Security planning

This topic gives background information about the methods of maintaining security for the BMC PATROL Agent, lists default ownership and permissions for the PATROL Agent, and tells you how to change the ownership and permissions. This topic contains the following sections:

• • Access control list
  • Security levels
  • PATROL access control
  • Application accounts
  • User accounts
  • Firewall requirements
  • Ownership and permissions
  • TLS security considerations for the PATROL Agent

Access control list

The Access Control List (ACL) controls which users are authorized to connect to an agent, in which modes and from which hosts. An agent configuration variable defines the ACL. The ACL configuration variable is described in Defining-Access-Control-Lists. For information about setting up an ACL, see Controlling access to the Agent.

Security levels

Allows you to install one of the five security-level policies to secure the data flow between the PATROL Agent, PATROL Consoles, and PATROL Console Server. For more information, see Chapter 1 of PATROL Security User Guide.

PATROL access control

You can control the access by setting the definitions in patrol.conf file. For more information, see PATROL Console for Microsoft Windows User Guide - Customizing PATROL, Volume 3.

Application accounts

You can instruct the PATROL Agent to use separate accounts for individual applications and instances. For more information about how to specify which accounts are used for which commands, see Establishing-accounts-and-ports.

User accounts

The default account for the PATROL Agent to run commands is specified by the defaultAccount variable in the agent configuration file. The agent cannot run application discovery and parameters properly without a valid user name. For more information, see Default-ownership-and-permissions-for-files.

Firewall requirements

If your environment is protected by firewalls, you may have to modify the firewall configuration to accommodate the PATROL. For information about installing and configuring PATROL in an environment with firewalls, see the Installing-in-a-ProactiveNet-Performance-Management-environment.

Ownership and permissions

The PATROL_HOME/log and PATROL_HOME/config directories are created when the PATROL Agent process is run for the first time. At that time, the ownership and permissions of the PATROL Agent log and configuration directories are set. If the $PATROL_ADMIN environment variable is set, it specifies the user who owns the newly created log and configuration files. If the $PATROL_ADMIN environment variable is not set, the user PATROL owns all of the files by default.

For more information, see Default-ownership-and-permissions-for-files.

The default ownership and permissions of the PATROL Agent log and configuration directories are set according to the following table:

The following table shows the default ownership and permissions of the log and configuration files: 

TLS security considerations for the PATROL Agent

For an improved authentication and security mechanism, the PATROL Agent can be configured to use the Transport Layer Security (TLS) 1.2. The following architecture diagram explains the communication between the PATROL Agent and the other components:

Security Architecture - PATROL Agent communication

By default, the PATROL Agent uses either Transmission Control Protocol (TCP) or Secure Sockets Layer (SSL) protocol for communication. To configure the PATROL Agent to enable TLS 1.2, see Configuring-the-PATROL-Agent-to-enable-TLS-1-2.