Install and Config Guide
Installing and Configuring VMware AppDefense on VxRail
Abstract
This document describes the procedure used for installing VMware AppDefense on a VxRail cluster and for protecting the VxRail Manager virtual machine.
January 2021
Revisions
Revisions
Date |
Description |
|
|
May 2019 |
Initial release |
|
|
The information in this publication is provided “as is.” Dell Inc. makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose.
Use, copying, and distribution of any software described in this publication requires an applicable software license.
Copyright © 2019-2021 Dell Inc. or its subsidiaries. All Rights Reserved. Dell, EMC, Dell EMC and other trademarks are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be trademarks of their respective owners. [1/6/2021]
2 Installing and Configuring VMware AppDefense on VxRail Manager
Table of contents
Table of contents
Revisions |
............................................................................................................................................................................. |
2 |
|
Table of contents ................................................................................................................................................................ |
3 |
||
1 |
AppDefense Installation ............................................................................................................................................... |
4 |
|
|
1.1 |
Enable Platinum License .................................................................................................................................... |
4 |
|
1.1.1 ................................................................................................................................. |
Install AppDefense Plug - in |
4 |
|
1.1.2 .................................................................................. |
Register the AppDefense Appliance with vCenter Server |
5 |
|
1.1.3 ................................................................................... |
Enable AppDefense Service (SaaS Connectivity Mode) |
6 |
|
1.2 ....................................................................................................................................... |
Install the Host Module |
8 |
|
1.3 ..................................................................................................................................... |
Install the Guest Module |
8 |
|
1.3.1 .................................................................................................................................. |
Linux Guest Prerequisites |
8 |
|
1.3.2 .......................................................................... |
Install Guest Module on Linux System Using Local Download |
9 |
|
1.3.3 ............................................................................................................................................. |
For SLES systems: |
9 |
|
1.4 ................................................................................................................................................ |
After Installation |
12 |
2 |
Using ......................................................................................................................................AppDefense Manager |
15 |
|
|
2.1.1 ............................................................................................................................................... |
Creating a scope |
15 |
|
2.1.2 ............................................................................................ |
Review of state in AppDefense Manager (Cloud) |
16 |
|
2.1.3 .................................................................................................. |
Switching from Discovery to Protection Mode |
18 |
|
2.1.4 ........................................................................................................... |
AppDefense Informational screenshots |
20 |
|
2.2 ............................................................................................ |
VxRail Manager issues when in protection mode |
22 |
|
2.2.1 ........................................................................................................................ |
Adding node: Attestation Alarm |
22 |
|
2.2.2 ...................................................................................................... |
Adding Node – raised AppDefense Events |
23 |
|
2.2.3 ............................................................................................................................................. |
Re - adding a node |
28 |
|
2.2.4 ................................................................................................................................................. |
Post - Add Node |
29 |
|
2.2.5 .................................................................................................................................... |
LCM: Upgrading VxRail |
31 |
3 Installing and Configuring VMware AppDefense on VxRail Manager
Installation is straightforward, as described in the VMware guide, Installing AppDefense with AppDefense Plug-In. The main steps are:
1.Enable the Platinum license.
2.Install the AppDefense plug-in.
3.Install the host module on the cluster host.
4.Install the Guest module on the VMs that you want to protect.
1.In vCenter, navigate to: Home > Administration > Licenses.
2.Click: +Add New Licenses.
3.Add license.
4.Set Name: VMware vSphere 6 for Platinum with AppDefense Plugin
5.Navigate to: Licenses > Assets > Hosts.
6.Select all hosts on the VxRail cluster.
7.Click: Assign License and select Platinum from the list. Click OK.
1.1.1Install AppDefense plug-in
Refer to the VMware guide here.
1.Download the AppDefense OVA.
2.Install the AppDefense appliance by installing the OVA template in vCenter, and use the following settings:
•VM Name: AppDefense-Appliance
•Location: <VxRail-Datacenter name>
•Compute Resource: <VxRail cluster name>
•Storage: VxRail vSAN Datastore, policy: VXRAIL-SYSTEM-STORAGE-PROFILE
•Network: Management Network
•Customize template:
i.Initial root, admin pwds
ii.Default GW
iii.Domain name
iv.Domain search path
v.DNS
vi.IP
vii.Netmask
The following figure shows how the Deploy OVF template screen should look:
4 Installing and Configuring VMware AppDefense on VxRail Manager
OVF template
•Click Finish. vCenter imports the OVF and displays the AppDefense appliance VM in the VxRail cluster.
•Log out of vCenter and log back in. Notice the AppDefense icon is now part of the Home menu in vCenter.
1.Browse to the AppDefense appliance at https://<AppDefense-IP>.
2.Go to the Configuration > Registration tab.
3.Leave Connectivity Mode set to Online for the moment.
4.Under the SSO lookup configuration, enter the PSC hostname and provide its credentials.
5.Select the vCenter server from the dropdown list and register it.
The following figure shows how the AppDefense Manager registration screen should look:
5 Installing and Configuring VMware AppDefense on VxRail Manager
AppDefense Manager Registration
You can enable the AppDefense service when you register the AppDefense appliance with vCenter server. Switching the AppDefense appliance connectivity to SaaS enables the AppDefense appliance to communicate with the AppDefense service, enabling the complete solution.
•You have installed the AppDefense appliance.
•The AppDefense appliance VM is powered-on.
•You have provisioned the AppDefense appliance as described in the following steps.
1.Log in to AppDefense Manager.
2.Navigate to the settings icon > Appliance > Provision New Appliance page. The New appliance window opens.
3.Create an appliance by entering the appliance name.
The appliance name is an identifier and does not need to match the actual VM name within the vCenter Server, but the best practice is to match the names. For example, AppDefense appliance.
4.Click Provision.
5.The New Appliance Created window displays the URL for the manager in the region, UUID, and appliance API key. Keep this window open until the appliance configuration is done, or make a note of the information which will be used in SaaS configuration.
1.Open a web browser and navigate to the AppDefense appliance GUI at https://<appliance ip address>. The Select a Certificate window opens.
2.Log in to the AppDefense appliance using either the admin credentials or using the certificate.
•If you want to log in to the AppDefense appliance using the admin credentials, click Cancel. Use the admin credentials that you added while installing the AppDefense appliance OVA file.
Important: Do not click OK to accept the certificate.
6 Installing and Configuring VMware AppDefense on VxRail Manager
•If you want to log in to the AppDefense appliance using a self-signed or CA certificate, follow the procedure described in the VMware Log In to AppDefense Appliance with Certificate topic.
The AppDefense dashboard opens as the default home page.
3.Go to the Configuration > Registration tab.
4.In the AppDefense Manager section, click Edit, change connectivity mode to SAAS, and configure the following values (noted during the appliance creation process in section 1.1.3.1):
•AppDefense Manager URL
•Manager UUID
•Manager API key
5.Click Save.
The AppDefense Manager pane in the Registration screen of the AppDefense appliance should now reflect the new SAAS connectivity mode as shown in the following figure:
AppDefense Manager pane
Having registered the required information in the AppDefense appliance, we can now see the AppDefense plug-in showing the AppDefense dashboard in vSphere Client as shown in the following figure:
Vsphere Client – AppDefense dashboard
Notice the connectivity mode is now SAAS and no hosts or virtual machines have the AppDefense module installed yet.
7 Installing and Configuring VMware AppDefense on VxRail Manager
After you have installed and registered the plug-in, you are ready to install the AppDefense host module on your ESXi hosts. As the VMware manual page shows, you can install it on all hosts in a cluster at the same time, or you can install it individually on each host.
The easiest way is to install it on all hosts, with a single click from the Cluster > Configuration, and click
Enable AppDefense For All Hosts.
The installation of the AppDefense guest module includes the AppDefense package, Guest Introspection package, and the netfilter dependencies. The guest module must be installed on all workload VMs that you want to protect.
LIMITATIONS:
•AppDefense does not work with virtual machines that have Fault Tolerance enabled. This limitation applies to both Linux and Windows guest virtual machines.
•Monitoring vCenter, PSC’s and AppDefense itself is currently not supported.
NOTE: If a resource allocation such as CPU or memory is changed at any time, you must reboot the guest VM.
In the following screenshot, taken from AppDefense Manager, the only VMs in our cluster are the vCSA, PSC, VxRail Manager and AppDefense appliance.
Unassigned VMs
Ensure that the guest virtual machine (VM) complies with the following prerequisites:
•ESXi 6.5 U1 or later is installed.
The VxRail Manager VM runs on the cluster hosts, which run VMware ESXi 6.7.0.
•A supported version of Linux is installed.
The VxRail Manager VM running SLES 12.2.
•iptables package of 1.4.11 version or later is installed.
Iptables version is: v1.4.21
8 Installing and Configuring VMware AppDefense on VxRail Manager
•Verify glib 2 is installed on the Linux VM.
The following glib packages are already installed:
VMware manual page here.
This is a common step for any Linux distribution. Download and import the complete VMware package using the given URLs. Use the following commands to unpack the required tar files:
18w-app03-vxm:~ # cd /AppDefense/LinuxGuestModule
18w-app03-vxm:~/AppDefense/LinuxGuestModule # |
ls -l |
||||
total 2676 |
root |
696320 |
Oct 20 19:33 |
AppDefense.tar |
|
-rw-r--r-- 1 root |
|||||
-rw-r--r-- 1 root |
root |
522240 |
Oct 20 19:33 |
guest-introspection-for-vmware-nsx.tar |
|
-rw-r--r-- 1 root |
root 1495040 Oct 20 19:33 |
guest-introspection-os-bundle.tar |
|||
18w-app03-vxm:~/AppDefense/LinuxGuestModule # |
for f in *.tar;do tar -xf $f; done |
||||
18w-app03-vxm:~/AppDefense/LinuxGuestModule # |
ls -l |
||||
total 2676 |
201 |
4096 |
Oct 20 18:44 |
AppDefense |
|
drwxr-xr-x 6 361763 |
|||||
-rw-r--r-- 1 root |
root |
696320 |
Oct 20 19:33 |
AppDefense.tar |
|
drwxr-xr-x 4 361763 |
201 |
4096 |
Oct 20 |
18:44 |
guest-introspection-for-vmware-nsx |
-rw-r--r-- 1 root |
root |
522240 |
Oct 20 |
19:33 |
guest-introspection-for-vmware-nsx.tar |
drwxr-xr-x 6 361763 |
201 |
4096 |
Oct 20 |
18:44 |
guest-introspection-os-bundle |
-rw-r--r-- 1 root |
root 1495040 Oct 20 |
19:33 |
guest-introspection-os-bundle.tar |
1.3.3 |
For SLES systems: |
|||||||
|
1. Get the public key and import into rpm: |
|||||||
|
18w-app03-vxm:~ # |
cd |
/root/AppDefense/LinuxGuestModule/AppDefense/key |
|||||
|
18w-app03- |
|
vxm:~/AppDefense/LinuxGuestModule/AppDefense/key # |
rpm |
--import VMWARE-APPDEFENSE- |
|||
|
PACKAGING-GPG-RSA-KEY.pub |
|
|
|
||||
|
2. Add the following repositories: |
|||||||
|
18w-app03-vxm:~/AppDefense # |
zypper ar "file:/root/AppDefense/LinuxGuestModule/AppDefense/latest" AppDefense |
|
|||||
|
Adding repository 'AppDefense' |
|
|
|||||
|
............................................................................................................... |
|||||||
|
................................ |
|
|
|
[done] |
|||
|
Repository 'AppDefense' successfully added |
|||||||
|
URI |
: file:/root/AppDefense/LinuxGuestModule/AppDefense/latest |
||||||
|
Enabled |
: Yes |
||||||
|
GPG Check |
: Yes |
||||||
|
Autorefresh |
: No |
||||||
|
Priority |
: 99 (default priority) |
Repository priorities are without effect. All enabled repositories share the same priority. 18w-app03-vxm:~/AppDefense # zypper ar "file:/root/AppDefense/LinuxGuestModule/guest-introspection-for-vmware- nsx/latest/sles/x86_64/" guest-introspection-for-vmware-nsx
Adding repository 'guest-introspection-for-vmware-nsx'
...............................................................................................................
........[done]
Repository 'guest-introspection-for-vmware-nsx' successfully added
URI |
: file:/root/AppDefense/LinuxGuestModule/guest-introspection-for-vmware-nsx/latest/sles/x86_64/ |
|
Enabled |
: Yes |
|
GPG Check |
: Yes |
|
Autorefresh |
: No |
(default priority) |
Priority |
: 99 |
Repository priorities are without effect. All enabled repositories share the same priority.
9 Installing and Configuring VMware AppDefense on VxRail Manager
3.For SLES 11.4, 12.2, or 12.3: To install a dependent component, run the following command to add the extra repository:
18w-app03-vxm:~/AppDefense # zypper ar "file:/root/AppDefense/LinuxGuestModule/guest-introspection-
os-bundle/sles/12.2/" gios Adding repository 'gios'
...............................................................................................................
...................................... |
|
[done] |
Repository 'gios' successfully added |
||
URI |
: file:/root/AppDefense/LinuxGuestModule/guest-introspection-os-bundle/sles/12.2/ |
|
Enabled |
: Yes |
|
GPG Check |
: Yes |
|
Autorefresh |
: No |
(default priority) |
Priority |
: 99 |
Repository priorities are without effect. All enabled repositories share the same priority.
4. Install the AppDefense Guest Module package.
Note: There is a pre-existing SLES repo defined, which points to a remote IP location. This causes a timeout and prevents using the AppDefense repos that have just been added, resulting in a failure to install.
The repository that you must remove is a default SLES repository and can be identified as follows:
To identify the repositories that are currently defined in zipper:
18w-app03-vxm:~/AppDefense # zypper lr
Repository priorities are without effect. All enabled repositories share the same priority.
# | Alias |
| |
Name |
| Enabled |
| GPG Check |
| Refresh |
|
--+------------------------------------ |
+ |
------------------------------------SLES12 - SP2 - 12.2 - 0 |
+--------- |
+----------- |
+-------- |
|
1 |
| SLES12-SP2-12.2-0 |
| |
| Yes |
| (r ) Yes |
| Yes |
|
2 |
| AppDefense |
| |
AppDefense |
| Yes |
| ( p) Yes |
| No |
3 |
| gios |
| |
gios |
| Yes |
| ( p) Yes |
| No |
4 |
| guest-introspection-for-vmware-nsx | |
guest - introspection - for - vmware - nsx | Yes |
| ( p) Yes |
| No |
18w-app03-vxm:~/AppDefense # ls -l /etc/zypp/repos.d/
total 16 |
1 |
root root 147 |
Nov 30 |
12:56 SLES12-SP2-12.2-0.repo |
|||
-rw-r--r-- |
|||||||
-rw-r--r-- |
1 |
root root 112 |
Feb |
5 |
09:28 AppDefense.repo |
||
-rw-r-- |
r-- |
1 |
root root |
129 |
Feb |
5 |
09:28 gios.repo |
-rw-r-- |
r-- |
1 |
root root |
173 |
Feb |
5 |
09:28 guest-introspection-for-vmware-nsx.repo |
The pre-existing SLES repository is currently enabled:
18w-app03-vxm:~/AppDefense # more /etc/zypp/repos.d/SLES12-SP2-12.2-0.repo
::::::::::::::
/etc/zypp/repos.d/SLES12-SP2-12.2-0.repo
::::::::::::::
[SLES12-SP2-12.2-0] name=SLES12-SP2-12.2-0 enabled=1 autorefresh=1
baseurl=http://<baseurlIP>/build/.0/repo/iso
path=/
type=yast2
keeppackages=0
With all repos having equal priority and the SLES repo being repo #1, it will use that repo first. For now, disabling that repo should resolve the installation issue. In the SLES repository file, change the value for enabled from 1 to 0:
::::::::::::::
/etc/zypp/repos.d/SLES12-SP2-12.2-0.repo
::::::::::::::
[SLES12-SP2-12.2-0] name=SLES12-SP2-12.2-0
enabled=0 # DISABLED BY CHANGING THIS FROM 1 to 0
10 Installing and Configuring VMware AppDefense on VxRail Manager