Table of Contents
Profense™ includes a secured operating system and can be installed on most AMD64 and i386 compatible hardware platforms incl. virtual platforms.
During the Profense™ installation, the harddisk you install it on, will be completely erased.
For testing purposes, Profense™ can be installed on most PCs. For production use, we recommend usage of a hardware platform which is tested and approved by Armorlogic. Please refer to our home page for the current list: www.armorlogic.com/purchase_supported_hardware.html.
During the Profense™ installation, you will be asked to supply the following information:
-
IP address(es) for the system's network interfaces
-
Network mask for the respective interfaces
-
Gateway IP address (default route)
-
If you have downloaded a Profense™ ISO-image, start with creating a Profense™ CD-ROM from the image. The resulting CD-ROM is bootable. If you are installing on a virtual platform you can probably skip this step as you can mount the ISO-image directly.
-
Boot the installation platform from the Profense™ CD-ROM or ISO-image.
-
Follow the on-screen instructions. Depending on the size of the harddisk you install on, the installation usually takes between 5 and 15 minutes.
-
When the installation is finished, the address and login credentials for the web-based management interface are displayed at the screen. Remember to note this information.
-
Remove the CD-ROM from the CD-ROM drive and reboot the platform.
Profense™ management interface contains many features to help you manage the security of your web applications and servers. In this section, we attempt to highlight all of these features, by listing tasks that you should perform to correctly configure Profense™. The information contained in this table presumes that you have successfully installed and configured Profense™ on your hardware.
To access Profense™ management interface, open a web-browser and enter URL https://profense_ip_address:2000/. The management interface port (which by default is 2000) can be changed.
If you are accessing the management interface for the first time, you will be asked for a license key.
If you do not have a license key follow the instructions below the license key input field. We recommend that you activate the Profense™ Professional 30-day trial as the trial is fully functional and later can be converted to either a Professional or the free license.
Enter the license key and click the "Activate" button. If the key is valid, you will be asked to agree to the Profense™ license agreement. After you have read and agreed to the license terms you are redirect to the "Profense™ administration login" screen.
Note: The first time you log in to the CLI, use the default username "admin" and the default password "admin123". This can be changed when logged in.
The management interface is divided into 3 main sections:
Configuration of all defined virtual proxies, including proxy settings, ACL (access control list) administration, configuration of proxy global security settings and logs.
Configuration of system parameters like network interfaces, IP addresses, fail-over, network settings (DNS, NTP, SMTP), viewing of system logs and status information, including administration of updates, backup and configuration restore.
Main (vertical) menu system is on the left side of the screen. Content assigned to the menu item is displayed on the right side of the screen. An additional horizontal menu system appears where applicable.
This section describes most of the basic administration tasks that can be performed via Profense™ management interface.
Web server: A web server is a logical server defined by its web address - i.e. http://www.armorlogic.com or https://www.armorlogic.com.
Protecting a web site serving traffic both on HTTP and HTTPS on the same DNS-address, requires therefore the creation of two Profense™ proxies.
Proxy: Profense™ protects a web site by acting as a filtering proxy for the sites web servers. Profense™ can handle several web servers and every server is referred to as a "proxy" in Profense™.
Clicking on Help in the horisontal menu will display the manual reference section covering the current window.
The complete manual is available in HTML and PDF versions in the Help section of the left menu pane .
Change the administrator password from the default value in:
System ->
Be sure to bind "inbound traffic" to at least one of the systems interfaces in:
System ->
Otherwise the requests to the systems proxies will not be answered.
In order for the automated update system to work, you need to configure a DNS-server in:
System ->
Also Profense™ needs to be able to initiate the following outbound connections:
29700/tcp: querying of available updates
8080/tcp: download of available packages
to the host "updates.Profense™.net". Make sure that these connections are allowed.
To install available updates, perform the following steps:
-
Click on System -> in the left menu
-
Select updates you want to install under Available updates section by checking the box to the right
-
Click on the button
![[Note]](images/note.png)
|
Note |
|---|---|
|
Updates must be installed in the correct order. This is enforced by the system. |
|
|
Note |
|---|---|
|
Updates to the core Profense™ components require system reboot. A message will appear on the screen informing the system administrator that a reboot is needed in order to complete the update. |
To manage, add and remove proxies select Proxy -> in the left menu pane. This will take you to the proxy overview page.
To add a new proxy, click on the button in the proxy overview page.
The Proxy -> section consists of the subsections:
- Virtual web server
-
Enter the HTTP address of the web server you want to proxy connections for including protocol and port. This address is the one you want the web sites visitors to see.
When selecting HTTPS as the protocol a temporary certificate will be generated. When the new proxy is created the certificate can be replaced by importing the real certificate in Proxy -> -> -> .
- Real web server
-
Enter the address of the web server you want Profense™ to redirect allowed client requests to. This address is the address of the web server you want to protect.
- Initial operating mode
-
The proxy can operate in one of the five major modes below:
- Pass through
-
No filtering or learning applied. All requests are passed through to web systems.
Load balancing and acceleration features working as configured.
- Learn
-
All requests are passed through to web systems. Requests and web server responses are analyzed by the learner and a policy is gradually built upon the information learned. When learning thresholds are reached, by default the system will switch to
detect mode.Load balancing and acceleration features working as configured.
- Detect
-
All requests are passed through to web systems but the policy is applied and requests violating the policy are logged. This mode can best be compared to an IDS-system applying a positive policy.
Load balancing and acceleration features working as configured.
- Block
-
All requests are validated against the policy and requests validating the policy are logged and blocked according to the block action configured.
Load balancing and acceleration features working as configured.
- Auto
-
In
Auto modethe proxy automatically adapts to changes in the web applications. Auto mode offers instant protection by employing a combination of positive and negative policy rules. At first a general negative policy is enforced but as Profense maps a profile of the web applications and the web site in general the policy becomes more specific and shift towards a positive security model for specific applications.Auto mode is only available in Profense™ Professional (and trial).
Default selection : License dependent:
- Professional and Professional Trial license
-
Auto mode - Base license
-
Pass through
- Initial policy configuration
-
Should a basic policy be configured or not? The two options are:
- Normal policy configuration
-
No policy is configured as the policy is expected to be configured automatically by the learner.
- Normal policy configuration with basic (loose) policy rules
-
With this option selected a few very general policy rules are configured.
Default selection: depends on
Initial operating mode.Pass throughandLearn:Normal policy configuration.DetectandBlock:Normal policy configuration with basic (loose) policy rules. - Buggy web server options
-
In some cases (mostly when IIS is envolved) it can be necessary to disable real server keep-alive and/or down grade the real server to HTTP/1.0. You want to start without these options unless you know for certain that they are necessary.
If this is the first proxy you create do not enable any of these options. They can be set later in -> + -> if necessary.
- Disable real server keep alive
-
In some cases (mostly when IIS is involved) using keep-alive to backend servers can result in "Bad gateway" error (502) being sent to the client due to the web server not handling the keep-alive connection well.
To check if it is necessary to enable this feature look for log lines like "
(54)Connection reset by peer: proxy: error reading status line from remote server" in the system core log ( -> + ).This is an option to compensate for buggy web server implementations. In some cases (mostly when you do not need to enable it) it will force the real server to downgrade to HTTP/1.0 disabling cookies, etc.
- Force HTTP 1.0 protocol to real server
-
As above, this is an option to compensate for buggy web server implementations.
All selections, except for the Virtualhost/IP
can be changed later so it is perfectly OK to accept default
selections.
To delete a proxy from the system, perform the following steps:
-
Click on Proxy -> in the left menu
-
From the overview list shown, simply locate the proxy you want to delete and click on the symbol to the right of the proxy you want to delete
-
Confirm the action by clicking on button in the dialog box that appears on the screen
The level of automation and the tools and methods available and for developing the policy depends on the license.
The Policy can either be developed automatically using the Learner or manually or using a combination. That is: modifying the automatically generated policy manually. The learner does a pretty good job though and in most cases it is not necessary to post modify the automatically generated policy.
In Profense™ Professional (and trial) Auto mode is available. Auto mode start out with negative filtering and gradually shifts towards positive filtering as the website and web applications are learned.
If you want to build the policy manually please familiarize yourselve with the access policy chapter of the Profense Manual.
In Auto mode the proxy automatically adapts
to changes in the web applications. Auto mode offers instant
protection by employing a combination of positive and negative policy
rules. At first a general negative policy is enforced but as Profense
maps a profile of the web applications and the web site in general the
policy becomes more specific and shift towards a positive security
model for specific applications.
-
Make sure requests to the web site you want to protect are handled by Profense™ by pointing DNS lookups to the web system to Profense™.
-
Configure the proxy to run in Auto mode (if not already done so) by setting the mode using the mode selector in Proxy -> or by accepting default mode and policy configuration when creating a proxy.
-
Watch the policy evolve as Profense learns the website and web applications. For every 10,000 requests the Learner analyzes the learning state a.o. by building a trial policy and comparing it to former trial policies. When configurable threshold values are reached for request parameters or paths (URI's) the Learner adapts the policy to enforce positive validation of these.
-
The Proxy stays in Auto mode and when new content or new applications are added to the web site they are learned and the policy is adapted.
Auto mode is only available in Professional and Professional trial licenses.
To build a policy automatically:
-
Make sure requests to the web site you want to protect are handled by Profense™ by pointing DNS lookups to the web system to Profense™.
-
Configure the proxy to run in Learn mode (if not already done so) by setting the mode using the mode selector in Proxy -> .
-
Wait for the learning process to complete. For every 10,000 requests the Learner analyzes the learning state a.o. by building a trial policy and comparing it to former trial policies. When configurable threshold values are reached the Learner automatically change the Proxy operating mode to
Detect.Note that for Profense™ to learn the "behaviour" of one or more web applications it is necessary that the learning data are representative of normal traffic to the web site in question. By default the Learner is configured not to switch to
Detect modeuntil 100,000 requests have been handled by the Learner without resulting in policy changes. This threshold is if course configurable. -
Let the Proxy run for a while in
Detect modeto ensure that the policy is working as intended and then switch toBlock mode.
Learn mode is available in all licenses.
To view the current system status, click on System -> in the left menu. A page showing important system parameters is displayed.
|
|
Note |
|---|---|
|
System monitoring can be performed externally by accessing the URL https://profense_system_ip_address:2000/monitor.html. Make sure that the management interface is available on the selected IP address by verifying the configuration under the Bind section |
Backup and restore can be performed via filesystem, FTP or SCP.
To manually backup the entire Profense™ configuration to a file, perform the following steps:
-
Click on System -> in the left menu
-
Click on the button right to the Export section of Backup
-
Select a directory where to save the file and confirm the prompted dialog
To restore the entire Profense™ configuration from a file, perform the following steps:
-
Click on System -> in the left menu
-
Click on the button right to the File upload section of Backup
-
Select the file containing the previously saved Profense™ configuration and confirm the prompted dialog
-
Click on the button
To restore the entire Profense™ configuration from an FTP server, perform the following steps:
-
Click on System -> in the left menu
-
Enter the full path to the Profense™ configuration file stored on the FTP server configured in the FTP download field section of Backup
-
Click on the button
To configure automated FTP backup, perform the following steps:
-
Click on System -> in the left menu
-
Under Auto-backup enter the required information
-
Check the checkbox
-
Click on the button.
To restore the entire Profense™ configuration from an SCP server, perform the following steps:
-
Click on System -> in the left menu
-
Enter the full path to the Profense™ configuration file stored on the SCP server configured in the SCP download field section of Backup
-
Click on the button
To configure automated SCP backup, perform the following steps:
-
Click on System -> in the left menu
-
Under Auto-backup enter the required information
-
Check the checkbox
-
Click on the button.