Operation ========= This chapter covers the operation of the Greenbone Security Manager Appliance and looks at the most important aspects that could be encountered during operation. This chapter highlights first steps of user management. In addition, the upgrade of the appliance directly via the Internet as well as via Airgap mode are discussed. Finally, the backup and restoring of data are topics of this chapter. User management --------------- The Greenbone Security Manager user management allows for the definition and management of different users with different roles and permissions. When initializing the GSM appliance the first user (web/scan user respectively) is being set up via the GOS-Admin-Menu. This user allows the login and management of additional users. The GSM user management supports a role based permission concept when accessing the web interface. Some roles are set up by default. However, other roles can be created and used by an administrator. The role defines which functions within the web interface a user is allowed to view and modify. The roles are not put in effect in the web interface rather than in the underlying :index:`OMP` protocol and as such have an impact on all OMP clients. Read and modifying access can be assigned to roles separately. Aside from roles the GSM user management supports groups as well. Groups allow the aggregation of users. This is mainly used for logical grouping. Aside from the management of permissions through roles, groups can also be assigned specific permissions. Additionally, through user management every user can be assigned a range of IP addresses of which scanning is allowed or prohibited. The GSM appliance then denies a specific user the scanning of IP addresses other than the ones specified. Access to specific adapters of the GSM appliance can be allowed or denied. The Greenbone Security Manager offers its own user management for the management of the roles and specific permissions of the users. In order not to have to manage multiple passwords and to allow for password synchronization the Greenbone Security Manager allows for integration with a central LDAP server. It will only be used for the verification of the password of the user during log in. All other settings are performed in the user management of the GSM appliance. The following sections cover the creation of individual users. The management of the permissions, groups and roles is covered in chapter :doc:`user_permissions`. Creating and Managing Users ^^^^^^^^^^^^^^^^^^^^^^^^^^^ The dialog for creating and managing users can be accessed via the menu :gos:webui:`Administration`. This menu is only visible to administrators since only they are allowed to create and manage users initially. Here the dialog for the creation of a new user can be started by clicking on the white star on blue background |new| or a user can be modified by clicking on the wrench icon. When creating a user the following settings are possible: .. figure:: images/newuser.png :align: center :height: 5cm Creating a new user * :gos:webui:`Login Name`: This is the name the user logs in with. If an LDAP server is used for central password management, the user needs to be created with the identical name (rDN) as in the LDAP server. The name can be a maximum of 80 characters and can contain letters and numbers. * :gos:webui:`Password`: This is the password for the user. The password can be a maximum of 40 characters and can contain any type of character. Please note when using special characters that they are available on all keyboards and operating systems in use. * :gos:webui:`Roles (optional)`: Each user can have multiple roles. The roles define the permissions of a user when using the OMP protocol. Since the Greenbone Security Assistance utilized the OMP protocol the roles define directly the features in the web interface. While it is possible to add and configure additional roles, at the beginning some default roles are available. These roles are discussed in more detail in section :ref:`user_roles`. * :gos:webui:`Groups (optional)`: Each user can be a member of multiple groups. Permissions management can be performed via groups as well (see section :ref:`permissions`). * :gos:webui:`Host Access`: Here it can be defined which systems a specific user can analyze in a scan and which systems should not be considered in a scan. These restrictions can also be set up for administrators. They can, however, remove these restrictions again themselves. This is why this function is simply a self-protection for administrators. Normal users (:gos:role:`User`) and roles without access to the user management respectively cannot circumvent this restriction. Basically it can be chosen between a whitelist (deny all and allow) and a blacklist (allow all and deny). In the first case the scanning of all systems is denied in general and only explicitly listed systems are allowed to be scanned. In the latter case the scanning of all systems is allowed except the listed systems. System names as well as IPv4 and IPv6 addresses can be entered. Furthermore individual IP addresses as well as address ranges and network segments can be specified. The following listing shows some examples: * 192.168.15.5 (IPv4 address) * 192.168.15.5-192.168.15.27 (IPv4 range long form) * 192.168.15.5-27 (IPv4 range short form) * 192.168.15.128/25 (CIDR notation) * 2001:db8::1 (IPv6 address) * 2001:db8::1-2001:db8::15 (IPv6 range long form) * 2001:db8::1-15 (IPv6 range short form) * 2001:db8::/120 (CIDR notation) All options can be mixed and matched and entered as a comma separated list. The netmask in the CIDR notation is restricted however to a maximum of 20 for IPv4 and 116 for IPv6. In both cases the result is a maximum of 4096 IP addresses .. figure:: images/addeduser.png :align: center :height: 3cm Displaying a user * :gos:webui:`Interface Access`: Here it can be specified which network adapter a user can run a scan on. A comma separated list of network adapters can be entered and similar to the Host Access it can be chosen between a whitelist and blacklist methodology. .. tip:: In general the whitelist methodology should be used and scans of systems denied except for the chosen systems. This is to ensure that users do not scan systems by accident or unknowingly that are outside of their responsibility, are located somewhere on the Internet or react critical to a scan. After creating the user the user’s properties are displayed. The display should be verified to ensure that the user does not have too many permissions assigned to him. .. _upgrade: Upgrade ------- As part of your subscription Greenbone provides upgrades for the GSM appliance. The upgrades are provided regularly. Users can decide if an upgrade should be applied. The given numbers are based on the release data from the last 5 years as well as based on experience of the Support Team when helping customers to execute an upgrade. There are three different kinds of updates: * Patch-Level upgrade (i.e. from version 3.0.16 to 3.0.17) * ca. 1 per month * some recommended, some critical (security) * 10 min per Master-GSM * Release upgrade (i.e. from version 3.0.16 to 3.1.0) * ca. 1-2 per year * upon preference or due to End-of-Life * 2-6 hours (depending on whether it is necessary to adjust configuration due to functionality changes and whether users need to be trained about the changes) * LTS Release upgrade * ca. 1 per 2 years * required due to End-of-Life * ca. 1-2 days (depending on whether it is necessary to adjust configuration due to functionality changes and whether users need to be trained about the changes) * Generation Upgrade (i.e. from version 2.2.9 to 3.1.0) * ca. 1 per 2 years * upon preference or due to End-of-Life * ca. 1-2 days (depending on whether it is necessary to adjust configuration due to functionality changes and whether users need to be trained about the changes) These upgrades are not being performed automatically. The user has to invoke the upgrades manually. |gb_video| The upgrade steps are also explained in a video at http://docs.greenbone.net/Videos/gos/en/GSM-Upgrade-en-20150703.mp4. If there are Master-GSMs as well as Slave-GSMs in the environment the following information is important: * Sensors are being updated automatically by the master. * Slaves must be updated manually. The masters should be updated first and then the slaves. It works this way under :index:`Airgap` operation as well. * Two GSMs with different patch levels can work together. However, this is not supported. * Different release versions on master and slave are not possible! Checking the Current Version ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ To check the current version all that is required is to connect to the GSM appliance. A log in is not even required. The welcome message of the GSM lists the current version in its banner. Alternatively executing the command :gos:cmd:`softwareversion` produces the same output. .. code-block:: bash Welcome to the Greenbone OS 3.1.6 running on a Greenbone Security Manager Web Interface available at : https ://192.168.155.100 gsm login : The log in screen of the web interface can also be checked. The version is displayed at the bottom right as well. Alternatively after logging in using the command line via SSH for example, the version can be checked in the GOS-Admin-Menu. Under :gos:menu:`Upgrade` it can be checked directly if an newer version is available. The current installed version can be displayed with *Current*. *Available* displays the latest version downloaded from the Greenbone feed server during last feed synchronisation. Under menu option :gos:menu:`Sync` available versions on the Greenbone servers can be checked and a possible installation can be downloaded. Performing Patch-Level upgrades ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Before performing an upgrade it is recommended to inform yourself of the changes resulting from an upgrade. Greenbone is documenting all changes that are performed by an update on http://www.greenbone.net/technology/gos_release_history.html. Before an upgrade a backup of the GSM should be performed also. The backup procedures are covered in section :ref:`backup_restore`. It makes sense to backup the entire appliance on the internal backup partition if supported by the appliance. Furthermore the timing of the backup should be chosen so that no scans are actively run or started. Possibly individual system services will be restarted. This could cause scan results to get lost and limit the speed of an upgrade. A Patch-Level upgrade usually completes after a couple of minutes. Afterwards a reboot is not required but recommended. The upgrade is started via the GSM-Admin-Menu. Start the GSM-Admin-Menu and then select menu option :gos:menu:`Upgrade`. .. figure:: images/ updateavail.png :align: center :width: 70% The GOS-Admin-Menu displays the availability of new versions .. figure:: images/ syncupdate.png :align: center :width: 70% The search for updates can be started at anytime. With the menu option :gos:menu:`Sync` the availability of new versions can be checked anytime. It starts a new software synchronization in the background. The upgrade functions will then be disabled temporarily. By selecting the menu option :gos:menu:`Refresh` the display can be updated. Synchronizing available upgrades can take several minutes as the required data for a possible upgrade is downloaded. Afterwards the upgrade can be performed via the menu option :gos:menu:`Upgrade`. Normally this process takes only a couple minutes, if a jump over multiple patch levels is performed it can take several minutes more. The upgrade is also requested in the background. For the actual start of the upgrade it can still take several minutes. All the while the GOS-Admin-Menu displays the message ``System upgrade is scheduled``. As soon as the upgrade is performed the message in the GOS-Admin-Menu changes to ``System-Upgrade is in process``. A couple of minutes later the message of the current version changes. The upgrade is not completed, however, until the message shows the system upgrade. .. figure:: images/systemupgrade.png :align: center :width: 70% System upgrade in progress After completion a system reboot should be performed. Release Upgrade ^^^^^^^^^^^^^^^ A release change is not being indicated in the GOS-Admin-Menu. A release change is announced by Greenbone via Newsletter and on the web site. Select the menu option :gos:menu:`Switch Release` in the GOS-Admin-Menu. After a warning message the available release is displayed and is being downloaded from the Greenbone Feed servers. This process can take up to an hour depending on the Internet connection. Afterwards a new version for upgrade is being offered in the GOS-Admin-Menu and the release change is preformed along the same lines as a Patch-Level upgrade. .. figure:: images/rel_upgrade.png :align: center :width: 70% Release upgrade To complete a reboot is required. The upgrade can also take a couple of hours. While upgrading no scans should be running or being started. Use of Proxies ^^^^^^^^^^^^^^ In case the GSM appliance cannot access the Internet directly and requires the use of a proxy, it must be stored on the GSM appliance. Start the GOS-Admin-Menu and select the :gos:menu:`Feed` option. Then select the option :gos:menu:`Proxy Feed`. Here the proxy can be entered. Make sure that a valid HTTP-URL is used. Names as well as IP address can be used. :: http://proxy.mycompany.com:3128 http://192.168.15.5:3128 To enter proxy credentials select :gos:menu:`Credentials` in the same menu. This proxy configuration will be used for the feed updates as well as for the software updates. .. _backup_restore: Backup and Restore ------------------ Regularly backing up the GSM appliance and the created data ensures fast restoration of operation of a new appliance, should the appliance have to be replaced by Greenbone after a failure of the appliance. Moreover, to be safe a backup of the system should be done prior to every update. Three different ways of backup are available: * Backup of the entire system (SystemBackup) * Snapshot of the entire system (SystemSnapshot) * Backup of the created and changed data (user data). This includes all created scan configurations, users, overrides and so on. A backup of the entire system prior to every update of the GSM appliance is recommended. This ensures the GSM appliance can be returned to its original state should the update fail. A backup of the user data should be performed regularly. With this backup it is possible to restore your configurations after an exchange by Greenbone should the appliance have failed. Additionally this backup is recommended prior to every update. The following sections cover the individual steps. Backup of the entire system ^^^^^^^^^^^^^^^^^^^^^^^^^^^ The way the backup of the entire system is performed depends on the appliance in use. The GSM ONE and GSM 25V are virtual appliances. It is very simple to utilize the backup functionalities of the hypervisor. The hypervisor, for example, supports the snapshot functionality that allows to backup and if needed the restoring, of the current state of the running system. The GSM 25 and GSM 100 do not support the backup of the entire system. All other appliances (GSM 500 and up) come with a backup partition. The backup partition can store exactly one complete backup of the appliance. An incremental backup or the provisioning of other types is not supported. To perform a complete backup start the GOS-Admin-Menu from the console. Select the menu option :gos:menu:`Backup`. The menu being displayed has the options :gos:menu:`Create System Backup` and :gos:menu:`Restore System Backup`. .. figure:: images/full-backup.png :align: center :width: 70% The complete backup is being started from the GOS-Admin-Menu :gos:menu:`Create System Backup` start the backup process. Afterwards the GSM appliance will reboot within the next 10 minutes (often immediately) and the system is backed up to the backup partition. This process can take about 30-60 minutes. A respective maintenance window is required and before starting the backup the process has to be confirmed. .. figure:: images/full-yes.png :align: center :width: 70% The backup requires some time. While the appliance waits to reboot other menu options in the backup menu are no longer available. .. figure:: images/backup-unavail.png :align: center :width: 70% After scheduling a backup, until reboot, other options are no longer available. Restoring the GSM appliance from a complete backup is also performed with the assistance of the GOS-Admin-Menu. Select the menu option :gos:menu:`Restore from Partition`. A maintenance window of 30-60 minutes is also required and the appliance performs a reboot. The process needs to be confirmed as it could cause data loss. .. note:: If, since the last backup, there have been changes to user data, new scan configurations, tasks or overrides, they will be overridden. If in doubt user data should be backed up before restoring! .. _snapshot: Snapshot of the System ^^^^^^^^^^^^^^^^^^^^^^ The snapshot backup is another alternative to backing up the entire system. The system snapshot is only available with certain appliances (i.e. 5xx but not 6xx). Both the system backup as well as the system snapshot creates a complete backup of the partition. However both of the backups don’t override each other. This means that practically two (backup) states can be stored (with one GSM 5xx). A GSM 600 only the system backup is possible for example. To start the creation of a snapshot change to the command line and enter the command :gos:cmd:`systemsnapshot`. Afterwards the GSM appliance will boot and create the snapshot. With the GSM 5xx a snapshot backup as well as a system backup can be created. Restoring of a system snapshot backup is done via the Grub boot menu. Connect to the system vie serial port or a VGA monitor. Perform a reboot. In the grub menu (before the GOS boot) a menu option :gos:menu:`Snapshot Backup` should be displayed. Select this option. The system now boots into the snapshot. .. _user_data: Backup of User Data via USB-Stick ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Backing up of user data is performed on all GSM appliances in the same way. The GSM appliance supports first of all the backup of the user data to the GSM appliance itself. The file created can be copied to a USB key or a separate SSH server afterwards. This way the data will still be available when the appliance fails. To save the data to an external USB key two steps are always required: #. Backup of the user data #. Copying of the backup to the USB key The same process is performed backwards when restoring the user data. First the user data is copied from the USB key or the SSH server to the appliance. Then the data can be restored. The following covers the individual steps. |gb_video| These backup steps are also explained within the following video covering upgrades: http://docs.greenbone.net/Videos/gos/en/GSM-Upgrade-en-20150703.mp4. First, log into the appliance, for example, via SSH. The start the GOS-Admin-Menu and select the menu option :gos:menu:`Backup`. After selecting the option :gos:menu:`Userdata Backup` the menu options concerning the Userdata Backup are available. While the actual Userdata backup is in progress the other options will be blocked until the backup is complete. Otherwise the system can be used as usual. A maintenance window is not required. A reboot is not performed either. .. figure:: images-3.1/backup-user1.png :align: center :width: 70% The backup of user data can be done during regular operation. Opposite to the complete backup multiple versions of user data backups can be stored on the appliance. They are being saved by name with the following pattern:: -