Perform Manual Hardening for Versa Analytics

TACACS+ Server Configuration

Users logging in from the TACACS+ server can have administrative permissions or operator permissions. To configure this, the TACACS+ server return must return the following versa-user-group attributes:

• admin—Users have administrative access to the Analytics node.
• oper—Users have operator access to the Analytics node.

Versa Analytics Services 

Analytics services include processes such as the log collector exporter, which accepts and processes incoming log connections, and the Versa Analytics driver, which processes log files created by the log collector exporter and forwards log data to the database and search engine on the cluster. Each Analytics node runs instances of various services, and the instances interact with the other nodes of the cluster to perform their tasks and maintain synchronization.

To view a list of services running on an Analytics node, log into a shell on the node and issue the vsh status command.

admin@Analytics$ vsh status
versa-confd                  is Running                 [*] process 23356
versa-lced                   is Running                 [*] process 23940
versa-spackmgr               is Running                 [-] process 23516
versa-analytics-monitor      is Running                 [*] process 23436
versa-analytics-driver       is Running                 [*] process 23434
versa-analytics-app          is Running                 [*] process 27050
versa-monit                  is Running                 [*] process 23451
versa-analytics-dataops      is Running                 [*] process 23405
versa-analytics-redis        is Running                 [-] process 23711

To restart services for all nodes in an Analytics cluster, log in to a shell on the active Director node and issue the following command:

admin@Director$ sudo ./van_cluster_installer.py --restart-van-services

Modify Database and Service Passwords 

When you change the password for a feature using the commands in this section, all nodes in the cluster are updated with the new password.

To modify passwords for an Analytics cluster.

1. Login to the shell on the active Director node.
2. Change to the van_cluster_install directory.

   admin@Director$ cd /opt/versa/vnms/scripts/van-cluster-config/van_cluster_install

3. Issue the command displayed in the table to change the password for the listed feature or features:
    

   Feature	Command  (Note: By default, the script prompts you for a password. If you append the ‘--force’  option to any of the commands, the script instead assigns a random password.)
   Analytics database	admin@Director$ sudo ./van_cluster_installer.py --regen-analytics-db-password
   Analytics database encryption key	admin@Director$ sudo ./van_cluster_installer.py --regen-van-encryption-key
   Analytics search engine	admin@Director$ sudo ./van_cluster_installer.py --regen-search-db-password
   Analytics services	admin@Director$ sudo ./van_cluster_installer.py --van-svcs-password
   All password types: database, search, encryption key, and analytics services	admin@Director$ sudo ./van_cluster_installer.py --regen-all-password

Change Shell Account Passwords

The default configuration for Analytics nodes includes two shell accounts: admin and versa. The default password for both accounts is versa123. To harden Analytics nodes, you must change the passwords for these accounts on every search-type and analytics-type Analytics node.

To change passwords for the versa and admin accounts:

1. Login to the shell on the node.
2. Issue the commands shown below.

admin@Analytics$ cd /opt/versa/scripts/van-security

admin@Analytics$ sudo ./analytics_securemode.sh -s
Do you want to change the shell login system password (y/N) : y
Please enter username:versa
versa exists... changing password.
New password: new-password
Retype new password: new-password
passwd: password updated successfully
Password is successfully changed for user: versa

admin@Analytics$ sudo ./analytics_securemode.sh -s
Do you want to change the shell login system password (y/N) : y
Please enter username:admin
admin exists... changing password.
New password: new-password
Retype new password: new-password
passwd: password updated successfully
Password is successfully changed for user: admin

Change Analytics Application UI Passwords

The default configuration for Analytics nodes includes two Analytics application accounts: admin and Administrator. To harden Analytics nodes, you must change the default passwords for these accounts on each of the analytics-type and search-type Analytics nodes. This protects the nodes from unauthorized user access, and is critical if Analytics nodes have public internet access.

If the user logs in as user Administrator to Analytics directly, and if Director is registered for authentication, then the login request is sent to Director. If Director fails, then the local database is used for authentication. If there is no Director registered, the local database is only used for authentication.

Note that you can find the default passwords in the /opt/versa/var/van-app/properties/application.properties file. You need root access to view this file.

To change the default passwords for the admin and Administrator accounts, perform the following procedure on each Analytics node:

1. Login to the shell.
2. Run the AdminManager.sh script, as follows:

   admin@Analytics$ sudo /opt/versa/scripts/van-scripts/AdminManager.sh
   Versa Analytics Admin Users Manager
   Passwords for all local UI users need to be changed
   Please enter password for user:admin
   Password ?
   Re-enter password ?
   Please enter password for user:Administrator
   Password ?
   Re-enter password ?
   Login credentials for all users have been changed, please do vsh restart for change to take effect.
   

3. Restart Analytics services.

   admin@Analytics$ vsh restart

Change Tomcat Passwords

As part of Analytics hardening, you must change the Tomcat password and update certificates on each of the analytics-type and search-type Analytics nodes.

To change the Tomcat password and update certificates:

1. On the Analytics node, change to the /opt/versa/scripts/van-security directory:

   admin@Analytics$ cd /opt/versa/scripts/van-security

2. Run the analytics_securemode.sh script as shown below to modify the Tomcat password. 
   
   Note: When the script prompts  "Do you want to change the Analytics UI local authentication administration password (y/N):", enter N if you changed the Analytics UI password in the Change the Analytics Application UI Passwords section, above. Otherwise, enter y to change the Analytics UI passwords now. 

admin@Analytics$ sudo ./analytics_securemode.sh -a

Info: Parsing van-security arguments

Info: modify-application-password
Do you want to change the Analytics UI local authentication administration password (y/N): N

Do you want to change the SSL and Tomcat Certificate passwords (y/N): y
Modifying Tomcat passwords ...
Change the Tomcat Password if your certificate passwords have changed
Please re-confirm (y/N): y
Enter NEW  Password: new-password
ReEnter NEW Password: new-password
Modifying self-signed certificate passwords ...
Modifying Analytics-Director certificate passwords ...
This password should match the password in Director's vd-van-import-cert.sh file
Do you want to change the Analytics-Director certificate password (y/N): y
Enter NEW  Password: new-password
ReEnter NEW Password: new-password
Please regenerate the certificates for this change to take effect
Regenerate certificate file using: van-import-cert.sh script
You will need to re-import certificates to Versa Director and re-register Director in Analytics
To ensure Analytics-Director communication certificates are changed with non-default passwords
Delete the TrustStore at: /opt/versa/var/van-app/certificates/versa_director_truststore.ts
Re-import by running: /opt/versa/scripts/van-scripts/van-vd-cert-install.sh

3. Delete the Analytics Java keystore file:

   admin@Analytics$ sudo rm /opt/versa/var/van-app/certificates/versa_analytics.jks
   

4. Delete the Director trust store file:

   admin@Analytics$ sudo rm /opt/versa/var/van-app/certificates/versa_director_truststore.ts
   

5. To use self-signed certificates, switch to the Director node and regenerate them (you can choose to back up the certificates):

   admin@Director$ sudo rm /opt/versa/var/van-app/certificates/versa_analytics_client.*
   admin@Director$ sudo /opt/versa/scripts/van-scripts/van-cert-install.sh

6. To use CA-signed certificates, re-import the certificates on the Analytics node:

   admin@Analytics$ sudo /opt/versa/scripts/van-scripts/van-import-cert.sh \
   --key path-to-private-key-file \
   --cert path-to-signed-certificate-file \
   --keypass certificate-password \
   --cafile path-to-CA-certificate-file
   

7. On the Director node, copy the Director certificate to the Analytics cluster:

   admin@Director$ cd /var/versa/vnms/data/certs
   admin@Director$ scp versa_director_client.cer versa@analytics-node-ip:/opt/versa/var/van-app/certificate
   

8. On the Analytics node, re-import the Director certificate:

   admin@Analytics$ cd /opt/versa/var/van-app/certificates/
   admin@Analytics$ sudo /opt/versa/scripts/van-scripts/van-vd-cert-install.sh versa_director_client.cer director-hostname

Change the SSH Port

To change the default port that the SSH daemon listens on:

1. Change the default SSH port:

   $ sudo sed -i ‘s/22/1022/g’ /etc/ssh/sshd_config
   

2. Restart the SSH service:

   $ sudo service ssh restart
   

Disable the SSH Server

As part of system hardening, you can optionally disable the SSH service on the Analytics node.

To disable the SSH server:

1. Stop the SSH daemon:

   $ sudo service ssh restart

2. Remove the SSH daemon from the init.d directory:

   $ sudo rm /etc/init.d/ssh
   

Harden the SSH Server Configuration

To have the SSH server on the Analytics node continue to run, set the following parameters:

1. Edit the /etc/ssh/sshd_config file and replace the following values:
   • ClientAliveInterval—300
   • ClinetAliveCountMax—0
2. Save the file.
3. Restart the SSH daemon:

   $ sudo service ssh restart

Configure iptables Rules

To configure iptables rules:

1. Download the analytics_securemode.sh script to each of the Analytics nodes. 
   1. Backup the existing script.

      admin@Analytics$ cd /opt/versa/scripts/van-security
      admin@Analytics$ cp analytics_securemode.sh analytics_securemode.sh.bak
      

   2. Download the latest version of analytics_securemode.sh from the following location: 
      https://download.versa-networks.com/index.php/s/dVyHEx2tZIxNAGG
   3. Copy the downloaded script to /opt/versa/scripts/van-security/analytics_securemode.sh.
2. Configure iptables rules. The following table lists notable port numbers and the methods you use to configure rules for these ports. 
    

$ sudo iptables -A INPUT -p tcp -m tcp --dport 1234 -j ACCEPT

$ sudo iptables -A INPUT -s <versa-monitoring-server>/32 \
   -p tcp --dport 8010 -j ACCEPT
$ sudo iptables -A INPUT -s <versa-monitoring-server>/32 \
   -p tcp --dport 8020 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 8010 -j REJECT
$ sudo iptables -A INPUT -p tcp --dport 8020 -j REJECT

$ sudo iptables -A INPUT -s <versa-director-IP>/32 -p tcp \
   --dport 22 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 22 -j REJECT

$ sudo iptables -A INPUT -p udp --dport 123 -j ACCEPT

$ sudo iptables -A INPUT -m state --state \
   ESTABLISHED,RELATED -j ACCEPT
$ sudo iptables -P OUTPUT ACCEPT
$ sudo iptables -P FORWARD DROP
$ sudo iptables -P INPUT DROP

3. Issue the following command so that the rules persist when you reboot the system.

   admin@Analytics$ vsh restart

4. To display the updated iptables rules, issue the following command.

   admin@Analytics$ sudo iptables -L

Install iptables Rules Using a Script

You can configure many iptables rules using the analytics_securemode.sh script. Each time you issue the analytics_securemode.sh -i enable command, it sets up rules for inter-cluster access and management (UI) access. For inter-cluster access, the script determines the subnet automatically and adds it to the allow list. For management access, the script determines the subnet from the /opt/versa/scripts/van-scripts/vansetup.conf file. The script allows Analytics application port access to Versa Director and Analytics nodes only. 

The script adds iptables entries for the following port numbers: 

• 8983 (Solr)
• 9042 (Cassandra)
• 2181 (Zookeeper)
• 5000, 5010, 5020, 8008 (Versa)
• 443, 8443 (Analytics Application)

The script can also configure access for additional IP addresses and subnets. To do this, the script automatically searches for entries in the /opt/versa/etc/WHITELIST file. If the file does not exist, the script prompts you to enter the IP addresses and subnets manually.

To configure iptables rules:

1. Login to a shell on the Analytics node.
2. Ensure that you have download the latest version of analytics_securemode.sh as described in Step 1 of Configure IP Table Rules.
3. Change to the /opt/versa/scripts/van-security directory.

   admin@Analytics$ cd /opt/versa/scripts/van-security

4. Run the analytics_securemode.sh script. ​​​​​
   • To run the script and enter additional allowed IP addresses and subnets interactively:
     
     Ensure that no /opt/versa/etc/WHITELIST file exists, and then run the script as follows.

     admin@Analytics$ sudo ./analytics_securemode.sh -i enable
     
     (output omitted for brevity)
     
     Info: Please add comma separated subnets/IP eg: 1.1.1.1, 10.10.10.0/24
     ===> Please enter subnets/IP (or ENTER if none): 10.10.10.0, 10.20.20.0/24
     Info: These are the IP ranges/IP to whitelist for inter-cluster localhost.localhost.localhost.0/24 10.10.10.0/24 10.20.20.0/24 127.0.0.1
     ===> Do you want to proceed? (y/N)? y
     
     (output omitted for brevity)
     
     Info: Please add comma separated subnets/IP eg: 1.1.1.1, 10.10.10.0/24
     ===> Please enter subnets/IP (hit ENTER if none): 2.2.2.2, 1.1.1.1
     Info: These are the IP ranges/IP to whitelist for UI access 127.0.0.1 localhost.localhost.localhost.0/24  2.2.2.2 1.1.1.1
     ===> Do you want to proceed? (y/N)? y
     
     (output omitted for brevity)
     
     admin@Analytics$ vsh restart

   • To run the script using a whitelist file:

     1. Add entries to the /opt/versa/etc/WHITELIST file. For access between Analytics clusters, you add entries in the section labeled INTERNAL. For management access, you add additional IP addresses and/or subnets in the section labeled MANAGEMENT.
        
        For example, the following white list file adds subnets 10.10.10.0/24 and 10.20.20.0/24 in the allowed sources list for inter-cluster access. This can be used for additional collector subnets. Additionally, 2.2.2.2 and 1.1.1.1 are added to allow source IP addresses for management access.

        admin@Analytics$ cat /opt/versa/etc/WHITELIST
        INTERNAL: 10.10.10.10, 10.20.20.1/24
        MANAGEMENT: 2.2.2.2, 1.1.1.1
        

     2. Run the script as follows.

        admin@Analytics$ sudo ./analytics_securemode.sh -i enable
        Info: Parsing van-security arguments
        Info: Setup iptable rules
        Info: Determined 192.168.1.0/24 to be the VAN inter-cluster subnet, Will add 192.168.1.0/24 to inter-cluster whitelistInfo: Determined 10.40.93.0/24 to be the VAN management subnet, Will add 10.40.93.0/24 to MGMT whitelist
        Info: Reading arguments from /opt/versa/etc/WHITELIST for iptables rules. If you want to make changes, pls edit the file or
        remove the file for interactive mode
        Info: These are the IP ranges/IP to whitelist for inter-cluster communication 192.168.1.0/24 127.0.0.1 10.10.10.0/24 10.20.20.0/24
        
        (output omitted for brevity)
        
        Info: These are the IP ranges/IP to whitelist for management communication 2.2.2.2 1.1.1.1 127.0.0.1 192.168.1.0/24 10.40.93.0/24
        
        (output omitted for brevity)
        
        Info: You can check the rules by executing 'sudo iptables -L' on the shell
        
        admin@Analytics$ vsh restart