Installing the Agent Using a Pre-Shared Key

This section describes the process to install and configure the Agent, using a pre-shared key to authenticate communication with the Bridge. For more information about different authentication methods, see Choosing an Authentication Method for Agents.

Step 1. Configuring the Bridge on a Tripwire Log Center Manager

Note 

The Bridge only needs to be configured on a Tripwire Log Center Manager once, before connecting to an Agent for the first time. If the Bridge has already been configured (that is, the Bridge is already connected to an Agent) proceed to Step 2. (Optional) Configuring a DNS SRV Record for the Agent's Domain.

To configure the Bridge on a Tripwire Log Center Manager

1. Ensure that a supported version of Tripwire Log Center Manager is installed.
2. Verify that port 5670 is available on the Tripwire Log Center Manager.
3. Open the following file in a text editor:

<TLC_Manager_install_dir>\Agent Services\config\bridge_sample.properties

4. Save a copy of this file with the name bridge.properties in the same directory.
5. In the bridge.properties file, complete the following steps: 
a. Locate the following line: 

#tw.cap.bridge.port=5670

This entry specifies the port with which the Bridge will 'listen' for incoming log messages from Agents (5670 by default). If you want to use another port, remove the pound sign (#) from the beginning of the line and replace "5670" with the new port number.

b. Locate the following line:

#tw.cap.bridge.registrationPreSharedKey=

Remove the pound sign (#) from the beginning of the line and enter a registration pre-shared key of your choice. This pre-shared key is used by the Agent to register with the Tripwire Log Center Manager. The pre-shared key may include the space character and any alphanumeric characters, as well as the following special characters: 

"%$'( )*+,-./:;<=>?_

c. By default, the Bridge uses TLSv1.2 with cipher suites TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384. To change these settings, see Configuring TLS Versions and Cipher Suites.
d. Save the file.
6. At a command prompt, enter the following commands to restart the Bridge service:

net stop TripwireBridge

net start TripwireBridge

Tip 

If you encounter a problem with the Bridge after configuration, review the Bridge log file to assess the issue:

<TLC_Manager>/Agent Services/Jetty/logs/TripwireBridge-YYYY-MM-DD

For additional assistance, contact Tripwire Support.

Step 2. (Optional) Configuring a DNS SRV Record for the Agent's Domain

In a Domain Name System (DNS), an SRV record (or service record) defines the hostnames and port numbers of servers running various services. If you have a DNS Server with an SRV record for the domain(s) containing the Agent host system, no further configuration of the host system will be required following the installation of the Agent software (see Step 3. Installing the Agent). Instead, following installation, the Agent will query the DNS Server for any SRV records in the DNS domains associated with any IP addresses assigned to the Agent host system’s interfaces.

If you do not wish to employ DNS SRV records to configure the Agent, proceed to Step 3. Installing the Agent.

Otherwise, edit one of the DNS SRV records for the Agent host system's domains as described below.

To edit an SRV record on your DNS server:

1. Open the SRV record for a domain containing the Agent host system. The name of the SRV record will appear in this format: 

_tw-agw._tcp.<domain_name>

where <domain_name> is the name of the domain.

2. To specify the Tripwire Log Center Manager to which the Agent will send data, enter the server's IP address or host name in the Server Hostname field.
3. In the Port field, enter the number of the port on the Tripwire Log Center Manager to be used for communications with Agents. To use the default port, enter 5670.

Step 3. Installing the Agent

In this step, you will install the Agent software on an Agent host system. You must install the Agent software on each system that you want to monitor.

To install the Agent software, complete the appropriate steps for the Agent host system:

Installing the Agent on a Linux System

Installing the Agent on a Windows System

Caution 

After installation, the Agent will look for and use any
_tw-agw._tcp.<domain_name>
DNS SRV record that exists for its DNS domain. This can be an issue if an existing DNS SRV record points to a different server, for example if Tripwire Enterprise and Tripwire Log Center are both installed in the same domain.

To resolve this issue, before installing the Agent software:

1. Create one of the following directories for the Agent files:

Linux:/etc/tripwire

Windows:%PROGRAMDATA%\Tripwire\agent\config

2. Create the Agent configuration file (twagent.conf) and registration pre-shared key file (registration_pre_shared_key.txt) in the directory you just created, as described in Step 4. Configuring the Agent.
3. Install the Agent software as described below.

Installing the Agent on a Linux System

To install the Agent software on a Linux system:

1. See Supported Platforms to make sure that the Agent is supported on the target system.
2. Log in to the host system with a local administrator account.
3. Use the following command to install the software:

rpm –ivh <installer_rpm_file>

where <installer_rpm_file> is the appropriate installer file (Table 9).

Table 9. Agent installer files

File name

Target OS

tw-via-agent-installer-linux-x86.rpm

32-bit Linux systems

tw-via-agent-installer-linux-x64.rpm

64-bit Linux systems

Installing the Agent on a Windows System

To install Agent software on a Windows system:

1. See Supported Platforms to make sure that the Agent is supported on the target system.
2. Log in to the host system with a local administrator account.
3. To install the software in the default location (C:\Program Files\Tripwire\Agent), double-click the appropriate installer file (see Table 10) in the directory in which you unzipped the Agent installation package. 

To install the software in a different directory, open a command prompt and enter the following command:

<installer_file> INSTALLDIR=<target_binary_installation_dir>

where

<installer_file> is the name of the appropriate installer file (see Table 10), and

<target_binary_file_directory> is the full path to the target installation directory

Table 10. Agent installer files

File name

Target OS

TW_VIA_Agent_x86.msi

32-bit Windows systems

TW_VIA_Agent_x64.msi

64-bit Windows systems

Step 4. Configuring the Agent

To configure an Agent to communicate with the Tripwire Log Center Manager, you edit the Agent's configuration file twagent.conf. You must edit the configuration file on each system where the Agent is installed.

To configure the Agent:

1. Open one of the following files in a text editor:

Linux:
/etc/tripwire/twagent_sample.conf

Windows:
%PROGRAMDATA%\Tripwire\agent\config\twagent_sample.conf

2. Save a copy of this file with the name twagent.conf in the same directory.
3. If you did not configure an SRV record in Step 2. (Optional) Configuring a DNS SRV Record for the Agent's Domain, you must manually enter the host name or IP address of the Tripwire Log Center Manager as the bridge.host option in the Agent configuration file.

bridge.host=<product_server_hostname_or_IP>

If you did configure an SRV record, the Agent will query the DNS Server when you restart the Agent service (below). This query will attempt to identify an SRV record and use the hostname or IP address and port from the record to connect to the Bridge. If the query is successful, the Agent's running configuration will use these values as the bridge.host and bridge.port options (see Table 12).

4. The Agent spools data to be sent to the Tripwire Log Center Manager's Bridge (see Getting Started with the Agent). Based on the speed with which the Agent collects data from the Agent host system, edit the spool.size.max option to adjust the size of the spool (see Table 11).

Note 

When the Agent sends data to the Tripwire Log Center Manager, it first copies the data to the spool. If the connection is dropped, transmitted data may be lost. In this case, the server will ask the Agent to re-send the spooled data. A spool size that is too small will limit the Agent's ability to respond to such requests, while a spool size that is too large will needlessly fill the Agent's disk space with old data.

Table 11. Guidelines for spool.size.max

Spool Size

If the Agent collects ...

Recommended value for spool.size.max

Small

... 1 to 5 events (i.e., log messages) per second (EPS)

100 MB

Medium

... 6 to 10 events per second (EPS)

500 MB

Large

... 11 or more events per second (EPS)

1 GB

5. As needed, edit the values of the other options in the Agent configuration file (see Table 12).
6. (Optional) To configure the Agent to communicate through a SOCKS5 proxy, edit the values for the SOCKS5 settings. For more information, see Table 13.
7. (Optional) By default, the Agent uses TLSv1.2 with cipher suites DHE-RSA-AES256-SHA:RSA-AES256-SHA:AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384. To change these settings, see Configuring TLS Versions and Cipher Suites.
8. Create a text file named registration_pre_shared_key.txt and save the file in the following directory:

Linux: /etc/tripwire
Windows: %PROGRAMDATA%\Tripwire\agent\config\

9. In the text file, enter the same registration pre-shared key (value only) that you specified in the bridge.properties file in Step 1. Configuring the Bridge on a Tripwire Log Center Manager.
10. At a command prompt, enter one of the following sets of commands to restart the Agent Service:

Linux: 

/sbin/service twagent stop

/sbin/service twagent start

Windows: 

net stop TripwireViaAgent

net start TripwireViaAgent

11. After completing these steps, you should see an Auto Discovery message for the Agent in the TLC Manager log. For information on using the Agent with Tripwire Log Center, see the Tripwire Log Center User Guide.

Tip 

If you encounter a problem with the Agent after configuration, review the Agent log file to assess the issue:

Linux:

/var/log/tripwire/twagent.log

Windows:

%PROGRAMDATA%\Tripwire\agent\log\twagent.log

For information on interpreting error messages, see Agent Error Messages. For additional assistance, contact Tripwire Support.

Table 12. Options in the Agent configuration file

Option

Description

bridge.host

The host name or IP address of the TLC Manager to which this Agent will connect. For more information, see Step 1. Configuring the Bridge on a Tripwire Log Center Manager.

bridge.port

The port on the TLC Manager used for communication between the Bridge and the Agent. (Default = 5670)

dns.service.domain

Specifies a DNS domain other than the Agent host system's domain for SRV record lookup.

dns.service.name

Specifies a DNS service name. (Default = _tw-agw)

registration.file.name

The name of the file containing the registration pre-shared key (defined in Step 1. Configuring the Bridge on a Tripwire Log Center Manager) for the Agent to register with the Bridge. (Default = registration_pre_shared_key.txt) The Agent searches for the specified file name in the following directory:

Linux: /etc/tripwire
Windows: %PROGRAMDATA%\Tripwire\agent\config

spool.size.max

The maximum size of the spool with which the Agent collects data from the Agent host system. (Default = 1GB)

For sizing guidelines, see Table 11.

Table 13. SOCKS5 proxy options in the Agent configuration file

Option

Description

socks5.host

The host name or IP address of the SOCKS5 proxy through which the Agent communicates with the Bridge.

socks5.port

The port on the SOCKS5 proxy through which the Agent communicates with the Bridge.

Default value: 1080

socks5.user.name

The username with which the Agent will authenticate with the SOCKS5 proxy.

If the SOCKS5 proxy is using username/password authentication, enter the username here and enter the password using the socks5.user.password setting.

If the SOCKS5 proxy is using the "no authentication" method, leave this field and the socks5.user.password setting blank.

socks5.user.password

The password that the Agent will use to authenticate with the SOCKS5 proxy if the proxy is using username/password authentication.

Table 14. TLS version and supported protocols in the Agent configuration file

Option

Description

tls.version

The TLS version used to connect with the Bridge. Valid options are TLSv1, TLSv1.1, and TLSv1.2. Only one TLS version can be specified here.

For information on changing the TLS version and cipher suites, see Configuring TLS Versions and Cipher Suites.

Default value: TLSv1.2

tls.cipher.suites

A colon-delimited list of cipher suites used by the Agent when it connects to the Bridge. Only OpenSSL FIPS-compatible cipher suites which utilize RSA keys are supported.

Default value: DHE-RSA-AES256-SHA:RSA-AES256-SHA:AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384

Table 15. Public key infrastructure options in the Agent configuration file

Option

Description

bridge.auth.mode

The authentication mode for this Agent. Valid options are pki and registration.

Default value: registration

keystore.password

The password for the key store and private key.