2.4 Configuring Change Guardian Server

After installing the Change Guardian server, you must configure several items to ensure communication for the components.

If you want Change Guardian to run in FIPS mode, you must complete additional steps. For more information, see Section 2.4.7, Configure Change Guardian to Run in FIPS Mode.

2.4.1 Verify the Server Host Name

You have the option to install the Change Guardian server using a static IP address or a dynamic (DHCP) IP address mapped to a host name. For the Change Guardian server to work correctly when configured to DHCP, ensure that the system can return its host name correctly using the following procedure:

  1. Verify the host name configuration with the following command: cat /etc/HOSTNAME

  2. Check the server host name setting with the following command: hostname -f

  3. Verify the DHCP configuration with the following command: cat /etc/sysconfig/network/dhcp

    NOTE:The DHCLIENT_HOSTNAME_OPTION setting should reflect the fully-qualified host name of the Change Guardian server.

  4. Resolve the host name to the IP address with the following command: nslookup FULLY_QUALIFIED_HOSTNAME

  5. Resolve the server host name from the client with the following command entered from the remote server: nslookup FULLY_QUALIFIED_CHANGEGUARDIANSERVER_HOSTNAME

2.4.2 Ensure the Appropriate Server Ports Are Open

Enter the following command from the Change Guardian server to verify that the appropriate ports are open:

For SLES, use:

  • iptables -I INPUT -p tcp --dport <port_number> -j ACCEPT
  • iptables-save

For RHEL, use:

  • iptables -I INPUT -p tcp --dport <port_number> -j ACCEPT
  • service iptables save

For more information, see Section 1.2, Understanding Change Guardian Components.

2.4.3 Configure the Server Date and Time Synchronization

To determine the current date/time configured on the Change Guardian server, run the following command: date -u

To synchronize the Change Guardian server date/time with an external time service, configure NTP.

2.4.4 Configure Server Certificates

To configure trusted connections when authenticating to the Change Guardian web console, you must install valid certificates on the Change Guardian server. Use the command line tool provided on the Change Guardian server to complete the following procedure.

  1. su to novell.

  2. cd to /opt/novell/sentinel/setup.

  3. Generate certificate signing requests using the ./ssl_certs_cg command, and make the following selections:

    1. Generate certificate signing requests.

    2. Web Server.

    3. Specify a certificate signing request (.csr) filename.

    4. Have your generated .csr file signed by a certificate authority.

  4. Copy your CA root certificate chain (ca.crt) and the signed certificate (.crt) to /opt/novell/sentinel/setup.

  5. Import the CA root certificate chain and the web server certificate with the following commands:

    1. ./ssl_certs_cg

    2. At the menu prompt, select Import certificate authority root certificate.

    3. Enter the CA root certificate chain file name (ca.crt).

    4. At the menu prompt, select Import certificate authority root certificate.

    5. At the menu prompt, select Web Server.

    6. Enter the CA root certificate chain file name (ca.crt).

  6. Restart the Change Guardian server using service sentinel restart.

  7. Import the CA root certificate change to the computer where you use the Change Guardian web console.

2.4.5 Change Default Email Host Settings

You can change the email settings after installing Change Guardian server by using the following commands:

  • cd /opt/netiq/cg/scripts
  • ./configure.sh udei

2.4.6 Verify the SHMMAX Setting

The SHMMAX setting configures the maximum size, in bytes, of a shared memory segment for PostgreSQL. Desirable values for SHMMAX start in the hundreds of megabytes to a few gigabytes.

To change the kernel SHMMAX parameter, append the following information to the /etc/sysctl.conf file: # for Sentinel Postgresql kernel.shmmax=1073741824

NOTE:By default, RHEL specifies a small value for this setting so it is important to modify it when installing to this platform.

2.4.7 Configure Change Guardian to Run in FIPS Mode

Change Guardian offers enhanced protection against security threats and compliance with United States federal government standards by supporting Federal Information Processing Standards (FIPS). Change Guardian leverages the FIPS 140-2 compliant features to meet the security requirements of United States federal agencies and customers with highly secure environments. Change Guardian is now re-certified by Common Criteria at EAL3+ and provides FIPS 140-2 Inside.

Complete the following procedure to configure Change Guardian to run in FIPS mode.

  1. Ensure that Mozilla Network Security Services (NSS) and Mozilla NSS Tools are installed on the Change Guardian server.

  2. From a command prompt on the Change Guardian server, change directory to /opt/novell/sentinel/bin and enter the following command:

    ./convert_to_fips.sh

  3. Provide the requested input:

    1. When asked whether to backup the server, select n.

    2. Provide a password that meets the stated criteria. You will need this password later in this procedure.

    3. When asked whether to enter the external certificate in the keystore database, select n.

    4. When asked whether to restart the Sentinel server, select y.

  4. Ensure that the server0.0.log file (located in /var/opt/novell/sentinel/log) contains the following entry:

    Date_Timestamp|INFO|JAVOS listener|com.netiq.cg.capi.dao.UpgradeDao.upgrade

    Upgrading EventDestination.Upgrade to fips compatible

    Date_Timestamp|INFO|JAVOS listener|com.netiq.cg.capi.dao.UpgradeDao.upgrade

    records updated=1 data={"service-host":"Server_Name","password":"Encrypted_Password","protocol":"vosrestdispatcher:rest

  5. From a command prompt, change directory to /opt/netiq/cg/javos/bin and enter the following command:

    ./convert_to_fips.sh

  6. Provide the password for the FIPS keystore database (the password you created in Step 3.b).

  7. When asked whether to restart the Java OS (javos) service, select y.

  8. Ensure that the following entry is present in the javos.log file (located in javos/log):

    Creating FIPS SSL listener on 8094

  9. From a command prompt, change directory to /opt/netiq/ams/ams/bin and enter the following command:

    ./convert_to_fips.sh

  10. Provide the requested input:

    1. Provide the password for the FIPS keystore database (the password you created in Step 3.b).

    2. When asked whether to restart the Agent Manager service, select y.

  11. Ensure that the ams.log file (located in ams/log) contains the following entry:

    INFO [Date_Timestamp,446] com.netiq.commons.security.FIPSProvider: Running in FIPS mode. Changing the SSL security provider from JSSE to FIPS. /opt/netiq/ams/ams/security/nss