How to configure High Availability (HA) in AlienVault USM (for versions 4.14 and prior)

Transcription

2 AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat Exchange, AlienVault OTX Reputation Monitor, AlienVault OTX Reputation Monitor Alert, AlienVault OSSIM and OSSIM are trademarks or service marks of AlienVault.

3 CONTENTS 1. INTRODUCTION HIGH AVAILABILITY (HA): OVERVIEW AND REQUIREMENTS Requirements Architecture ENVIRONMENT INSTALLATION CONFIGURATION How to configure the local machine How to configure the remote machine How to synchronize databases How to synchronize local files DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 3 of 12

4 1. INTRODUCTION High Availability (HA) refers to a system or component that is continuously operational for a desirable long length of time. AlienVault USM offers HA capabilities in all its components: server, logger and sensor. HA is only offered to professional versions. This document describes HA capabilities, requirements, architecture, installation and configuration. 2. HIGH AVAILABILITY (HA): OVERVIEW AND REQUIREMENTS HA refers to a deployment in a distributed installation. It exactly consists of an active unit that is running in production and that is at risk of failure. There is also a standby unit that comes on line in the case of a failure of the active and ensures continuous operation of AlienVault services REQUIREMENTS The standby unit must be setup and configured with the same version of AlienVault as the active or master one. Both of them need to stay in the same subnet (even if it is extended between different datacenters). These do not need to be at the same physical location if extended vlans are deployed between the datacenters (same network addressing in both places). Special care must be taken in situations such as network latency, network disconnections and that kind of problems that can make the replication to fail. For this reason, it is necessary to place checks to guarantee the replication is working properly in those situations. This HA feature is not designed to work across disperse locations (with different IP addressing). It is encouraged to use isolated interfaces (eth1) at each node connected through a dedicated network cable without any network equipment involved in order to avoid any CPD network failures to affect the AV USM HA performance and service functionality. The date in both appliances must be the same. An NTP Server can be configured (see section 3 ENVIRONMENT INSTALLATION). Both appliances must be registered. DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 4 of 12

5 2.2. ARCHITECTURE In a HA installation, there are 2 levels: one for physical appliances and another, higher, for virtual information. This limit must be established in the AlienVault-Center, which can access to real appliances. The rest of the system can only access to the virtual information. The AlienVault-Center manages the real appliances. The agent, server, IDM, forwarder and rest of services of AlienVault know only the virtual IP to connect them. In the slave appliances, all services have to be stopped except the following ones: Alienvault Center Rsyslog Cron Heartbeat MySQL MongoDB The architecture can be the following: DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 5 of 12

6 The appliances are configured as follows: Hostname Real IP V Hostname Virtual IP Report To HA-server HA-server HA-Logger HA-Logger HA-Sensor HA-Sensor VServer VLogger None VSensor DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 6 of 12

7 3. ENVIRONMENT INSTALLATION The following instructions must be followed for having the same version in all appliances: 1. Install a virtual appliance according the configuration above mentioned (see section 2.1 Requirements. 2. During the installation, a real IP address is assigned to each appliance. 3. Once the installation is finished, activate your appliance to professional by entering a key provided by AlienVault. 4. Open the AlienVault Setup main menu. Navigate to System Preferences > Configure Hostname. Change the appliance hostname following the configuration above mentioned (see section 2.2 Architecture). Ensure the appliances hostnames have different names. 5. Back to the AlienVault Setup main menu and select the option Apply all Changes. Press Enter to accept the selection (<OK>). 6. The date in both appliances must be the same. An NTP Server can be configured: Move to the option System Preferences and press Enter to accept the selection (<OK>). Move to the option Change Location and press Enter to accept the selection (<OK>). Move to the option Date and time and press Enter to accept the selection (<OK>). Move to the option Configure NTP Server and press Enter to accept the selection (<OK>). Enable the NTP Server and press Enter to accept the selection (<OK>). DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 7 of 12

8 Enter the NTP Server Name or its IP Address. Go back to the main menu. Move to the option Apply all Changes and press Enter to accept the selection (<OK>). This configuration must be done in both appliances. 7. It is recommended stopping the appliance and making a snapshot. 4. CONFIGURATION The configuration of a HA system cannot be done from the Alienvault-Setup. The master appliance can include information, but the slave appliance must always remain empty, without data, because data will be lost in the configuration. The local appliance is the appliance having its services continuously running. The remote appliance has its services in stand-by. DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 8 of 12

9 4.1. HOW TO CONFIGURE THE LOCAL MACHINE Follow the instructions below to configure HA without opening the web interface: 1. Connect by ssh to the local IP of your appliance. 2. The AlienVault Setup main menu is displayed after the user authentication. 3. On the computer keyboard, press the arrow keys to move to the option Jailbreak System. Then, press Enter to accept the selection (<OK>). 4. Edit the file /etc/ossim/ossim_setup.conf. 5. Change the following fields: Ha_heartbeat_start= enter yes. Ha_local_node_ip= enter the local appliance IP Ha_other_node_ip= enter the remote appliance IP Ha_other_node_name= enter the remote appliance name Ha_password= enter a password. This password is valid for both appliances (local and remote) and must be the same. Ha_role= enter master Ha_virtual_ip= enter the IP address assigned to the virtual appliance 6. Save changes. 7. Enter the following command: DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 9 of 12

10 ossim-reconfig 4.2. HOW TO CONFIGURE THE REMOTE MACHINE 1. Connect by ssh to the remote IP of your appliance. 2. The AlienVault Setup main menu is displayed after the user authentication. 3. On the computer keyboard, press the arrow keys to move to the option Jailbreak System. Then, press Enter to accept the selection (<OK>). 4. Edit the file /etc/ossim/ossim_setup.conf. 5. Change the fields as indicated below: Ha_heartbeat_start= enter yes. Ha_local_node_ip= enter the remote appliance IP Ha_other_node_ip= enter the local appliance IP Ha_other_node_name= enter the local appliance name Ha_password= enter a password. This password is valid for both appliances (local and remote) and must be the same. Ha_role= enter slave Ha_virtual_ip= enter the IP address assigned to the virtual appliance 6. Save changes. 7. Enter the following command: ossim-reconfig 4.3. HOW TO SYNCHRONIZE DATABASES 1. Connect by ssh to the local IP of your appliance. 2. The AlienVault Setup main menu is displayed after the user authentication. 3. On the computer keyboard, press the arrow keys to move to the option Jailbreak System. Then, press Enter to accept the selection (<OK>). 4. To synchronize the databases, enter the following command: DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 10 of 12

11 ossim-reconfig -mysql_replication The deployment view in the web will display the IP and hostname of one of both appliances HOW TO SYNCHRONIZE LOCAL FILES The following instructions must be done on both servers, local and remote. 1. Connect by ssh to the IP of your appliance. 2. The AlienVault Setup main menu is displayed after the user authentication. 3. On the computer keyboard, press the arrow keys to move to the option Jailbreak System. Then, press Enter to accept the selection (<OK>). 4. Edit the file /etc/cron.d/ossim_ha_rsync. 5. Uncomment lines depending on the information that is going to be synchronized between servers. The user must choose the hours by executing and activating the line, for instance: Risk metrics graphs #0 * * * * root /usr/local/sbin/ossim_ha-rsync.sh var_lib_ossim_rrd /var/lib/ossim/rrd >/dev/null Netflow configuration #2 * * * * root /usr/local/sbin/ossim_ha-rsync.sh etc_nfsen /etc/nfsen >/dev/null Netflow data collected #4 * * * * root /usr/local/sbin/ossim_ha-rsync.sh var_cache_nfdump /var/cache/nfdump >/dev/null Netflow graphs #6 * * * * root /usr/local/sbin/ossim_ha-rsync.sh var_nfsen /var/nfsen >/dev/null Nagios configuration #8 * * * * root /usr/local/sbin/ossim_ha-rsync.sh etc_nagios3_conf.d /etc/nagios3/conf.d >/dev/null DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 11 of 12

12 Nagios checks #10 * * * * root /usr/local/sbin/ossim_ha-rsync.sh var_cache_nagios3 /var/cache/nagios3 >/dev/null Ossim database backups #12 * * * * root /usr/local/sbin/ossim_ha-rsync.sh var_lib_ossim_backup /var/lib/ossim/backup >/dev/null Ossim agent configuration and plugins #14 * * * * root /usr/local/sbin/ossim_ha-rsync.sh etc_ossim_agent /etc/ossim/agent >/dev/null Ntop graphs and statistics #16 * * * * root /usr/local/sbin/ossim_ha-rsync.sh var_lib_ntop /var/lib/ntop >/dev/null Ntop configuration #18 * * * * root /usr/local/sbin/ossim_ha-rsync.sh etc_ntop /etc/ntop >/dev/null DC Edition 02 Copyright 2015 AlienVault. All rights reserved. Page 12 of 12