Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Can Proxy Settings Be Changed After Sensor Install?

Carbon Black Cloud: Can Proxy Settings Be Changed After Sensor Install?

Environment

  • Carbon Black Cloud Sensor: 3.2.x.x and Higher
  • Microsoft Windows: All Supported Versions

Question

After defining proxy settings during command line installation, can those proxy settings be changed?

Answer

Yes. The proxy credentials can changed by using the sensor's "cfg.ini" file:
  1. Place sensor into bypass mode by running commands:
    cd c:\Program Files\Confer\
    repcli bypass 1
  2. Shutdown the sensor service:
    repcli stopCbServices
  3. Open the cfg.ini file with a text editor
  4. If present, remove:
    ProxyServer=
    ProxyServerCredentials=
  5. Add:
    ProxyServer=[PROXY_IP_OR_DOMAIN]:[PROXY_PORT]
    ProxyServerCredentials=[USERNAME]:[PASSWORD] (Optional- if proxy requires authenitcation)
    PreferStaticProxyOverLastUsed=true
    
Example:
ProxyServer=TestProxy.net:8080
ProxyServerCredentials=TestUsername:TestPassword
PreferStaticProxyOverLastUsed=true

Replace PROXY_IP_OR_DOMAIN, PROXY_PORT, USERNAME and PASSWORD with the corresponding values.

  1. Start the sensor service, this will force the sensor to update its proxy internal configuration, with the caveat that should the sensor be unable to connect to the proxy server/appliance, it may attempt to bypass it
    sc start CbDefense
  2. Reload/refresh the sensor configuration with the recently-made changes:
repcli updateconfig
  1. Remove device from bypass:
repcli bypass 0
  1. To force an immediate check-in (optional):
repcli cloud hello

 

Additional Notes

  • PreferStaticProxyOverLastUsed (available in 3.6 October Maintenance build) is optional if the intent is making a successful connection to the cloud.  However, if the goal is for the sensor to prioritize the new proxy connection provided  over other previously used, then PreferStaticProxyOverLastUsed should be used.
  • Important: repcli functionality needs to be enabled (see KB), in order to follow the steps above
  • If the current cloud communications are all still successful, the proxy won't re-evaluate it's current proxy settings. Restarting the CbDefense service might be needed for immediate re-evaluation.

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎12-11-2018
Views:
5380
Contributors