Chat now with support
Chat mit Support

Foglight Agent Manager 7.3.0 - Foglight Agent Manager Guide

Configuring the embedded Agent Manager Installing external Agent Managers Configuring the Agent Manager Advanced system configuration and troubleshooting
Configuring Windows Management Instrumentation (WMI) Configuring Windows Remote Management (WinRM) UNIX- and Linux-specific configuration
Monitoring the Agent Manager performance Deploying the Agent Manager to large-scale environments

Creating a secure connection with downstream instances

The following procedure can be used to create a secure connection between the concentrator and downstream Agent Manager instances using HTTPS.

To create a secure connection between the concentrator and downstream instances:
1
Stop the Agent Manager concentrator.
1
Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/jre/<jre_version>/<jre>/bin/ directory.
2
If you do not already have an SSL certificate for the concentrator host, you can create a self-signed certificate by executing the following command on the concentrator machine, where <password> is replaced with your desired password:
keytool -genkeypair -alias fglam -keystore </path/to/fglam.kesytore> -storepass <password>
3
Respond to the prompts from keytool. Only the “first and last name” are required, all other fields can be left blank. The “first and last name” form the common name (CN) for this key pair and this needs to be provided to the Management Server (for reverse polling) or downstream Agent Managers (as the ssl-cert-common-name). You can type anything you want into this field, but the host name is the most common choice. The default value, if left blank, is Unknown.
4
Press Enter to set the key password to the same value as the keystore.
5
Open the file <fglam_home>/state/<state name>/config/fglam.config.xml for editing.
6
Between the existing <http-downstreams> and </http-downstreams> tags, add an <https-downstream/> child element:
<https-downstream key-password=<password> keystore=<path_to_keystore> port=<port_number> [address=<network_address>]/>
Where:
•
<password> is the same password you specified in Step 2 for -storepass. The password is saved in an encrypted form in fglam.config.xml when you restart the Agent Manager.
•
<path_to_keystore> is the path to the Agent Manager keystore.
•
<port_number> is the port number on which you want the concentrator to listen for connections from downstream Agent Manager instances.
•
<network_address> is the network address, to which the concentrator is bound when receiving connections from the downstream instances. This argument is optional. It is useful when a machine has two or more network addresses and you want the connections to the Management Server to go out from one, and the connections from the downstream instances to come in to another.
 
* 
IMPORTANT: Other optional attributes are available for the <https-downstreams> element. See the file fglam.config.xml for details.
7
If required, configure the concentrator to listen for connections on multiple different ports by adding additional <https-downstream/> elements and setting the arguments as described above.
This is useful in situations where the machine on which the concentrator runs has multiple network connections and you want the concentrator to listen on different network connections with different ports. For example, the concentrator listens on network connection 1 with port 8081 and listens on network connection 2 with port 8082.
8
Restart the Agent Manager concentrator.
9
Configure each downstream Agent Manager instance that connects to the Agent Manager concentrator using this secure connection so that:
•
It connects using HTTPS.
•
It accepts self-signed certificates.
•
It accepts a certificate with an unexpected common name (host name), and the common name for the certificate is set to Unknown.
See Configuring Management Server URLs using the installer interface or Step 10: Change service credentials [Optional] for information about these parameters, which you can set through the Agent Manager installer or configuration interface.
* 
NOTE: It is not recommended to enable the ssl-allow-self-signed configuration when the downstream Agent Manager is running in FIPS-compliant mode. If this configuration is disabled, you have to add the concentrator's certificate to the downstream Agent Manager's keystore in order to connect to the concentrator using HTTPS.
To export certificate from concentrator:
1. Locate the element <config:http-downstream> in <fglam_home>/state/default/config/fglam.config.xml file on concentrator Agent Manager, and get the path of the keystore corresponding to the downstream Agent Manager. If it is a relative path, it is relative to the path of "<fglam_home>/state/default/".
2. Launch a command shell and navigate to the <fglam_home>/jre/<jre_version>/jre/bin directory.
3. Issue the following command to export concentrator's certificate:
keytool -exportcert -noprompt -rfc -alias fglam-cert -file <exported-cert-filename> -keystore </path/to/keystore> -storepass <key-password> -storetype BCFKS -providerpath "<fglam_home>\client\<build-version>\lib\bc-fips.jar" -providername BCFIPS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
To import the exported certificate to downstream Agent Manager:
1. Launch a command shell and navigate to the <fglam_home>/bin on the downstream Agent Manager.
2. Issue the following command to import certificate:
fglam --add-certificate <alias=/path/to/exported-cert-filename>

Excluding SSL ciphers from upstream or downstream Connections

You can exclude SSL cipher suites from both upstream Agent Manager connections (to the Management Server or an Agent Manager concentrator), or downstream connections (as a concentrator).

If you need to exclude one or more ciphers from the SSL encryption used for SSL connections, you can do so using one or more excluded-ssl-cipher elements in the fglam.config.xml file. For example, you may want to exclude lower encryption strength ciphers, or ciphers with security vulnerabilities.

To exclude specific SSL ciphers from an upstream connection:
1
Open the <fglam_home>/state/<state name>/config/fglam.config.xml file for editing.
2
Between the existing <config:http-upstreams> and </config:http-upstreams> tags, add an <config:http-upstream/> child element:
<config:http-upstream url="https://secure_server_URL:port_number">
<config:excluded-ssl-cipher name="SSL_RSA_WITH_RC4_128_MD5"/>
<config:excluded-ssl-cipher name="SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"/>
<config:excluded-ssl-cipher name="SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"/>
</config:http-upstream>
3
Save your changes.
4
Restart the Agent Manager.
To exclude specific SSL ciphers from a downstream connection:
1
Open the <fglam_home>/state/<state name>/config/fglam.config.xml file for editing.
2
Between the existing <config:http-downstreams> and </config:http-downstreams> tags, add an <config:https-downstream/> child element:
<config:https-downstream port="port_number">
<config:excluded-ssl-cipher name="SSL_RSA_WITH_RC4_128_MD5"/>
<config:excluded-ssl-cipher name="SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"/>
<config:excluded-ssl-cipher name="SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"/>
</config:https-downstream>
3
Save your changes.
4
Restart the Agent Manager.
 
* 
NOTE: For a complete list of SSL cipher suite names, consult your vendor-specific JRE documentation.

Excluding Specific SSL Protocols from Downstream Connections

If you need to exclude one or more protocols from the SSL protocol negotiation, you can do so using one or more excluded-ssl-protocol elements. Some common values are SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2.

If none are specified, then SSLv2Hello and SSLv3 are disabled by default. Otherwise only those protocols listed will be excluded.

To exclude specific SSL protocols from a downstream connection:
1
Open the <fglam_home>/state/<state name>/config/fglam.config.xml file for editing.
2
Between the existing <config:http-downstreams> and </config:http-downstreams> tags, add an <config:https-downstream/> child element:
<config:https-downstream port="8443">
<config:excluded-ssl-protocol name="SSLv2Hello"/>
<config:excluded-ssl-protocol name="SSLv3"/>
<config:excluded-ssl-protocol name="TLSv1"/>
</config:https-downstream>
3
Save your changes.
4
Restart the Agent Manager.

Configuring the Agent Manager to accept connections from the Management Server

You can configure the Foglight® Agent Manager to accept connections from the Management Server and enable reverse data polling. This is useful in situations when the Agent Manager cannot connect to the Management Server due to its location. For example, when the Agent Manager is located in the cloud and the Management Server runs on premises, the Agent Manager has no means to connect to the Management Server and pass on the collected data. Another example is when the Agent Manager resides in a demilitarized zone (DMZ), exposed to untrusted networks, and the Management Server is behind a firewall.

To enable this feature, you must instruct the Agent Manager to accept connections from the Management Server in order to facilitate normal message passing and data polling.

 
* 
NOTE: Only the Management Server can reverse poll an Agent Manager instance. An Agent Manager instance cannot reverse poll another Agent Manager instance.

You do this by performing the following steps:

•
Configure downstream SSL connections using the configuration interface. You can do that either using the installer interface (see Step 8: Downstream Connection Configuration ), or the command-line interface (see Step 6: Downstream Connection Configuration ).
Or:
Configure downstream non-SSL connections, or connections requiring user-provided certificates or keystores. For instructions, see To configure non-SSL connections or connections using user-provided certificates or keystores:.
•
Using the fglam.config.xml file, disable upstream connections to the Management Server. For instructions, see To prevent the Agent Manager from connecting to the Management Server:.
•
On the Management Server, configure the FglAM Adapter, to instruct the Management Server to connect to this Agent Manager. For instructions, see To configure the Management Server to connect to the Agent Manager:.

To prevent the Agent Manager from connecting to the Management Server:
1
Open the fglam.config.xml file for editing. This file is located in the <fglam_home>/state/default/config directory.
2
In the fglam.config.xml file, locate the <config:http-upstreams> XML element, and within that element, declare a new <config:http-upstream> element using the following lines of code:
<config:http-upstream>
<no-connection/>
</config:http-upstream>
The no-connection element prevents the Agent Manager from connecting to the upstream Management Server.
3
Save your changes and restart the Agent Manager.
To configure non-SSL connections or connections using user-provided certificates or keystores:
1
Open the fglam.config.xml file for editing. This file is located in the <fglam_home>/state/default/config directory.
2
In the fglam.config.xml file, locate the <config:http-downstreams> XML element, and within that element, declare a new <config:http-downstream> sub-element for a non-SSL connection or <config:https-downstream> for an SSL connection.
3
Non-SSL connections only. Within the newly created <config:http-downstream> element, provide a port number that the Agent Manager will use to listen for incoming connections, and optionally the IP address of the network interface. For example:
<http-downstream port="9090" address="127.0.0.1"/>
4
User-provided certificates or keystores only. Within the newly created <config:https-downstream> element, provide the information about the certificate and keystore you want to use. There is a wide range of attributes that you can use. For complete instructions, review the <config:documentation> element under <config:http-downstreams>.
NOTE: When Agent Manager runs in FIPS-compliant mode, only the BCFKS keystore type can be used to store the key pair. Follow below steps to generate a key pair and BCFKS keystore on Agent Manager, and then import its certificate to Management Server for SSL connections:
1
Launch a command shell and navigate to the <fglam_home>/jre/<jre_version>/jre/bin directory on Agent Manager. And then issue the following command to generate the keypair and BCFKS keystore.
keytool -genkeypair -noprompt -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -dname "CN=<fglam_host_name>" -validity 365 -alias <keypair_alias_name> -keystore </path/to/fglam.kesytore> -storepass <password> -storetype BCFKS -providerpath <fglam_home>\client\<build-version>\lib\bc-fips.jar -providername BCFIPS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
2
Export the certificate from BCFKS keystore:
keytool -exportcert -noprompt -rfc -alias <keypair_alias_name> -file </path/to/exported-cert-filename> -keystore </path/to/fglam.kesytore> -storepass <password> -storetype BCFKS -providerpath <fglam_home>\client\<build-version>\lib\bc-fips.jar -providername BCFIPS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
3
Import the certificate to Management Server:
a
Locate the property 'Trust Store' in Administration > Setup > Management Server Configuration dashboard, and get the path of current trust store used by Management Server.
b
Issue the following command to import the certificate to Management Server:
•
The JRE cacerts is the default trust store if Management Server runs in non-FIPS mode. Issue the following command to import the certificate to Management Server:
keytool -import -alias <alias_name> -file </path/to/exported-cert-filename> -keystore <fms_home>/jre/lib/security/cacerts -storepass changeit
•
The trust.fips.keystore is the default trust store if Management Server runs in FIPS-compliant mode. Issue the following command to import the certificate to Management Server:
keytool -import -alias <alias_name> -file </path/to/exported-cert-filename> -keystore <fms_home>/config/security/trust.fips.keystore -deststoretype BCFKS -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath <fms_home>/server/core/bc-fips.jar -storepass nitrogen
To configure the Management Server to connect to the Agent Manager:
1
Log in to the Foglight browser interface and navigate to the Agent Properties dashboard.
2
On the Agent Properties dashboard, under Agent Type, select FglAM Adapter, and in the pane on the right, click Edit.
3
In the Agent Type Properties dialog box that appears, under Hosts to Pull Data From, click Edit.
4
In the Edit List of Hosts to Pull Data From dialog box that appears, click Add.
The table refreshes, showing a newly added row.
5
Specify the connection information to the Agent Manager that you want the Management Server to connect to by populating any of the following columns, as required.
•
Enabled: Select this check box if you want the Management Server to connect to this Agent Manager.
•
URL: Type the URL the Agent Manager uses to communicate with the Management Server.
•
Local Address: To specify a local network address for the Management Server connection to the Agent Manager, type the IP address of a NIC (network interface card) on the machine hosting the Agent Manager required to establish connections to the Management Server.
•
Proxy URL: If you want the Management Server to connect to the Agent Manager using a proxy, type the URL of the proxy server.
•
Proxy NTLM Domain: If you are using a proxy server for communication, and the proxy uses Windows authentication, type the Windows domain.
•
Proxy User Name: If you are using a proxy server for communication, type the user name needed to access the proxy server.
•
Proxy Password: If you are using a proxy server for communication, type the password associated with the user name.
•
Allow Self Signed SSL Certificates: Select this check box if you want to enable the Management server to accept self-signed-certificates from the Agent Manager. It is not recommended to enable this configuration in FIPS-compliant mode for security consideration. When Management Server is running in FIPS-compliant mode, you need to add the Agent Manager's public certificate to Management Server's jre keystore. For more information, see To configure non-SSL connections or connections using user-provided certificates or keystores: .
•
SSL Certificate Common Name: If you want to enable the Management Server to accept self-signed certificates from the Agent Manager, and the certificate has a different common (host) name than the one reported by the Agent Manager, type the certificate common name.
•
Compressed Connection: Select this check box if you want the Management Server to establish HTTP-compressed communication with the Agent Manager.
•
Chunked HTTP Connection: Select this check box if you want to use an HTTP connection with chunked transfer encoding enabled.
Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen