alerts are sent to the alert e-mail address (see Section 4.3.4, Configuring system monitoring on SCB).

   8. Click Commit.

2. Figure 4.18. Configuring system backups

   
   

   To use this policy to create configuration backups, navigate to Basic Settings > Management > System backup, and select the backup policy you want to use for backing up the configuration of SCB in the System backup policy field.

   To use this policy to create data backups, navigate to Connections, select the connection you want to backup, and select a backup policy in the Backup policy field.

3. Click Commit.

   	Tip
   	To create an immediate backup of SCB's configuration to your machine (not to the backup server), select Basic Settings > System > Export configuration. Note that the configuration export contains only the system settings and configuration files (including changelogs). System backups includes additional information like reports and alerts, and also the connection database.

Procedure 4.10. Archiving the collected data

1. Create an archive policy.

   1. Navigate to Policies > Backup & Archive/Cleanup and click in the Archive/Cleanup policies section to create a new archive policy.

   2. Figure 4.19. Configuring backups and archiving

      
      

      Enter a name for the archive policy.

   3. Enter the time when the backup process should start into the Start time field in HH:MM format (e.g., 23:00).

   4. Enter the IP address or the hostname of the remote server into the Target server field (e.g., backup.example.com).

   5. Fill the Retention time in days field. Only audit data older than this value is archived to the external server.

      	Note
      	The archived data is deleted from SCB. Connection metadata is not deleted. Log files are not deleted at this point, but are rotated on a weekly basis.

   6. SCB organizes the audit trails into directories based on the date or the protocol. The subdirectories are created directly into the archive directory. Select one of the following directory structures:

      • Protocol/Connection/Archive Date/

      • Archive Date/Connection/Protocol/

      • Connection Date/Protocol/Connection/

      • Archive Date/

      • Connection Date/

      For example, Protocol/Connection/Archive Date template will have create subdirectories for the audited protocols (i.e., ssh, rdp, telnet, vnc), for the name of the connection policy, and finally, for the date (YEAR-MONTH-DAY in YYYY-MM-DD format).

      	Note
      	Connection Date refers to the time the connection started, while Archive Date to the time it was archived. The difference between the two dates depends on the retention time set for the archiving policy.

   7. SCB can access the remote server via different protocols. Select the one to use from the available protocols:

      • Only cleanup, no archiving: Do not archive data to a server, simply delete the data that is older than Retention time in days.

        	Warning
        	No archiving permanently deletes all audit trails and data that is older than Retention time in days without creating a backup copy or an archive. Such data is irrecoverably lost. Use this option with care.

      • SMB/CIFS: Server Message Block protocol used on Microsoft Windows Network.

      • NFS: Network File System protocol.

   8. Provide the protocol-specific parameters for the selected method. The protocol-specific parameters are described in Section 4.3.5.2, Parameters of the backup protocols.

   9. To receive e-mail notification of the backup, select the Send notification on errors only or the Send notification on all events option. Notifications are sent to the administrator e-mail address set on the Management tab, and include the list of the files that were backed up.

      	Note
      	This e-mail notification is different from the one set on the Alerting & Monitoring tab. This notification is sent to the administrator's e-mail address, while the alerts are sent to the alert e-mail address (see Section 4.3.4, Configuring system monitoring on SCB).

   10. Click Commit.

2. To use this policy to archive the data of a connection policy, navigate to the connection (e.g., to SSH Control > Connections, select the connection to archive the recorded audit trails from, and select the archive policy you want to use in the Archive/Cleanup policy field.

3. Click Commit.

   	Tip
   	To start the archiving process immediately, click Archive now. The Archive now functionality works only after the archiving has been configured.

Procedure 4.15. Creating local users

1. Figure 4.24. Creating local users

   
   

   Navigate to AAA > Local Users and click .

2. Enter the username into the User field.

   	Note
   	The following characters cannot be used in usernames: \\/[]:;|=,+*?<>

3. Enter a password for the user into the Password and Verify password fields.

   The strength of the password is indicated below the Password field as you type. To set a policy for password strength, see Section 4.4.1.1, Setting password policies for local users. The user can change the password later from the SCB web interface.

4. Click in the Groups section and select a group that the user will be member of. Repeat this step to add the user to multiple groups. See Section 4.4.4, Managing user rights and usergroups for details about the different groups.

   • To remove a user from a group, click the icon located next to the group.

   • To delete a user, click the icon located at the right edge of the screen.

5. Click Commit.

Procedure 4.18. Configuring LDAP authentication

1. Figure 4.27. Configuring LDAP authentication

   
   

   Navigate to AAA > Settings > Authentication settings.

2. Select the LDAP option and enter the parameters of your LDAP server.

   Figure 4.28. Configuring LDAP authentication

   
   

   1. Enter the IP address or hostname and port of the LDAP server into the Server Address field.

      To add multiple servers, click and enter the address of the next server. If a server is unreachable, SCB will try to connect to the next server in the list in failover fashion.

      	Warning
      	If you will use a TLS-encrypted with certificate verification to connect to the LDAP server, use the full domain name (e.g., ldap.example.com) in the Server Address field, otherwise the certificate verification might fail. The name of the LDAP server must appear in the Common Name of the certificate.

   2. Select the type of your LDAP server in the Type field. Select Active Directory to connect to Microsoft Active Directory servers, or Posix to connect to servers that use the POSIX LDAP scheme (e.g., Novell e-directory).

   3. Enter the name of the DN to be used as the base of the queries into the Base DN field (e.g., DC=demodomain,DC=exampleinc).

   4. Enter the name of the DN where SCB should bind to before accessing the database into the Bind DN field (e.g., CN=Administrator,CN=Users,DC=demodomain,DC=exampleinc).

      	Note
      	SCB accepts both pre-win2000-style and Win2003-style account names (User Principal Names), e.g., administrator@example.com is also accepted.

   5. Enter the password to use when binding to the LDAP server into the Bind Password field.

3. If you want to encrypt the communication between SCB and the LDAP server, select the Use StartTLS option and complete the following steps:

   1. 	Note
      	TLS-encrypted connection to Microsoft Active Directory is supported only on Windows 2003 Server and newer platforms. Windows 2000 Server is not supported. Only the STARTTLS method is supported to encrypt the communication between the LDAP server and SCB. The LDAPS protocol is not supported.

      • If you want SCB to verify the certificate of the server, click the icon in the CA X.509 certificate field. A popup window is displayed.

        Click Browse, select the certificate of the Certificate Authority (CA) that issued the certificate of the LDAP server, then click Upload. Alternatively, you can paste the certificate into the Copy-paste field and click Set.

        SCB will use this CA certificate to verify the certificate of the server, and reject the connections if the verification fails.

        If you want SCB to simply accept any certificate shown by the LDAP server, select Required untrusted in the Server key check field.

        Note

        Alternatively, you can use the following options to check the certificate of the LDAP server: None: Do not request a certificate from the remote host, and accept any certificate if the host sends one. Optional trusted: If the remote host sends a certificate, SCB checks if it is valid (not expired) and that the Common Name of the certificate contains the domain name or the IP address of the host. If these checks fail, SCB rejects the connection. However, SCB accepts the connection if the host does not send a certificate. Optional untrusted:Accept any certificate shown by the remote host. Note that the host must show a certificate. Required trusted: Verify the certificate of the remote host. Only valid certificates signed by a trusted certificate authority are accepted. See Procedure 4.41, Uploading external certificates to SCB for details on importing CA certificates. Note that the Common Name of the certificate must contain the domain name or the IP address of the host. Request untrusted: SCB requests a certificate from the remote host, and rejects the connection if no certificate is received; if the certificate is not valid (expired); or if the Common Name of the certificate does not contain the domain name or the IP address of the host.

        	Warning
        	If you will use a TLS-encrypted with certificate verification to connect to the LDAP server, use the full domain name (e.g., ldap.example.com) in the Server Address field, otherwise the certificate verification might fail. The name of the LDAP server must appear in the Common Name of the certificate.

      • If the LDAP server requires mutual authentication, i.e., it expects a certificate from SCB, generate and sign a certificate for SCB, then click the icon in the Client X.509 certificate field to upload the certificate. After that, click the icon in the Client key field and upload the private key corresponding to the certificate.

4. If you have modified the Server key check field or the keys used in the connections, perform the following steps:

   	Warning
   	This step terminates all controlled connections going through SCB. Disconnect your clients from the protected servers before proceeding.

   To activate the new settings, navigate to Basic Settings > System > System control, and click All services > Restart.

5. Click Commit.

6. Click Test to test the connection. Note that the testing of SSL-encrypted connections is currently not supported.

Procedure 4.19. Configuring RADIUS authentication

To authenticate SCB users to a RADIUS server, complete the following steps:

1. Figure 4.29. Configuring RADIUS authentication

   
   

   Navigate to AAA > Settings.

2. Set the Authentication method field to Radius.

3. Enter the IP address or domain name of the RADIUS server into the Address field.

4. Enter the password that SCB can use to access the server into the Shared secret field.

5. To add more RADIUS servers, click and repeat Steps 2-4.

   Repeat this step to add multiple servers. If a server is unreachable, SCB will try to connect to the next server in the list in failover fashion.

6. 	Warning
   	After clicking Commit, the SCB web interface will be available only after successfully authenticating to the RADIUS server. Note that the default admin account of SCB will be able to login normally, even if the RADIUS server is unaccessible.

   Click Commit.

Procedure 4.20. Modifying group privileges

1. Navigate to AAA > Access Control.

2. Find the group you want to modify and click . The list of available privileges is displayed.

3. Figure 4.31. Modifying group privileges

   
   

   Select the privileges (pages of the SCB interface) to which the group will have access to and click Save.

   	Warning
   	Assigning the Search privilege to a user on the AAA page automatically enables the Search in all connections privilege, and grants the user access to every audit trail, even if the user is not a member of the groups listed in the Access control option of the particular connection policy.

4. Select the type of access (read or read & write) from the Type field.

5. Click Commit.

Procedure 4.21. Creating new usergroups for the SCB web interface

1. Navigate to AAA > Access Control and click .

2. Enter a name for the group. See Section 4.4.4.2, How to use usergroups for details on how you should name your groups.

3. Click the icon located next to the name of the group. The list of available privileges is displayed.

4. Select the privileges (pages of the SCB interface) to which the group will have access to and click Save.

5. Select the type of access (read or read & write) from the Type field.

6. Click Commit.