Configuring SSL and TLS Decryption in ngeniusone

Transcription

1 Cnfiguring SSL and TLS Decryptin in ngeniusone The cnfigure SSL Decryptin feature supprts real-time capture f ASI and ASR traffic flws as well as decding f Secure Scket Link (SSL) and Transprt Layer Security (TLS) packet data frm yur ngenius InfiniStream appliance. This allws yu t analyze the packet data frm encrypted packets by prviding the decryptin key. SSL and TLS are prtcls that encrypt certain applicatin data fr the transprt layer using asymmetric cryptgraphy t exchange keys, symmetric encryptin t maintain privacy, and message authenticatin cdes t retain message integrity. Sme applicatins that use SSL include: HTTP Applicatins using SSL encryptin and RSA keys NetScut supprts tw methds f Public/Private key usage fr real-time SSL/TLS packet decryptin and decding. The Lcal ptin enables strage f Public and Private Keys fr this purpse. The Hardware Security Mdule (HSM) ptin, n the ther hand, prvides the means fr using a Private Key, which is stred in an HSM device, fr this purpse. NetScut prvides multiple slts with lgin credentials fr each. G t Cnfiguratin Step 2: fr an verview f NetScut's HSM implementatin. Withut decrypting the SSL packet itself, NetScut cllects ASI data as well as SSL errr cdes n the HTTPS prtcl nly. Upn successful decryptin, NetScut cllects ASI data n HTTP and HTTPS prtcls nly. Scenaris where decryptin is supprted include: Resumed SSL sessins SSL chunking/fragmentatin Certificate fragmentatin Saving decrypted paylads Scenaris where decryptin is nt supprted include: Encrypted SSL handshakes Out-f-sequence SSL packets Retransmitted packets Additinally, SSL decryptin is successfully perfrmed fr cnversatins nly when: Handshake packets used t establish the cnversatin have been mined Handshake packets include these messages: ClientHell

2 ServerHell ClientKeyExchange ChangeCipherSpec Supprted SSL and key exchange prtcls, and Bulk Ciphers SSL prtcl versins supprting packet analysis and decdes are: SSL v3.0 TLS v1.0 TLS v1.1 TLS v1.2 Key exchange prtcls define hw keys are generated and exchanged. Only RSA-type certificates are supprted: RSA used fr key exchange and authenticatin prtcls nly Supprted bulk ciphers are listed belw. These encryptin algrithms define hw data is encrypted n the wire. RC4 DES 3DES AES Cnfiguratin Step 1: Setting Privileges and Optinal Settings Perfrm the fllwing tasks: 1. Optinal. Lcate and extract a private key (in the frm f a certificate) frm yur Tmcat, Apache r Windws lls Web server and dwnlad it t yur server (Lcal ptin nly). Click here fr instructins. Imprtant: when cnverting a Lcal Server t a Glbal Manager, supprt fr Name-IP Address translatins requires yu t include the Cmmn Name (CN) - the Fully Qualified Dmain Name - f the server in the private key. 2. Authrize SSL privileges fr decryptin and adding certificates/keys, as described belw. Privileges can be assigned t different rles reflecting the nature and imprtance f the task at hand. Fr example, fr decryptin, yu may want t assign users a SYSADMIN r NTWKADMIN-level rle. Fr adding certificates/keys, yu may want t assign a lwerlevel privilege such as APPROVR. 1. Successively click the Cnfiguratin Manager and Server Management icns. 2. Select the Users and Rles tabs.

3 3. Select the apprpriate rle. 4. In the right-hand pane, match the Packet Analysis SSL Admin privilege with the selected rle by clicking the apprpriate checkbx. Repeat the prcess fr the Packet Analysis SSL/IPSec Decryptin privilege. Bth checkbxes must be selected. Imprtant: SSL cnfiguratin n the ngeniusone requires that a user in nly the SYSADMIN rle can select the Packet Analysis-Admin checkbx. Als, in a distributed envirnment, a user in the SYSADMIN rle can enable SSL functinality nly n a Glbal Manager, nt a Lcal Server. Imprtant: When a Lcal Server is added t a Glbal Manager where the rle fr Packet Analysis Decryptin User is defined in SYSADMIN, the Enable Decryptin User ptin will nt be present in the Lcal Server Cnsle and Lcal trace file decryptin cannt be tested even thugh all cnfiguratin settings are pushed dwn t the Lcal Server frm the Glbal Manager. 5. Click Save. Cnfiguratin Step 2: Enabling HTTPS SSL Decryptin and HSM n the InfiniStream Enable decryptin f HTTPS SSL packets n yur ngenius InfiniStream appliance. Be sure t restart yur prbe after cnfiguring this setting. Optinal. Fr Thales/SafeNet HSM users nly, cnfigure sftware n the ngenius InfiniStream appliance (described here) Cnfiguratin Step 3: Enabling SSL Decryptin n the ngeniusone Server Cnfigure the SSL certificate in the Device Management mdule using either the Lcal r HSM ptin (described here). The Lcal ptin pushes dwn t and stres the private key (.PEM file) in the PM Server, then InfiniStream, then the Lcal decryptin device. In the case f a Glbal Manager, the.pem file is pushed dwn t and stred in the client device, then Glbal Manager, then all assciated Lcal Servers, then all InfiniStreams. The HSM (Hardware Security Mdule) ptin des nt distribute PEM files but des distribute the private key in a similar fashin using the PKCS11 prtcl. 1. Successively click Cnfiguratin Manager and Glbal Settings icns. 2. Click the SSL Keys tab. 3. Click either the Lcal Decryptin r Hardware Security Mdule (described here) tab in cnfrmance with the type f certificate yu have.

4 Lcal Decryptin 1. Select the Lcal tab and click Add SSL certificate. The Add SSL Certificate dialg bx pens. 2. Enter parameters fr the fllwing values. Refer t this Prt Parameters table fr supprted values. Server an alias fr the mnitred Web server whse packets will be decrypted such as VISA Web Server. Server IP the IP Address f the mnitred Web server whse packets will be decrypted. SSL Prt the SSL prt n the mnitred Web server whse packets will be decrypted. Applicatin Prt the prt which will replace the SSL prt after decryptin. Key the private key,.pem file name and path t uplad the certificate frm (system where the PM Client is running). 3. Click OK. 4. If yu have mre keys t enter, repeat the abve steps. 5. If yu have Hardware Security Mdule keys, prceed t the fllwing sectin. 6. Click OK t clse the dialg bx. Cnfiguratin Step 4: Setting an HTTPS Child fr Decryptin n the ngeniusone Server Yu must add an HTTPS child applicatin and specify a server IP address in Glbal Settings t cmplete decryptin cnfiguratin n the ngeniusone server. The HTTPS child shuld be a URL applicatin. T cnfigure an HTTPS child: 1. In Glbal Settings, select the Applicatins tab. 2. Select the HTTPS prtcl and click Add Applicatin. 3. Enter the apprpriate values and click the URL Applicatin radi buttn. Take care that the URL string matches the hst name exactly as it appears in the hst field. 4. Click OK. Cnfiguratin Step 5: SSL/TLS Wrkflws Once cnfigured, SSL decryptin is available in the fllwing wrkflws: Decde wrkflws launched by selecting Prtcl Decde frm the Packet Analysis menu. Decde wrkflws launched frm the nei and nsi. Decde wrkflws launched frm the InfiniStream Cnsle sftware.

5 Yu can add an SSL key fr an HSM server frm the SSL Keys > HSM tabs. The fllwing actins are prvided: Add SSL certificate. Mdify selected SSL certificate. Delete selected SSL certificate. Shw /Hide the Filter t display r hide the fields fr filtering any f the parameters listed belw. Reset the Filter t adjust it t the default view. Refresh t refresh data in the table. Nte: right-clicking an entry in the list displays a Mdify menu item t change settings and Delete menu item t remve the entry. Enter the fllwing parameters and when finished, click OK. Parameter Server Label Server IP SSL Prt Applicatin Prt Key Label Slt ID Passwrd Cnfirm Passwrd Descriptin An alias fr the mnitred Web server whse packets will be decrypted such as VISA Web Server. The IP Address f the mnitred Web server whse packets will be decrypted. IPv4 and IPv6 addresses are supprted. The SSL prt n the mnitred Web server whse packets will be decrypted. The prt which will replace the SSL prt after decryptin. The private key,.pem file name and path t uplad the key frm (system where the PM Client is running). The HSM smart card slt number where the private key is stred. The unique passwrd used by the HSM t access this key. This value is shadwed (marked by asterisks) as it is entered. Re-enter the passwrd typed in the Passwrd field.