Hyperic Security Features and Recommendations

SSL Best Practices for New Hyperic Installations

Hyperic 4.6 and later supports the use of SSL communication for both server-to-agent and agent-to-server communications. VMware recommends that you install trusted keystores from you CA for Hyperic 4.6.x components. If you do not configure your own SSL keystores for Hyperic Agents and the Hyperic Server, the components will generate keystores with self-signed certificates — this is not recommended.

For more information about SSL communications, configuration, and default behavior in Hyperic, see About SSL in Hyperic.

Agent-Initiated Communication

You can configure Hyperic such that Hyperic Agents initiate all communications with the Hyperic Server. This feature — referred to as unidirectional communication is useful if your network topology requires managed platforms to initiate all communication with processes outside a firewall.

You can configure unidirectional communication interactively at first agent startup, or with the agent.setup.unidirectional in the agent's agent.properties file. See the requirements described at agent.setup.unidirectional.

• The Hyperic Agent supplies a username and password to connect to the Hyperic Server. There are two ways to define the credentials:

  • You can define the username and password for connecting to the server interactively, the first time you start the agent. Upon successful first connection to the server, the agent saves the credentials in its /data directory. In Hyperic 4.6.6 and later, the value of the password is encrypted.

  • You can define the username and password for connecting to the server in the agent's agent.properties file prior to starting the agent for the first time. At first startup, the agent will use the credentials specified in the properties file, and upon successful connection to the server, the agent will (as with interactive configuration) save the credentials in its /data directory, encypting the password. In Hyperic 4.6.6 and later, the agent will also remove the plain text password from the properties file, and add a password property definition with an encrypted value. Note that Hyperic 4.6.6 and later, you can add encrypted properties to agent.properties yourself, as described in Encrypt Agent Property Value.

• If the server and agent have user-managed keystores, each component stores the password to its keystore in its properties file.

  • The Hyperic's Server's keystore can be configured interactively at installation. The keystore path and password are saved in hq-server.conf, with the password encrypted. If you define the keystore password in the properties file yourself, after installation, In Hyperic 4.6.6 and later, the server will encrypt the password value at next startup.

  • The Hyperic's Agent's keystore can only be configured in the agent.properties file. In Hyperic 4.6.6 and later, you can add encrypted properties to agent.properties yourself, as described in Encrypt Agent Property Value. Otherwise, if you define the password in plain text in the properties file, the agent will encrypt the value at next startup.

Protection of Sensitive Data

In this version of Hyperic, the Hyperic installer writes some sensitive data to installation log files.

Use LDAP Authentication

Hyperic Server encrypts user passwords using a encryption key you supply during installation. Note however, that Hyperic Server does not have a strength-of-password policy, or a lockout policy for failed login attempts. Best practice is to integrate Hyperic with your existing enterprise directory. For information about integrating Hyperic with LDAP, Active Directory, and Kerberos, see Configure LDAP Properties and Configure Kerberos Properties.