CloudSphere Appliance Pre-Reqs (Summary) – CloudSphere

This document provides the appliance prerequisites as a single summary document.

General Requirements

Supported (Appliance Deployment) Platforms

VMware ESX server platform, AWS cloud, Azure cloud, Google Cloud Platform

Installation:

The CloudSphere virtual Appliance download and installation instructions are found in the accompanying Virtual Appliance and Install Guide. The Install Guide includes separate instructions for the following platforms: VMware ESX server platform, AWS cloud, and Azure cloud.

Whitelisting:

A range of IP addresses to add to the client IP whitelist to allow communication from the newly deployed appliance to the CloudSphere cloud to establish the tenant.
For Performance metrics – Please whitelist scripts to prevent AV capture

What you need from us:

IP/DNS names to whitelist for Appliance access to the CloudSphere SaaS solution (three DNS names in total).

Hardware & Resources

The following VM configuration is required:

RAM: 4GB,

vCPU: 2,

Storage in HDD: 30GB

Private IP address: 1

Console Access

Access to the required console to deploy the VM image (vCenter, AWS console, Azure console, etc.)

Firewall

Rules opened to grant access from the new appliance to the CloudSphere platform

Appliance, Network and Discovery Scanning Requirements

Appliance / Virtual Infrastructure(VMware Example)

ESX server setup with vSphere 6.
Image provided as an OVF file format and will require 4GB in RAM, 2vCPU and 25GB in disk (Appliance based on Ubuntu).

Appliance is also available for Hyper-V, AWS and Azure.

Appliance Network Settings

Local static IP address (to assign to the appliance)
DNS Servers (for the appliance to use)
Open Access to Illuminate 360 SaaS platform over the internet using port 443 WebSocket. (an alternative is HTTP Proxy but needs WebSocket support) (from the appliance)

Discovery and Scan Privileges

For credentials used by the appliance to scan target devices

Unix & LINUX: root privileges required or sudo allowing root privileges (See the commands detailed below).
Windows: Administrator privileges required (Windows domain user or local administrator user. Note: The local Windows firewall needs to allow protocol access to the local machine). For a list of supported protocols see the section: Appliance to Discovered Devices

Scanning configuration Requirements

Discovery Scope

An initial list of IP addresses or Subnet Ranges that need to be scanned

Credentials

An initial set of credentials associated with remote access to the IP Addresses (using supported appliance protocols). The credential types are specified in the table below.

Commands & Privilege Escalation

Scanning of Windows targets uses a specific set of Windows protocols and commands. Scanning of windows does not provide for privilege escalation. The credential provided for Windows must have sufficient privileges to execute windows based commands. Scanning of Unix targets uses a specific set of Unix protocols and commands. The list of commands is identified in the table below and can be used within a sudoers file (for example). The presence in the suoders file provides a means to allow privilege escalation for the Unix user.

Endpoint Scanning Credentials

Credential Type	Access Level
Windows	Local Admin or Domain Admin Account
UNIX	Elevated privileges or sudo (predefined list see appendix). RequireTTY must be disabled to run sudo. Configured user requires a shell and home directory CloudSphere supports accounts with passwords or SSH keys.
VMWare vSphere	Read-Only Role
AWS SSM	AWS IAM user account with the following permissions (Policy Actions)Policy Actions (Privileges) ssm:SendCommand ssm:ListCommandInvocations ssm:DescribeInstanceInformation

Protocol and Ports

Appliance to Discovered Devices

Protocol	Ports	Description
ICMP	N/A	Ping
WMI, SMB, Windows Remote Registry, Windows Remote Process	135, 137, 138, 139, 445, 1024 -65535	Windows Server Discovery
VCenter/vSphere	443, 9443	vSphere Client access
SSH	22	Unix Discovery

Appliance and Users to CloudSphere Platform

Protocol	Ports	Description
HTTPS	443	https://.cloudsphere.com https://.iquate.net (legacy appliance installs only)

Users to Appliance

Protocol	Ports	Description
HTTP	80	Local (customer) login into appliance for configuration of appliancehttp: //[Appliance_IP]:80/ddm/index.html

Discovered Devices to Appliance

Protocol	Ports	Description
HTTP	8080	HTTP post to send metrics from scanned target to the appliance

AWS SSM

Policy Actions (Privileges)

AWS IAM user credentials

(Access key ID, Secret access key)

ssm:SendCommand
ssm:ListCommandInvocations
ssm:DescribeInstanceInformation

Commands

Windows EndPoints

WMI Requests

Other Commands

*Admin Privilege Required

Win32_ComputerSystem

Win32_ComputerSystemProduct

Win32_SystemEnclosure

Win32_Process Win32_DiskDrive

Win32_PhysicalMemory

Win32_Processor

Win32_OperatingSystem

Win32_BIOS

Win32_NetworkAdapter

MSCluster_Cluster

MSCluster_Resource

MSCluster_ClusterToNode

MSCluster_ClusterToResource

Msvm_ComputerSystem

Msvm_VirtualSystemSettingData

*Admin Privilege Required

type, netstat

Windows VB Scripts

*Admin Privilege Required

VBS Functions used to collect instance performance metrics using:

HTTP GET
HTTP POST

UNIX EndPoints

Unix Commands
The following text is suitable for direct insertion in a SUDO config file. The commands are identified as groups of commands of similar levels of escalation

Cmnd_Alias UNIX_STANDARD =

/bin/grep, /bin/ls, /bin/ps, /bin/df, \

bin/uname, /bin/netstat, /bin/hostname “”, \

/bin/hostname -I, /bin/echo, /bin/date +*, \

/bin/cat, /bin/dmesg “”, /usr/bin/whereis, \

/sbin/ifconfig -a, /sbin/fdisk -l, \

/usr/sbin/dmidecode, /usr/bin/find , /usr/bin/getconf, \ /usr/bin/groups ,

/usr/bin/hostid, /usr/bin/last, \

/usr/bin/lsattr, /usr/bin/lscpu, /usr/bin/lscfg, \

/usr/bin/bootinfo, /usr/bin/lspv, \

/usr/bin/lsmod, /usr/bin/lsof, /usr/bin/lspci, \

/usr/bin/lsusb, /usr/sbin/arp -a, /usr/sbin/arp -an, \

/usr/sbin/ip a, /usr/sbin/prtconf, /bin/true

Cmnd_Alias UNIX_NON_STANDARD =

/usr/bin/dmidecode

#dmidecode may be present in other directories

Cmnd_Alias OS_SPECIFIC =

/usr/sbin/sneep, \

/usr/bin/entstat, /usr/bin/kstat, /usr/bin/lparstat, \

/usr/bin/pfiles, /usr/bin/pargs, \

/usr/bin/model

Cmnd_Alias TASK_SPECIFIC =

/usr/sbin/ip netns exec ‘*’ netstat -natup, \

/usr/bin/nsenter --net=/proc/*/ns/net -F -- hostname -I , \

/usr/bin/nsenter --net=/proc/*/ns/net -F -- netstat -natpu , \

/usr/bin/nsenter --net=/proc/*/ns/net -F -- ifconfig -a , \

/usr/bin/perl -e ‘print int(time)’ , \

/usr/sbin/ifconfig lan0

Cmnd_Alias PROPRIETARY =

/usr/contrib/bin/machinfo , \

/usr/sbin/mysqld * -V, \

/usr/sbin/nginx -V, \

/usr/bin/docker inspect *, \

/usr/bin/docker version, \

/usr/bin/docker ps -a, \

/usr/bin/docker network ls

Cmnd_Alias MODIFYING =

/bin/ln -sfT /proc/*/ns/net /var/run/netns/.*, \

/bin/mkdir /var/run/netns, \

/bin/rm -f /var/run/netns/.*

Cmnd_Alias DANGEROUS =

/*/catalina.sh version

user ALL = UNIX_STANDARD, UNIX_NON_STANDARD, OS_SPECIFIC, TASK_SPECIFIC, PROPRIETARY, MODIFYING, DANGEROUS

General Requirements

Appliance, Network and Discovery Scanning Requirements

Scanning configuration Requirements

Endpoint Scanning Credentials

Credential Type

Access Level

Protocol and Ports

Appliance to Discovered Devices

Protocol

Ports

Description

Appliance and Users to CloudSphere Platform

Protocol

Ports

Description

Users to Appliance

Protocol

Ports

Description

Discovered Devices to Appliance

Protocol

Ports

Description

AWS SSM

Policy Actions (Privileges)

Commands

Windows EndPoints

WMI Requests

Other Commands

Windows VB Scripts

UNIX EndPoints

Related articles