4.1.1. Procedure – Configuring Postfix

Purpose: 

Zorp uses Postfix as a native service for handling emails. A mail transferring agent (MTA) must be installed on the machine at least for delivering the locally generated messages.

Steps: 

1. Select the mail server configuration that best meets your needs. The following options are available:

   

   Figure 4.1. Postfix Configuration - General

   
   

   • No configuration: No configuration changes will be done. Use this option if a working Postfix configuration is already available on the host, or if you wish to configure Postfix manually from ZMC.

   • Internet Site: Sending and receiving mails is possible by using SMTP directly. This option is suitable in the most common scenarios.

   • Internet with smarthost: Mails are received either by using SMTP directly or by running a utility such as fetchmail. Outgoing messages are sent through another machine (a smarthost).

   • Satellite system: No mail is received locally. Root and postmaster mails are handled according to /etc/aliases. All messages are sent to another machine (a smarthost) for delivery.

   • Local only: Mails are only delivered locally on the machine for local users. There is no network.

2. Enter the name that should appear in the domain part of the outgoing mail (that is, after the @ character). This name will also be used by other programs. It should be the fully qualified domain name (FQDN).

   

   Figure 4.2. Postfix Configuration - mail name

   
   

4.1.2. Procedure – ZCV — Configuring the zorp-utils package

Purpose: 

If you are installing ZCV, then configure the zavupdate tool that updates the databases of the virus filtering engines:

Steps: 

1. FTP proxy: The zavupdate application can download database updates through FTP or HTTP. Enter the URL of the FTP proxy to be used (or NONE if the updates can be downloaded directly without using a proxy server).

   

   Figure 4.3. Configuring zorp-utils - Configuring the FTP proxy for database updates

   
   

2. HTTP proxy: The zavupdate application can download database updates through FTP or HTTP. Type the URL of the HTTP proxy to be used (or NONE if the updates can be downloaded directly without using a proxy server).

   

   Figure 4.4. Configuring zorp-utils - Configuring the HTTP proxy for database updates

   
   

3. Send update logs in email: zavupdate can send the logs of the periodic antivirus (AV) update to the administrator through email. Type the address of the administrator and the subject to be used in these emails. If you do not want email notifications, enter NONE.

   

   Figure 4.5. Configuring zorp-utils - Specifying the administrator's email address

   
   

   Note
   It is not advised to use a personal email address. Instead, use an address of a shared folder that can be accessible to whom it belongs. It can also be the address of a mailing list. In this way, more than one administrator can be notified at the same time, and the archive of the messages can be accessed by more than one administrator.

4. Specifying email prefix: zavupdate can add a prefix to the subject of the emails it sends to make sorting the messages easier for the administrator. Type a prefix (for example the name of the host in square brackets), or leave these fields blank. You can use command subtitution using backticks (`) to include the output of any Linux shell command in the subject. This command will be run before sending the email and the output of the command will be the prefix of the email.

   Note

   This setting can only be changed manually later. Therefore, make sure that you enter a value that you will not want to change. As a best practice, use a command rather than a fixed name. A command will dynamically follow the changes to your infrastructure, however, a fixed name will not. For example, if you use the name of the host myhost1 and later you rename your host myhost2, you will still be receiving emails with the myhost1 prefix and that can be confusing.

   

   Figure 4.6. Configuring zorp-utils - Specifying a prefix for the administrator's email messages

   
   

   In practice, it can be used in your mail client (or on the mail server) to move these mails (with the given prefix) automatically to a subfolder in the inbox. Also, it can be used to differentiate between emails originating from several firewalls. This can be especially useful if, for example, you have several firewalls and you want to easily identify the firewall that had an unsuccessful update.

   Example 4.1.
   For example, if you use hostname --long as prefix, you can later determine the exact origin of the message from the prefix, because it will display the Fully Qualified Domain Name (FQDN) of the host.

   Note
   If you want to change this setting later, you can reconfigure zorp-utils with the following terminal command: dpkg-reconfigure zorp-utils

5. Verbosity level of zavupdate: Select the level of verbosity of zavupdate.

   First the zavupdate options are displayed:

   

   Figure 4.7. Configuring zorp-utils - Configuring the verbosity of zavupdate — options

   
   

   Each level includes the logs of the levels above, for example, Verbose logging will include all errors and successful update messages too.

   • No logging: logging is disabled

   • Errors only: only error messages are logged

   • Normal logging: error messages and successful updates are logged

   • Verbose logging: detailed logging

   • Everything: everything is logged, including the output of the update programs of ClamAV and/or NOD32

   Then you can select the actual log level:

   

   Figure 4.8. Configuring zorp-utils - Configuring the verbosity of zavupdate log level

   
   

6. Specify the firewall's Balasys Support System technical account username and password to enable the firewall to access the Zorp repository and to download the updates.

   

   Figure 4.9. Configuring zorp-utils - Specifying the user name for the technical uer to access Zorp repository

   
   
   

   Figure 4.10. Configuring zorp-utils - Specifying the technical user’s password to access Zorp repository

   
   

7. Configuring zavupdate: Specify the actual minutes when the zavupdate process shall start in every hour. In case the necessary licenses are also purchased for the URL filter database, the upgrade for the URL database will also be performed as part of the zavupgade process. The upgrade for the URL filter database though will be performed only in the hours being specified in the next step.

   

   Figure 4.11. Configuring zavupdate - Specifying the actual minutes for the zavupdate process to start

   
   

8. Specify the timing for the URL filter database: Specify the actual hours when the upgrade of the URL filter database shall take place. Provide the actual hours for the time of the upgrade.

   

   Figure 4.12. Specifying the exact time for the upgrade

   
   

9. Fill in this field only if it is required. (optional step)

   In specific cases, based on an agreement between Balasys and the customer, the customer has a mirror URL filtering database. The location of this mirror database can be specified here.

   In any other cases, please leave this field empty or add the value NONE.

   

   Figure 4.13. Configuring zorp-utils - Updating URL filtering database

   
   

10. Choose the size of the URL filter database.

    At this stage, the administrator can choose the size of the URL filtering database. The database can be a smaller-sized, optimized database (the recommended version) for usual scenarios, which requires 1 GB storage space and 300 MB daily update traffic, or a normal database for more extensive scenarios, which requires 6 GB storage space and 2 GB daily update traffic. If there are no specific needs, we recommend to choose the optimized database.

    

    Figure 4.14. Configuring zorp-utils - Selecting the size of the URL filtering database

    
    

4.1.3. Procedure – ZCV — Configuring the NOD32 virus filtering modules

Purpose: 

If you are installing ZCV with the NOD32 module, complete the following steps:

Steps: 

1. To delete the virus database if you remove the NOD32 package, select Yes.

   

   Figure 4.15. Deleting the virus database

   
   

2. To be able to use the NOD32 Scanner effectively, you have to update the NOD32 virus database. The databases of the NOD32 module can be instantly updated from the official NOD32 webserver if the machine you are installing Zorp on has network access.

   To update the NOD32 module, select Yes.

   Otherwise, you can start an update using the zavupdate command later.

   

   Figure 4.16. Updating the virus database

   
   

4.1.4. Procedure – Configuring One Time Password for initial connection to ZMSs

Purpose: 

If the host you are installing will be managed from ZMS, you have to configure a One Time Password (OTP) for connecting to ZMS the first time. To configure the initial OTP, complete the following steps.

Steps: 

1. Type a One Time Password that will be used to connect to ZMS for the first time. Subsequent connections will be mutually authenticated using X.509 certificates.

   

   Figure 4.17. One time password

   
   

2. To receive email alerts from ZMS before a certificate or license used in Zorp expires, type the email address of the administrator who will receive these alerts.

   

   Figure 4.18. PKI email

   
   

4.1.5. Procedure – Configuring Zorp Management Server (ZMS)

Purpose: 

To configure Zorp Management Server, complete the following steps.

Steps: 

1. Configure the site name.

   The hosts managed by ZMS are organized into sites. Use a descriptive name for the site, for example, the name of the company. This will help the administrator distinguish ZMSs from each other. Enter the site name.

   

   Figure 4.19. Configuring the site name

   
   

2. Configure the hostname of the ZMS Engine.

   It is recommended to enter the normal hostname, but do not use FQDN. The default value is ZMS-Host.

   Warning
   Make sure to enter the correct hostname, because it is stored in the ZMS database and is complicated to modify later.

   

   Figure 4.20. Configuring the hostname of the ZMS Engine supervising the Zorp host

   
   

3. Configure the initial password of the administrator user on ZMS.

   Enter the ZMS administrator password. This password is used to login to ZMS from the Zorp Management Console as an administrator, and configure the Zorp firewalls. The username of the administrator by default is admin, which can be modified later. The password can be changed later at any time.

   Note
   Make sure to create a password that conforms to the secure password generation standards of your organization. Store the password in a secure way.

   

   Figure 4.21. Configuring the initial password of the administrator user on ZMS

   
   

4. Configure the Certificate Authority of ZMS.

   Enter a secure password for the Certificate Authority (CA) of ZMS. This password will be used as the passphrase of the initial CA certificate.

   Note
   Make sure to create a password that conforms to the secure password generation standards of your organization. Store the password in a secure way.

   Warning
   Make sure to enter the correct CA password. It is difficult to change the CA password later and requires regenerating the whole CA chain.

   

   Figure 4.22. Specifying the CA password of ZMS

   
   

5. Create the root Certificate Authority.

   ZMS includes public key infrastructure (PKI) management to ensure that each element of the firewall system (ZMS module, VPNs, users) can be authenticated with X.509 certificates. During this stage of the installation the root CA is created and configured. Provide the following parameters.

   

   Figure 4.23. Creating the root Certificate Authority

   
   

   Warning
   Do not use accented characters. They are not supported in the X400/X500 standard.

   • Country ID: two characters only. For example, US, DE, HU.

   • State: Optional. United States (US) only. For example, Nevada.

   • City: Optional. For example, Las Vegas.

   • Company name: Optional. For example, Example Ltd..

   • Department name: Optional. For example, IT department.

4.1.6. Procedure – Selecting the role of the host

Purpose: 

By default, the iptables utility denies any traffic going through or to the machine. The installer configures the iptables utility according to the role of the host. This selection affects only the first installation of the host, it will not modify an existing iptables configuration.

Steps: 

1. Select the role of this machine in your firewall configuration. The following roles are available:

   

   Figure 4.24. Selecting the role of the host

   
   

   • FIREWALL: Only connections from the ZMS host are allowed.

     Select this role when you are installing a firewall host, or any other standalone host that will be managed from ZMS.

     ZMS agent and remote shell (SSH) communication will be enabled. This technically means ports TCP/1311 and TCP/22.

   • ZMSHOST: Only connections from ZMCs are allowed.

     Select this role if you are installing the Zorp firewall and the Zorp Management Server on the same host.

     ZMC to engine communication and remote shell communication will be allowed on ports TCP/1314 and TCP/22, respectively.

   • NONE: The host is unreachable from the network.

     All IP traffic will be dropped by default, therefore all remote administration attempts will fail. All allowed traffic has to be enabled manually from a local terminal.

2. If you have selected the FIREWALL or the ZMSHOST role, enter its IP addresses:

   

   Figure 4.25. Specifying the IP addresses of the machines running ZMC

   
   

   • FIREWALL: The IP address of the ZMS host used to manage the firewall.

   • ZMSHOST: The IP address of the ZMC used to manage the ZMS host (that is, the machines from where the firewall administrators will connect to ZMS). If managing ZMS is allowed from multiple hosts, separate the IP addresses of these hosts with spaces.

   Warning
   Make sure that you type the IP adresses of the ZMS/ZMC hosts correctly. Otherwise, the machine will not be accessible from ZMS/ZMC. In this case, you must manually correct the configuration of iptables. For details, see man iptables-utils.

6.1.1. Procedure – Installing the Zorp Authentication Agent on Microsoft Windows

Purpose: 

The Zorp Authentication Agent (ZAA) installer is located in the \windows\satyr\ folder of the Zorp CD-ROM, its latest version is also available from the Balasys website.

The following Zorp Authentication Agent installer options are available:

/S Silent mode
/D=[path] Set target path
/NO_VCREDIST Do not check/install Visual Studio Redistributable
/log-mpxd=[yes|no] Enable debug logging of AA multiplexer daemon
/log-client=[yes|no] Enable debig logging of AA client

Steps: 

1. Place the Zorp CD-ROM into the CD drive and start the satyr-setup.exe file located in the \windows\satyr\ folder.

   Warning
   Administrator privileges are required to install the application.

2. Click I agree to accept the End-User License Agreement, which is displayed after the installer starts. To cancel the installation at any time during the process, click Cancel.

   

   Figure 6.1. Accepting the EULA

   
   

3. Select the destination folder for the application and click Install. The default folder in the 64-bit version of Windows is C:\Program Files (x86)\Satyr Client (in the 32-bit version of Windows, it is C:\Program Files\Satyr Client).

   

   Figure 6.2. Selecting the destination folder

   
   

4. Click Show details to display details about the copied files. The installer copies the required files and registers the service called Zorp Authentication Agent Multiplexer, which is started after the registration.

   

   Figure 6.3. Copying the files

   
   

5. Optional step: Click Browse, select the CA certificate to import, then click Close to import the CA certificate.

   Note
   For authentication purposes, when Zorp communicates with ZAA, ZAA expects TLS-encrypted communication. For details, see section Section 4.1.1, Registry entries on Microsoft Windows platforms in Zorp Authentication Agent Manual and section Section 4.1, Configuring Zorp Authentication Agent on Microsoft Windows platforms in Zorp Authentication Agent Manual.

   If the Zorp Authentication Agent and Zorp communicate through an SSL-encrypted channel (recommended), the certificate of the Certificate Authority (CA) signing the certificates of the Zorp firewalls can be imported to the Zorp Authentication Agent.

   Note
   The CA certificate has to be in DER format. It is not necessary to import the certificate during the installation, it can also be done later. For details about encrypting the agent-Zorp authentication, see Section 4.1.3, Configuring SSL connections on Microsoft Windows platforms in Zorp Authentication Agent Manual.

   

   Figure 6.4. Importing the CA certificate

   
   

6. After the installer has completed the above steps, click Close.

7. The Zorp Authentication Agent (ZAA) logo is displayed on the system tray, indicating that the application is running. It is also started automatically after each Windows startup.

6.1.2. Procedure – Installing Zorp Authentication Agent with Group Policy Object (GPO) deployment

Prerequisites: 

Steps: 

1. Download the .exe format installer. The browser application or the Windows Defender Cloud might send a notification or a warning due to the new and unknown installer program, this can be disregarded.

2. Install the Windows Client and import the CA certificate during the installation. Reboot the system, if it is necessary.

3. Define the preferences with the help of the GUI or via the registry.

4. Test the expected behaviour by initiating traffic.

5. Export the following registries:

   • Export the HKEY_CURRENT_USER\Software\BalaBit\Satyr registry to the hlcuzaa.reg file, which contains the user settings for ZAA. The result shall be as follows:

     Windows Registry Editor Version 5.00
     
     [HKEY_CURRENT_USER\Software\BalaBit]
     
     [HKEY_CURRENT_USER\Software\BalaBit\Satyr]
     "Has preferences"=dword:00000000
     "SSL"=dword:00000001
     "Automatic"=dword:00000001
     "Details"=dword:00000000
     "Can Remember"=dword:00000001
     "Forget Password"=dword:00000000
     "Forget Password Interval"=dword:00000001

   • As ZAA Client is 32 bit executable, and runs on both 32 and 64 bit systems, if the target system is a 32 bit system, as Windows, for example, the following solution is required:

     Export the HKEY_LOCAL_MACHINE\SOFTWARE\BalaBit\Satyr, which contains the ZAA Multiplexer settings, into the hklmzaa32.reg file. The result shall be as follows:

     Windows Registry Editor Version 5.00
     
     [HKEY_LOCAL_MACHINE\SOFTWARE\BalaBit]
     
     [HKEY_LOCAL_MACHINE\SOFTWARE\BalaBit\Satyr]
     "InstallLang"="1033"

   • If the target system is a 64 bit system, export the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BalaBit\Satyr registry to the hklmzaa64.reg file, which contains the multiplexer settings. The result shall be as follows:

     Windows Registry Editor Version 5.00
     
     [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BalaBit]
     
     [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BalaBit\Satyr]
     "InstallLang"="1033"

     Note
     If the ZAA Client will be used on both 32 and 64 bit systems, create both registries, adding or removing the WOW6432NODE string to the paths. ZAA will use the corresponding one.

     For more details, see 32-bit and 64-bit Application Data in the Registry.

     Later at the deployment, the registries can be distributed as duplicated keys on the target system safely, as detailed at the following site: Registry key WOW6432Node may be listed in system registry in 32 bit (x86) version of Windows 7.

     The service private certificate store, used by the ZAA Multiplexer, can also be deployed as a registry key.

   • Export the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Cryptography\Services\satyr-mpxd registry to the hklmzaacert.reg file. The result shall be as follows:

     Windows Registry Editor Version 5.00
      
     [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Services\satyr-mpxd]
      
     [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Services\satyr-mpxd\
     SystemCertificates]
      
     [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Services\satyr-mpxd\
     SystemCertificates\MY]
      
     [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Services\satyr-mpxd\
     SystemCertificates\MY\Certificates]
      
     [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Services\satyr-mpxd\
     SystemCertificates\MY\Certificates\6421DCB8501C2E1F15DB8BD3A94F435C01DB7CD3]
     "Blob"=hex:03,00,00,00,01,00,00,00,14,00,00,00,64,21,dc,b8,50,1c,2e,1f,15,db,\
     ...
     ...
     ...
     ...
     ...
       64,0a,87,e9,45,99,04,9e,28,cb,c0,6c,2a,e5,c7,cb,ce,29,d8,b1,e1

     Note
     Note that there can be several empty paths created by the system automatically, which can be included safely.

   For further details on registries, see Section 4.1.1, Registry entries on Microsoft Windows platforms in Zorp Authentication Agent Manual.

   As a result, there will be four registries exported.

6. Switch to the GPO administrator system and download the ZAA msi flavor installer and place it in the Windows share where the other remotely installled applications are stored.

7. Continue with the procedures detailed in section Procedure 4.1.5, Configuring Group Policy Object (GPO) deployment in Zorp Authentication Agent Manual