Tchater maintenant avec le support
Tchattez avec un ingénieur du support

Foglight 5.9.4 - Installing Foglight on Windows with an Embedded PostgreSQL Database

Before Installing Foglight Installing Foglight
Preparing to install Installing a new version of the Management Server Installed directories Foglight settings Uninstalling Foglight Upgrading the Management Server
Running the Management Server Installing and Upgrading Cartridges Installing Agents Appendix: Switching from an Embedded to an External Database

Importing a network security certificate

In order to set up the Foglight Management Server to use HTTPS, you must generate a key pair (security certificate) into the Foglight keystore. This security certificate allows the server to communicate through the HTTPS protocol. Delete the existing certificate shipped with Foglight before generating a new key pair. Use the keytool utility shipped with Foglight to create, import, and export certificates. This utility can be found at:

<foglight_home>\jre\bin\keytool.exe

There are two keystores that Foglight uses:

•
The built-in Tomcat™ keystore located at:
<foglight_home>\config\tomcat.keystore (default password: nitrogen)
•
The Management Server keystore located at:
<foglight_home>\jre\lib\security\cacerts (default password: changeit)
To import a certificate:
1
Back up the existing tomcat key using the following command:
cd <foglight_home>\config
cp tomcat.keystore <your_backup_key>
2
Delete the existing tomcat key from the tomcat.keystore directory using the following command:
<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -delete
3
Create a new key under the tomcat alias using the following command:
<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -genkeypair -alias tomcat -validity <number of days> -keyalg RSA -keysize 2048 -dname "CN=<your_fmsserver_dns_name>, OU=<your_organizational unit_name>, O=<your_organization_name>, L=<your_city_name>, ST=<your_state_name>, C=<your_two-letter_country_code>" -ext SAN=dns:<your_fmsserver_dns_name>,ip:<your_fmsserver_ip>
4
Generate a Certificate Signing Request (CSR) using the following command:
<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -validity <number of days> -certreq -ext san=dns:<your_fmsserver_dns_name>,ip:<your_fmsserver_ip> -file <your_request_file.csr>
This file must be signed by Certification Authority (CA).
5
Once you have the certificate signed, import it back to the tomcat.keystore using the following command:
<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -validity <number of days> -trustcacerts -import -file <your_converted_cerificate>
You will get a prompted message similar to the following:... is not trusted. Install reply anyway? [no]:
Type yes to install the new certificate.
The following is an example of commands for importing a certificate.
cd <foglight_home>/config
cp tomcat.keystore tomcat.keystore.backup
<foglight_home>/jre/bin/keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -delete
<foglight_home>/jre/bin/keytool -keystore tomcat.keystore -storepass nitrogen -genkeypair -alias tomcat -validity 730 -keyalg RSA -keysize 2048 -dname "CN=fms.quest.com, OU=Foglight, O=Quest, L=Aliso Viejo, ST=CA, C=US" -ext SAN=dns:fms.quest.com,ip:192.168.1.1
<foglight_home>/jre/bin/keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -validity 730 -certreq -ext san=dns:fms.quest.com,ip:192.168.1.1 -file san.p7b
<foglight_home>/jre/bin/keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -validity 730 -trustcacerts -import -file san.p7b

Importing a PKCS #12 (pfx) format certificate

If you have an existing SSL certificate and you want to use this certificate in Tomcat, follow the steps below to import this SSL certificate.

* 
NOTE: This certificate must be provided in the PKCS #12 (pfx) format. If the certificate and private key are saved in separate files, run the following command to merge them to the PKCS12 format:
openssl pkcs12 -export -in <certfile> -inkey <keyfile> -out <keystorefile> -name tomcat -CAfile <cacertfile> -caname root
To import a certificate in Tomcat:
1
Delete the existing tomcat certificate from the tomcat.keystore directory using the following command:
<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -delete
2
Obtain the certificate’s alias name from the certificate PFX file using the following command:
<foglight_home>\jre\bin\keytool -keystore <your certificate pfx file> -storepass <certificate pfx password> -list -v
The following is an example of command output. The value of Alias name is required in step 3.
Your keystore contains 1 entry
Alias name: tq-294043e3-fd9d-42ee-a596-0217c7d6d5f8
Creation date: May 8, 2020
Entry type: PrivateKeyEntry
3
Merge the Tomcat keystore and the PKCS12 keystore using the following command:
<foglight_home>\jre\bin\keytool -importkeystore -destkeystore tomcat.keystore -deststorepass nitrogen -destalias tomcat -srckeystore <your certificate pfx file> -srcstorepass <certificate pfx password> -srcstoretype pkcs12 -srcalias <alias name in step 2>
4
On the Management Server, open the <foglight_home>/server/tomcat/server.xml file for editing.
5
In the server.xml file, locate the following Connector element and add keyPass and keyAlias parameters at the end:
<Connector executor="tomcatThreadPool" maxHttpHeaderSize="8192" URIEncoding="UTF-8" scheme="https" secure="true" SSLEnabled="true" clientAuth="false" keystoreFile="../../config/tomcat.keystore" keystorePass="q171ede14ed29f0c1ee9dc65f698d8e6d" sslProtocol="TLS" sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1,SSLv2Hello" bindOnInit="false" maxThreads="900" keyPass="<certificate pfx password>" keyAlias="tomcat"/>

Setting the length of Foglight sessions

 
* 
NOTE: This section applies only to Foglight for Virtualization, Enterprise Edition.

You can configure the length of inactive Foglight browser interface sessions by changing the value of the parameter server.console.session.timeout. This parameter controls the length of time that Foglight waits before automatically logging you out of an idle browser interface session.

To change the Foglight session time-out setting:
1
Stop the Management Server.Open the file <foglight_home>\config\server.config on the Management Server machine. Set the parameter server.console.session.timeout to the desired value in minutes.
The default value is 60 minutes. If you set the value to less than or equal to 0, or greater than 30000000, Foglight never logs you out of the browser interface, regardless of how long the session has been inactive.
For example, to increase the time-out to 2 hours (120 minutes), you would set this parameter as follows:
server.console.session.timeout = "120";
2
Save the server.config file.
3
Restart the Management Server.

Uninstalling Foglight

You can uninstall Foglight using the uninstaller utility for your platform. The uninstaller can be found in <foglight_home>\UninstallerData.

The default mode for the uninstaller is the graphical user interface (GUI) mode. However, in cases where a graphics display is not available, the Foglight installer can be run from the command line by using the silent uninstaller.

To uninstall Foglight:
1
Stop the Foglight Management Server using the appropriate method:
•
To stop a standalone Management Server that is not running as a Windows® service, follow the instructions in Stopping the Management Server.
•
To stop a standalone Management Server that is running as a Windows service, follow the instructions in Running the Management Server as a Windows service.
2
Navigate to the UninstallerData directory of your Foglight installation and run the Uninstall Foglight executable.
•
To launch the uninstaller in GUI mode, simply run the Uninstall Foglight executable.
•
To launch the uninstaller in silent mode, run the Uninstall Foglight executable using the following command:
”Uninstall Foglight.exe” -i silent -f installvariables.properties
3
After uninstallation, you can safely delete the <foglight_home> directory. It is recommended that you do so, since the uninstaller does not remove certain directories within <foglight_home>.
 
* 
NOTE: After uninstallation, you can also safely delete any Foglight shortcuts, regardless of their location.
Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation