Alert Logic Web Security Manager for Amazon Web Services Direct (Linux)

Create a security group for protected hosts

A security group acts as a firewall that controls the traffic allowed to reach your instances.

To create a security group for protected hosts:

1. Log into the Amazon Web Services console, and then navigate to EC2.
2. In the navigation pane, click Security Groups.
3. Click Security Group.
4. In Create Security Group:
   • In Name, enter Alert Logic TM Protected.
   • In Description, enter Alert Logic Threat Manager Protected Hosts.
   • In VPC,
     • If you do not have a VPC, select No VPC from the drop-down menu.
     • If you have a VPC, select the desired VPC ID from the drop-down menu.
5. Click Yes, Create.

Create a security group for the appliance

To create a security group for an appliance:

1. Log into the Amazon Web Services console, and then navigate to EC2.
2. In the navigation pane, click Security Groups.
3. Click Security Group.
4. In Create Security Group:
   • In Name, enter Alert Logic TM Appliance.
   • In Description, enter Alert Logic Threat Manager Appliances.
   • In VPC,
     • If you do not have a VPC, select No VPC from the drop-down menu.
     • If you have a VPC, select the desired VPC ID from the drop-down menu.
5. Click Yes, Create.

Set up rules for appliances and protected hosts

Be sure to set up the following rules:

• Inbound appliance rules
• Outbound appliance rules
• Rules for protected host security group

Set up inbound appliance rules

To edit a inbound appliance rules in a security group:

1. Log into the Amazon Web Services console, and then navigate to the EC2 section.
2. In the navigation pane, click Security Groups.
3. Select the security group you want to edit.
4. Click the Inbound tab.
5. Apply the appropriate rules.

6. Click Apply Rule Changes.

Set up outbound appliance rules

Outbound firewall rules for AWS pertain only to VPC customers. By default, the outbound rules open any port to any destination. These firewall rules are acceptable, but you can edit them.

To edit outbound appliance rules in a security group:

1. Log into the Amazon Web Services console, and then navigate to the EC2 section.

2. In the navigation pane, click Security Groups.

3. Select the security group you want to edit.

4. Click the Outbound tab.

5. Apply the appropriate rules:

6. Click Apply Rule Changes.

Set up rules for protected host security group

1. Select VPC Security Groups, from the Viewing pull-down menu.
2. Click the Outbound tab, and apply the following rules, as necessary:
   
   To use the US data center:

   Create a new rule	Port range	Destination
   Custom TCP Rule	7777	<Appliances>*
   Custom TCP Rule	443	204.110.218.96/27
   Custom TCP Rule	443	204.110.219.96/27
   Custom TCP Rule	443	208.71.209.32/27

   To use the EU data center:

   Create a new rule	Port range	Destination
   Custom TCP Rule	7777	<Appliances>*
   Custom TCP Rule	443	185.54.124.0/24

   * In the above examples, replace <Appliances> with the Alert Logic TM Appliances security group ID.

3. Click Apply Rule Changes.
4. Repeat these instructions for every protected host security group associated with the appliance you configure.

Download the agent

To download the agent:

1. In the Alert Logic console, open the Settings menu, and then click Support Information.
2. From the menu bar, click Quick Install Guide and Downloads.
3. Download the appropriate agent and follow the on-screen instructions.
   • For Windows users, click Windows Agents, and then select the desired agent.
   • For Linux users, click Linux Agents. Linux users can select either Debian-based agent installers or RPM-based agent installers. Both installers are available in a 32-bit or 64-bit format.
     
4. Locate the Unique Registration Key from the Downloads screen. Copy your unique registration key. You will need to enter this key to install the agent.
   

Install the agent for Linux

Install the agent

To install the agent:

1. Copy package to the target machine.
2. If you run SELinux, you must first run the following command:
   semanage port -a -t syslogd_port_t -p tcp 1514

3. Run one of the following commands, depending on the distribution:
   • RPM: rpm -U al-agent-<version>*.rpm
   • Debian: dpkg –i al-agent-<version>*.deb

4. (Optional) If you have set up a NAT, virtual, or physical appliance and want to specify it as a single point of egress for agents to use, run the following command:
   /etc/init.d/al-agent configure --host <THREATMANAGERAPPLIANCEIP>

5. (Optional) If you have set up a proxy, and you want to specify the proxy as a single point of egress for agents to use, then run the following command: /etc/init.d/al-agent configure --proxy <PROXYIP/PROXYHOST>
   

A TCP or HTTP proxy may be used in this configuration.

6. Run the following command: /etc/init.d/al-agent start

7. Do one of the following:

8. Restart the syslog daemon.

Install the agent with image capture

To install the agent with image capture:

1. Copy the package to the target machine.
2. If you run SELinux, you must first run the following command:
   semanage port -a -t syslogd_port_t -p tcp 1514

3. Run one of the following commands, depending on the distribution:
   • RPM : rpm -U al-agent-<version>*.rpm
   • Debian: dpkg –i al-agent-<version>*.deb

4. (Optional) If you have set up a NAT, virtual, or physical appliance and want to specify it as a single point of egress for agents to use, run the following command:
   /etc/init.d/al-agent configure --host <THREATMANAGERAPPLIANCEIP>

5. (Optional) If you use an rsyslog daemon, add the following line to rsyslog.conf:
   *.* @@127.0.0.1:1514;RSYSLOG_FileFormat

6. (Optional) If you use a syslog-ng daemon, add the following lines to syslog-ng.conf:
   1. destination d_alertlogic {tcp("localhost" port(1514));};
   2. log { source(s_src); destination(d_alertlogic); };

7. Restart the syslog daemon.
8. In the EC2 console, stop the running instance.
9. To create a new AMI, right-click the stopped instance, then click Image, and then click Create Image. In Create Image enter a name and description for the new AMI, and then select No Reboot.
10. (Optional) Start an instance from the newly-created AMI, and verify that the agent has registered with the Alert Logic console.
    If you need to edit your OS image, do not register the agent in the Alert Logic console.
    • To stop the agent, enter /etc/init.d/al-agent stop
    • If the following files are present, remove the files before you shut down and save the image: /var/alertlogic/etc/host_crt.pem and /var/alertlogic/etc/host_key.pem

Create an assignment policy

An assignment policy is a set of rules that indicates to appliances how to handle incoming traffic; the appliance will either accept or ignore the traffic. An assignment policy directs protected hosts to encrypt traffic and send traffic to specific appliances. In a dynamic environment where IP addresses often change, an assignment policy ensures that hosts always correspond to their appliances.

To create an assignment policy:

1. In the Alert Logic console, click CONFIGURATION, and then click Deployments.
2. In the left navigation area, click Policies.
3. Click the Assignment tab.
4. Click the Add icon ().
5. In Appliance Assignment Policy Name, enter a name.
6. In Appliances, select an appliance.
7. Click Save.

Assign a policy to a protected host

To assign a policy to a protected host:

1. In the Alert Logic console, click CONFIGURATION, and then click Deployments.
2. Click the All Deployments tile.
3. In the left navigation pane, click Networks and Hosts, and then click the Protected Hosts tab.
4. Click the pencil icon ( ) for the desired protected host.
5. Select Use an Existing Assignment Policy.
6. From the Existing Assignment Policy drop-down menu, select the assignment policy you want to use.
7. Click SAVE.

Related topics