Configuring TrueSight Infrastructure Management to enable TLS 1.2


You can upgrade the security in your enterprise environment by using TLS 1.2 to communicate with TrueSight Infrastructure Management components. After the installation of TrueSight Infrastructure Management components, you can switch from the default inter-component security configuration to TLS 1.2 configuration.

Related topics

Rolling back to SSL configuration

TLS-considerations-for-TrueSight-Infrastructure-ManagementConfiguring IT Data Analytics communication to enable TLS 1.2

Before you begin

Ensure to complete the certificate creation and import tasks for the relevant components before you configure TLS 1.2 between them. For more information about how to create and import private certificates, see Implementing-private-certificates-in-TrueSight-Operations-Management. 

To configure the TrueSight Infrastructure Management components to enable TLS 1.2

There are different communication channels established between the TrueSight Infrastructure Management components. Perform the TLS configurations per communication channel. Select the communication channel which you want to make TLS compliant and perform the tasks accordingly. The flowchart in the following diagram explains the complete TLS configuration workflow.

tls_config_flow.png

To enable TLS 1.2, complete the procedures by navigating the following tabs, or select the procedures from documentation links in the flowchart.

  1. Navigate to the <Presentation Server Install Directory>\truesightpserver\bin directory, and run the following command to check whether the TrueSight Presentation Server is running.

    tssh server status

    Note

    Ensure that the TrueSight Presentation Server is running before proceeding further.

  2. Log on to the TrueSight console and select Administration> Components.

    Displays the components that are registered with the Presentation Server. Ensure that no TrueSight Infrastructure Management Server is registered with the TrueSight Presentation Server. If a TrueSight Infrastructure Management Server is registered delete the same. For more information, see To delete a component

  3. Set the property in the database by running the following command:

    tssh properties set tsps.cell.conntype ssl
    tssh properties set pronet.jms.conntype ssl
  4. Using a text editor, open the mcell.dir file located in <Presentation Server Install Directory>\conf directory.

  5. Comment out the instances of the code lines having the encryption key value as mc as shown in the following code block:

    #Type                            <name>             encryption key         <host>/<port>
    #gateway.gateway_subtype   ts_event_gateway         mc             tsps_server1.bmc.com:1900
    #cell                         pncell_tsim_server1        mc              tsim_server1.bmc.com:1828    

  6. Set the encryption key value to *TLS as shown in the following code block:

    #Type                            <name>             encryption key         <host>/<port>
    gateway.gateway_subtype     ts_event_gateway        *TLS          tsps_server1.bmc.com:1900
    cell                         pncell_tsim_server1        *TLS              tsim_server1.bmc.com:1828   

    Parameter description

    The following notes describe the key parameters used in the preceding command:

    • tsps_server1 is the name of the computer where the TrueSight Presentation Server is installed.
    • tsim_server1 is the name of TrueSight Infrastructure Management Server registered with the TrueSight Presentation Server. If there are multiple Infrastructure Management Server entries in the mcell.dir file, change the encryption key to *TLS for all such entries.
  7. Save and close the file.

  8. Set the property in the database by running the following command:

    tssh properties set server.eventgateway.encryption.key *TLS

  9. Stop the Presentation Server by running the following command:

    tssh server stop

The following sections describe the configuration steps for both the local Integration Service and remote Integration Service in TLS 1.2 mode. Perform the configuration steps based on the type of Integration Service installed:

To configure the local Integration Service


Failed to execute the [excerpt-include] macro.

To configure the remote Integration Service

Failed to execute the [excerpt-include] macro.

To start the servers

Failed to execute the [excerpt-include] macro.

The following section guides you to configure the Integration Service to Cell communication in TLS 1.2. Choose the appropriate configuration steps based on the type (local / remote) of the Integration Service and the cell used.

To configure the local Integration Service

Failed to execute the [excerpt-include] macro.

To configure the remote Integration Service

Failed to execute the [excerpt-include] macro.

To configure the local Cell

Failed to execute the [excerpt-include] macro.

To configure the remote Cell

Failed to execute the [excerpt-include] macro.

To start the servers

Failed to execute the [excerpt-include] macro.

Perform the following steps to configure the Infrastructure Management Server to Oracle database communication to enable TLS 1.2 mode:

To configure the Infrastructure Management Server to Oracle database communication to enable TLS 1.2

Perform the following steps to enable the Infrastructure Management Server to Oracle database communication to be TLS compliant:

Notes

  • If the Oracle database is configured in TLS 1.2 mode, then perform the following steps to configure the Infrastructure Management Server in TLS 1.2 mode.
  • Oracle database version 11G is TLS 1.0 compliant.
  • Oracle database version 12.1.0.2 is TLS 1.2 compliant.

  1. Stop the Infrastructure Management Server by running the following command:

    pw system stop

  2. Navigate to the <Infrastructure Management Server Install Directory>\pw\pronto\bin directory, and run the switchTLSMode.pl script as shown in the following code block:

    #Syntax
    perl switchTLSMode.pl -<on/off> -flow <communication channel> -dbport <Oracle Database port> -dbver <Oracle Database version>

    #Example
    perl switchTLSMode.pl -on -flow oracle –dbport 1521 -dbver 11G

    Parameter description

    The following notes describe the key parameters used in the preceding command:

    • -on/off: on option enables TLS mode of communication. off option disables TLS mode of communication and enables the default tcp/ssl mode of communication.
    • -flow: This variable can have two options: event_and_data,oracle. If flow is set to oracle, the communication between the Infrastructure Management Server and the Oracle database is TLS 1.2 enabled.
    • -dbport: Provide the port number that is configured for the Oracle database communication.
    • -dbver: Provide the Oracle database version. There are two compatible Oracle database versions: 11G, 12C

  3. Start the Infrastructure Management Server by running the following command:

    pw system start
To upgrade the Infrastructure Management server that communicates with the Oracle database in TLS mode

To upgrade the Infrastructure Management server that communicates with the Oracle database in TLS mode, perform the following sequence of steps:

  1. Disable TLS communication between Infrastructure Management server to Oracle database. For detailed instructions, see Rolling-back-to-SSL-configuration.
  2. Upgrade the Infrastructure Management server. For detailed instructions, see Upgrading the Infrastructure Management Server.
  3. Enable TLS communication between Infrastructure Management server to Oracle database. For detailed instructions, see Configuring-TrueSight-Infrastructure-Management-to-enable-TLS-1-2.

By default, the PATROL Agent communicates using either Transmission Control Protocol (TCP) or Secure Sockets Layer (SSL) protocol, but you can configure PATROL Agents to enable TLS 1.2 mode. 

The following process workflow guides you to configure the PATROL Agent to Integration Service communication to be TLS compliant:

Latest_PA_IS.png

 

 

  1. Ensure that the signed certificates are generated for the Integration Service and imported into the PATROL Agent's client DB certificate store. 
    To generate signed certificates for the Integration Service, see Implementing-private-certificates-in-the-Integration-Service.

  2. Ensure that the PATROL Agent and the TrueSight Integration Service are running at the same security level.
  3. Configure the PATROL Agent to Integration Service communication to enable TLS mode.

  4. Update the PATROL Agent's registry files. 
    For details, see Updating the PATROL Agent registry files. 

  5. Update the Integration Service's registry files. 
    For details, see Updating the Integration Service registry files.

Perform the following steps to enable the Infrastructure Management Server to BMC Impact Integration Web Services (IIWS) communication to be TLS compliant:

To configure the Infrastructure Management Server

Failed to execute the [excerpt-include] macro.

To configure the BMC Impact Integration Web Services server

Failed to execute the [excerpt-include] macro.

To start the servers

Failed to execute the [excerpt-include] macro.

Perform the following steps to enable the Infrastructure Management server main cell to Reporting engine communication to be TLS compliant:

Note

If the Reporting Engine is in TLS mode, it cannot communicate with any of the remote cells or Infrastructure Management server cells operating in Non-TLS mode.

 

Infrastructure Management server cells in TLS mode

Infrastructure Management server cells in Non-TLS mode

Remote cellsin TLS mode

Remote cells in Non-TLS mode

Reporting Engine in TLS mode

✅️

❌️

✅️

❌️

 

To configure the Infrastructure Management server cell component

  1. Using a text editor, open the mcell.dir file on the BMC TrueSight Infrastructure Management Server host computer. The file is located in the <Infrastructure Management server Install Directory>\pw\server\etc directory.

  2. Check for the instance of the code line having encryption key value as shown in the following code block:

    gateway.reportengine bpre.<fullyQualifiedHostName> <encryptionKey> <fullyQualifiedHostName>:<3783>

    #Example

    gateway.reportengine bpre.vs-pun-tsim-bp03.bmc.com mc vs-pun-tsim-bp03.bmc.com:3783

  3. Modify the existing value of encryption key to *TLS as shown in the following example:

    gateway.reportengine bpre.vs-pun-tsim-bp03.bmc.com *TLS vs-pun-tsim-bp03.bmc.com:3783
  4. Save and close the file.

  5. Reload the mcell.dir file by entering the following command from a command line:

    #Syntax

    mcontrol -n cellName reload dir

    #Example

    mcontrol -n pncell_vm-w23-rds1016 reload dir

    Note

    pncell_vm-w23-rds1016 is the name of the cell.


To configure the Report Engine component

  1. Navigate to the reportsCLI directory by running the following command:

    # Microsoft Windows operating system

    CurrentDirectory>cd <TrueSight Operations Management Reporting Install directory>\bin\reportsCLI

    # Unix operating system

    $cd <TrueSight Operations Management Reporting Install directory>/bin/reportsCLI

  2. Initiate the configuration settings by running the following command:

    #Syntax

    tls_config init -truststore <truststore file> -truststorepassword <truststore password> [-keystore <keystore file> -keystorepassword <keystore password>][-SqlAnywhereCert <trust certificate path>]

    #Example

    tls_config init -truststore cacerts -truststorepassword <truststore password> -keystore cacerts -keystorepassword <keystore password> -SqlAnywhereCert <BMC TrueSight Operations Management Report Engine Install Directory>\ReportEngine\tools\jre\bin

    When you run the tls_config script, you are prompted to confirm the restart of the Reporting Engine. The TLS configurations are applied only when the Reporting Engine restarts.

    Parameter description

     The following notes describe the key parameters used in the preceding command:

    • cacerts: Name of the keystore and truststore file of the Report Engine.
    • <truststore password>: Password for the keystore/truststore. changeit is the default password for the cacerts keystore. If you have changed this password, use the current password.
    • <BMC TrueSight Operations Management Report Engine Install Directory>\ReportEngine\tools\jre\bin: The directory path where the cacerts truststore file is located.

  3. Enable the TLS configuration by running the following command:

    tls_config enable -component cell

 Perform the following steps to configure the Infrastructure Management server to Publishing Server communication to enable TLS 1.2 mode:

To configure the Infrastructure Management server

Perform the following steps to enable the Infrastructure Management server to Publishing Server communication to be TLS compliant:
  1. Stop the Infrastructure Management Server by running the following command:
    pw system stop
  2. Using a text editor, open the pronet.conf located in the <Infrastructure Management Server Install Directory>\pw\custom\conf directory.
  3. Add the following properties in pronet.conf as shown in the following code block:
    pronet.jms.passwd.file=pronto/conf/.ks_pass
    pronet.apps.ipc.ssl.context.pserver.truststore.filename=messagebroker.ts
    pronet.apps.ipc.ssl.context.pserver.keystore.filename=pnserver.ks
    pronet.apps.ipc.ssl.context.pserver.enabledsuites=TLS_RSA_WITH_AES_128_CBC_SHA256
    pronet.apps.ipc.ssl.context.pserver.keystore.passwdfile=pronto/conf/.ks_pass
  4. Using a text editor, open the mcell.dir located in the <Infrastructure Management Server Install Directory>\pw\server\etc directory.
  5. Comment out any existing instances of the code lines having encryption key value as mc as shown in the following code block:
    #Type                            <name>             encryption key                <host>/<port>
    #cell                      pncell_hostname         mc                pncell_hostname.bmc.com:1828
    #gateway.imcomm              gw_ps_pncell_hostname       mc                    hostname.bmc.com:1839
  6. Add the code lines to set the encryption key value to *TLS as shown in the following code block:
     #Type                            <name>             encryption key               <host>/<port>
     cell                      pncell_hostname        *TLS            pncell_hostname.bmc.com:1828
    gateway.imcomm              gw_ps_pncell_hostname       *TLS                    hostname.bmc.com:1839
  7. Save and close the file.
  8. Using a text editor, open the smmgr.conf located in the <Infrastructure Management Server Install Directory>\pw\server\etc directory.
  9. Comment out any existing instance of the code line having ServerTransportProtocol value as tcp as shown in the following code block:
    #ServerTransportProtocol=tcp
  10. Add the code lines to set the ServerTransportProtocol value to tls, and server certificate file name and key values as shown in the following code block:
    ServerTransportProtocol=tls
    ServerCertificateFileName=mcell.crt
    ServerPrivateKeyFileName=mcell.key
    Notemcell.crt and mcell.key are the names of the cell key and the certificate. If the cell certificate and key names in your Infrastructure Management server are different then use the relevant names in the preceding settings. For more information about how to create cell key and certificate, see Implementing-private-certificates-in-the-TrueSight-Infrastructure-Management.
  11. Save and close the file.
  12. Start the Infrastructure Management Server by running the following command:
    pw system start

Where to go from here

Securing-communication-among-Infrastructure-Management-components

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*