UBA - Securing Job Manager Port 9002 - Using your own Certificate

Applicability

Description

Vulnerability scanners may indicate that the Job Manager (port 9002) is insecure with self-signed certificates.

Investigation

By default, UBA is shipped with self-signed certificates.

You can verify this by running the below command as caspida user:

sudo keytool -list -v -keystore /etc/caspida/conf/jobconf/keystore.jm

When prompted for a password, default password is "password".

From the output, the "Owner, and Issuer is the same".  Here is an example:

Creation date: May 25, 2018
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=UBA JobManager, OU=UBA, O=Splunk Inc, L=San Jose, ST=CA, C=US
Issuer: CN=UBA JobManager, OU=UBA, O=Splunk Inc, L=San Jose, ST=CA, C=US
Serial number: 763de6b3

Resolution

To replace Job Manager certificate with Third party or your own self-signed certificate follow the procedures below on the management node (node 1):

1. While UBA is running, stop UBA services:

/opt/caspida/bin/Caspida stop

2. Make a copy of /etc/caspida/conf/jobconf/keystore.jm for backup and place in /home/caspida (or wherever you'd like):

cp /etc/caspida/conf/jobconf/keystore.jm /home/caspida/keystore.jm

3. Delete current certificate stored in Job Manager keystore:

sudo keytool -delete -alias "jmserver" -keystore /etc/caspida/conf/jobconf/keystore.jm

4. Bundle the certificate with the private key of the server into a PKCS#12 file (export password must be the same as the /etc/caspida/conf/jobconf/keystore.jm password - “password“)

openssl pkcs12 -export -in certificate.pem -inkey private_key.pem -name jmserver -out generated_key.p12

5. Import PKCS#12 file into the keystore for Job Manager, when prompted for password, it is "password":

keytool -importkeystore -destkeystore /etc/caspida/conf/jobconf/keystore.jm -srckeystore generated_key.p12 -srcstoretype PKCS12

6. Confirm that the certificate is imported correctly by reviewing the output of the following command.  (see Issuer/Owner):

sudo keytool -list -v -keystore /etc/caspida/conf/jobconf/keystore.jm

7. Start UBA:

/opt/caspida/bin/Caspida start