Launching Xacta 360 Marketplace AMI Guide June 2017

Launching Xacta 360 Marketplace AMI Guide June 2017 Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

1 Cntents Overview... 2 Prerequisites... 2 Xacta Architecture... 5 Launching AMI frm the AWS Marketplace... 5 Setting Up the Initial Instance... 7 Replacing the Default Xacta 360 and EP Self-Signed Certificates... 8 Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

2 Overview This article prvides Xacta 360 GvClud/Cmmercial AMI users instructins n hw t launch the Xacta AMI (Amazn Machine Images) server frm the AWS Marketplace. The fllwing are the steps t be perfrmed t launch Xacta 360 AMI: 1. Launch the AMI s EC2 instance in the AWS. 2. Run the initial instance setup (this is nly perfrmed when yu set up Xacta AMI fr the first time). Befre prceeding with setting up Xacta 360 AMI, make sure that yu have met the required AWS cmpnents listed in the Prerequisites sectin. Prerequisites Befre deplying the Xacta server in AWS AMI, yu must have the fllwing AWS cmpnents are created and are up and running t ensure successful installatin and cnfiguratin: VPC Make sure that the VPC is set up with the required and recmmended VPC infrastructure is met. Required Infrastructure The Xacta EC2 Instance must be set up in a VPC with at least ne subnet. SSH access t the Xacta Instance is required fr first time set up. The subnet int which Xacta is deplyed must have a rute t RDS and be able t cmmunicate with the RDS endpint. This means any security grups attached t the RDS database must allw the Xacta server t cmmunicate with it ver TCP prt 5432 The Xacta Applicatin must be accessible via HTTPS (443). Recmmended Infrastructure A single, nn-default VPC with fur subnets. The recmmended design is t have the Xacta instance in a separate subnet frm an RDS instance that will hst the database data. One public Subnet fr jump hsts/lad Balancers. One private Subnet fr the Xacta instance. Tw private Subnets in different availability znes that will be part f the RDS database subnet grup. One lad balancer that pints t the Xacta Instance. It is recmmended t pass the traffic thrugh a lad balancer rather than have the instance itself be expsed t the Internet. A jump hst in the public subnet t allw SSH cnnectins t the Xacta instance. It is recmmended that the Xacta Instance nt have SSH expsed directly t the Internet. A jumphst/bastin hst is recmmended fr accessing SSH n the Xacta instance. The security grup attached t the Xacta EC2 instance can then have SSH restricted t the jumphst/bastin hst A Security Grup attached t the Xacta instance that allws prt 443 cnnectins t the lad balancer and prt 22 cnnectins frm the jump hst t the Xacta instance. The Xacta EC2 instance in the private subnet (see the EC2 sectin belw) An RDS database (see the RDS Database fr Xacta sectin belw) created in a database subnet grup f at least tw subnets. Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

3 RDS Database fr Xacta Nte: It is nt necessary t use RDS if yu are using a pre-existing database r anther PstgreSQL server. The pre-existing DB must meet the requirements defined belw and shuld be accessible frm the Xacta server. The RDS database shuld be running n PstgreSQL 9.5. The RDS instance will have a database cnfigured n it by the installer. Take nte f the endpint because it is required when yu set up the Xacta server fr the first time. Yu must als take nte f the RDS instance s DNS hst name and the Administratr s credentials setup when creating the RDS instance. The RDS database shuld als meet the fllwing Recmmended Cnfiguratin: Set RDS t Multi-AZ D nt allw public access. Yu must limit cnnectins nly t thse that are required t access the database. The recmmended db instance identifier is xacta-pstgres-db. The recmmended db instance master username is pstgres. The recmmended db instance master passwrd shuld be ver 8 characters in length, and shuld cntain upper r lwer case letters, numbers, and symbls. The fllwing are the Recmmended Technical Specificatins fr the RDS: Minimum Standard Large DB size N/A 300GB 1024GB Instance size N/A db.m4.large db.m4.xlarge IAM Instance Prfile Yu must create the IAM instance prfile fr the Xacta EC2 t ensure that Xacta 360 can cnnect t ther AWS accunts fr scanning purpses. T create the IAM instance prfile, d the fllwing steps: 1. Create the plicy that allws the EC2 t assume a rle by running the fllwing script: Nte: Yu can name the plicy as Allw_Xacta_AssumeRle. { "Versin": "2012-10-17", "Statement": [ { "Actin": [ "sts:assumerle" ], "Resurce": "*", "Effect": "Allw" } Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

4 } ] 2. Create an IAM Instance Prfile by selecting Create Rle and the Amazn EC2 radi buttn. 3. Attach the fllwing plicies that were previusly created t assume rles: Allw_Xacta_AssumeRle and ReadOnlyAccess (which is an AWS built-in plicy). 4. Specify a rle name; e.g., Xacta_AssumeRle_InstancePrfile. The IAM Instance Prfile creatin is cmpleted. Optinal Cmpnents The fllwing AWS services are ptinal but prvide enhanced visibility t the Xacta server peratins: Cludwatch lgs Cludwatch lgs shuld be used t mnitr the EC2 instance and any ther infrastructure set up in AWS. Cludwatch is a centralized lgging service and lgs frm EC2, RDS, ELB, and ther AWS services are available in a single cnsle. Nte: Yu will need t install the Cludwatch Lgs agent n the hst fr hst-level lgging t functin. Mnitring In rder t autmatically mnitr Cludwatch, it is recmmended that the Cludwatch Alarms be set up t mnitr fr security and ther cmpliance issues. Belw are listed the recmmended alarms: Alarms when an API call is made t create, update, r delete a Security Grup. Alarms when an API call is made t create, update, r delete a Netwrk ACL. Alarms when an API call is made t create, update, r delete a Custmer r Internet Gateway. Alarms when an API call is made t create, update, r delete a VPC, VPC peering cnnectin, r VPC cnnectin t classic. Alarms when an API call is made t create, terminate, start, stp, r rebt an EC2 instance. Alarms when an API call is made t create, terminate, start, stp, r rebt a 4x- r 8xlarge EC2 instance. Alarms when an API call is made t create, update r delete a CludTrail trail, r t start r stp lgging t a trail. Alarms when an unauthenticated API call is made t sign int the cnsle. Alarms when an unauthrized API call is made. Alarms when an API call is made t change an IAM plicy. Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

5 Xacta Architecture Refer t the diagram belw fr mre infrmatin n the Xacta AMI server infrastructure. Launching AMI frm the AWS Marketplace T successfully launch AMI frm the AWS Marketplace, yu must set up yur EC2 instance in AWS. T d this, perfrm the fllwing steps: Nte: It is assumed that yu are already lgged in AWS using an apprpriate AWS accunt and yu have selected the Manual Launch frm the Xacta 360 AMI page in the AWS Marketplace. 1. In the Step 2: Chse the instance type page, select the desired size fr the hst and then click Next: Cnfigure Instance Details. Nte that Tels recmmends the fllwing instance sizes: Standard Large DB size 300GB 1024GB Instance size db.m4.large db.m4.xlarge Strage type General Purpse (SSD) General Purpse (SSD) Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

6 2. In the Step 3: Cnfigure Instance Details page, yu can use the default values r cnfigure the settings as necessary. Then, click Next: Add Strage when yu have cmpleted cnfiguring the instance details. Make sure that the fllwing settings are set r cnfigured accrdingly. a. Netwrk select the desired VPC t deply the Xacta hst b. Subnet select the desired subnet t deply the Xacta hst Nte: If yu wish this server t be accessible frm the Internet, it will need t be deplyed int a public subnet r be deplyed behind a lad balancer. c. Aut-assign Public IP Nte: If yu wish this server t be accessible frm the Internet it will need t have a public IP assigned r be deplyed behind a lad balancer. 3. In the Step 4: Add Strage, leave the default 100GB strage fr nw, r add additinal space if necessary. Make sure that the default strage size is nt set belw the 100GB t avid the build frm failing t run. Then, click Next: Add Tags. 4. Add any desired tags t the hst. Then, click Next: Cnfigure Security Grup. 5. Select Create a New Security Grup and prvide yur preferred security grup name (e.g., Xacta- Access). 6. Fr rules, add SSH n prt 22 and HTTPS n prt 443 frm desired surce range(s) as shwn belw. Nte: The surce shuld be the hst(s) that will cnfigure the applicatin as well as thse accessing the Xacta web applicatin. The rules can be updated after the server is created. 7. Click Review and Launch. The Step 7: Review Instance Launch page appears. 8. Click Launch. The Select existing key r create a new key pair windw appears. 9. Select Chse an existing key pair and select yur preferred key pair. 10. Click the I acknwledge that I have access t the selected private key file (<name f selected key pair>), and that withut this key file, I wn t be able t lg int my instance checkbx. 11. Click Launch Instances. The launching f the instance is initiated. When the instance is successfully launched, the Launch Status page is displayed. 12. In the Yur instances are nw launching message, click the link f the launched instance. The page where the instance yu have launched is listed appears. When it is fully nline, prceed t Settings Up the Initial Instance. Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

7 Setting Up the Initial Instance When yu have successfully launched Xacta AMI frm the AWS Marketplace, yu need t perfrm the initial instance setup by cnnecting t the instance via SSH. Yu must fllw the n-screen instructins and ensure that yu have cnfigured the settings. 1. Launch the SSH client tl in the hst machine. 2. Enter the fllwing cmmand in the SSH terminal: ssh i <pem key> cents@<prvide the public ip> Nte: The public IP can be fund in the instance details in AWS cnsle. If the instance des nt have a public IP, the instance must be accessed via private IP frm a hst with the ability t rute t the private IP. When yu launch the instance fr the first time, the fllwing setup wizard appears: 3. Enter yur preferred temprary passwrd fr the madmin accunt. Yu must change yur passwrd after the initial lg in t the applicatin 4. Enter the RDS server URL. The RDS server URL refers t the RDS endpint, which yu can get frm the RDS cnsle. Make sure that yu als have the prt f the RDS endpint, and yu must als indicate where t pull data frm. 5. Specify yur preferred name fr the Xacta database. The system will use the default xacta_ae name if yu d nt enter any database name. This is the name f the admin user fr the RDS database that will be created. 6. Enter the RDS database admin user name that was cnfigured during the RDS setup. 7. Enter the RDS database admin user s passwrd that was cnfigured during the RDS setup. 8. Enter yur preferred name fr the Xacta DB user accunt. The system will use the default xacta_ae name if yu d nt enter any database name. This is the name f the system user that Xacta will use t update the infrmatin in the RDS database. Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

8 9. Enter the passwrd fr the Xacta DB user accunt. The passwrd must have at least 10 characters, and have a capital letter, a number, and a special character. 10. Press Enter. Xacta 360 and EP will be installed and cnfigured. Nte: If yu accidentally cancel the wizard befre the installatin and cnfiguratin is cmpleted, yu can relgin r manually run the xacta_install.sh script frm the cents users hme directry. 11. After Xacta 360 is successfully cnfigured, access the applicatin via a web brwser at https://<dns>/xacta. When yu lg in r access the applicatin fr the first time, use madmin as user name and enter the default passwrd yu specified in the EC2 cnsle prmpt. Nte: When yu lg in r access the applicatin fr the first time, yu will be prmpted t change the madmin passwrd. It is als recmmended t replace the self-signed certificates fr Xacta 360 and EP with CA-signed certificates; see Replacing the Default Xacta 360 and EP Self-Signed Certificates fr mre infrmatin. Replacing the Default Xacta 360 and EP Self-Signed Certificates By default, the self-signed certificates created by the applicatin cntain generic infrmatin. It is recmmended t replace the self-signed certificates with CA-signed certificates. T replace the default certificates fr Xacta 360 and EP, perfrm the fllwing steps accrding t the specified rder: i. Replace the Xacta 360 keystre. ii. Imprt the new Xacta 360 certificate t the EP truststre. i. Replacing the Xacta 360 Keystre Nte: Make sure yu have the cpy f the required CA-signed Xacta 360 certificate and have generated a keystre using the new certificate. 1. G t the installatin directry f Xacta 360 (i.e., /pt/xacta/applicatin/app/engine/cnf). 2. Lcate and pen the Tmcat s server.xml. 3. Lcate the prt= 443 in the server.xml, and update the attributes f the fllwing t pint t the new keystre file lcatin and passwrd: keystrefile keystrepass 4. Encrypt the keystre passwrd and enter it in the webca.prperties file in /pt/xacta/applicatins/app/engine/webapps/xacta/web-inf/classes. T encrypt the keystre passwrd, d the fllwing steps: Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

9 a. Launch the Cmmand Prmpt windw as administratr. b. Enter the fllwing script: sud chmd +x /pt/xacta/applicatins/app/engine/tls/cnfigae.sh sud /pt/xacta/applicatins/app/engine/tls/cnfigae.sh /pt/xacta/applicatins/app/engine/webapps/xacta encrypt -p <passwrd> Fr example, the passwrd is Passwrd: sud chmd +x /pt/xacta/applicatins/app/engine/tls/cnfigae.sh sud /pt/xacta/applicatins/app/engine/tls/cnfigae.sh /pt/xacta/applicatins/app/engine/webapps/xacta encrypt -p Passwrd The encrypted passwrd will be displayed in the screen. c. G t /pt/xacta/applicatins/app/engine/webapps/xacta/web-inf/classes and pen the webca.prperties file using built-in applicatin vi editr. Nte: The built-in applicatin vi editr shuld be ran as sud. d. Lcate and change the attributes f the fllwing: webca.application.secstrepasswd=<encrypted passwrd> webca.application.secstrepath=<path t keystre> e. Save the changes made. ii. Imprting the Xacta 360 Certificate t the EP Truststre Xacta 360 and EP servers are bth lcated in the Xacta EC2. They cmmunicate via SSL, and the certificates are managed in Xacta 360 s Manage Remte Servers page. When Xacta 360 s certificate is changed, yu must als imprt the applicatin s new certificate int EP s truststre. Perfrm the fllwing steps t imprt the certificate: 1. Stp the Publisher service. 2. Launch the SSH client windw as sud. 3. Enter the fllwing cmmand: keytl -imprt -alias <alias name f the certificate> -file <lcatin f the new certificate> -keystre /pt/xacta/applicatins/xacta-ep/engine/cnf/xacta-truststre.jks 4. Specify the passwrd fr the truststre. Yu can find the passwrd in the /pt/xacta/applicatins/xacta-ep/engine/cnf/server.xml by lcating the Cnnectr element and lking fr the truststrepass attribute. 5. Enter [y] r [yes] when prmpted whether t trust the certificate r nt. Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm

10 Related Tpic 6. Restart the publisher service by entering the fllwing cmmand in the Cmmand Prmpt windw: sud service xacta-ep restart Upgrading AMI Tels Crpratin 2017. All rights reserved. U.S. patents Ns. 6,901,346; 6,980,927; 6,983,221; 6,993,448; and 7,380,270. Xacta is a registered trademark f Tels Crpratin. Tels Crpratin 19886 Ashburn Rad, Ashburn, VA 20147-2358 1.800.70.TELOS 1.800.708.3567 Fax 703.724.3865 www.tels.cm