Cisco Intrusion Prevention System Device Manager Configuration Guide for IPS 7.3

Authorized RSA Keys Pane

Note You must be administrator to add or edit authorized RSA keys. If you have operator or viewer privileges and you try to add or edit an authorized key, you receive the Delivery Failed message.

Use the Authorized RSA Keys pane to manage public keys for SSHv2 clients allowed to use RSA authentication to log in to the local SSH server. The Authorized RSA Keys pane displays the public keys of all SSH clients allowed to access the sensor. You can view only your key and not the keys of other users.

Each user who can log in to the sensor has a list of authorized keys compiled from each client the user logs in with. When using SSHv2 to log in to the sensor, you can use RSA authentication rather than using passwords.

Authorized RSA Keys Pane Field Definitions

The following fields are found in the Authorized RSA Keys pane:

• ID—Specifies a unique string (1 to 256 characters) to identify the key. You receive an error message if the ID contains a space or exceeds 256 alphanumeric characters.
• Public Key—Specifies the public key of the SSHv2 client.

Add and Edit Authorized RSA Key Dialog Boxes Field Definitions

The following fields are found in the Add and Edit Authorized RSA Key dialog boxes:

• ID—Specifies a unique string (1 to 256 characters) to identify the key. You receive an error message if the ID contains a space or exceeds 256 alphanumeric characters.
• Public Key—Specifies the public key of the SSHv2 client.

Defining Authorized RSA Keys

To define public RSA keys, follow these steps:

Step 2 Choose Configuration > Sensor Management > SSH > Authorized RSA Keys, and then click Add to add a public key to the list. You can add a maximum of 50 SSHv2 authorized keys.

Step 3 In the ID field, enter a unique ID to identify the key.

Step 4 In the Public Key field, enter the public key.

Note You generate the key on the SSH client and enter it in the Public Key field.

Tip To discard your changes and close the Add Authorized RSA Key dialog box, click Cancel.

Step 5 Click OK . The new key appears in the authorized keys list in the Authorized RSA Keys pane.

Step 6 To edit an existing entry in the authorized keys list, select it, and click Edit .

Step 7 Edit the ID and Public Key fields.

Tip To discard your changes and close the Edit Authorized RSA Key dialog box, click Cancel.

Step 8 Click OK . The edited key appears in the authorized keys list in the Authorized RSA Keys pane.

Step 9 To delete a public key from the list, select it, and click Delete . The key no longer appears in the authorized keys list in the Authorized RSA Keys pane.

Tip To discard your changes, click Reset.

Step 10 Click Apply to apply your changes and save the revised configuration.

Authorized RSA1 Keys Pane

Note You must be administrator to add or edit authorized keys. If you have operator or Viewer privileges and you try to add or edit an authorized key, you receive the Delivery Failed message.

Use the Authorized RSA1 Keys pane to specify SSHv1 public keys for a client allowed to use RSA authentication to log in to the local SSH server. The Authorized RSA1 Keys pane displays the public keys of all SSH clients allowed to access the sensor. You can view only your key and not the keys of other users.

Each user who can log in to the sensor has a list of authorized keys compiled from each client the user logs in with. When using SSHv1 to log in to the sensor, you can use the RSA authentication rather than using passwords.

Use an RSA key generation tool on the client where the private key is going to reside. Then, display the generated public key as a set of three numbers (modulus length, public exponent, public modulus) and enter those numbers in the fields on the Authorized RSA1 Keys pane.

Authorized RSA1 Keys Pane Field Definitions

The following fields are found in the Authorized RSA1 Keys pane:

• ID—Specifies a unique string (1 to 256 characters) to identify the key. You receive an error message if the ID contains a space or exceeds 256 alphanumeric characters.
• Modulus Length—Specifies the number of significant bits (511 to 2048) in the modulus. You receive an error message if the length is out of range.
• Public Exponent—Used by the RSA algorithm to encrypt data. The valid range is 3 to 2147483647. You receive an error message if the exponent is out of range.
• Public Modulus—Used by the RSA algorithm to encrypt data. The public modulus is a string of 1 to 2048 numbers (where modulus is (2 ^ length) < modulus < (2 ^ (length + 1))). You receive an error message if the modulus is out of range or if you use characters rather than numbers. The numbers must match the following pattern: ^[0-9][0-9]*$.

Add and Edit Authorized RSA1 Key Dialog Boxes Field Definitions

The following fields are found in the Add and Edit Authorized Key dialog boxes:

• ID—Specifies a unique string (1 to 256 characters) to identify the key. You receive an error message if the ID contains a space or exceeds 256 alphanumeric characters.
• Modulus Length—Specifies the number of significant bits (511 to 2048) in the modulus. You receive an error message if the length is out of range.
• Public Exponent—Used by the RSA algorithm to encrypt data. The valid range is 3 to 2147483647. You receive an error message if the exponent is out of range.
• Public Modulus—Used by the RSA algorithm to encrypt data. The public modulus is a string of 1 to 2048 numbers (where modulus is (2 ^ length) < modulus < (2 ^ (length + 1))). You receive an error message if the modulus is out of range or if you use characters rather than numbers. The numbers must match the following pattern: ^[0-9][0-9]*$.

Defining Authorized RSA1 Keys

To define public RSA1 keys, follow these steps:

Step 2 Choose Configuration > Sensor Management > SSH > Authorized RSA1 Keys, and then click Add to add a public key to the list. You can add a maximum of 50 SSH authorized keys.

Step 3 In the ID field, enter a unique ID to identify the key.

Step 4 In the Modulus Length field, enter an integer. The modulus length is the number of significant bits in the modulus. The strength of an RSA key relies on the size of the modulus. The more bits the modulus has, the stronger the key.

Note If you do not know the modulus length, public exponent, and public modulus, use an RSA key generation tool on the client where the private key is going to reside. Display the generated public key as a set of three numbers (modulus length, public exponent, and public modulus) and enter those numbers in Steps 4 through 6.

Step 5 In the Public Exponent field, enter an integer. The RSA algorithm uses the public exponent to encrypt data. The valid value for the public exponent is a number between 3 and 2147483647.

Step 6 In the Public Modulus field, enter a value. The public modulus is a string value of numbers (where modulus is (2 ^ length) < modulus < (2 ^ (length + 1))). The RSA algorithm uses the public modulus to encrypt data.

Tip To discard your changes and close the Add Authorized RSA1 Key dialog box, click Cancel.

Step 7 Click OK . The new key appears in the authorized keys list in the Authorized RSA1 Keys pane.

Step 8 To edit an existing entry in the authorized keys list, select it, and click Edit .

Step 9 Edit the Modulus Length, Public Exponent, and Public Modulus fields.

Tip To discard your changes and close the Edit Authorized RSA1 Key dialog box, click Cancel.

Step 10 Click OK . The edited key appears in the authorized keys list in the Authorized RSA1 Keys pane.

Step 11 To delete a public key from the list, select it, and click Delete . The key no longer appears in the authorized keys list in the Authorized RSA1Keys pane.

Tip To discard your changes, click Reset.

Step 12 Click Apply to apply your changes and save the revised configuration.

Known Host RSA Keys pane

Note You must be administrator to add or edit known host RSA keys.

Use the Known Host RSA Keys pane to define public keys for the blocking devices that the sensor manages, and for SSH (SCP) servers that are used for downloading updates or copying files. You must get each device and server to report its public key so that you have the information you need to configure the Known Host RSA Keys pane. If you cannot obtain the public key in the correct format, click Retrieve Host Key in the Add Known Host RSA Keys dialog box.

The IDM attempts to retrieve the known host key from the host specified by the IP address. If successful, The IDM populates the Add Known Host RSA Key pane with the key.

Note Retrieve Host Key is available only in the Add dialog box. You receive an error message if the IP address is invalid.

Known Host RSA Keys Pane Field Definitions

The following fields are found in the Known Host RSA Keys pane:

• IP Address—Specifies the IP address of the host for which you are adding keys.
• Public Key—Specifies the RSA host key.

Add and Edit Known Host RSA Key Dialog Boxes Field Definitions

The following fields and button are found in the Add and Edit Known Host RSA Key dialog boxes:

• IP Address—Specifies the IP address of the host for which you are adding keys.
• Public Key—Specifies the RSA host key.
• Retrieve Host Key—Lets the IDM try to retrieve the known host key from the host specified by the IP address. If successful, The IDM populates the Add Known Host RSA Key pane with the key.

Note Retrieve Host Key is available only in the Add dialog box. You receive an error message if the IP address is invalid.

Defining Known Host RSA Keys

To define known host RSA keys, follow these steps:

Step 2 Choose Configuration > Sensor Management > SSH > Known Host RSA Keys , and then click Add to add a known host RSA key to the list.

Step 3 In the IP Address field, enter the IP address of the host for which you are adding a key.

Step 4 If you know the public key, enter it in the Public key field, or click Retrieve Host Key to obtain the known host key. The IDM attempts to retrieve the key from the host whose IP address you entered in Step 3. If the attempt is successful, go to Step 5.

Tip To discard your changes and close the Add Known Host RSA Key dialog box, click Cancel.

Step 5 Click OK . The new key appears in the known host keys list in the Known Host RSA Keys pane.

Step 6 To edit an existing entry in the authorized keys list, select it, and click Edit .

Step 7 Edit the ID and the Public Key fields.

Tip To discard your changes and close the Edit Known Host RSA Key dialog box, click Cancel.

Step 8 Click OK . The edited key appears in the known host keys list in the Known Host RSA Keys pane.

Step 9 To delete a public key from the list, select it, and click Delete . The key no longer appears in the known host keys list in the Known Host RSA Keys pane.

Tip To discard your changes, click Reset.

Step 10 Click Apply to apply your changes and save the revised configuration.

Known Host RSA1 Keys Pane

Note You must be administrator to add or edit known host keys.

Use the Known Host RSA1 Keys pane to define public keys for the blocking devices that the sensor manages, and for SSH (SCP) servers that are used for downloading updates or copying files. You must get each device and server to report its public key so that you have the information you need to configure the Known Host RSA1 Keys pane. If you cannot obtain the public key in the correct format, click Retrieve Host Key in the Add Known Host RSA1 Keys dialog box.

The IDM attempts to retrieve the known host key from the host specified by the IP address. If successful, The IDM populates the Add Known Host RSA1 Key pane with the key.

Note Retrieve Host Key is available only in the Add dialog box. You receive an error message if the IP address is invalid.

Known Host RSA1 Keys Pane Field Definitions

The following fields are found in the Known Host Keys pane:

• IP Address—Specifies the IP address of the host for which you are adding keys.
• Modulus Length—Specifies the number of significant bits (511 to 2048) in the modulus. You receive an error message if the length is out of range.
• Public Exponent—Used by the RSA algorithm to encrypt data. The valid range is 3 to 2147483647. You receive an error message if the exponent is out of range.
• Public Modulus—Used by the RSA algorithm to encrypt data. The public modulus is a string of 1 to 2048 numbers (where modulus is (2 ^ length) < modulus < (2 ^ (length + 1))). You receive an error message if the modulus is out of range or if you use characters rather than numbers. The numbers must match the following pattern: ^[0-9][0-9]*$.

Add and Edit Known Host RSA1 Key Dialog Boxes Field Definitions

The following fields are found in the Add and Edit Known Host Key dialog boxes:

• IP Address—Specifies the IP address of the host for which you are adding keys.
• Modulus Length—Specifies the number of significant bits (511 to 2048) in the modulus. You receive an error message if the length is out of range.
• Public Exponent—Used by the RSA algorithm to encrypt data. The valid range is 3 to 2147483647. You receive an error message if the exponent is out of range.
• Public Modulus—Used by the RSA algorithm to encrypt data. The public modulus is a string of 1 to 2048 numbers (where modulus is (2 ^ length) < modulus < (2 ^ (length + 1))). You receive an error message if the modulus is out of range or if you use characters rather than numbers. The numbers must match the following pattern: ^[0-9][0-9]*$.

Defining Known Host RSA1 Keys

To define known host RSA1 keys, follow these steps:

Step 2 Choose Configuration > Sensor Management > SSH > Known Host RSA1 Keys , and then click Add to add a known host key to the list.

Step 3 In the IP Address field, enter the IP address of the host for which you are adding a key.

Step 4 Click Retrieve Host Key . The IDM attempts to retrieve the key from the host whose IP address you entered in Step 3. If the attempt is successful, go to Step 8. If the attempt is not successful, complete Steps 5 through 7.

Step 5 In the Modulus Length field, enter an integer. The modulus length is the number of significant bits in the modulus. The strength of an RSA key relies on the size of the modulus. The more bits the modulus has, the stronger the key.

Step 6 In the Public Exponent field, enter an integer. The RSA algorithm uses the public exponent to encrypt data.

Step 7 In the Public Modulus field, enter a value. The public modulus is a string value of numbers (where modulus is (2 ^ length) < modulus < (2 ^ (length + 1))). The RSA algorithm uses the public modulus to encrypt data.

Tip To discard your changes and close the Add Known Host RSA1 Key dialog box, click Cancel.

Step 8 Click OK . The new key appears in the known host keys list in the Known Host RSA1 Keys pane.

Step 9 To edit an existing entry in the authorized keys list, select it, and click Edit .

Step 10 Edit the Modulus Length, Public Exponent, and Public Modulus fields.

Tip To discard your changes and close the Edit Known Host RSA1 Key dialog box, click Cancel.

Step 11 Click OK . The edited key appears in the known host keys list in the Known Host RSA1 Keys pane.

Step 12 To delete a public key from the list, select it, and click Delete . The key no longer appears in the known host keys list in the Known Host RSA1 Keys pane.

Tip To discard your changes, click Reset.

Step 13 Click Apply to apply your changes and save the revised configuration.

Sensor Key Pane

Note You must be administrator to generate sensor SSH host keys.

The server uses the SSH host key to prove its identity. Clients know they have contacted the correct server when they see a known key. The sensor generates an SSHv1 or SSHv2 host key the first time it starts up. It is displayed in the Sensor Key pane along with the Bubble Babble. Click Generate Key to replace that key with a new key.

Note If you generate a new key, you must update the known hosts tables on remote systems with the new key to prevent connection failures.

Sensor Key Pane Field Definitions

The Sensor Key pane displays the current sensor RSA1 (SSHv1) and RSA (SSHv2) host keys. Press Generate Key to generate a new sensor SSH host key.

Displaying and Generating the Sensor SSH Host Key

To display and generate sensor SSH host keys, follow these steps:

Step 2 Choose Configuration > Sensor Management > SSH > Sensor Key . The sensor SSH host key is displayed.

Step 3 To generate a new sensor SSH host key, click Generate Key . A dialog box displays the following warning:

Step 4 Click OK to continue. A new host key is generated and the old host key is deleted. A status message states the key was updated successfully.

Trusted Hosts Pane

Note You must be administrator to add trusted hosts.

Use the Trusted Hosts pane to add certificates for master blocking sensors and for TLS and SSL servers that the sensor uses for downloading updates. You can also use it to add the IP addresses of external product interfaces, such as CSA MC, that the sensor communicates with.

The Trusted Hosts pane lists all trusted host certificates that you have added. You can add certificates by entering an IP address. The IDM retrieves the certificate and displays its fingerprint. If you accept the fingerprint, the certificate is trusted. You can add and delete entries from the list, but you cannot edit them.

For More Information

For more information on adding external product interfaces, see Chapter16, “Configuring External Product Interfaces”

Trusted Hosts Pane Field Definitions

The following fields are found in the Trusted Hosts pane:

• IP Address—Specifies the IP address of the trusted host.
• SHA1—Specifies the Secure Hash Algorithm. SHA1 is a cryptographic message digest algorithm.

Add Trusted Host Dialog Box Field Definitions

The following fields are found in the Add Trusted Host dialog box:

• IP Address—Specifies the IP address of the trusted host.
• Port—(Optional) Specifies the port number of where to obtain the host certificate.

Adding Trusted Hosts

To add trusted hosts, follow these steps:

Step 2 Choose Configuration > Sensor Management > Certificates > Trusted Hosts , and then click Add to add a trusted host to the list.

Step 3 In the IP Address field, enter the IP address of the trusted host you are adding.

Step 4 In the Port field, enter a port number if the sensor is using a port other than 443.

Tip To discard your changes and close the Add Trusted Host dialog box, click Cancel.

Step 5 Click OK . The IDM retrieves the certificate from the host whose IP address you entered in Step 3. The new trusted host appears in the trusted hosts list in the Trusted Hosts pane. A dialog box informs you that the IDM is communicating with the sensor:

A dialog box provides status about whether the IDM was successful in adding a trusted host:

Step 6 To view an existing entry in the trusted hosts list, select it, and click View . The View Trusted Host dialog box appears. The certificate data is displayed. Data displayed in this dialog box is read-only.

Step 7 Click OK .

Step 8 To delete a trusted host from the list, select it, and click Delete . The trusted host no longer appears in the trusted hosts list in the Trusted Hosts pane.

Tip To discard your changes, click Reset.

Step 9 Click Apply to apply your changes and save the revised configuration.

Trusted Root Certificates Pane

Use the Trusted Root Certificates pane to add trusted root certificates used to validate the root certificate chain of the updater server when updates are downloaded. The IPS validates whether the root certificate in the certificate chain is signed by a trusted root CA. For example, the TLS root certificates obtained during signature updates from the Cisco server and global correlation server will be validated.

In the Network pane, you can enable strict TLS certificate checking or you can disable it and the root certificate of the certificate chain will not be validated against the root certificate store. The default is disabled.

If the root CA validation fails, the TLS connection is not established and signature updates and global correlation updates are not downloaded from the update server.

The Trusted Root Certificates pane lists all trusted root certificates that you have added. You can use SCP or HTTPs protocol to add and update the trusted root certificates. Global correlation updates use SHA-384.

Note TLS root certificates installed on the sensor are preserved across software upgrades and recovery.

Note You can add and update entries from the list, but you cannot delete them.

For More Information

For information on enabling strict TLS server validation, see Configuring Network Settings.

Trusted Root Certificates Field Definitions

The following fields are found in the Trusted Root Certificates pane:

• TLS Certificate Name—Specifies the common name of the certificate.
• Expiry Date—Specifies the date the certificate expires.
• Issued To—Specifies the specific domain name to which the certificate is issued.
• Issued By—Specifies the entity that verified the information and issued the certificate.
• SHA1-Fingerprint—Specifies the Secure Hash Algorithm. SHA1 is a cryptographic message digest algorithm.
• MD5-Fingerprint—Specifies the Message Digest 5 encryption. MD5 is an algorithm used to compute the 128-bit hash of a message.

Add and Update Trusted Root Certificates Dialog Box Field Definitions

The following fields are found in the Add/Update Trusted Root Certificate dialog box:

• URL—Specifies the protocol and path from where the trusted root certificate can be downloaded.

Note Make sure the sensor has access to the server.

• Username—Specifies the login name on the server where the certificate is located.
• Password—Specifies the password of the user logging into the server where the certificate is located.

Adding and Updating Trusted Root Certificates

To add or update trusted root certificates, follow these steps:

Step 2 Choose Configuration > Sensor Management > Certificates > Trusted Root Certificates , and then click Add/Update to add or update a trusted root certificate.

Step 3 In the URL field, choose the protocol (SCP or HTTPs) and enter the path where the sensor can find the trusted root certificate.

Note Make sure the sensor has access to the server.

Step 4 In the Username field, enter the login name on the server where the certificate is located.

Step 5 In the Password field, enter the password of the username on the server where the certificate is located

Tip To discard your changes and close the Add/Update Trusted Root Certificate dialog box, click Cancel.

Step 6 Click OK . The new/updated trusted root certificate appears in the list.

Step 7 To refresh the list, click Refresh .

Server Certificate Pane

Note You must be administrator to generate server certificates.

The Server Certificate pane displays the sensor server X.509 certificate. You can generate a new server self-signed X.509 certificate from this pane. A certificate is generated when the sensor is first started. Click Generate Certificate to generate a new host certificate.

Server Certificate Pane Field Definitions

The Server Certificate pane displays the current server X.509 certificate. Click Generate Certificate to generate a new sensor X.509 certificate.

Displaying and Generating the Server Certificate

Note Write down the new fingerprint. Later you will need it to verify what is displayed in your web browser when you connect, or when you are adding the sensor as a trusted host. If the sensor is a master blocking sensor, you must update the trusted hosts table on the remote sensors that are sending blocks to the master blocking sensor.

To display and generate the sensor server X.509 certificate, follow these steps:

Step 2 Choose Configuration > Sensor Setup > Certificate > Server Certificate . The sensor server X.509 certificate is displayed.

Step 3 To generate a new sensor server X.509 certificate, click Generate Certificate . A dialog box displays the following warning:

Step 4 Click OK to continue. A new server certificate is generated and the old server certificate is deleted.