Novell Sentinel Rapid Deployment 6.1, Installation Manual

Page: 51 / 84

Security Considerations for Sentinel 6.1 Rapid Deployment 51
no
vd
ocx
(e
n)
17
Sep
te
m
be
r 20
09
NOTE: Turning encryption on has a negative impact on the performance of the system. Therefore,
this security concern needs to be weighed against your performance needs. The database
communication is not encrypted by default for this reason.
5.1.4 Communication between the Collector Managers and
Event Sources
You can configure Sentinel to collect data from the event source in a secure manner depending on
the protocols that the event source supports. For example, the LEA WMS, SYSLOG, and AUDIT
Connector can be configured to encrypt their communication with their respective devises. For
more information on the possible security features that can be enabled, refer to the Connector and
Event source vendor documentation given in the
Novell Sentinel Content Page (http://
support.novell.com/products/sentinel/secure/sentinel61.html) .
5.1.5 Communication with the Web Browsers
The Web server is by default configured to communicate via HTTPS. For more information, see the
Tomcat documentation (http://tomcat.apache.org/tomcat-4.0-doc/ssl-howto.html) .
5.1.6 Communication between the Database and Other Clients
You can configure the PostgreSQL SIEM database to allow connection from any client machine by
using the Sentinel Data Manager or by using any third-party application such as Pgadmin*.
To allow the Sentinel Data Manager to connect from any client machine, add the following line in
the
<Install_Dirirectory >/3rdparty/postgresql/data/pg_hba.conf
file:
host all all 0.0.0.0/0 md5
If you want to limit the client connections that are allowed to run and connect to the database
through the SDM, replace the line above with the IP address of the host.
The following line in
pg_hba.conf
is an indicator to PostgreSQL to accept connections from the
local machine so that the Sentinel Data Manager is allowed to run only on the server.
host all all 127.0.0.1/32 md5
In order to limit connections from other client machines, you can add additional
host
entries.
5.2 Securing Users and Passwords

Section 5.2.1, “Operating System Users,” on page 51
 Section 5.2.2, “Sentinel Application and Database Users,” on page 52
5.2.1 Operating System Users
 “Server Installation” on page 52

“Collector Manager Installation” on page 52