Versions Compared

Old Version 2

changes.mady.by.user IDERA

Saved on

compared with

New Version 3

changes.mady.by.user IDERA

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

To enable SSL encryption, complete the following steps on each agent system:

...

Note
titleNote
Do not perform these steps on the monitoring station.

  1. Ensure Stunnel is installed on the agent server. If you do not have access to a distribution, you can download it from Stunnel.org.

  2. Edit the /etc/xinetd.d/uptmagnt file so that it includes the following configuration information:

    Code Block
    languagetext
    service uptmagnt
    \n
     
{
    \n disable 
     
disable = no
    \n flags 
     
flags = REUSE
    \n 
     
socket_type
     = stream
    \n wait 
     
wait = no
    \n user 
     
user = nobody
    \n server 
     
server = /usr/sbin/stunnel
    \n 
     
server_args
     = /etc/stunnel/uptmagnt.conf
    \n
     
}
    \n
  3. Create the certificate that will be used by Stunnel. For example: 
     Code Block
    languagetext
    openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem
    4. \n
  4. The following is a sample stunnel.cnf for the openssl program:
     Code Block
    languagetext
    # create RSA certs - Server
    5. \n\nRANDFILE
  5. 
RANDFILE = stunnel.rnd
    6. \n\n
  6. 
[ req ]
    7. \ndefault
  7. 
default_bits = 1024
    8. \nencrypt
  8. 
encrypt_key = yes
    9. \ndistinguished
  9. 
distinguished_name = req_dn
    10. \nx509
  10. 
x509_extensions = cert_type
    11. \n\n
  11. 
[ req_dn ]
    12. \ncountryName
  12. 
countryName = Country Name (2 letter code)
    13. \ncountryName
  13. 
countryName_default
    14.             
  14.  = PL
    15. \ncountryName
  15. 
countryName_min 
    16.                 
  16. = 2
    17. \ncountryName
  17. 
countryName_max
    18.                 
  18.  = 2
    19. \n\nstateOrProvinceName            
  19. 
stateOrProvinceName = State or Province Name (full name)
    20. \nstateOrProvinceName
  20. 
stateOrProvinceName_default
    21.     
  21.  = Some-State
    22. \n\nlocalityName                    
  22. 
localityName = Locality Name (eg, city)
    23. \n\n0.organizationName             
  23. 
0.organizationName = Organization Name (eg, company)
    24. \n0
  24. 
0.organizationName_default
    25.      
  25.  = Stunnel Developers Ltd
    26. \n\norganizationalUnitName          
  26. 
organizationalUnitName = Organizational Unit Name (eg, section)
    27. \n#organizationalUnitName
  27. 
#organizationalUnitName_default =
    28. \n\n0.commonName                   
  28. 
0.commonName = Common Name (FQDN of your server)
    29. \n0
  29. 
0.commonName_default
    30.            
  30.  = localhost
    31. \n\n#
  31. 
# To create a certificate for more than one name uncomment:
    32. \n#
  32. 
# 1.commonName
    33.     
  33.  
    34.              
  34. = DNS alias of your server
    35. \n#
  35. 
# 2.commonName
    36.                  
  36.  = DNS alias of your server
    37. \n#
  37. 
# ...
    38. \n#
  38. 
# See http://home.netscape.com/eng/security/ssl_2.0_certificate.html
    39. \n#
  39. 
# to see how Netscape understands commonName.
    40. \n\n
  40. 
[ cert_type ]
    41. \nnsCertType
  41. 
nsCertType = server
    42. \n
  43. Copy stunnel.pem to /etc/stunnel/uptmagnt.pem.
...

  1. Create the /etc/stunnel/uptmagnt.conf file and add the following lines:
     Code Block
    languagetext
    cert=/etc/stunnel/uptmagnt.
...
  1. pem 
exec=/opt/uptime-agent/bin/uptmagnt
...
  1. Restart the xinetd service. After doing this, your agent should now be in SSL mode.
    You can verify that your agent is communicating securely by running the following command on your monitoring station:
     Code Block
    languagetext
    agentcmd +s -p 9998 <hostname> df-k
...
...
 Note
titleNote
  1. You can change the port on which to enable SSL to any value. To change the default agent port to something other than 9998, edit the /etc/services file, and restart xinetd. You can also use the agent-configure.sh script (see Setting the agent port or permissions for more information). 
Enabling SSL in the up.time UI
If the Linux agent has already been added to up.time, complete the following steps in the up.time Web interface for each agent system that you want to configure to use SSL.
      1. Click My Enterprise.
      2. Click the name of the agent system for which you want to enable SSL.
      3. On the system information page, click the Edit Performance Monitor link in the System Profile section.
      4. In the new Edit Service Monitor window that appears, select the Use SSL (HTTPS) option.
      5. Click Save.

        Once saved, your monitoring station Monitoring Station and agent system will be communicating via SSL.
...