System architecture on CloudBolt Documentation

Appliance security

Mon, 01 Jan 0001 00:00:00 +0000

CMP is a highly sensitive piece of infrastructure because it often houses credentials with elevated privileges across multiple cloud environments. The appliance can be configured to meet different hardening guidelines depending on your regulatory environment. If you have specific hardening needs, contact Support.

Encryption

CMP encrypts the secrets file with AES in CBC mode. The key is derived with Argon2.

TLS and end-to-end transport encryption

Avoid unencrypted protocols during deployment when establishing connections to external providers, for example, resource handlers and configuration managers.

Hardware guidelines

Mon, 01 Jan 0001 00:00:00 +0000

Processing requirements depend on active workloads. Memory requirements depend on the total size of transactions and the objects being managed. The application itself has minimal storage requirements, but the underlying storage backend should have a relatively high-performance disk subsystem.

Deployment shapes

The two shapes below correspond to the two designs described in System architecture.

Single node is appropriate for most initial production deployments and for development and testing environments. It is one appliance running all CMP roles.
Distributed (HA) is for production environments with consistent, high workloads. This could be a large number of transactions, blueprints, managed VMs and objects, or a combination of the three. It splits the roles across three web servers and three job engines.

The CMP installer supports only the x86_64 architecture.

Network connectivity

Mon, 01 Jan 0001 00:00:00 +0000

The preconfigured application uses the following ports and services on a single appliance. Ensure that connectivity requirements are in place for internal network communication with the CMP appliance.

The appliance makes outbound network connections as required by your configured resource handlers and any other integrations. These are specific to each resource handler and are not detailed in the tables below.

Ports

Inbound

TCP port	Protocol	Usage
22	SSH	Appliance management. Not required for end users
80	HTTP	HTTP to HTTPS redirect, optional HTTP access
443	HTTPS	Web UI and APIs. Also carries the RDP/SSH terminal and console sessions, which are proxied through the web server as WebSocket connections
5900-6900	VNC	Port range the appliance uses to give browsers access to VM consoles. Required only for consoles that are not proxied over HTTPS. Configurable through the `LOW_CONSOLE_PORT` and `HIGH_CONSOLE_PORT` settings

The Guacamole services that support the RDP/SSH terminal, guacd and guacg, listen on the loopback interface only and sit behind the web server. They do not need firewall rules. If you relocate guacd to a secondary server, allow traffic between the nodes on the port you configure for it.

Use SSL with an external PostgreSQL database

Mon, 01 Jan 0001 00:00:00 +0000

This procedure applies to a distributed deployment in which the database runs outside the appliance. Every web server and job engine node needs outbound access to the database on TCP 5432. See Network connectivity.

The paths and commands below use PostgreSQL 14. If your database server runs another version, such as PostgreSQL 18, replace 14 with your version number.

PostgreSQL database configuration

Perform the following on the PostgreSQL server.

Add the following to the PostgreSQL data directory: /var/lib/pgsql/14/data
- Server SSL certificate: server.crt
- Private key: server.key

Update the SSL configuration to enable SSL:

Edit /var/lib/pgsql/14/data/postgresql.conf:
1. Uncomment ssl and set the value to on
If the filename for the server SSL certificate is not server.crt, or the private key is not server.key, do the following:
1. Uncomment ssl_cert_file and set the value to the server SSL certificate filename
2. Uncomment ssl_key_file and set the value to the private key filename

Example /var/lib/pgsql/14/data/postgresql.conf

# - SSL -

ssl = on
#ssl_ca_file = ''
#ssl_cert_file = 'server.crt'
#ssl_crl_file = ''
#ssl_crl_dir = ''
#ssl_key_file = 'server.key'
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
#ssl_prefer_server_ciphers = on
#ssl_ecdh_curve = 'prime256v1'
#ssl_min_protocol_version = 'TLSv1.2'
#ssl_max_protocol_version = ''
#ssl_dh_params_file = ''
#ssl_passphrase_command = ''
#ssl_passphrase_command_supports_reload = off

Update the allowed hosts to use SSL by adding hostssl entries for your IP addresses or IP ranges:

Edit /var/lib/pgsql/14/data/pg_hba.conf:

Example /var/lib/pgsql/14/data/pg_hba.conf

# TYPE  DATABASE        USER            ADDRESS                 METHOD

# "local" is for Unix domain socket connections only
local   all             all                                     peer
# IPv4 local connections:
host    all             all             127.0.0.1/32            scram-sha-256
# IPv6 local connections:
host    all             all             ::1/128                 scram-sha-256
# Allow replication connections from localhost, by a user with the
# replication privilege.
local   replication     all                                     peer
host    replication     all             127.0.0.1/32            scram-sha-256
host    replication     all             ::1/128                 scram-sha-256
hostssl all             all             192.168.56.0/24         scram-sha-256

Restart the database
```
systemctl restart postgresql-14
```

Verify SSL is configured properly by connecting to the database using the psql command below:

#Replace value for password in the psql command below

psql "dbname=cloudbolt host=db.cloudbolt.vm user=cb_dba password=yourdbpassword sslmode=require"

Example expected return after running the psql command above

# Example of successful psql command return
psql (14.2)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.

cloudbolt=>