IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  First install ok, re-install not ok - Not supporting unauthenticated GIM clients

    Posted Tue October 08, 2019 01:17 PM

    Hi,

    Actions prior to issue:
    I installed a GIM 10.2 on a Microsoft server 2012 with MSSQL and got a connection back to my appliance and I installed a S-TAP remotely with GIM without any issue. However, the inspection engine did not verify properly due to a misconfiguration during the S-TAP installation. So, I decided to remove the S-TAP but the GUI continued to show that the S-TAP was installed and then I decided to reset the GIM client by using the reset function in Set up by client. Since the reset didnt seem to propagate properly I decided to remove it manually in the Windows server environment and reinstall the GIM. After the re-installation the GIM would not call back to the appliance as it did the first time.

    The problem:
    GIM appliance is not getting registered in appliance GUI.

    System (DB):

    • Windows server 2012 MSSQL


    Tried the following actions:

    • Remote connection to GIM => Connection refused error
    • Installed different versions of GIM (10.2 & 10.6)
    • Check the central logger (copy snipets from the log)=> 
      • <html><head> error report HTTP Status 400 - Not supporting unauthenticated GIM clients
      • send_to_gim:: going to read at least 1 byte and at most 186
      • recv_data_ssl:: Total read 175 bytes
      • send_to_gim::Finished writing to file this block of bytes !
      • HTTP response processed successfully (last row)
    • GIM log under GIM/currents
      • -I- send_to_gim_server:: Detected non HTTP error from stdout [GIM_HEADER_MARKER
      • Error report: HTTP Status 400 - Not supporting unauthenticated GIM clients
      • GIM Service failed to register with server
      • HTTP Status 400 - Not supporting unauthenticated GIM clients) (last row)
    • Run installation setup.exe as admin
    • IBM Security Guardium Installation manager service is running
    • Restared CLI GUI
    • Check installed management => GIM/Event list/Installed modules/Unautheticated GIM clients

    Question:

    • Does anyone know how to resolve this issue? 
    Let me know if you need more infomration

    ------------------------------
    Herman Engström
    ------------------------------


  • 2.  RE: First install ok, re-install not ok - Not supporting unauthenticated GIM clients

    Posted Wed October 09, 2019 07:54 AM
    I "solved" it by chaning the GIM Global Parameter: enable_secure_unauthenticated_communication value - to 1.

    Not the optimal solution but will work for now, if anyone have any idea why this happened in the first place, please let me know.

    ------------------------------
    Herman Engström
    ------------------------------

    Original Message


  • 3.  RE: First install ok, re-install not ok - Not supporting unauthenticated GIM clients

    Posted Fri October 18, 2019 06:56 AM
    Herman's answer suggests to switch the GIM server configuration to ignore incorrect certificate from GIM client.
    It is good for a while only because it leads to situation that any GIM client can register itself on your GIM server.
    I suggest check - why your GIM client is not able to register with valid certificate, two situations can happen:
    1 - You have installed GIM with predefined certificates and GIM server is configured with customer owned
    2 - You provided in the installation process incorrect certificates

    ------------------------------
    Zbigniew Szmigiero
    IBM
    Warsaw
    ------------------------------

    Original Message


  • 4.  RE: First install ok, re-install not ok - Not supporting unauthenticated GIM clients

    Posted Fri October 18, 2019 07:54 AM
    I have tried to investigate why the certificates did not get accepted and I could not identify the issue by looking at the central_logger and GIM log. There might be other logs that I am not aware off. 

    My assumption of the issue is as follows:
    Since the authentication worked correctly the first time and when trying to fix the inspection engine connection I could have made errors causing the collector to store the key that was used in the first installation (as mentioned in the first post). Then, when trying to connect from the same client (MSSQL) the gim client would get rejected since the gim client was sending a different cert and key (assuming new keys are generated for each connection/session?) to authenticate the GIM client on the MSSQL client.

    I followed this guide to specify the certificates on the client but I see now that I forgot to load the the collector using command:  store certificate gim. https://www.ibm.com/support/knowledgecenter/SSMPHH_10.5.0/com.ibm.guardium.doc.stap/gim/gim_server_allocation.html

    I am new to Guardium, I lack more in-depth knowledge how each component function but hopefully I am getting there. 

    Thanks for the feedback.

    /Herman



    Original Message


  • 5.  RE: First install ok, re-install not ok - Not supporting unauthenticated GIM clients

    Posted Fri October 18, 2019 08:08 AM
    GIM comes with default (IBM generated certificates) - both sides Client and Server have to trust them.
    If you changed certificates for GIM client you have to also use this same CA for GIM Server. However in Guardium 10.x the GIM certificate exchange is not implemented well and some problems exist. Here is the link to my article with section about configuration of GIM certificates in G 10: https://guardiumnotes.wordpress.com/2015/09/06/review-guardium-installation-manager-gim-on-windows-version-10/

    In version 11 the TLS implementation for GIM is changed and you can manage certificate centrally from GIM server. It is much easier to implement own certificates and configure GIM server to support the older and newer SSL chain without necessity to approve non-authenticated clients.

    ------------------------------
    Zbigniew Szmigiero
    IBM
    Warsaw
    ------------------------------

    Original Message


Related Content