|
@@ -1,79 +0,0 @@
|
|
|
-# Enabling Security on the Management Station
|
|
|
|
|
-
|
|
|
|
|
-Omnia uses FreeIPA on RockyOS to enable security features like authorisation and access control.
|
|
|
|
|
-
|
|
|
|
|
-## Enabling Authentication on the Management Station:
|
|
|
|
|
-
|
|
|
|
|
-Set the parameter 'enable_security_support' to true in `base_vars.yml`
|
|
|
|
|
-
|
|
|
|
|
-## Prerequisites Before Enabling Security:
|
|
|
|
|
-
|
|
|
|
|
-* Enter the relevant values in `login_vars.yml`:
|
|
|
|
|
-
|
|
|
|
|
-| Parameter Name | Default Value | Additional Information |
|
|
|
|
|
-|----------------------------|---------------|--------------------------------------------------------------------------------------------------|
|
|
|
|
|
-| ms_directory_manager_password | | Password of the Directory Manager with full access to the directory for system management tasks. |
|
|
|
|
|
-| ms_kerberos_admin_password | | "admin" user password for the IPA server on RockyOS. If LeapOS is in use, it is used as the "kerberos admin" user password for 389-ds <br> This field is not relevant to Management Stations running `LeapOS` |
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-* Enter the relevant values in `security_vars.yml:
|
|
|
|
|
-
|
|
|
|
|
-If `RockyOS` is in use on the Management Station:
|
|
|
|
|
-
|
|
|
|
|
-| Parameter Name | Default Value | Additional Information |
|
|
|
|
|
-|------------------------|-----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
|
|
|
-| domain_name | omnia.test | The domain name should not contain an underscore ( _ ) |
|
|
|
|
|
-| realm_name | OMNIA.TEST | The realm name should follow the following rules per https://www.freeipa.org/page/Deployment_Recommendations <br> * The realm name must not conflict with any other existing Kerberos realm name (e.g. name used by Active Directory). <br> * The realm name should be upper-case (EXAMPLE.COM) version of primary DNS domain name (example.com). |
|
|
|
|
|
-| max_failures | 3 | Failures allowed before lockout. <br> This value cannot currently be changed. |
|
|
|
|
|
-| failure_reset_interval | 60 | Period (in seconds) after which the number of failed login attempts is reset <br> Accepted Values: 30-60 |
|
|
|
|
|
-| lockout_duration | 10 | Period (in seconds) for which users are locked out. <br> Accepted Values: 5-10 |
|
|
|
|
|
-| session_timeout | 180 | Period (in seconds) after which idle users get logged out automatically <br> Accepted Values: 30-90 |
|
|
|
|
|
-| alert_email_address | | Email address used for sending alerts in case of authentication failure. Currently, only one email address is supported in this field. <br> If this variable is left blank, authentication failure alerts will be disabled. |
|
|
|
|
|
-| allow_deny | Allow | This variable sets whether the user list is Allowed or Denied. <br> Accepted Values: Allow, Deny |
|
|
|
|
|
-| user | | Array of users that are allowed or denied based on the `allow_deny` value. Multiple users must be separated by a space. |
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-## Log Aggregation via Grafana
|
|
|
|
|
-
|
|
|
|
|
-[Loki](https://grafana.com/docs/loki/latest/fundamentals/overview/) is a datastore used to efficiently hold log data for security purposes. Using the `promtail` agent, logs are collated and streamed via a HTTP API.
|
|
|
|
|
-
|
|
|
|
|
->> __Note:__ When `control_plane.yml` is run, Loki is automatically set up as a data source on the Grafana UI.
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-### Querying Loki
|
|
|
|
|
-
|
|
|
|
|
-Loki uses basic regex based syntax to filter for specific jobs, dates or timestamps.
|
|
|
|
|
-
|
|
|
|
|
-* Select the Explore  tab to select control-plane-loki from the drop down.
|
|
|
|
|
-* Using [LogQL queries](https://grafana.com/docs/loki/latest/logql/log_queries/), all logs in `/var/log` can be accessed using filters (Eg: `{job=”Omnia”}` )
|
|
|
|
|
-
|
|
|
|
|
-## Viewing Logs on the Dashboard
|
|
|
|
|
-
|
|
|
|
|
-All log files can be viewed via the Dashboard tab (). The Default Dashboard displays `omnia.log` and `syslog`. Custom dashboards can be created per user requirements.
|
|
|
|
|
-
|
|
|
|
|
-Below is a list of all logs available to Loki and can be accessed on the dashboard:
|
|
|
|
|
-
|
|
|
|
|
-| Name | Location | Purpose | Additional Information |
|
|
|
|
|
-|--------------------|-------------------------------------------|------------------------------|----------------------------------------------------------------------------------------------------|
|
|
|
|
|
-| Omnia Logs | /var/log/omnia.log | Omnia Log | This log is configured by Default |
|
|
|
|
|
-| syslogs | /var/log/messages | System Logging | This log is configured by Default |
|
|
|
|
|
-| Audit Logs | /var/log/audit/audit.log | All Login Attempts | This log is configured by Default |
|
|
|
|
|
-| CRON logs | /var/log/cron | CRON Job Logging | This log is configured by Default |
|
|
|
|
|
-| Pods logs | /var/log/pods/ * / * / * log | k8s pods | This log is configured by Default |
|
|
|
|
|
-| Access Logs | /var/log/dirsrv/slapd-<Realm Name>/access | Directory Server Utilization | This log is available when FreeIPA is set up ( ie when enable_security_support is set to 'true') |
|
|
|
|
|
-| Error Log | /var/log/dirsrv/slapd-<Realm Name>/errors | Directory Server Errors | This log is available when FreeIPA is set up ( ie when enable_security_support is set to 'true') |
|
|
|
|
|
-| CA Transaction Log | /var/log/pki/pki-tomcat/ca/transactions | FreeIPA PKI Transactions | This log is available when FreeIPA is set up ( ie when enable_security_support is set to 'true') |
|
|
|
|
|
-| KRB5KDC | /var/log/krb5kdc.log | KDC Utilization | This log is available when FreeIPA is set up ( ie when enable_security_support is set to 'true') |
|
|
|
|
|
-| Secure logs | /var/log/secure | Login Error Codes | This log is available when FreeIPA is set up ( ie when enable_security_support is set to 'true') |
|
|
|
|
|
-| HTTPD logs | /var/log/httpd/* | FreeIPA API Call | This log is available when FreeIPA is set up ( ie when enable_security_support is set to 'true') |
|
|
|
|
|
-| DNF logs | /var/log/dnf.log | Installation Logs | This log is configured on Rocky OS |
|
|
|
|
|
-| Zypper Logs | /var/log/zypper.log | Installation Logs | This log is configured on Leap OS |
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
cgoveas