Secure Communications

Creating Secure Geneos Servers

Geneos server components read the key pairs at start up. Their locations are provided using the following command line options;

-ssl-certificate <file>
-ssl-certificate-key <file>

The ssl-certificate command line option points to a file that can either contain just the TLS certificate, or both the TLS certificate and the server’s private key. If the private key is not provided in the certificate file it can be provided in a separate file using the ssl-certificate-key option. Both of these files are expected to have their contents stored using PEM (Privacy-enhanced Electronic Mail) format.

The key pair provides the Geneos servers with the ability to provide a TLS-encrypted connection to their clients. In order to enable this the secure service must be turned on. The way that the secure service is turned on differs for different Geneos components.

Geneos Clients

When a Geneos client connects to a Geneos server it may connect securely or insecurely. The connection type of the client must match the connection type of the server. Different clients configure this in different ways.

<?xml version="1.0" encoding="ISO-8859-1"?>
<netprobe
   compatibility="1"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:noNamespaceSchemaLocation="http://schema.itrsgroup.com/GA2011.2-110303/netprobe.xsd">
   <selfAnnounce>
      <enabled>true</enabled>
      <probeName>Probe</probeName>
      <managedEntity>
         <name>ME</name>
         <types>
            <type>HW</type>
         </types>
      </managedEntity>
      <gateways>
         <gateway>
            <hostname>localhost</hostname>
            <port>7038</port>
            <secure>true</secure>
         </gateway>
      </gateways>
   </selfAnnounce>
</netprobe>

gateways {
    connection name {
        host = "hostname"        port = 30000
        user = "username"        password = "password"        secure = true
    }
    another connection name {
        secure = true
        primary {
            host = "primary_host"            port = 30002
        }
        secondary {
            host = "secondary_host"            port = 30003
        }
    }
}

...
<gatewayConnections>
     <gatewayConnection name="Gateway 1">
         <enabled>true</enabled>
         <secure>true</secure>
         <primary>
             <host>gateway-host</host>
             <port>7039</port>
         </primary>
         <secondary>
             <host>gateway-host-2</host>
             <port>7040</port>
         </secondary>
         <description/>
         <user/>
         <password/>
     </gatewayConnection>
             ...
</gatewayConnections>
...

ERROR: SSLConnector:accept SSL Error:[1408f10b] SSL3_GET_RECORD:wrong version number
WARN: SSLConnector:accept Possible attempt to connect insecurely to a secure port

ERROR: CONNECTOR ERROR: Secure Connection from '...' received on insecure port. Dropping connection

ERROR: SSLConnector SSL Connection(=>127.0.0.1:19067) failed to complete handshake in 70s : Dropping connection

Connection details on Geneos

This section covers the list of all incoming connections from and outgoing connections to each component of Geneos. Also, this list identifies if the components require an SSL encryption or not, and other information relevant to Geneos connections.

Incoming connections

Component	Incoming connection from	SSL encryption	SSL verification of connecting components	Port	Service	Source IP	Destination IP	Purpose
Netprobe	Gateway			User-defined Default: 7036	Netprobe	Any Gateway node	Any Netprobe node	Netprobe-Gateway communication (normal probes). This supports two-way SSL verification.
Netprobe	ORB debug page		N/A	Same as listen port for Netprobe Default: 7036	ORB debug	Web browser	Any Netprobe node	ORB debug
Plugins	API Plug-in (XML-RPC)		N/A	User-defined Default: 7036	Netprobe XML-RPC API	Any external client	Any Netprobe node	Manipulates dataviews using XML-RPC API
Plugins	REST API		N/A	User-defined Default: HTTP-only server at port 7136	Netprobe REST API	Any external client	Any Netprobe node	Manipulate dataviews and streams using Netprobe REST API
Plugins	Message Tracker plugin real-time Checkpoint		N/A	User-defined Default: 7036	Netprobe XML-RPC API	Any external client	Any Netprobe node	External real-time checkpoint for Message Tracker
Plugins	Message Tracker plugin XML-RPC Source		N/A	User-defined Default: 7036	Netprobe XML-RPC API	Any external client	Any Netprobe node	External data source for Message Tracker
Plugins	Trapmon	N/A	N/A	On Unix: User-defined Default: 162 On Windows: None	SNMP	Any external client	Any Netprobe node	Monitors incoming SNMP traps
File Agent	Fix Analyser 2 Netprobe			User-defined Default: 7030	File Agent	Any FIX Analyser 2Netprobe	Any File Agent node	Sends contents of monitored files
File Agent	ORB debug page	N/A	N/A	Same as listen port for Gateway Default: 7030	ORB debug	Web browser	Any File Agent node	ORB debug
FIX Analyser 2 Netprobe	Gateway			User-defined Default: 7030	Fix Analyser 2 Netprobe	Any Gateway node	Any FIX Analyser 2 Netprobe node	Fix Analyser 2 Netprobe-Gateway communication
FIX Analyser 2 Netprobe	ORB debug page		N/A	Same as listen port for Gateway Default: 7030	ORB debug	Web browser	Any FIX Analyser 2 Netprobe node	ORB debug
FIX Analyser 2 Netprobe	Order reports browser interface	N/A	N/A	Same as listen port for Gateway Default: 7030	HTTP	Web browser or Active Console	Any FIX Analyser 2 Netprobe node	Provides HTML-based report regarding FIX orders
Gateway	Self-Announcing Netprobe			User-defined Default: 7039	Netprobe	Any Self-Announcing Netprobe	Any Gateway node	Netprobe-Gateway communication (SAN probes). This supports two-way SSL verification
Gateway	Floating Netprobe			User-defined Default: 7039	Netprobe	Any Floating Probe	Any Gateway node	Netprobe-Gateway communication (Floating probes). This supports two-way SSL verification
Gateway	Active Console		N/A	User-defined Default: 7039	Gateway Client (Active Console and GSE)	Any Active Console or GSE	Any Gateway node	Active Console-Gateway communication
Gateway	Gateway Sharing			User-defined Default: 7039	Gateway Sharing	Any Gateway node	Any Gateway node	Gateway sharing. This supports two-way SSL verification
Gateway	Web Dashboard		N/A	User-defined Default: 7039	Gateway Client (Web Dashboard)	Any Web Dashboard	Any Gateway node	Web Dashboard-Gateway communications
Gateway	Webslinger		N/A	User-defined Default: 7039	Gateway Client (Webslinger)	Any Webslinger	Any Gateway node	Webslinger-Gateway communications
Gateway	ORB debug page		N/A	Same as listen port for Gateway Default: 7039	ORB debug	Web browser	Any Gateway node	ORB debug
Gateway	Gateway as Web server		N/A	Same as listen port for Gateway Default: 7039	HTTP serving of static pages	Web browser	Any Gateway node	Serving of helper pages (Knowledge base)
Gateway	Gateway REST Command		N/A	Same as listen port for Gateway Default: 7039	REST API for commands and other REST services	Any external client	Any Gateway node	Running commands through REST
Active Console	ORB debug page		N/A	User-defined Default: 7040	ORB Debug	Web browser	Active Console host	ORB debug
Web Dashboard	Browser interface		N/A	User-defined Default: 8080	Web Dashboard	Web browser	Web Dashboard host	Web Dashboard application
Web Dashboard	JMX metrics		N/A	User-defined JMX port (run script specifies 50505)	JMX client	JMX client node	Web Dashboard host	JMX monitoring
Webslinger	Browser interface		N/A	User-defined Default: 8080	Webslinger	Web browser	Webslinger host	Webslinger application
Licence Daemon	Gateway		N/A	User-defined Default: 7041	Licence Daemon	Gateway node	Licence Daemon node	Get licences
Licence Daemon	Browser interface		N/A	User-defined Default: 7041	Licence Daemon reporting	Web browser	Licence Daemon node	Get licence details
SSO Agent	Active Console		N/A	User-defined Default: 8080	SSO Agent	Active Console node	SSO Agent node	SSO Agent application
SSO Agent	Web Dashboard		N/A	User-defined Default: 8080	SSO Agent	Web Dashboard node	SSO Agent node	SSO Agent application
SSO Agent	Webslinger		N/A	User-defined Default: 8080	SSO Agent	Webslinger node	SSO Agent node	SSO Agent application
SSO Agent	Gateway		N/A	User-defined Default: 8080	SSO Agent	Gateway node	SSO Agent node	SSO Agent application
Collection Agent	Health check	N/A	N/A	User-defined Default: 9136	Collection Agent health check	Netprobe node	Collection Agent node	Collection Agent health check
Collection Agent plugins	Health check	N/A	N/A	User-defined Default: 8125	StatsD server	StatsD client node	Collection Agent node	Publishing for StatsD clients

Outgoing connections

Component	Outgoing connection to	SSL encryption	SSL verification of connecting components	Port	Service	Source IP	Destination IP	Purpose
Netprobe	Gateway			User-defined	Gateway	Any Netprobe node	Any Gateway node	Netprobe-Gateway communication (Self-Announcing Netprobes and floating probes). This supports two-way SSL verification.
Netprobe	SAN/Floating config from URL			User-defined	HTTP/HTTPS	Any Netprobe node	Any Web server	Gets the Netprobe setup file from a Web server
Plugins	Bloomberg-bpipe	N/A	N/A	User-defined Default: 8194	B-PIPE	Any Netprobe node	Bloomberg B-PIPE server	Bloomberg monitoring
Plugins	Control-M			User-defined	HTTPS	Any Netprobe node	Any Control-M server	Gets information regarding jobs in a Control-M sever (only the built-in plug-in for REST API version)
Plugins	E4JMS (Tibco EMS)		N/A	User-defined	EMS server port	Any Netprobe node	Any Tibco EMS server	Monitors Tibco EMS server
Plugins	IBM-i plugins	N/A	N/A	Refer to JT400 Ports	Refer to JT400 Ports	Any Netprobe node	IBM-i node	Monitors IBM-i
Plugins	JMX Server	N/A	N/A	User-defined	JMX	Any external client	Any server running an JMX-enabled application
Plugins	JMX ThreadInfo	N/A	N/A	User-defined	JMX	Any external client	Any server running an JMX-enabled application
Plugins	Mibmon	N/A	N/A	User-defined Default: 161	SNMP	Any Netprobe node	Any SNMP server	Gets the MIBS information from a SNMP server
Plugins	MQ (IBM MQ)	N/A	N/A	User-defined	MQ	Any Netprobe node	MQ server	Gets information from MQ server
Plugins	Oracle	N/A	N/A	User-defined	Database	Any Netprobe node	Any database server	Performs queries on a database
Plugins	REST Extractor		N/A	User-defined	HTTP/HTTPS	Any Netprobe node	Any web server	Performs queries on a database
Plugins	SQL Toolkit	N/A	N/A	User-defined Default for MySQL, SQL Server, Postgre SQL: 3306	Database	Any Netprobe node	Any web server	Performs queries on a database
Plugins	Sybase	N/A	N/A	User-defined	Database	Any Netprobe node	Any database server	Performs queries on a database
Plugins	Web-mon	N/A	N/A	User-defined Default on HTTP: 80 Default on HTTPS: 443	HTTP/HTTPS	Any Netprobe node	Any web server	Performs queries on a database
Plugins	Publisher		N/A	User-defined	Elasticsearch	Any Netprobe node	Elasticsearch server	Publishes data to Elasticsearch
FIX Analyser 2 Netprobe	Database	N/A	N/A	User-defined	MySQL	Any Fix Analyser 2 Netprobe	Any MySQL server	Augments HTML-based order reports to display drill-down message level data
FIX Analyser 2Netprobe	File Agent	N/A	N/A	User-defined Default: 7030	File Agent	Any FIX Analyser 2Netprobe	Any File Agent node	Sends contents of monitored files
Gateway	Netprobe			User-defined	Netprobe	Any Gateway	Any Netprobe	Netprobe-Gateway communication
Gateway	Licence Daemon			User-defined	License Server	Any Gateway	Any Licence Daemon	Requests licenses for Gateway and its probes and samplers
Gateway	Database Logging	N/A	N/A	User-defined	Database	Any Gateway	Any database server	Inserts data on the database
Gateway	Express Reports (DB)	N/A	N/A	User-defined	Database	Any Gateway	Any database server	Performs queries on the database
Gateway	Valo Stream Data Plug-in
Gateway	Kafka (Publishing)		N/A	User-defined	Kafka	Any Gateway	Any Kafka server	Pushes Geneos metrics into Kafka queues
Gateway	Remote Include files		N/A	User-defined	HTTP/HTTPS	Any Gateway	Any web server	Requests remote include files
Gateway	Gateway Sharing			User-defined	Gateway	Any Gateway	Any Gateway node	Shares Gateway data
Gateway	Gateway Hub	N/A	N/A	User-defined	Gateway Hub (Publishing) Gateway Hub REST (HTTP/HTTPS)	Any Gateway	Any Gateway node	Interacts with Gateway Hub
Gateway Hub	Kafka (Publishing)		N/A	User-defined	Kafka	Any Gateway Hub node	Any Kafka server	External Kafka Publishing
Active Console	Gateway		N/A	User-defined	Gateway	Active Console node	Any Gateway Hub node	Connection to secure Gateways
Active Console	Database		N/A	User-defined	Database	Active Console node	Any Gateway Hub node
Active Console	Gateway Hub		N/A	User-defined	Gateway Hub Rest (HTTP/HTTPS)	Active Console node	Any Gateway Hub node
Web Dashboard	Gateway			User-defined	Gateway	Web Dashboard node	Any Gateway Hub node	Supports two-way SSL authentication
Webslinger	Gateway			User-defined	Gateway	Webslinger node	Any Gateway Hub node
SSO Agent	AD server		N/A	User-defined	AD service	SSO Agent node	Active Directory server	Gets user details and permissions from Active Directory

Web services

Certain Geneos Components provide web services. These web services can be accessed via HTTP or HTTPS depending on whether the service is published on a secure or an insecure port. Any web service that is published via the same port that is used for EMF connections will inherit the security settings from the EMF settings. So, for example if a netprobe is started with the -secure flag, then its web services will also be secure. The ORB debug pages will only be viewable via HTTPS. XML-API connections to the probe will need to use HTTPS rather than HTTP.

Hot Standby Gateways

Hot standby gateways connect to one another using Geneos’ EMF protocol. If one gateway is configured to use TLS security then both must be. If a secondary gateway is configured to listen on a secure port, then when it is connecting to the primary gateway it will attempt to connect securely. If the primary gateway is not also configured to listen on a secure port then the gateway will fail to connect.

Example 1

Example 1 has a Netprobe and Gateway running on the same Linux machine, and a Active Console connected to them.

If you are running a different platform, replace the names of the Gateway and Netprobe binaries in the commands below with its corresponding platform binary.

First, create a pair of certificates using OpenSSL. One for the Netprobe (np.pem) and one for the Gateway (gw.pem).

Generate your own Self signed Certificate Authority:

> openssl genrsa -out rootCA.key 2048
> openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem -subj "/CN=certificateAuthority"

Generate a certificate for your Netprobe:

> openssl genrsa -out np.key 2048
> openssl req -new -key np.key -out np.csr -subj "/CN=<Netprobe server host name>"
> openssl x509 -req -in np.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out np.crt -days 30
> cat np.crt np.key > np.pem

For the common name ("/CN= "), specify the Netprobe server host name, without the angle brackets.

Generate a certificate for your Gateway:

> openssl genrsa -out gw.key 2048
> openssl req -new -key gw.key -out gw.csr -subj "/CN=<Gateway server host name>"
> openssl x509 -req -in gw.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out gw.crt -days 30
> cat gw.crt gw.key > gw.pem

For the common name ("/CN= "), specify the Gateway server host name, without the angle brackets.

Next, copy the setup (eg1.setup.xml) into the Gateway directory, the newly generated certificate (gw.pem), and the certificate of the CA (rootCA.pem). Then, start the Gateway as follows (replace <LICD-HOST> by the location of your Licence Daemon).

> gateway2.linux -setup eg1.setup.xml -licd-host <LICD-HOST> -ssl-certificate ./gw.pem -ssl-certificate-chain ./rootCA.pem

This will start a directory running on the default port. You can connect to this gateway using the Active Console. Note that you will have to tick the “Secure Connection” option in the gateway connections dialog as the gateway has been configured only to listen on a secure port. See below;

You should find that you are connected to the gateway (which will be red). Looking at the Gateway Managed Entity you will see in the client view that the Active Console has connected securely to the gateway.

Looking at the GW view you will see that there are two gateway ports are listed. The insecurePort is set to 7039, indicating that the gateway is listening insecurely on that default insecure port, while the securePort value is 7038 indicating that the gateway is listening securely on the default secure gateway port.

Now you can start the netprobe. Copy the netprobe certificate (np.pem) and the certificate of the CA (rootCA.pem) into the netprobe directory start the netprobe by typing;

> netprobe.linux -ssl-certificate ./np.pem -secure -ssl-certificate-chain ./rootCA.pem

The gateway will now connect to the probe and go green. If you now look Probes view on the Gateway Managed Entity you will see that the gateway has connected to the probe and the connection is secure.

The netprobe is now connected and all the netprobe functionality is available to the user via the gateway and the Active Console.

Example 2

Example 2 has a netprobe and gateway running on the same computer, and a Active Console connected to them. The difference is that the netprobe is configured to be a self announcing netprobe and so the netprobe will not require a certificate in order to perform secure communications. Agian all 3 componenets will need to be version 3.1.X or better. The assumption is that you are using the linux version of the gateway and netprobe. If you use a different version, please replace the names of the gateway and netprobe binaries in the commands below with the ones appropriate for your system.

Please follow the instructions from Example 1 to create the key pairs (you will only be using the gw.pem key pair).

Next copy the setup (eg2.setup.xml) into the gateway directory and the newly generated certificate (gw.pem). Now start the gateway as follows (please replace <LICD-HOST> by the location of your licence daemon);

> gateway2.linux -setup eg2.setup.xml -licd-host <LICD-HOST> -ssl-certificate ./gw.pem

This will start a directory running on the default port. You can connect to this gateway using the Active Console. Note that you will have to tick the “Secure Connection” option in the gateway connections dialog as the gateway has been configured only to listen on a secure port. See below;

You should find that you are connected to the gateway. Looking at the Gateway Managed Entity you will see in the client view that the Active Console has connected securely to the gateway.

Looking at the GW view you will see that there are two gateway ports are listed, just as in example 1. The insecurePort is set to 7039, indicating that the gateway is listening insecurely on that default insecure port, while the securePort value is 7038 indicating that the gateway is listening securely on the default secure gateway port.

Now you can start the self-announcing netprobe. Copy the netprobe setup from (eg2_np.setup.xml) into the netprobe directory and start the netprobe by typing;

> netprobe.linux -setup eg2_np.setup.xml

Looking at eg2.np.xml you will see that the gateway section specifies to connect securely to the gateway on port 7038.

<?xml version="1.0" encoding="ISO-8859-1"?>
<netprobe
   compatibility="1"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:noNamespaceSchemaLocation="http://schema.itrsgroup.com/GA2011.2-110303/netprobe.xsd">
   <selfAnnounce>
      <enabled>true</enabled>
      <retryInterval>20</retryInterval>
      <probeName>Probe</probeName>
      <managedEntity>
         <name>ME</name>
         <types>
            <type>HW</type>
         </types>
      </managedEntity>
      <gateways>
         <gateway>
            <hostname>localhost</hostname>
            <port>7038</port>
            <secure>true</secure>
         </gateway>
      </gateways>
   </selfAnnounce>
</netprobe>

The Netprobe will connect to the gateway and a new row will appear in the Probes view indicating that a new Self-Announcing probe has connected and that it is connected securely.