User Manual IDM V1.4.2 - Innominate Security Technologies AG

2.8 Pre-configuration of the mGuards
Enable SSH access
Please follow the steps described in the device manual for starting up and
configuring the device (IP addresses of the interfaces etc.).
Installation
The IDM installs the configuration files on the mGuards using SSH. Therefore
SSH access has to be permitted on the mGuards if IDM is using the external
(untrusted) interface to upload the configuration.
Select Management » System settings » Shell access in the menu of the Web
user interface and enable SSH remote access. For more detailed information on
SSH remote access please consult the mGuard User’s Manual.
If you enable remote SSH access, make sure that you change the default
admin and root passwords to secure passwords.
IDM is using the admin password to log into the Innominate mGuard. If
the password was changed locally on the device please change the
password setting in IDM accordingly using the Set Current Device
Passwords option in the context menu of the device overview table.
Otherwise IDM is not able to log into the device.
The current root password is part of the configuration file. If the
password was changed locally on the device please change the password
setting in IDM accordingly. Otherwise the mGuard will reject the
configuration.
2.9 Installation of an HTTPS configuration pull server
To transmit information on the configuration status of an mGuard, the HTTPS
pull server has to send SYSLOG messages to the IDM server (pull feedback).
Please make sure that neither the communication between the HTTPS server and
the IDM server nor the communication between the HTTPS pull server and the
mGuards is blocked by a firewall or a NAT device.
2.10 Securing the communication between IDM components
Since critical information is exchanged between the IDM components it is highly
recommended to secure the communication paths. This chapter describes the
required steps to manually create the keys and certificates required for SSL.
If you prefer to use the demoCA scripts, instead of manually creating
and installing the required components, you can skip this chapter and
read Chapter 2.7.3 instead.
If you are not familiar with OpenSSL it is highly recommended to read
Chapter 7 first, which introduces some of the basic concepts and the usage of the
OpenSSL command line tool.
Figure 7 shows an overview over the IDM components and their communication
paths.
Please note that the truststore and the keystore of the CA shown in
Figure 7 are used for SSL communication only. The certificates and
keys used to issue certificates are stored in a different keystore.
34 of 122