Balabit - Management and date and time (site 1)
Balabit SCB Solution · Config document · referenced from Basic settings, logging and monitoring and Backup, archive and retention
note
password_for_scb_mail was a placeholder already in my design document, and <LOCAL_TIMEZONE> replaces the time zone. <GPG_FINGERPRINT> replaces the fingerprint of the GPG key SCB-BACKUP on the System backup line.The Management page of Basic Settings without its SSL certificate section, plus the Date & Time page: where the appliance sends its syslog and its mail, how long a web session lives, which backup policy saves the configuration and with which key, what happens when the disks fill up, and which NTP servers it follows.
| Item | Value |
|---|---|
| Where | SCB web interface, Basic Settings > Management and Basic Settings > Date & Time |
| Cluster | dc1-s-xblb001, site 1 |
| Firmware at the time | 5 LTS (5.0.3) |
| Source | My design document, version 0.5 of 2017-12-01 (draft), chapters 7.2.9 to 7.2.14, 7.2.16 to 7.2.18 and 7.2.20 |
| Elsewhere | SSL certificate section: SSL certificate page (site 1). Alerting & Monitoring: Alerting and monitoring (site 1). The policy SYSTEM-BACKUP: Backup policies (site 1) |
The answers
# Page / Field = value, as configured on dc1-s-xblb001, from the design document v0.5, chapters 7.2.9-7.2.14, 7.2.16-7.2.18, 7.2.20 Basic Settings > Management > Syslog / SYSLOG RECEIVERS = Address: 10.11.17.113 / Port: 514 / Protocol: legacy-TCP Basic Settings > Management > Syslog / SERVER KEY CHECK = Optional untrusted Basic Settings > Management > Syslog / CA X.509 CERTIFICATE = - Basic Settings > Management > Syslog / CLIENT X.509 CERTIFICATE = - Basic Settings > Management > Syslog / CLIENT KEY = - Basic Settings > Management > Syslog / INCLUDE NODE ID IN HOSTNAME IN BOOT FIRMWARE MESSAGES = Yes Basic Settings > Management > Mail settings / SMTP SERVER ADDRESS = dc1-a-vcmsx001.adm.example.net Basic Settings > Management > Mail settings / ENCRYPTION / SERVER CERTIFICATE CHECK / AUTHENTICATE AS CLIENT = STARTTLS / No certificate is required / No Basic Settings > Management > Mail settings / AUTHENTICATION / USERNAME / PASSWORD = Enabled / scb_mail@ad.example.net / password_for_scb_mail Basic Settings > Management > Mail settings / SEND E-MAILS AS = scb_mail@ad.example.net Basic Settings > Management > Mail settings / ADMINISTRATOR’S E-MAIL ADDRESS = scb_mail_group@ad.example.net Basic Settings > Management > Mail settings / SEND E-MAIL ALERTS TO = scb_mail_group@ad.example.net Basic Settings > Management > Mail settings / SEND REPORTS TO = scb_mail_group@ad.example.net Basic Settings > Management > Web interface timeout / TIMEOUT = 10 (minutes) Basic Settings > Management > RPC API settings / ENABLE RPC API = No Basic Settings > Management > System backup / SYSTEM BACKUP POLICY = SYSTEM-BACKUP Basic Settings > Management > System backup / ENCRYPT THE CONFIGURATION = Yes Basic Settings > Management > System backup / PUBLIC GPG KEY = SCB-BACKUP Basic Settings > Management > System backup / PUBLIC GPG KEY FINGERPRINT = SCB-BACKUP ("SCB backup encryption") <scb_mail@ad.example.net> <GPG_FINGERPRINT> Basic Settings > Management > Debug logging / ENABLE DEBUG LOGS = No Basic Settings > Management > Core files / DELETE CORE FILES OLDER THAN = 14 (days) Basic Settings > Management > Disk space fill up prevention / DISCONNECT CLIENT WHEN DISKS ARE = 80 (percent used) Basic Settings > Management > Disk space fill up prevention / AUTOMATICALLY START ARCHIVING = No Basic Settings > Management > Web gateway authentication / ENABLE WEB GATEWAY AUTHENTICATION BANNER = No Basic Settings > Management > Web gateway authentication / ENABLE AUTO-ASSIGN = No Basic Settings > Date & Time / TIMEZONE = <LOCAL_TIMEZONE> Basic Settings > Date & Time / NTP SERVERS = Address: 10.11.16.145 / Address: 10.11.18.145
| Setting | What it means here |
|---|---|
legacy-TCP to 10.11.17.113:514 | BSD syslog (RFC 3164) over plain TCP to the central syslog server dc1-a-vcsys001. The design gives the reasons: TCP so that the server receives the messages, no TLS because the syslog server had none, IPv4 because the appliance did not support IPv6 for syslog. With no TLS, the server key check and the three certificate fields do nothing |
| Include node ID in hostname | Messages of the boot firmware carry the node, so the two nodes can be told apart. Core firmware messages carry the cluster name, as the generated syslog-ng.conf shows |
| SMTP server by name | dc1-a-vcmsx001.adm.example.net. The design pairs this name with 10.11.19.34 in chapter 4.1.4 and with 10.11.19.33 in its integration table; the page holds the name, so DNS decided |
| STARTTLS, "No certificate is required" | The mail is encrypted to the server, but the server's certificate is not checked |
| Authentication | As the AD account scb_mail, which is also the sender. All three recipients are the distribution group scb_mail_group |
| Timeout 10 minutes | Idle web sessions end after ten minutes |
| RPC API off | The appliance could not be scripted through its API |
SYSTEM-BACKUP, GPG key SCB-BACKUP | The configuration backup runs daily at 00:00 to the NetApp export scb_system_backup and is encrypted to the public GPG key (RSA 2048, no expiry); see Backup, archive and retention |
| Core files 14 days | Core dumps older than two weeks are deleted |
| Disks 80 % | Client connections are cut when the disks are 80 % used; archiving is not started automatically then, the archive policies run on their nightly schedule only |
| Web gateway authentication | Off. Gateway authentication was not used at all |
| NTP | The two Infoblox appliances dc1-a-adnsvip001 and dc1-b-adnsvip001; my notes add that the SCB and the domain controllers should follow the same NTP source |
The exported config.xml of the site 2 cluster (2018-09-17, element <management>) has the same values with its own syslog server 10.12.17.113 (protocol written as tcp) and its own SMTP server dc2-a-vcmsx001.adm.example.net, and it takes NTP from the site 1 Infoblox addresses 10.11.16.145 and 10.11.18.145. It also holds what the design does not show: an SNMP trap setting of version 2c with the community public and no receiver, and the root and GRUB passwords, which the appliance had already removed from the export.
Checked against One Identity Safeguard for Privileged Sessions 9.0
| As built | Today |
|---|---|
Syslog legacy-TCP without TLS, "Optional untrusted" | The legacy- prefix is still RFC 3164 and syslog- RFC 5424; TCP+TLS with "Check server certificate" against a trust store and client authentication are offered. The receiver must still be an IPv4 address. Local logs are kept seven days |
| SMTP with STARTTLS, "No certificate is required" | STARTTLS remains, with the option to accept only certificates issued by a given CA |
| RPC API off | The SOAP RPC API was deprecated as of SPS 5 F7 and is absent from the 9.0 guide; the REST API replaces it |
| Disk fill-up at 80 % | Since 6.4 the field accepts 50 to 98 percent; 80 passes an upgrade |
| Web interface timeout, NTP servers | Both pages remain |
Every insecure choice on this page has a documented secure alternative today: TLS to the syslog server and a CA check for the mail server. The as-built values would survive an upgrade unchanged, which means they would also stay insecure until someone changed them.