Security on CloudBolt Documentation

Security information and event management (SIEM)

Mon, 01 Jan 0001 00:00:00 +0000

SIEM providers collect application logs so you can aggregate, visualize, and analyze events in real time. CMP can help configure the forwarding agents offered by SIEM providers, which ship logs back to the parent indexing server. Two integrations are supported:

Splunk: a CMP-managed SIEM provider. Install and configure the Splunk Universal Forwarder from the CMP UI.
Elastic: a manual integration. Install and configure Filebeat on your CMP server to ship logs to Elasticsearch.

Splunk

The Splunk SIEM provider manages the relationship between a Splunk Universal Forwarder and the remote Splunk server. From the CMP UI, you can install the Splunk Universal Forwarder and configure its essential settings.

Certificate-based authentication

Mon, 01 Jan 0001 00:00:00 +0000

Configure PKI in the Cloud Management Platform (CMP) web interface

Turn on the Database Browser: add ENABLE_DB_BROWSER = True to /var/opt/cloudbolt/proserv/customer_settings.py, then run systemctl restart httpd.
Log in to CMP as an admin user.
Go to Admin > Database Browser. On that page, find the Utilities section and select Add in the PKIUtilities row.
Enter regex expressions that evaluate to the username, first, last, and email fields based on the Subject (or DN) field in the user certificates your company uses.
Optionally, determine which groups the new users should have requestor, approver, and other roles in.
Save the form.

Configure PKI in CMP’s server settings

Edit /var/opt/cloudbolt/proserv/customer_settings.py and append the following section:

SSL root certificates

Mon, 01 Jan 0001 00:00:00 +0000

(opens full-size image in a new tab)

For Cloud Management Platform (CMP) to verify TLS/SSL connections whose certificate is issued by a private certificate authority, add that private CA to CMP’s built-in list of trusted SSL root certificates.

CMP ships with the certifi (Mozilla-curated) bundle of trusted certificate authorities, so connections to public cloud services should not require adding SSL root certificates.

SSL certificates

Mon, 01 Jan 0001 00:00:00 +0000

To log in to the CMP appliance for the first time, you must accept the self-signed certificate. To let your browser verify the certificate afterward, configure CMP with a certificate trusted by your clients.

CMP requires a certificate issued by either a public or a private CA. Ensure all your client and user devices trust this CA.

Additional resource: How to force HSTS in CloudBolt Server

Install a signed certificate

If you already have a signed certificate and key in PEM (Base64-encoded) format, update the certificate on the CMP appliance via SSH/SCP. Otherwise, first generate a CSR.

SSH keys

Mon, 01 Jan 0001 00:00:00 +0000

CMP needs the private key material for the key pair a server accepts before it can open an SSH session to that server, whether to provision it, run a remote script, or connect to it later.

Keys from a resource handler

Several clouds create and hold key pairs, and a server built there accepts the pair it was created with. These resource handlers have an SSH Keys tab listing the key pairs CMP found in the provider:

API personal access token

Mon, 01 Jan 0001 00:00:00 +0000

This is useful when you implement SSO and your users cannot authenticate with a username and password.

Create a personal API access token

On your user profile page, select Create API Token.

(opens full-size image in a new tab)
In the dialog, select the number of days for token expiration and select Create.

(opens full-size image in a new tab)
The API access token is created. Use the icons to the right of the masked token to copy, regenerate, or delete it.

(opens full-size image in a new tab)

Use password vaults

Mon, 01 Jan 0001 00:00:00 +0000

The following solutions are supported:

🔐 AWS Secrets Manager
🔐 Azure Key Vault
🔐 CyberArk
🔐 HashiCorp Vault
🔐 Keeper

This guide details the HashiCorp Vault integration. AWS Secrets Manager, Azure Key Vault, CyberArk, and Keeper follow a similar workflow: enable the feature flag, add the provider under Admin > Password Vaults, then reference stored secrets from a supported password field.

When the vault feature is enabled, password and secret fields offer Locally Stored or Vault Managed. These fields appear on resource handlers, connection info, IPAM, ITSM, data protection, network virtualization, LDAP, and source code repositories.

Cache vault secrets

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) can store credentials and other sensitive values in an external secrets manager (a vault provider) instead of in the CMP database. When CMP needs one of these values, it resolves it by calling the provider’s API.

By default, every access to a vault-backed value calls the provider. Environments that read these values frequently can approach or exceed the provider’s rate or quota limits.

Secret caching lets an administrator cache a resolved secret for a configurable time-to-live (TTL). While a cached value is within its TTL, CMP serves it directly from the cache without calling the provider, reducing API traffic and speeding up resolution.

MFA management

Mon, 01 Jan 0001 00:00:00 +0000

MFA adds an additional layer of authentication using time-based one-time passwords (TOTP), typically via an authenticator app.

Prerequisites

SSH access to the Cloud Management Platform (CMP) appliance with sudo/root privileges
A TOTP-based authenticator app (for example, Microsoft Authenticator or Google Authenticator)

Enable multi-factor authentication (MFA)

Modify customer_settings.py
- SSH into the CMP appliance.
- Open the settings file /var/opt/cloudbolt/proserv/customer_settings.py.
- Add the following lines to enable MFA:
```
from settings import FEATURE_REGISTRY

FEATURE_REGISTRY["authentication::mfa"] = True
```
Reset the feature list and restart the HTTP service
- Run the following command to apply changes:
```
/opt/cloudbolt/manage.py features --reset && systemctl restart httpd
```
Verify that MFA is active
- Check the features list:
```
/opt/cloudbolt/manage.py features --list
```