4.3 Configuring Security Settings

Change Guardian uses the profile_javos profile for secure communication.

This section provides the following information:

4.3.1 Configuring TLS

Enabling TLS 1.1

By default, TLS 1.1 is disabled for new installations. Enable TLS 1.1 if you have Change Guardian running on FIPS mode.

To enable TLS 1.1:

  1. Log in to the Change Guardian server as root.

  2. Edit the /opt/novell/sentinel/jdk/jre/lib/security/java.security file.

  3. Remove TLSv1.1 from the following list of disabled algorithms:

    jdk.tls.disabledAlgorithms=TLSv1,TLSv1.1,SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL

  4. Restart the Change Guardian server:

    /opt/netiq/cg/scripts/cg_services.sh restart

4.3.2 Configuring Certificates

To configure trusted connections when authenticating to the Administration Console, install valid certificates on the Change Guardian server.

Following sections provide information about configuring certificates:

Installing the Certificates

To install certificates:

  1. Log in to the Change Guardian server as root.

  2. Switch user to novell.

  3. Go to the /opt/novell/sentinel/setup directory.

  4. (Optional) Generate request to sign certificate:

    ./ssl_certs_cg

    1. Select Web Server.

    2. Specify the certificate signing request (.csr) filename.

    3. Specify to get the .csr file signed by a certificate authority (CA).

  5. Copy the CA root certificate chain (ca.crt) and the signed certificate (.crt) to /opt/novell/sentinel/setup.

  6. Import the CA root certificate chain and the web server certificate:

    1. Generate request to sign certificate:

      ./ssl_certs_cg

    2. Select Import certificate authority root certificate.

    3. Enter the CA root certificate chain file name (ca.crt).

    4. Select Import certificate signed by certificate authority.

    5. Select Web Server.

    6. Specify the name of the file that contains the CA signed digital certificate.

    7. Select another service if necessary or select Done and exit from the service option.

  7. Select Exit to exit from the TLS/SSL certificate configuration.

  8. Restart the Change Guardian server:

    service sentinel restart

  9. Import the CA root certificate change to the computer where you want to use the Administration Console.

Using CA-Signed Certificate

You can use CA-signed certificates in place of the self-signed certificates provided by Change Guardian.

To replace the self-signed certificates on the server:

  1. Log in to the Change Guardian server as root.

  2. Switch user to novell.

  3. Backup of the existing certs folder, which is located at /opt/netiq/cgutils/certs.

  4. Create a new certs folder at /opt/netiq/cgutils/.

  5. Copy the CA-signed certificates to /opt/netiq/cgutils/certs.

  6. Change the permission of the certs folder:

    chmod 700 /opt/netiq/cgutils/certs

  7. Rename the CA-signed certificate files as below:

    • cgca-cert.pem: Root CA certificate

    • cgca-pk.pem: Private key

    • cgca-pk.pem.pass: Private key password

  8. Change the ownership of the CA-signed files:

    chown novell:novell /opt/netiq/cgutils/certs/*

  9. Go to the /opt/netiq/cgutils/bin directory and run the following command:

    ./cg_cert_setup.sh

    The required certificates are created in the /opt/netiq/cgutils/certs/ directory.

  10. Verify that the new certificates have the new CA name in the issuer field:

    • openssl x509 -in amsca-cert.pem -noout -text

    • openssl x509 -in javosca-cert.pem -noout -text

  11. Go to the /opt/netiq/ams/ams/bin directory, and run the following commands:

    ./ams_cert_setup.sh --setup --profile=ams_new_profile_name

    ./ams_cert_setup.sh --enable --profile=ams_new_profile_name

    NOTE:Consider not changing default profile names and create profile with a new name.

  12. Confirm that the profile is enabled:

    ./ams_cert_setup.sh --show

  13. Go to the /opt/netiq/cg/javos/bin/ directory and run the following commands:

    ./javos_cert_setup.sh --setup --profile=javos_new_profile_name

    ./javos_cert_setup.sh --enable --profile=javos_new_profile_name

  14. Confirm that the profile is enabled:

    ./javos_cert_setup.sh --show

  15. (Conditional) If the Change Guardian server is in FIPS mode, run the following commands:

    ./opt/netiq/ams/ams/bin/convert_to_fips.sh

    ./opt/netiq/cg/javos/bin/convert_to_fips.sh

  16. (Optional) To test if the certificates are replaced successfully, remotely deploy an agent using Agent Manager and generate an event.

4.3.3 Applying Updates for Security Vulnerabilities in Embedded Third-Party Products

Change Guardian contains embedded third-party products such as JRE, Jetty, PostgreSQL, and ActiveMQ. Change Guardian includes patches to address security vulnerabilities (CVE) for these products with Change Guardian releases.

The third-party products have their own release cycles and new CVEs might be discovered before a Change Guardian release. You must review the CVEs for each embedded third-party product and decide whether to apply these updates to your Change Guardian deployment before getting a corresponding Change Guardian patch from Micro Focus. If you decide to apply patches to address these CVEs, contact Technical Support.