Installing Tripwire Axon Agent using PKI

This section describes the process to install and configure the Axon Agent using PKI to authenticate communication with the Bridge.

Note	Tripwire strongly recommends installation using a pre-shared key instead of PKI unless you have an existing centralized public key infrastructure and are comfortable with creating and maintaining certificate keys. Using a pre-shared key is equally secure, and greatly simplifies the configuration process. For installation instructions using a pre-shared key, see Installing Tripwire Axon Agent using a Pre-Shared Key. For more information about these different authentication methods, see Choosing an Authentication Method for TLC Axon Agents.

Note

Tripwire strongly recommends installation using a pre-shared key instead of PKI unless you have an existing centralized public key infrastructure and are comfortable with creating and maintaining certificate keys. Using a pre-shared key is equally secure, and greatly simplifies the configuration process.

For installation instructions using a pre-shared key, see Installing Tripwire Axon Agent using a Pre-Shared Key.

For more information about these different authentication methods, see Choosing an Authentication Method for TLC Axon Agents.

Certificate Requirements

The Bridge and Axon Agent X.509 certificates must meet the following requirements:

The certificates must use an RSA key of a minimum size defined by FIPS 140-3.

The certificates on the Bridge and on each Axon Agent must be signed by a common CA.

Step 1. Creating Certificates on the Tripwire Log Center Manager

To create certificates and place them in a key store on the Tripwire Log Center Manager:

Create an X.509 certificate to be used by the Bridge.

Place the Bridge certificate and the signed certificate chain into a Java BCFKS key store.

For example, if you have a PKCS#12 key store that contains the Bridge's key and signed certificate, convert it to BCFKS format using the following keytool command:

keytool -importkeystore -srckeystore <path_to_PKCS#12_key_store> ‑srcstoretype PKCS12 -destkeystore bridge.ks -deststoretype BCFKS ‑srcstorepass <PKCS#12_key_store_password>
-deststorepass <tw.cap.bridge.keyStorePassword> -providername BCFIPS ‑providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
-providerpath <TLC_Manager_install_dir>\Agent Services\agentCrlManager\lib\bc-fips-*.jar

If you have a traditional Java key store (JKS format) that contains the Bridge's key and signed certificate, use a similar keytool command to convert it to BCFKS format:

keytool -importkeystore -srckeystore <path_to_JKS_key_store>
-destkeystore bridge.ks -deststoretype BCFKS
-srcstorepass <java_key_store_password>
-deststorepass <tw.cap.bridge.keyStorePassword> -providername BCFIPS
-providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
-providerpath <TLC_Manager_install_dir>\Agent Services\agentCrlManager\lib\bc-fips-*.jar

Tip	Remember this key store password value that you specify for -deststorepass. You will need to specify this password in the next step.

Import the CA cert used to sign the Bridge certificates.

keytool -import -alias tw_agent_ca -file <path_to_CA_certificate>
-keystore <path_to_bridge.ks> -storepass <password_for_bridge.ks>
-providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
-storetype BCFKS -providername BCFIPS
-providerpath <TLC_Manager_install_dir>\Agent Services\agentCrlManager\lib\bc-fips-*.jar

Step 2. Configuring the Bridge on a Tripwire Log Center Manager

Note	The Bridge only needs to be configured on a Tripwire Log Center Manager once, before connecting to an Axon Agent for the first time. If the Bridge has already been configured (that is, the Bridge is already connected to an Axon Agent) proceed to Step 3. (Optional) Configuring a DNS SRV Record for the Axon Agent's Domain.

To configure the Tripwire Bridge on a Tripwire Log Center Manager:

Ensure that a supported version of Tripwire Log Center Manager is installed.

Verify that port 5670 is available on the Tripwire Log Center Manager.

At a command prompt, enter the following command to stop the Bridge service:

net stop TripwireBridge

Open the following file in a text editor:

<TLC_Manager_install_dir>\Agent Services\config\bridge_sample.properties

Save a copy of this file with the name bridge.properties in the same directory.

In the bridge.properties file, complete the following steps:

Locate the following line:

#tw.cap.bridge.port=5670

This entry specifies the port with which the Tripwire Bridge will 'listen' for incoming log messages from Axon Agents (5670 by default). If you want to use another port, remove the pound sign (#) from the beginning of the line and replace "5670" with the new port number.

Locate the following line, then remove the pound sign (#) and set the value to PKI to configure PKI authentication mode:

#tw.cap.bridge.authMode=Pki

Locate the following line, then remove the pound sign and set the value to the certificate and key store’s password:

#tw.cap.bridge.keyStorePassword=<keystore_password>

where <keystore_password> is the certificate and key store password for the Bridge certificate key store.

By default, the Bridge uses TLSv1.2 with cipher suites TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384. To change these settings, see Configuring TLS Versions and Cipher Suites.

Save the file.

Copy the previously created certificate key store into place:

<TLC_Manager_install_dir>\Agent Services\data\bridge\bridge.ks

Note	The bridge directory will need to be created if it does not exist.

At a command prompt, enter the following command to start the Tripwire Bridge Service:

net start TripwireBridge

Tip	If you encounter a problem with the Bridge after configuration, review the Bridge log file to assess the issue: <TLC_Manager_install_dir>/Agent Services/Jetty/logs/TripwireBridge-YYYY-MM-DD For additional assistance, contact Tripwire Support.

Tip

If you encounter a problem with the Bridge after configuration, review the Bridge log file to assess the issue:

<TLC_Manager_install_dir>/Agent Services/Jetty/logs/TripwireBridge-YYYY-MM-DD

For additional assistance, contact Tripwire Support.

Step 3. (Optional) Configuring a DNS SRV Record for the Axon Agent's Domain

In a Domain Name System (DNS), an SRV record (or service record) defines the hostnames and port numbers of servers running various services. If you have a DNS Server with an SRV record for the domain(s) containing the Axon Agent host system, no further configuration of the host system will be required following the installation of Tripwire Axon Agent for TLC (see Step 4. Installing the Axon Agent). Instead, following installation, the Agent will query the DNS Server for any SRV records in the DNS domains associated with any IP addresses assigned to the Axon Agent host system’s interfaces.

If you do not wish to employ DNS SRV records to configure the Axon Agent, proceed to Step 4. Installing the Axon Agent.

Otherwise, edit one of the DNS SRV records for the Axon Agent host system's domains as described below.

To edit an SRV record on your DNS server:

Open the SRV record for a domain containing the Axon Agent host system. The name of the SRV record will appear in this format:

_tw-agw._tcp.<domain_name>

where <domain_name> is the name of the domain.

To specify the Tripwire Log Center Manager to which the Axon Agent will send data, enter the server's IP address or host name in the Server Hostname field.

In the Port field, enter the number of the port on the Tripwire Log Center Manager to be used for communications with Axon Agents. To use the default port, enter 5670.

Step 4. Installing the Axon Agent

In this step, you will install the Tripwire Axon Agent for TLC software on an Agent host system. You must install the this software on each system that you want to monitor.

To install the Agent software, complete the appropriate steps for the Agent host system:

Installing Tripwire Axon Agent for TLC on a Linux System

Installing Tripwire Axon Agent for TLC on a Windows System

Caution

After installation, the Agent will look for and use any
_tw-agw._tcp.<domain_name> DNS SRV record that exists for its DNS domain. This can be an issue if an existing DNS SRV record points to a different server, for example if Tripwire Enterprise and Tripwire Log Center are both installed in the same domain.

To resolve this issue, before installing the Agent software:

Create one of the following directories for the Agent files:

Linux:/etc/tripwire-tlc

Windows:%PROGRAMDATA%\Tripwire\agent-tlc\config

Create the Agent configuration file (twagent.conf) and registration pre-shared key file (registration_pre_shared_key.txt) in the directory you just created, as described in Step 6. Configuring the Axon Agent.

Install the Agent software as described below.

Installing Tripwire Axon Agent for TLC on a Linux System

To install Tripwire Axon Agent for TLC on a Linux system:

See Supported Platforms to make sure that the Axon Agent is supported on the target system.

Use the following command to install the software:

rpm –ivh <installer_rpm_file>

where <installer_rpm_file> is the appropriate installer file (Table 17).

Table 17. Axon Agent installer files
File name	Target OS
tw-axon-agent-tlc-linux-x86.rpm	32-bit Linux systems
tw-axon-agent-tlc-linux-x64.rpm	64-bit Linux systems

Installing Tripwire Axon Agent for TLC on a Windows System

To install Tripwire Axon Agent for TLC on a Windows system:

See Supported Platforms to make sure that the Axon Agent is supported on the target system.

To install the software in the default location (C:\Program Files\Tripwire\Agent-TLC), double-click the appropriate installer file (see Table 18) in the directory in which you unzipped the Agent installation package.

To install the software in a different directory, open a command prompt and enter the following command:

<installer_file> INSTALLDIR=<target_binary_installation_dir>

where

<installer_file> is the name of the appropriate installer file (see Table 18), and

<target_binary_file_directory> is the full path to the target installation directory

Table 18. Axon Agent installer files
File name	Target OS
tw-axon-agent-tlc-windows-x86.msi	32-bit Windows systems
tw-axon-agent-tlc-windows-x64.msi	64-bit Windows systems

Step 5. Creating Certificates on an Axon Agent

Follow the steps below to create certificates and place them in a key store on each Axon Agent that will connect with the Tripwire Log Center Manager.

To create certificates and place them in a key store on an Axon Agent:

Create an X.509 certificate for the Axon Agent.

Place the Agent's certificate and the signed certificate chain into a PKCS#12 key store.

Note	The key store must use PBE-SHA1-3DES for obfuscation. Remember the password you specify for the Axon Agent key store. You will need to specify this password in the next step.

Note

The key store must use PBE-SHA1-3DES for obfuscation.

Remember the password you specify for the Axon Agent key store. You will need to specify this password in the next step.

Step 6. Configuring the Axon Agent

To configure an Axon Agent to communicate with the Tripwire Log Center Manager, you edit the Agent's configuration file twagent.conf. You must edit the configuration file on each system where Axon Agent is installed.

To configure the Axon Agent:

At a command prompt, enter one of the following commands to stop the Axon Agent service:

Linux:
/sbin/service tw-axon-agent-tlc stop

Windows:
net stop TripwireAxonAgentTLC

Open one of the following files in a text editor:

Linux:
/etc/tripwire-tlc/twagent_sample.conf

Windows:
%PROGRAMDATA%\Tripwire\agent-tlc\config\twagent_sample.conf

Save a copy of this file with the name twagent.conf in the same directory.

If you did not configure an SRV record in Step 3. (Optional) Configuring a DNS SRV Record for the Axon Agent's Domain, you must manually enter the host name or IP address of the Tripwire Log Center Manager as the bridge.host option in the Axon Agent configuration file.

bridge.host=<product_server_hostname_or_IP>

If you did configure an SRV record, the Axon Agent will query the DNS Server when you restart the Axon Agent service (below). This query will attempt to identify an SRV record and use the hostname or IP address and port from the record to connect to the Bridge. If the query is successful, the Axon Agent's running configuration will use these values as the bridge.host and bridge.port options (see Table 20).

The Axon Agent spools data to be sent to the Tripwire Log Center Manager's Bridge (see Getting Started with Tripwire Axon Agent for TLC). Based on the speed with which the Axon Agent collects data from the Agent host system, edit the spool.size.max option to adjust the size of the spool (see Table 19).

Note	When the Axon Agent sends data to the Tripwire Log Center Manager, it first copies the data to the spool. If the connection is dropped, transmitted data may be lost. In this case, the server will ask the Axon Agent to re-send the spooled data. A spool size that is too small will limit the Agent's ability to respond to such requests, while a spool size that is too large will needlessly fill the Agent's disk space with old data.

Note

When the Axon Agent sends data to the Tripwire Log Center Manager, it first copies the data to the spool. If the connection is dropped, transmitted data may be lost. In this case, the server will ask the Axon Agent to re-send the spooled data. A spool size that is too small will limit the Agent's ability to respond to such requests, while a spool size that is too large will needlessly fill the Agent's disk space with old data.

Table 19. Guidelines for spool.size.max
Spool Size	If the Axon Agent collects ...	Recommended value for spool.size.max
Small	... 1 to 5 events (i.e., log messages) per second (EPS)	100 MB
Medium	... 6 to 10 events per second (EPS)	500 MB
Large	... 11 or more events per second (EPS)	1 GB

As needed, edit the values of the other options in the Axon Agent configuration file (see Table 20).

(Optional) To configure the Axon Agent to communicate through a SOCKS5 proxy, edit the values for the SOCKS5 settings. For more information, see Table 21.

(Optional) By default, the Axon Agent uses TLSv1.2 with cipher suites DHE-RSA-AES256-SHA:RSA-AES256-SHA:AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384. To change these settings, see Configuring TLS Versions and Cipher Suites.

Set the following values in the twagent.conf file to enable PKI authentication mode:

bridge.auth.mode=pki

keystore.password=<keystore_password>

where <keystore_password> is the certificate and key store password for this Axon Agent's certificate store.

10.

Copy the keystore.p12 certificate store for this Axon Agent into one of these directories:

Linux: /etc/tripwire-tlc/trust

Windows: %PROGRAMDATA%\Tripwire\agent-tlc\config\trust

Note	The trust directory will need to be created if the Axon Agent has not been previously started.

11.

At a command prompt, enter one of the following commands to start the Axon Agent service:

Linux:

/sbin/service tw-axon-agent-tlc start

Windows:

net start TripwireAxonAgentTLC

12.

After completing these steps, you should see an Auto Discovery message for the Axon Agent in the TLC Manager log. For information on using the Axon Agent with Tripwire Log Center, see the Tripwire Log Center User Guide.

Tip

If you encounter a problem with the Axon Agent after configuration, review the Agent log file to assess the issue:

Linux: /var/log/tripwire-tlc/twagent.log

Windows: %PROGRAMDATA%\Tripwire\agent-tlc\log\twagent.log

For information on interpreting error messages, see Axon Agent Error Messages. For additional assistance, contact Tripwire Support.

Table 20. Options in the Axon Agent configuration file
Option	Description
bridge.host	The host name or IP address of the TLC Manager to which this Axon Agent will connect. For more information, see Step 2. Configuring the Bridge on a Tripwire Log Center Manager.
bridge.port	The port on the TLC Manager used for communication between the Bridge and the Axon Agent. (Default = 5670)
dns.service.domain	Specifies a DNS domain other than the Axon Agent host system's domain for SRV record lookup.
dns.service.name	Specifies a DNS service name. (Default = _tw-agw)
registration.file.name	The name of the file containing the registration pre-shared key (defined in Step 1. Configuring the Bridge on a Tripwire Log Center Manager) for the Axon Agent to register with the Bridge. (Default = registration_pre_shared_key.txt) The Agent searches for the specified file name in the following directory: Linux: /etc/tripwire-tlc Windows: %PROGRAMDATA%\Tripwire\agent-tlc\config
spool.size.max	The maximum size of the spool with which the Axon Agent collects data from the Agent host system. (Default = 1GB) For sizing guidelines, see Table 19.

Table 21. SOCKS5 proxy options in the Axon Agent configuration file
Option	Description
socks5.host	The host name or IP address of the SOCKS5 proxy through which the Axon Agent communicates with the Tripwire Bridge.
socks5.port	The port on the SOCKS5 proxy through which the Axon Agent communicates with the Tripwire Bridge. Default value: 1080
socks5.user.name	The username with which the Axon Agent will authenticate with the SOCKS5 proxy. If the SOCKS5 proxy is using username/password authentication, enter the username here and enter the password using the socks5.user.password setting. If the SOCKS5 proxy is using the "no authentication" method, leave this field and the socks5.user.password setting blank.
socks5.user.password	The password that the Axon Agent will use to authenticate with the SOCKS5 proxy if the proxy is using username/password authentication.

Table 22. TLS version and supported protocols in the Axon Agent configuration file
Option	Description
tls.version	The TLS version used to connect with the Bridge. Valid options are TLSv1, TLSv1.1, and TLSv1.2. Only one TLS version can be specified here. For information on changing the TLS version and cipher suites, see Configuring TLS Versions and Cipher Suites. Default value: TLSv1.2
tls.cipher.suites	A colon-delimited list of cipher suites used by the Axon Agent when it connects to the Bridge. Only OpenSSL FIPS-compatible cipher suites which utilize RSA keys are supported. Default value: DHE-RSA-AES256-SHA:RSA-AES256-SHA:AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384

Table 23. Public key infrastructure options in the Axon Agent configuration file
Option	Description
bridge.auth.mode	The authentication mode for this Axon Agent. Valid options are pki and registration. Default value: registration
keystore.password	The password for the key store and private key.