Novell Sentinel Rapid Deployment 6.1, Installation Manual

Page: 57 / 84

Security Considerations for Sentinel 6.1 Rapid Deployment 57
no
vd
ocx
(e
n)
17
Sep
te
m
be
r 20
09
5.5 Securing the Operating System

Sentinel 6.1 Rapid Deployment is supported on SUSE
®
Linux Enterprise Server (SLES) 10
SP2 or later. For more information on securing a SLES machine, see the SuSE Linux
Enterprise Server 10 documentation (http://www.novell.com/documentation/sles10/
sles_admin/data/part_security.html)
.
 Secure access to the Sentinel 6.1 Rapid Deployment server with a firewall. If the Sentinel
server is accessible from outside the corporate network, a firewall should be employed to
prevent direct access by an intruder.
Enable the following ports in the firewall:
NOTE: Ports marked with the asterisk might be different if they were already in use on the
system at the time of installation. If they were in use at the time of installation, substitute in the
port numbers that were prompted for at the time of installation.
For more information on enabling a firewall on SLES 10, see Configuring Firewalls with
YaST (http://www.novell.com/documentation/sles10/sles_admin/data/sec_fire_suse.html) in
the SLES 10 Administration Guide .
5.6 Auditing Sentinel
Sentinel automatically generates events for many of its internal actions. These events can be viewed
in the Active Views or accessed through a search or report. For more information, see “
System
Events for Sentinel ” in the Sentinel 6.1 Rapid Deployment User Guide .
Components Port
ActiveMQ 61616*
PostgreSQL 5432
Tomcat 8443*
Sentinel Control Center Proxy Client port 10013*
Proxied trusted client 10014*
internal_gateway_server and internal_gateway
Used between engine and manager
5556
internal_router_server and internal_router_client
Used between event router client and server
5558
Event listener port
configured in config/collector_mgr.properties as
“ esecurity.agentmanager.event.port ”
35000