Environment
- EDR Console: All Versions
- EDR Server: All Versions
Objective
To customize the port that the EDR web UI uses.
Resolution
For customers who desire to use a custom WebUI cert, follow the directions here:
EDR: How to Implement Custom Web UI CertificatesImportant: These steps should be performed on Primary and Minion nodes. Without this, users will be able to access the UI via port 443 if the Minion IP is entered. It is recommended that minions not be used to access the web console and use the firewall to deny outside access on the port for the minions. They will still need to communicate on the custom port within each other.
- Rename the nginx cb.conf file with mv to back it up:
mv /etc/cb/nginx/conf.d/cb.conf /etc/cb/nginx/conf.d/cb.conf.default
- Copy and rename multi-home template configuration file:
cp /etc/cb/nginx/conf.d/cb.multihome.conf.example /etc/cb/nginx/conf.d/cb.multihome.conf
- Backup the nginx http.conf file:
cp /etc/cb/nginx/conf.d/http.conf /etc/cb/nginx/conf.d/http.conf.default
- Edit /etc/cb/nginx/conf.d/cb.multihome.conf.
- Modify the line in blue under the WebUI section to the desired port (8443 is the common choice). Note: There are two port areas, the first one is for Sensors. Make sure to edit the end one per the example here.
- On 7.5.0+ Only, comment out the cb.server.error line in red
server
{
# This server configuration is used for communications between the sensors
# and the server.
# IMPORTANT: If this configuration file is used, NginxSensor#### parameters in
# /etc/cb/cb.conf MUST be updated to match this file.
# Port 80 is defined in the http.conf. By default it redirects all trafic
# to the https://$host$request_uri; If this behaviour needs to change update http.conf
listen [::]:443 ssl ipv6only=off;
include /etc/cb/nginx/conf.d/includes/cb.server.body;
include /etc/cb/nginx/conf.d/includes/cb.server.sensor;
# Include content of custom server configuration file
include /etc/cb/nginx/conf.d/includes/cb.server.custom;
}
server
{
# This server configuration is used for VMware Carbon Black EDR Server's Web UI
# IMPORTANT: If this configuration file is used, NginxWebApi#### parameters in
# /etc/cb/cb.conf MUST be updated to match this file.
# Port 80 is defined in the http.conf. By default it redirects all trafic
# to the https://$host$request_uri; If this behaviour needs to change update http.conf
listen [::]:8443 ssl ipv6only=off;
include /var/cb/nginx/props/nginx.runtime.ssl_certificate.prop;
include /var/cb/nginx/props/nginx.runtime.ssl_certificate_key.prop;
include /etc/cb/nginx/conf.d/includes/cb.server.body;
include /etc/cb/nginx/conf.d/includes/cb.server.api;
#include /etc/cb/nginx/conf.d/includes/cb.server.error;
# Include content of custom server configuration file
include /etc/cb/nginx/conf.d/includes/cb.server.custom;
}
- Edit /etc/cb/cb.conf:
NginxWebApiHttpPort=443
Change to...
NginxWebApiHttpPort=8443
And if minion port was also changed (recommended, see additional notes)
MinionApiPort=443
change to...
MinionApiPort=8443
- Port 80 redirection is optional
- Update Nginx to forward the custom port in the header for CSRF:
- Open /etc/cb/nginx/conf.d/includes/headers.includes
- Find the following line:
proxy_set_header Host $host;
proxy_set_header Host $host:$server_port;
- Update the firewall to include 8443
- If using Iptables on CentOS 6
iptables -I INPUT 5 -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT
service iptables save
service iptables reload
- If using firewalld on CentOS 7
firewall-cmd --permanent --add-port=8443/tcp
firewall-cmd --reload
- Note: There should only be one cb*.conf file. Nginx will fail to start if there are two. Confirm there is only one ending in .conf by running: ls -lh /etc/cb/nginx/conf.d | grep 'cb\.'
cb.conf.default
cb.multihome.conf
- Restart the server services: EDR: How to restart server services
- Verify that the UI is accessible: https://<server>:8443
Additional Notes
- Any available port can be used if the firewall and network allow it. Port 8443 is used here as an example.
- It's recommended to follow the same instructions on the minions for clustered environments. Without this, the console will be accessible over 443 by minion IP and will not use the custom certificates.
- If using the cb event forwarder the cb_server_url value may need to be modified to add the port number in the /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf file
- For RHEL/CentOS 7, you can use the following cmds to check the firewall settings to see if anything is missing, like the 8443 config:
Related Content
