Novell SENTINEL LOG MANAGER 1.0.0.5 - 03-31-2010, Administration Manual

Page: 52 / 168

52 Sentinel Log Manager 1.0.0.4 Administration Guide
no
vd
ocx
(e
n)
19
Fe
bru
a
ry
20
10
After the truststore is imported successfully, you can click Details to see the certificates included in
the truststore.
Server Key Pair
The Sentinel Log Manager is installed with a built-in certificate, used to authenticate the Sentinel
Log Manager server to the event sources. This certificate can be overridden with a certificate signed
by a public certificate authority (CA).
To replace the built-in certificate:
1 Log in to the Sentinel Log Manager as an administrator.
2
Click the collection link at the upper left corner of the page.
The Collection tab is displayed on the right pane of the page.
3 Select the Event Source Servers tab.
4 In the Syslog Server section, under Server key pairs , select Custom .
5
Click Browse and browse to the truststore file.
6 Specify the password for the truststore file.
7
Click Import .
If there is more than one public-private key pair associated with the file, select the desired key
pair, and click
OK .
8 Click Details to see more information about the server key pair.
9 Click Reset to change the specified settings to previous setting before saving it
10 Click Save .
Listening on Ports Below 1024
NOTE: The instructions in this section assume that your firewall is enabled and is compatible with
the iptables command. If this is not the case, there are likely options in your firewall configuration
interface to allow you to configure the same port forwarding as described here.
As Sentinel Log Manager runs as the novell user, it cannot directly listen on ports that are less than
1024. To listen on a port that is less than 1024, use port forwarding to forward data to a port that
Sentinel Log Manager can directly listen on. Sentinel Log Manager comes with the
Install_Directory /bin/config_firewall.sh
script to assist you in getting port forwarding
setup. This script contains an example command of forwarding UDP port 514 to port 1514. This
script is automatically run every time Sentinel Log Manager service startup
/etc/init.d/
sentinel_log_mgr
script is executed with the start option by the
root
user.
You must run the following port forwarding command as root:
iptables -t nat -A PREROUTING -p <protocol> --destination-port <incoming port>
-j REDIRECT --to-ports
The following command is an example of how to forward events from the default syslog server port
514 to the Novell Sentinel Log Manager port 1514 for Syslog UDP traffic:
iptables -t nat -A PREROUTING -p udp --destination-port 514 -j REDIRECT --to-
ports 1514