Page History

...

1. Log in to the Main Precise FocalPoint.
2. Run the following command from the <precise<Precise_root> root> folder:
   • Windows
     infra\bin\psin_cli.bat
-i3-user<useruser<user_name>name>
{-i3-encrypted-password<encryptedpassword<encrypted_password>password>|-i3-clear-password<clear_password>}
-action communication-key-change
-type aes
   • UNIX
     ./infra/bin/psin_cli.sh
-i3-user<useruser<user_name>name>
{-i3-encrypted-password<encryptedpassword<encrypted_password>password>|-i3-clear-password<clear_password>}
-action communication-key-change
-type aes

Distributing the new encryption settings to all servers

For the new encryption settings to take effect, you must distribute them to all servers, completing no later than 24 hours after you changed the encryption configuration on the Precise FocalPoint server.

The new encryption settings will be effective within 48 hours. If a server does not receive the new settings within 48 hours, it is no longer able to communicate with the Precise system. In this case, you need to perform an additional step to reestablish the communication.NOTE    At

To distribute the new encryption settings to all servers1.    Run

1. Run the following command from

...

1. the <Precise_root> folder on the Main Precise FocalPoint server:

...

1. • Windows
     infra\bin\psin_cli.bat
-i3-

...

1. • user<user_

...

1. • name>
{-i3-encrypted-

...

1. • password<encrypted_

...

1. • password>|-i3-clear-password<clear_password>}
-action communication-key-distribute
{-servers

...

1. • "<comma_separated_servers_

...

1. • list>" | -all-servers true}
[-manual true]
[-secure true –user-

...

1. • name<user_

...

1. • name>-password<password>]
[-user-

...

1. • name<user_

...

1. • name>]
[-

...

1. • password<password>]

...

1. • UNIX
     ./infra/bin/psin_cli.sh
-i3-

...

1. • user<user_

...

1. • name>
{-i3-encrypted-

...

1. • password<encrypted_

...

1. • password>|-i3-clear-password<clear_password>}
-action communication-key-distribute
{-servers

...

1. • "<comma_separated_servers_

...

1. • list>" | -all-servers true}
[-manual true]
[-secure true –user-

...

1. • name<user_

...

1. • name>-password<password>]
[-user-

...

1. • name<user_

...

1. • name>]
[-

...

1. • password<password>]
   Specify one: -servers and a comma separated list of specific servers to distribute the key to, or -all-servers true to distribute the key to all installed servers.
   To use the secured mode transfer of the key, you need to specify -secure true, and supply the user name and password to use in SSH to connect to the servers.
   Alternatively, specify -secure true and -manual true to use the manual mode to send the secured mode transfer of key. Note that this manual mode requires you to run the script manually on the related servers.
   If you selected automatic distribution to servers, only servers with SSH or SCP protocols are supported.

...

1. If a server does not receive the new settings within 48 hours, do the following:

   ...

   1. 1. Copy all files from the

   ...

   1. 1. <precise_

   ...

   1. 1. root>/infra/listener/etc/crypt folder on the Precise FocalPoint server to the server that did not receive the new settings.

   ...

   1. 1. Restart all agents on that server.

   Verifying encryption configuration on a server (optional)

   You can verify that the encryption configuration has been updated on all servers. This procedure scans all of your Precise servers and checks if the server were successfully updated with the new encryption.

   If one of the server reports an error, you need to redistribute the encryption settings. If you still encounter an error after redistributing the settings, contact Precise Customer Support.NOTE    Run

   Info
   Run the verify command at least 48 hours after creating the new AES key. This will ensure that the protocol is secured with the new key.

   See Distributing the new encryption settings to all servers on page 216.

   If the new encryption settings were successfully received on all servers, the scan results in an output like the following:

   Server (aix1) ok
   Server (aix2) ok
   Server (aix3) ok
   server scan done

   If errors occurred on at least one of the servers, the scan results in an output like the following:

   Server (aix1) ok
   error on server (aix 2), see log file for details.
   Server (aix3) ok
   servers scan done

   The encryption log is written to the following trace file:<precise

   <Precise_root>/logs/infra.i3fp.crypt.log

   To verify encryption configuration on all servers1.    Run

   1. Run the following command from the

   ...

   1. <Precise_

   ...

   1. root> folder on the Main Precise FocalPoint server:
      • Windows
        

   ...

   1. • infra\bin\psin_cli.bat
-i3-

   ...

   1. • user<user_

   ...

   1. • name>
{-i3-encrypted-

   ...

   1. • password<encrypted_

   ...

   1. • password>|-i3-clear-password<clear_password>}
-action communication-key-verify
{-servers

   ...

   1. • "<comma_separated_servers_

   ...

   1. • list>" | -all-servers true}
      • UNIX
        

   ...

   1. • ./infra/bin/psin_cli.sh
-i3-

   ...

   1. • user<user_

   ...

   1. • name>
{-i3-encrypted-

   ...

   1. • password<encrypted_

   ...

   1. • password>|-i3-clear-password<clear_password>}
-action communication-key-verify
{-servers

   ...

   1. • "<comma_separated_servers_

   ...

   1. • list>" | -all-servers true}

   Specify one: -servers and a comma separated list of specific servers to distribute the key to, or -all-servers true to distribute the key to all installed servers.

   About encrypting passwords

   Precise uses an Advanced Encryption Standard (AES) to encrypt the passwords that its different components require to access the monitored instances (such as passwords for databases or Java application servers). These passwords are then saved in internal configuration files.

   By default the password encryption is AES.

   Replacing the password encryption key on the Precise FocalPoint server

   You can replace the password encryption key on the Precise FocalPoint server by using the Precise Command Line Interface (CLI) installation utility. For information on how to deploy this utility, see the Precise CLI Utility Reference Guide.

   To replace the password encryption key on the Precise FocalPoint server1.    Verify

   1. Verify that the CLI installation utility is deployed.

   ...

   1. Run the following command from

   ...

   1. the <Precise_root> folder on the Precise FocalPoint server:
      • Windows
        

   ...

   1. • infra\bin\psin_cli.bat
-i3-

   ...

   1. • user<user_

   ...

   1. • name>
{-i3-password encrypted-password
| -i3-clear-password clear-password}
-action encrypt-update
-type [aes-key]
      • UNIX
        

   ...

   1. • ./infra/bin/psin_cli.sh
-i3-user user-name
{-i3-password encrypted-password
| -i3-clear-password clear-password}
-action encrypt-update
-type [aes-key]

   Table C-1    Configuring 1 Configuring password encryption type elements on the Precise FocalPoint server

    

   Element    Description
   -i3-user    See “Authenticate to CLI Utility” in the Precise CLI Utility Reference Guide.
   -i3-encrypted-password    See “Authenticate to CLI Utility” in the Precise CLI Utility Reference Guide.
   -action    Always: encrypt-update
   
   Mandatory: Yes
   -type    Mandatory: Yes
   
   Always: aes-key
   
   AES-based encryption that uses a random symmetric key. It is recommended to update this key once a year.
   Security level: high
   For example:
   ./infra/bin/psin_cli.sh
   -i3-user user-name
   {-i3-password encrypted-password
   | -i3-clear-password clear-password}
   -action encrypt-update
   -type aes-key
   Distributing the new password encryption settings to all servers
   For the new password encryption settings to take effect, you must distribute them to all servers by using the Precise CLI installation utility. This procedure depends on the Precise Listener being up and running on all servers; otherwise, the agents on the servers will not be able to function.
   To distribute the new encryption settings to all servers
   1.    In AdminPoint, verify that the Precise Listener is up and running on all servers.
   
   2.    Run the following command from the <precise_root> folder on the Precise FocalPoint server:
   Windows    infra\bin\psin_cli.bat
   -i3-user user-name
   {-i3-password encrypted-password
   | -i3-clear-password clear-password}
   -action encrypt-distribute
   
   UNIX    ./infra/bin/psin_cli.sh
   -i3-user user-name
   {-i3-password encrypted-password
   | -i3-clear-password clear-password}
   -action encrypt-distribute
   Table C-2    Distributing new password encryption element settings to all servers
   Element    Description
   -i3-user    See “Authenticate to CLI Utility” in the Precise CLI Utility Reference Guide.
   -i3-encrypted-password    See “Authenticate to CLI Utility” in the Precise CLI Utility Reference Guide.
   -action    Always: encrypt-distribute
   
   Mandatory: Yes
   Configuring the Precise Apache Tomcat to work in HTTPS mode (SSL)
   The Precise user interface is based on an Apache Tomcat server. You can configure it to work in HTTPS mode. This mode uses the Secure Socket Layer (SSL) protocol to encrypt the data that is sent from the Web browser to the Tomcat server.
   To configure Precise Apache Tomcat to work in HTTPS mode
   1.    Create a certificate keystore on the Apache Tomcat server. This file is saved in the folder
   <precise_root>\products\gui\website as a certificate .keystore file.
   a.    Before you create the .keystore file, delete the alias Tomcat if it already exists.To delete the alias Tomcat, run the following command from the <precise_root> folder on the Precise FocalPoint:
   UNIX:
   java/JRE/bin/keytool -delete -alias tomcat -keystore products/gui/website/.keystore
   Windows:
   java\JRE\bin\keytool -delete -alias tomcat -keystore products\gui\website\.keystore
   NOTE    For the password, use "changeit”. For the question “What is your first and last name”, provide the server name used in the URL for the Precise GUI as the answer.
   b.    To create your own certificate, run the following command from the <precise_root> folder on the Precise
   FocalPoint: UNIX:
   java/JRE/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore products/gui/website/.keystore -validity 3000
   Windows:
   java\JRE\bin\keytool -genkey -alias tomcat -keyalg RSA -keystore products\gui\website\.keystore -validity 3000
   NOTE    For the password, use "changeit”. Also, use the host as displayed in the url for the name.
   2.    In the file <precise_root>\products\gui\website\conf\server.xml
   a.    Add comment tags around the non-SSL <Connector> tag, where the preliminary remark is “<!-- Define a non-SSL HTTP/1.1 …-->”.
   b.    Remove the comment tags around the SSL <Connector> tag, where the preliminary remark is “<!-- Define a SSL Coyote HTTP/1.1 …-->”.
   3.    Restart the Precise FocalPoint process on the UNIX server. Restart the Precise FocalPoint service and the Precise user interface service on the Windows server.
   
   4.    Open the Precise application using HTTPS.
   For example:
   https://<host>:<port>
   NOTE    After restarting the Precise FocalPoint, the SSL port changes to the default port added by the user during installation. If you want to use a different port, you can change the port as described in the “Change GUI server port” section in the Precise CLI Utility.
   When first launching Precise in a client, a security alert is displayed with the certificate details. You should sign your certificate with a trusted root authority (such as VeriSign). Alternatively you can install the certificate on each client server that uses the Precise GUI.
   5.    In AdminPoint, click the Setup tab and click on Nodes in the drop-down menu
   6.    n the Nodes tab, click Edit to update the url of the node for which you configured the SSL, according to step 4. In addition, if you are working with the Precise Custom Portal, the following configuration must be performed.
   To configure Precise Apache Tomcat to work in HTTPS mode with the Precise Custom Portal
   1.    Export the certificate:
   <i3>java\jre\bin\keytool -export -alias tomcat -file <file_name>.crt
   -keystore <i3>products\gui\website\.keystore
   2.    Import the certificate:
   <i3>java\jre\bin\keytool -import -file <file_name>.crt -alias tomcat
   -storepass <changeit> -keystore <i3>\java\JRE\lib\security\cacerts
   NOTE    Verify that the same <file_name>.crt is used for exporting and importing the certificate.
   
   NOTE    For the password, use "changeit”.
   To install a certificate
   1.    When you get the certificate warning, click View certificate.
   2.    Click Install certificate.
   3.    Click Next.
   4.    Select Place all certificates in the following store.
   5.    Click Browse.
   6.    Check Show physical store.
   7.    Select Local Computer under Trusted root certification Authorities.
   8.    Click OK, Next, and then Finish.
   9.    Close and restart the Precise GUI, and verify that the warning for the certificate does not re-appear.
   For general information regarding configuring HTTPS mode see Apache Tomcat server instructions found at this site: http://tomcat.apache.org/tomcat-4.1-doc/ssl-howto.html
   For information regarding configuring J2EE to work in HTTPS mode, see About Security Options in the J2EE User's Guide.
   For information on installing your own certificate for J2EE, see the Creating and installing certificates for SSL in the Precise Administration Guide.
   Changing the session timeout for an Apache Tomcat server
   For an Apache Tomcat server, you can configure the Tomcat session timeout.
   To change the session timeout for an Apache Tomcat server
   1.    Open the following file in a text editor:
   <precise_root>\products\gui\website\webapps\i3\web.xml
   
   2.    Change the default session timeout (180) to the required minutes. For example:
   <session-config>
   session-timeout>180</session-timeout>
   </session-config>
   3.    Restart the Precise FocalPoint server.

   ...

   Precise Version 9.6 can integrate with Lightweight Directory Access Protocol (LDAP). LDAP is a better option than JAAS. The following section describes how to configure LDAP.
   Best practices for LDAP configuration
   Once integrated with LDAP, Precise Version 9.6 gets all users and groups from the LDAP and synchronizes them into its own database. Login passwords are authorized by LDAP, thus preventing the need to keep (and verify) the users’ passwords within Precise.
   LDAP provides access for management and browser applications that provide read/write interactive access to the X500 folder. Setting up an LDAP configuration will reduce Users/Roles management in Precise; it also uses the already managed LDAP repository for Precise.
   Pay close attention to your organizational structure in the LDAP repository before setting up the LDAP configuration for Precise. You must understand the current LDAP structure to determine the data needed from existing LDAP repository entities for Precise.
   Map a set of users and roles to a Precise domain. While synchronizing the LDAP data to Precise, the relevant users/roles will be identified by the given domain. For login, the domain name will be the user.
   NOTE    It is preferable to set the domain name as the enterprise domain, and the Users/Roles root as the relevant LDAP branch which contains the domain users.
   Setting up the Precise system to work with LDAP blocks all user/role management operations in the Precise system, except for permissions management. The LDAP synchronization process deletes all Precise users and roles from the Precise system which are not also found in the LDAP repository, except for user “admin” and role “Precise manager”.
   Map a set of users and roles to the Precise domain. After synchronizing the LDAP data to the Precise system, the domain will identify relevant users or roles. The domain name will be user-defined for login purposes. Set the domain name as the enterprise domain, and the users/roles root as the relevant LDAP branch that holds domain users.
   To enable synchronization of Users and Roles from the LDAP repository into the Precise database, configure the LDAP as described below.
   To configure LDAP
   1.    Update the ldap file (as specified below) in the main Precise FocalPoint machine under:
   <precise_root>\products\i3fp\registry\products\infrastructure\login\ldap.xml
   2.    Delete the ldap.xml.status file (in the same folder as ldap.xml)
   3.    Update the roles file in the main Precise FocalPoint server under:
   <precise_root>\products\i3fp\registry\products\infrastructure\roles\settings.xml by updating ignore-last-role-on-delete to true:
   <ignore-last-role-on-delete>true</ignore-last-role-on-delete>
   4.    Delete the settings.xml.status file (in the same folder as settings.xml)
   5.    Restart the Precise FocalPoint.
   Connection details
   Enter the following connection information:
   •    <host> to specify the host name/IP of the LDAP repository server
   •    <port> to specify the port on which the LDAP repository server is listening on
   •    <bind-user> to specify the LDAP user name for binding in the synchronization process
   •    <bind-password> to specify the password of the bind user
   NOTE    The <bind-password> will be supplied encrypted. Use the “encrypt” CLI action to encrypt. If <use-ldap-authentication> is “false”, the password setting must be an encrypted empty string. For more details on how to encrypt a password, see the Precise CLI Utility Reference Guide.
   
   Mapping information
   The domain element holds information for the domains that are required to synchronize. You can specify one or more domain elements. Enter the following mapping information:
   <domain-name>    A unique name for the domain, to be concatenated to the imported users or roles name. The user name of such user is: domain-name\user-name.
   <root-group>    To specify an LDAP group DN. The import process will take all members (users and groups) of this group. (Use this when <domain-root-method> is ‘single’.)
   <users-root>    To specify an LDAP object DN. The import process will take all users under this object. (Use this when <domain-root-method> is ‘multiple’.)
   <groups-root>    To specify an LDAP object DN. The import process will take all groups under this object. (Use this when <domain-root-method> is ‘multiple’.)
   NOTE    The names <root-group>, <users-root>, and <groups-root> may have multiple entries under each domain entry.
   General information
   Enter the following general information:
   <user-object-class>    Indicates the object class name in the LDAP for the user entity.
   <group-object-class>    Indicates the object class name in LDAP for the group entity.
   <user-name-attribute>    Indicates the attribute name in the LDAP for the user name.
   <group-name-attribute>    Indicates the attribute name in the LDAP for the group name.
   <user-dn-attribute>    Indicates the attribute name in the LDAP for the user entity DN.
   <user-login-attribute>    Indicates the attribute name in the LDAP for the user login ID.
   <group-members-attribute>    Indicates the attribute name in the LDAP for the group members list.
   <max-users>    Indicates the maximum number of users allowed to import into Precise.
   <max-groups>    Indicates the maximum number of groups allowed to import into Precise.
   <domain-root-method>    Indicates whether to use the <root-group> or the <users-root>/<groups-root> configuration for the entities mapping. Specify single or multiple.
   <paging-size>    Indicates the number of entities per page in the result set from the LDAP. If zero (0) is specified, the paging mechanism is not used.
   <use-ldap-authentication>    Indicates whether the LDAP authentication mechanism is used. Specify true or false.
   <use-ldap-management>    If <use-ldap-authentication> is set to true, this parameter specifies whether users/roles management is by LDAP or by the Precise user interface. Specify true or false.
   <use-case-sensitive>    If <use-case-sensitive> is set to true, the LDAP sync user will be set to case sensitive.
   Example of a registry entry
   Below is a registry entry example for the ldap.xml file.
   <ldap>
   <!-- Indicator for using Ldap authentication true/false -->
   <use-ldap-authentication>true</use-ldap-authentication>
   <!-- Indicator for using Ldap for managing users/roles, true will block I3 GUI operations -->
   <use-ldap-managment>true</use-ldap-managment>
   <!-- Ldap server host name -->
   <host>pss-dc01</host>
   <!-- Ldap server port -->
   <port>389</port>
   <!-- Ldap paging size -->
   <paging-size>500</paging-size>
   <!-- Ldap bind user name -->
   <bind-user>CN=i4dcf,OU=APM Service Users &amp; Groups,DC=precise,DC=com</bind-user>
   <!-- Ldap bind user password, encrypted!! -->
   <bind-password>_EncryptI3_A_1_F10EEB2FC3B6F88E</bind-password>
   <!-- in case there is only on domain the user can configure not to type the domain in the login -->
   <use-domain-in-login>false</use-domain-in-login>
   <domains>
   <domain>
   <domain-name>development</domain-name>
   <!-- Ldap group to import its members -->
   <root-group>CN=BU_RnD,OU=R&amp;D,OU=APM,DC=precise,DC=com</root-group>
   <!-- Ldap group to import its members -->
   <root-group>CN=GRP_Integration,OU=Unknown users &amp; groups,OU=APM Service Users &amp; Groups,DC=precise,DC=com</root-group>
   </domain>
   <domain>
   <domain-name>QA</domain-name>
   <!-- Ldap group to import its members -->
   <root-group>CN=BU_RnD,OU=R&amp;D,OU=APM,DC=precise,DC=com</root-group>
   </domain>
   </domains>
   <!-- Ldap objectClass of the Users to sync -->
   <user-object-class>person</user-object-class>
   <!-- Ldap objectClass of the Roles to sync -->
   <group-object-class>group</group-object-class>
   <!-- Ldap attribute name of the User name -->
   <user-name-attribute>name</user-name-attribute>
   <!-- Ldap attribute name of the User distinguished name -->
   <user-dn-attribute>distinguishedName</user-dn-attribute>
   <!-- Ldap attribute name of the User login name -->
   <user-login-attribute>sAMAccountName</user-login-attribute>
   <!-- Ldap attribute name of the Role member list -->
   <group-members-attribute>member</group-members-attribute>
   <!-- Ldap attribute name of the Role name -->
   <group-name-attribute>name</group-name-attribute>
   <!-- I3 max users -->
   <max-users>500</max-users>
   <!-- I3 max roles -->
   <max-roles>500</max-roles>
   <!-- Parameters handling method: single/multiple -->
   <domain-root-method>single</domain-root-method>
   <!-- Ldap sync user set as case sensitive -->
   <use-case-sensitive>false</use-case-sensitive>
   </ldap>
   For more information on running LDAP-sync command, see the Precise CLI Utility Reference Guide.

   Precise. Performance intelligence from click to storage. Learn more > >

   Precise Website	Solutions	Support	Support Portal	Community	About Us	Legal