Transcription
BigFix PlatformConfiguration Guide
Special noticeBefore using this information and the product it supports, read the information in Notices(on page 233).
Edition noticeThis edition applies to version 9.5 of BigFix and to all subsequent releases andmodifications until otherwise indicated in new editions.
ContentsChapter 1. Introduction. 1What is new in V9.5. 1Terms used in this guide. 24Chapter 2. BigFix Site Administrator and Console Operators. 25The Site Administrator.25The Console Operators. 27Different ways to define a Console Operator. 29Adding Local Operators. 29Stop Other Operator's Actions feature. 34Mapping authorized activities with permissions. 37Operators and analysis. 39Monitoring Operators. 40Chapter 3. Integrating with LDAP. 42Integrating with a Generic LDAP. 42Integrating with Active Directory.44Integrating the Windows server with Active Directory. 44Integrating the Linux server with Active Directory. 47Adding LDAP Operators. 56Associating an LDAP group. 59Chapter 4. Enabling SAML V2.0 authentication for LDAP operators. 61What Is SAML 2.0. 61How SAML works.62Which BigFix user interfaces integrate with SAML V2.0.62
Contents vHow BigFix integrates with SAML V2.0.63Assumptions and requirements. 64What changes from the BigFix user's perspective. 66How to configure BigFix to integrate with SAML 2.0. 68Chapter 5. Using multiple servers (DSA). 73Disaster Server Architecture (DSA).73Configuring relay failover.75Message Level Encryption and DSA. 77Managing Replication (DSA) on Windows systems. 78Changing the replication interval on Windows systems.78Switching the master server on Windows systems. 79Managing Replication (DSA) on Linux systems.79Changing the replication interval on Linux systems. 80Switching the master server on Linux systems. 81Schema next tables regenerated during upgrade.83Chapter 6. Server object IDs. 84Chapter 7. Customizing HTTPS for Gathering. 85Chapter 8. Configuring secure communication.88Configuring custom certificates.88Private key and certificate format. 88Creating a Certificate Signing Request (csr). 90Generating a Self-Signed Certificate. 92Requesting a Certificate from a Certificate Authority. 93Customizing HTTPS on Web Reports.94Customizing HTTPS on REST API. 94
Contents viChapter 9. Real Time AV Exclusions. 100AV Exclusions on Windows. 100AV Exclusions on Linux. 103Chapter 10. Downloading files in air-gapped environments. 106Overview.106Non-extraction usage overview. 106Extraction usage overview. 110Requirements.113Using the Airgap tool. 114Non-extraction usage. 114Extraction usage. 131Log files. 140Chapter 11. Getting client information by using BigFix Query. 141BigFix Query requirements. 141BigFix Query restrictions.141Who can use BigFix Query. 142How to run BigFix Query from WebUI. 144How BigFix manages BigFix Query requests. 144Chapter 12. Persistent connections.150Chapter 13. Relays in DMZ.153Chapter 14. Working with PeerNest.157Chapter 15. Archiving Client files on the BigFix Server.166Archive manager settings.167Creating a Custom Action. 167Archive Manager. 167
Contents viiArchive Manager internal variables.167Archive Manager Index File Format. 168Upload Manager. 169PostFile.169Resource Examples.170Chapter 16. BigFix Configuration Settings.173Overview.173Chapter 17. Migrating the BigFix Server (Windows/MS-SQL).174Considerations for migration.174Migrating the BigFix root server. 176Migrating databases. 178Verifying the migration. 180Chapter 18. Migrating the BigFix Server (Linux). 182Relocating databases on a remote server. 184Chapter 19. Server audit logs.188Chapter 20. List of advanced options. 191Chapter 21. Security Configuration Scenarios. 207On Windows Systems. 207On Linux Systems. 209Chapter 22. Client Authentication.212Authenticating relays. 213Handling the key exchange. 214Manual key exchange. 215Revoking Client Certificates. 215Re-registering a revoked client.216
Contents viiiMailboxing.217Chapter 23. Maintenance and Troubleshooting. 220Monitoring relays health. 221Relay and Server diagnostics. 221Virtualized environments and virtual machines.224BES Client Helper Service (Windows only). 226Enabling debug/verbose logging for the BES Root Server and BES Relay services.227Appendix A. Support. 232Notices.233
Chapter 1. IntroductionThis guide explains additional configuration steps that you can run in your environment afterinstallation.What is new in V9.5BigFix Platform Version 9.5 provides new features and enhancements.Patch 20:Library upgrades The libcURL library was upgraded to Version 7.83.1.Patch 19:Added support for BigFix AgentAdded support for BigFix Agent running on Windows 11 21H2.Added support for Active Directory 2016Added support for Active Directory 2016 with Forest functionallevel Windows Server 2016 and Enterprise Certification Authorityfor BigFix Server running on Windows only.Library upgrades The libcURL library was upgraded to Version 7.79.1. The OpenSSL library was upgraded to Version 1.0.2zd. The jQuery UI library was upgraded to Version 1.13.1. The zlib library was upgraded to Version 1.2.12.Patch 18:Security vulnerabilities and library upgrades
Configuration Guide 1 - Introduction 2 The SQLite library was upgraded to Version 3.34.1. The OpenLDAP library was upgraded to Version 2.4.56. The OpenSSL library was upgraded to Version 1.0.2y.Added support for BigFix Relay, Console and AgentAdded support for BigFix Relay, Console and Agent running onWindows 10 Version 21H1.Added support for BigFix Relay, Console and AgentAdded support for BigFix Relay, Console and Agent running onWindows 10 Version 21H2.Added property to the operating system inspectorA new property named display version was added to theoperating system inspector. This property returns the Windowsoperating system version and returns valid information only forWindows 10 20H2 and later Windows 10 versions.Patch 17:Library upgradesThe Curl library was upgraded to Version 7.73.0.Added support for BigFix Server and ConsoleAdded support for BigFix Server and Console running onWindows Server 2019.Added support for BigFix AgentAdded support for BigFix Agent running on:
Configuration Guide 1 - Introduction 3 MacOS 11 x86 64-bit. Windows 10 Enterprise for Virtual Desktops.Note: For Windows 10 Enterprise for VirtualDesktops, the relevance expression "product infostring of operating system" returns “Server RDSH”.Added support for new database levels DB2 Version 11.5.4 / 11.5.5 / 11.5.6 / 11.5.7 StardardEdition support.Note: Ensure that you upgrade BigFix to Version9.5 Patch 17 or higher, before upgrading DB211.5.0 to 11.5.4 / 11.5.5 / 11.5.6 / 11.5.7. Microsoft SQL Server 2019 support.New RPM package requiredNote: Starting from Version 9.5 Patch 17, the unixODBC RPMpackage must be installed for the Server component on Linuxsystems.Patch 16:Security vulnerabilities and library upgrades The Codejock library was upgraded to Version 19.2.0. The YUI library was upgraded to Version 2.9.0. The Curl library was upgraded to Version 7.69.1.Added support for BigFix Relay running on: Red Hat Enterprise Linux Version 8 x86 64-bit on Intel. CentOS 8 x86 64-bit.
Configuration Guide 1 - Introduction 4Enhanced security of TLS connections with support of Diffie-Hellman(DHE) and ephemeral Elliptic Curve Diffie-Hellman (ECDHE)BigFix Platform Version 9.5 Patch 16 HTTPS servers now allowephemeral Diffie-Hellman (DHE) and ephemeral elliptic curveDiffie-Hellman (ECDHE) for key exchange while keep leveragingon RSA for authentication. With this feature, new, randomasymmetric keys are chosen for each TLS connection that arenever written to persistent storage. When the TLS connectionterminates, keys are securely erased, ensuring in this way that,if an RSA private key is ever divulged, that key cannot be used todecrypt any secret exchanged during the TLS sessions.Patch 15:Security vulnerabilities and library upgrades The OpenSSL toolkit level was upgraded to Version 1.0.2u.Added support for BigFix AgentAdded support for BigFix Agent running on Oracle EnterpriseLinux 8 on Intel.Patch 14:Security vulnerabilities and library upgrades The libssh2 external library level was upgraded to Version1.9.0. The OpenLDAP external library level was upgraded toVersion 2.4.48.Added support for new database levelsIBM DB2 Standard Edition Version 11.5 GA.Added support for BigFix Relay
Configuration Guide 1 - Introduction 5Added support for BigFix Relay running on Windows 10 Version20H2.Added support for BigFix ConsoleAdded support for BigFix Console running on Windows 10Version 2004 and Windows 10 Version 20H2.Added support for BigFix AgentAdded support for BigFix Agent running on: SUSE Linux Enterprise 15 PPC 64-bit. Red Hat Enterprise Linux 8 x86 64-bit. Red Hat Enterprise Linux 8 PPC 64-bit LE on Power 8 and9. Red Hat Enterprise Linux 8 on s390x. Ubuntu 18.04 LTS PPC 64-bit LE on Power 8. MacOS 10.15. Windows 10 Version 1909. Windows 10 Version 2004. Windows 10 Version 20H2. CentOS 8.Note: On CentOS 8, the Client UI might fail tolaunch.Patch 13:Relays in DMZYou can configure parent relays outside a demilitarized zone(DMZ) to initiate connections to child relays that are within theDMZ network. This means that relay-to-relay communication isalways initiated from the parent relay. You can use this featureto avoid opening firewall ports from the DMZ to the internal
Configuration Guide 1 - Introduction 6secure network which in turns helps toughen the security of yourenvironment.For details, see Relays in DMZ (on page 153).Troubleshoot issues more efficiently by persisting the relay chain on theBigFix ClientThe Relay chain is identified for each client and it consists of aset of Relays involved in the registration between the client andthe server to which the client is registered. With this feature, youcan allow the client to trace the relay chain for each registrationand ensure that the relay information is available on the clientside. This helps you troubleshoot issues related to client-toserver communications more efficiently, and improve the datareported by the BES Client Diagnostics task.For details, see Viewing the relay chain on the client.Install BigFix agent with IPS format (.p5p package) on Solaris 11On Solaris 11, the BigFix agent installation package is nowavailable as IPS (Image Packaging System), which is the latestSolaris packaging technology. The old version of the installationpackage is also still available. You can therefore choose aninstallation option that best suits your requirements.For details, see Solaris 11 installation Instructions.Delete registry keys by using actionscriptYou can now delete not just the values of the registry keys seton the clients, but the keys themselves as a whole by usingactionscripts. This operation also has a 64-bit equivalent.This feature helps you maintain the Windows registry keys, forexample by removing the keys that are no longer used.For details, see regkeydelete and regkeydelete64.Removal of Adobe Flash Player dependency in Web Reports component
Configuration Guide 1 - Introduction 7As a preparatory step to deal with end of support (EOS) ofAdobe Flash Player in the year 2020, the Adobe Flash Playerdependency was removed from the Web Reports functionality.However, your experience of viewing the graphs remains thesame.Run queries in client contextBigFix extends the ability of the Agent to run queries whensubmitted through the Fixlet Debugger or REST API. This allowsyou to run any relevance for tasks such as troubleshooting orinvestigations directly from these interfaces.For details, see BigFix Query.Added support for BigFix Agent on Raspberry PiAdded support for running Agent on Raspbian 9 and 10Raspberry Pi 3 models B and B .For details, see Raspbian Installation Instructions.Added support for BigFix Agent SLES 15 on IntelAdded support for BigFix Agent running on SUSE LinuxEnterprise 15 x86 64 on Intel.Security vulnerabilities and library upgrades The OpenSSL toolkit level was upgraded to Version 1.0.2r. The libcURL file transfer library level was upgraded toVersion 7.64.0.Patch 12:Security vulnerabilities and library upgradesIn this version, security vulnerabilities were addressed and somelibraries were upgraded.
Configuration Guide 1 - Introduction 8 The OpenSSL toolkit level was upgraded to Version 1.0.2q. The jQuery library level was upgraded to Version 3.0.0. The jQuery UI library level was upgraded to Version 1.12.1. The jqPlot (jQuery plugin) level was upgraded to Version1.0.9.Patch 11:Reduce network traffic and relay infrastructure costs by exchangingcached files with peers (PeerNest)This version introduces peer-to-peer configuration which willhelp you reduce the relay infrastructural costs. In a peer-topeer setup, endpoints in a subnet coordinate their downloadactivities in order to download binaries only once from the relay,thus reducing the network traffic outside of the subnet. Withthis setup, you can facilitate a faster and direct exchange ofbinaries between endpoints and remove the need for every clientto download the same binary from a relay, allowing the removalof dedicated relays from branch offices.For details, see Working with PeerNest (on page 157).Improve real-time visibility by delivering notifications to clients acrossfirewalls through client-established, persistent connectionsThe BigFix Query function relies on a UDP based notificationwhere the relay notifies the clients of a new query. Firewalls orNAT may block this notification mechanism. Through the newpersistent connection feature, a persistent connection initiatedby the client is used by the relay to manage the UDP basednotification. This allows the delivery of any type of notification,thus offering a faster alternative to command polling. Apersistent connected client also acts as a UDP notificationforwarder (proxy) for the other clients in the same subnetwhich can reduce the number of connections and optimize
Configuration Guide 1 - Introduction 9relay performance. The relay can deliver notifications to clientsthrough client-established, persistent connections.For details, see Persistent connections (on page 150).Prevent BES server overload and network congestion by defining afallback relayYou can now define a fallback relay for your clients when theyfail to connect to any relay specified in their settings.For details, see Step 2 - Requesting a license certificate andcreating the masthead and Editing the Masthead on Linuxsystems.Simplify the installation and upgrade of the WebUI component includingit as part of the BigFix Platform installationThe installation of the BigFix Platform (both evaluation andproduction versions) on both Windows and Linux now includesthe option to install the WebUI component as well, offeringa convenient alternative to the fixlet-based installation. Theupgrade of the WebUI component will be executed as part of theplatform components update process, and as noted in 9.5.10,the WebUI can now scale to manage 120,000 endpoints fromeither a Linux or Windows BES Server installation.For details, see Installing the WebUI (Windows) and (Optional) Installing the WebUI Standalone (Linux).Enhance corporate security by specifying the TLS ciphers that can beused in network communications between the BigFix components andthe internetStarting in this version, master operators can control which TLSciphers should be used for encryption. A master operator can
Configuration Guide 1 - Introduction 10set a deployment-wide TLS cipher list in the masthead by usingBESAdmin.For details, see Working with TLS cipher lists.Enhance security and reduce load on the BES root server byautomatically shutting down the BigFix Console after a period ofinactivityStarting in this version, you can control the maximum amount oftime to keep an inactive session of BigFix console alive. After thetimeout, the BigFix console is closed.For details, see List of advanced options (on page 191).Enhance the security of your BigFix Server by optionally disablingaccess to the InternetStarting in this version, you can control whether your serveraccesses the Internet for updating the license and gathering thesites or not by using a configuration setting.For details, see Airgap Mode.Gather WebUI content more securely through HTTPS and in anoptimized manner WebUI: Gather BES sites with HTTPS by defaultYou can gather license updates and external sites by usingthe HTTPS protocol on a BigFix server or in an airgappedenvironment. For details, see Customizing HTTPS forGathering (on page 85). Optimize Gathering from Synch ServersThe Gathering process has been optimized with moreeffective handling of Gather errors.
Configuration Guide 1 - Introduction 11Establish an increased level of security when creating new users byassigning them minimal permissionsWhen you create users, they are assigned minimum permissions(read-only) by default, which offers an additional level of security.For details, see List of advanced options (on page 191)(look up defaultOperatorRolePermissions) and Adding LocalOperators (on page 29).Enhanced security and visibility with more detailed server audit logsThe server audit logs now include the following items: Messages for deletion of computers from the console orthrough API Messages for deletion of actions Audit entries are presented in a single line and containthe same number of field delimiters. Field delimiters arepresent even if no value exists for a specific field. Sincethe format of the audit fields is subject to change overtime, each line has a version number as the first entry.The current format includes texts from existing audit logmessages (which are in old format) and presents them inthe last field.The server generates audit logs for two new events: the deletionof an action and the removal of a computer.For details, see Server audit logs (on page 188).Reduce the costs of managing relay infrastructure through a newDashboard that summarizes relay health across the entire networkYou can now monitor the status of your relays across the entirenetwork by using the Relay Health dashboard. The Relay Health
Configuration Guide 1 - Introduction 12Dashboard shows you specific details about the relays in yourBigFix environment.For details, see Relay Health Dashboard.Configure the default behavior of Timeout Override on clientsStarting in this version, you can define the default behavior fortimeout and disposition on a specific client for all the programsor processes triggered by any wait or waithidden commands,unless it is specified differently in an override section of thatspecific wait or waithidden command definition.For details, see List of settings and detailed descriptions.Optimize and accelerate Platform REST API interactionsYou can now control and reduce the number of fields returnedby a REST request by using the ?fields parameter to limitthe fields returned for a given resource when using the APIresources /api/actions and /api/action/{action id}/status.For details, see Action and Computer.Accelerate fixlet creation and testing by using the FastQuery interface inFixlet DebuggerFixlet Debugger is extended to use FastQuery interface inaddition to Local Fixlet Debugger Evaluator and Local ClientEvaluator. You can choose a remote endpoint to evaluaterelevance.For details, see Fixlet Debugger.Save time when working in tight maintenance windows by enablinggroup actions to start before sub action downloads are available
Configuration Guide 1 - Introduction 13Group actions with pre-cached downloads now start withoutrequiring all sub-action downloads to be available on the client,provided the downloads for the first relevant sub-action areavailable. Additionally, the server and relay caches are primedby continuing with as many download requests as possible evenunder a 'disk limited' constraint.For details, see Enabling data pre-cache.Other Enhancements Improved documentation on configuration settings. Fordetails, see BigFix Configuration Settings (on page 173). Added changes to the client component for enabling a newversion of the self-service application (SSA). Added support for running Agent and Relay on WindowsServer 2019.Patch 10:CDT Key file option and custom installation pathWhen installing the BigFix clients from the Client Deploy Tool(CDT) Wizard, you can access the target computers through theSSH key authentication. You can also specify for the Windowstarget computers a custom installation path, if you do not wantto use the default installation path.For more information, see Deploying clients from the console.TLS-encrypted SMTP connection for Web ReportsWhen setting up an email address from Web Reports, you canupgrade the SMTP connection to TLS.For more information, see Setting Up Email.Windows authentication leveraged in command line utilities
Configuration Guide 1 - Introduction 14You can use your Windows credentials to authenticate to BigFixutilities such as the PropagateFiles.exe tool and the IEM CLI.For more information, see Creating special custom sites whosename begins with FileOnlyCustomSite.Windows performance
This guide explains additional configuration steps that you can run in your environment after installation. What is new in V9.5 BigFix Platform Version 9.5 provides new features and enhancements. Patch 20: Library upgrades The libcURL library was upgraded to Version 7.83.1. Patch 19: Added support for BigFix Agent
