2. Configuration


Prev	Chapter 6. System reference	Next

2.1. Network

Basic network configuration is performed in this section. Any changes made to this section are applied and saved by clicking on the Save" button.

Hostname Input field	Domain name of the Web Security Manager Web application firewall. Valid input Fully qualified domain name. Input example `proxy.mydomain.com` Default value `None`
Default gateway Input field	IP address of the default gateway. Valid input IP address assigned must be in the same network subnet as the IP address of one of the physical network interfaces. Input example `192.168.0.1` Default value `None`
DNS server(s) Input field	IP address of one or more DNS servers. Valid input IP addresses Use space to separate multiple hosts (only one required). Input example `192.168.0.2` Default value `None`
SMTP server Input field	SMTP server hostname or IP address. SMTP server is used for sending alert e-mails to the contact e-mail address specified. Valid input IP address or fully qualified domain name Input example `smtp.mydomain.com` Default value `None`
Syslog server Input field	External syslog server hostname or IP address. Proxies with external syslog alert enabled will send syslog alerts to the specified server. Syslog messages are sent to `user` facility and `informational level` (criticality) is configurable for each proxy. Valid input IP address or fully qualified domain name Input example `syslog.mydomain.com` Default value `None`

2.2. Static routes

Define static routes.

Click Add new route and enter route information for each route you want to add.

When routes are entered click Save settings in lower button bar to save.

Destination

Input field

The route destination.

Enter first IP address of destination network.

Valid input

A valid ip address.

Input example

192.168.5.0
192.168.6.8
192.168.7.10

Default value

None

Subnet

Input field

Network mask of the destination IP address.

Valid input

A valid network mask

Input example

255.255.255.0
255.255.255.248
255.255.255.255

Default value

None

Gateway

Input field

IP address of the gateway through which the destination can be reached.

Valid input

An IP address of a gateway which is directly reachable by the Web Security Manager node.

Input example

192.168.0.4
192.168.0.5
192.168.0.6

Default value

None

The examples above would result in:

Access to IP addresses 192.168.5.0-255 (192.168.5.0/24) is routed through the gateway 192.168.0.4.
Access to IP addresses 192.168.6.8-16 (192.168.6.8/29) is routed through the gateway 192.168.0.5.
Access to IP address 192.168.7.10 (192.168.7.10/32) is routed through the gateway 192.168.0.6.

2.3. Syslog - logging to external host

Configure threshold level and address of external Syslog server.

Syslog server

Input field

External syslog server hostname or IP address.

Proxies with external syslog alert enabled will send syslog alerts to the specified server.

Syslog messages are sent to user facility and informational level (criticality) is configurable for each proxy.

Valid input: IP address or fully qualified domain name
Input example: syslog.mydomain.com
Default value: None

2.3.1. Mapping of Web Security Manager System Logs to Syslog facilities

Attack	`Local3`
Audit	`auth`
Proxy	`Local0`
Learner	`Local4`
Backup	`Local5`
WebGUI	`Local2`
Daemon	`Local1`
Syslog	Other facilities
Error	All facilities with informational level `error` and above

See Section 5, “Logs” for a description of the log mentioned above.

2.4. SNMP

Configure threshold level and address of external Syslog server.

Enable SNMP queries Check box	Enable or disable SNMP daemon. If checked, Web Security Manager will accept SNMP queries on the first of the IP addresses to which management is bound.
Public community Input field	Public community password. The read-only community password. Valid input Any string Input example `wdbhhaiedb` Default value `public`
System location Input field	Information about the system. Valid input Any string Input example `Facility 1, Server room 1` Default value `none`
Listening on Read only	If SNMP is enabled will display the IP address the SNMP daemon is listening on.

2.5. Date and Time

This section is used for configuration of time synchronization via NTP (Network Time Protocol).

It is strongly advised to configure an NTP server in order to have the correct date and time set on the system.

It is recommended to configure an internal NTP interface. If one is not available, a well-known NTP server time.nist.gov can be used. Also, have a look at www.ntpd.org for a more detailed list of NTP servers available for free on the Internet.

NTP server

Input field

IP address or hostname of an NTP server.

Remember to set up at least one DNS server if you enter a hostname here.

Valid input

IP address or fully qualified domain name.

Use space to separate multiple hosts (only one required).

Input example

time.nist.gov

Default value

None

Timezone

Drop down list

Timezone information.

Select the systems timezone from the drop down menu.

Valid input: A timezone option from the drop down list.
Default value: Europe/Copenhagen

Date format

Drop down list

Display dates in logs and reports in Month-Day-Year or Day-Month-Year format.

Select the date format from the drop down menu.

Valid input: An option from the drop down list.
Default value: Month-Day-Year

2.6. Admin contact

Update notifications, attack alerts and system errors can be sent by email to the admin contact email address.

Contact

Input field

E-mail address of the administrative contact.

All alert e-mails and notifications are sent to this address.

You need to define an SMTP server before any e-mails are sent.

Valid input: E-mail address
Input example: admin@mydomain.com
Default value: admin@mydomain.com

Sender domain

Input field

The e-mail address domain.

If not configured it will be extracted from the contact e-mail.

Valid input: a valid domain
Input example: mydomain.com
Default value: extracted from contact

2.7. Email system alerts

Critical events or conditions are logged both locally and to external syslog server (if enabled). However if an external syslog server is not available (or is not monitored) a subset of (potentially) critical alerts can be sent to the designated admin contact email.

Email system error messages to admin contact Check box	Enable or disable sending of error messages altogether. If checked, selected alert types will be sent.
Disk and memory Check box	If checked, disk and memory related errors at log level ERROR and CRITICAL will be sent.
Cluster interface events Check box	If checked, cluster interface related errors at log level ERROR and CRITICAL will be sent. The most common cluster interface event is STATE TRANSITION which, when sent by the slave node in a cluster, indicates that the master node is either down (backup > master) or has resumed operation (master > backup). When the nodes in a cluster are powered on/off or rebooted state transition messages are also logged to the syslog error log and may generate email alerts.
Administrative daemons Check box	If checked, any error at log level ERROR and CRITICAL from administrative daemons will be sent.

2.8. Forward HTTP proxy

Configure forward proxy to be used by the update system when connecting to the update server.

Use proxy for outbound HTTP Check box	Enable or disable the configured forward proxy.
Proxy address Input field	The address of the forward proxy Valid input A valid ip address. Input example `10.10.10.5` Default value `None`
Proxy port Input field	Proxy port number Valid input An TCP/IP port number Input example `8080` Default value `none`
Forward proxy authentication required Check box	Enable if forward proxy requires authentication.
Username Input field	User name used for authenticating to the Proxy. Valid input A valid username Input example `wsm1` Default value `none`
password Input field	Password to authenticate the proxy user.

2.9. Backup configuration

This section is used to configure an FTP/SCP server used for automated configuration backup/restore of Web Security Manager configuration.

2.9.1. FTP configuration

FTP server Input field	FTP hostname or IP address. Valid input IP address or fully qualified domain name Input example `ftp.mydomain.com` Default value `None`
FTP port Input field	FTP server port number Valid input An TCP/IP port number Input example `21` Default value `21`
Login Input field	Username used for login. FTP account used must be able to store files on the remote FTP server. Valid input A valid username Input example `wsm_backup` Default value `none`
Password Input field	Password used for SCP login. Valid input Any string. A long password is recommended as it do not have to be memorable by humans. Input example `s984ROf.dds&fdsfs)afa8343287` Default value `none`
Remote directory Input field	Full path to directory on FTP server used for storing Web Security Manager related files. Valid input A directory path ending with / Input example `/ftp/wsm/` Default value `none`

2.9.2. SCP configuration

SCP server Input field	SCP hostname or IP address. Valid input IP address or fully qualified domain name Input example `ftp.mydomain.com` Default value `None`
SCP port Input field	SCP server port number Valid input An TCP/IP port number Input example `21` Default value `21`
Login Input field	Username used for login. SCP account used must be able to store files on the remote SCP server. Valid input A valid username Input example `wsm_backup` Default value `none`
SCP key Button	Click Download Web Security Manager Public SCP Key to download key used for authentication. Make sure to add this key to the authorized keys list on the remote server.
Remote directory Input field	Full path to directory on SCP server used for storing Web Security Manager related files. Valid input A directory path ending with / Input example `/scp/wsm/` Default value `none`
Remote directory Input field	Full path to directory on SCP server used for storing Web Security Manager related files. Valid input A directory path ending with / Input example `/scp/wsm/` Default value `none`

2.10. Auto-backup

Auto-backup, if enabled, is performed daily at 03:00 AM based on your current timezone settings.

Enable FTP auto-backup

Check box

Enable or disable FTP auto-backup.

If checked, automated FTP configuration backup will be active.

Enable SCP auto-backup

Check box

Enable or disable SCP auto-backup.

If checked, automated SCP configuration backup will be active.

2.11. Remote access

The remote support feature allows for configuring Web Security Manager to allow requests from Alert Logic to port 22 on any of the systems ip addresses.

When enabled Alert Logic Support can connect to the underlying OS in order to help diagnose and troubleshoot problems.

Only requests originating from an Alert Logic support IP address will be redirected.

Enable SSH access to management IPs

Check box

Enable or disable ssh access to management IPs.

If checked, Web Security Manager will allow ssh connections to the same IP addresses as the GUI is bound to.

Enable remote support and monitoring from Alert Logic

Check box

Enable or disable remote support access.

If checked, requests from Alert Logic to port 22 on any of the systems interfaces will be allowed.

To view detailed settings and verify that remote support is disabled use the system remotesupport status command in the CLI (Section 2.22, “system remotesupport”).

If remote support is enabled the system will display a warning on the console when booted.

2.12. Management GUI

Manage password requirements, session and login restrictions and SSL certificate.

2.12.1. Password requirements

Minimum length Input field	Minimum password length in number of characters Valid input Number in the interval 6 to 64 Default value `8`
Letter characters required Check box	Require one or more letter character, a-z + international.
One or more digits (0-9) required Check box	Require one or more digits.
Combination of upper and lower case required Check box	Require a combination of upper and lower case characters.
Non alphanumeric characters required Check box	Require one or more special (non-alphanumeric) characters.

2.12.2. Login and session restrictions

Idle timeout Input field	Number of seconds the management GUI can be idle before the user is logged out. Valid input timeout in seconds 20 to 86400. Input example `900 - 15 minutes` Default value `600`
Failed login delay Input field	Number of seconds to wait after a failed login attempt before a new attempt can be made. Valid input timeout in seconds 0 to 60. Default value `3`
Failed logins limit Input field	Number of failed login attempts allowed before the failed login action is taken. Valid input Number of attempts 1 to 100. Default value `5`
Failed logins action Dropdown	What to do if a user exceeds the failed logins limit. Options: None No action Lockout The user account is locked for the configured duration. After the configured the duration the user account is unlocked and the user can log in. Suspend The user account is suspended and cannot be used until is the account status has been set to OK by an administrator. User account status can be set in System : Users or in the console (Section 2.10, “set user”) Valid input `None, Lockout, Suspend` Input example `Lockout` Default value `None`
Notify user on lockout and suspend Check box	If enabled, user will receive an error message in the login page if the account has been locked or suspended.
Suspend inactive accounts Check box	Enable suspending of accounts that has not been active for a specified duration.
Account inactivity threshold Input field	Number of days a user account can be inactive before it is automatically suspended. Valid input Duration in days 1 to 1000. Default value `90`

2.12.3. SSL certificate

Management GUI SSL certificates can either be self signed or imported certificates.

In the SSL certificate section the current SSL certificate in use is displayed. To upload a new certificate click the Manage GUI certificates button.

2.12.3.1. Generate self-signed SSL certificate

To generate a self signed certificate enter the certificate information in the input fields.

Click Save settings in the lower button pane.

2.12.3.1.1. Importing the PKCS12 format

If the certicifate is in the PKCS12 format follow the guidelines below:

Enter the path to the certificate file in the PKCS12 file input field.
Enter Passphrase in the Passphrase input field.
Click Save settings in the lower button pane.

If Validate certificate chain is enabled Web Security Manager will validate and order the chain certificates.

2.12.3.1.2. Importing the PEM format

If the certificate is in the PEM format follow the guidelines below:

Open the .PEM file in a text-editor. Copy the public certificate section of the certificate.

The public key/certificate is the section of the certificate file between (and including) the certificate start and end tags. Example:
```
-----BEGIN CERTIFICATE-----
 Certificate characters
-----END CERTIFICATE----- 
```
Select Import SSL certificate In the Web Security Manager management interface

Paste the SSL public key/certificate into the SSL-certificate field.
Now copy the (SSL) private key section of the certificate. The (SSL) private key is the section of the certificate file between (and including) the private key start and end tags. Example:
```
-----BEGIN RSA PRIVATE KEY-----
 Private key characters 
-----END RSA PRIVATE KEY-----
```
Enter the passphrase for the private key in the passphrase field (if the original private key was encrypted).
If a certificate authority chain is provided with your certificate enter the entire list of certificates (more than one certificate may be provided) in the SSL authority certificate(s) chain field

If Validate certificate chain is enabled Web Security Manager will validate and order the chain certificates.