Real Secure Support Tips

Most Recent Version: 3.0 (modified 12/30/1998)

ISS Support

Questions:

1) General platform install tips
2) General Real Secure Install Tips
3) Licensing questions
4) Is the Community Name field the write or read string?
5) What is the difference between viewing Session and Raw data?
6) Where is the session and raw data kept, and how is it moved?
7) What files must be copied for backup?
8) How do you create a custom report?
9) Is there a Real Secure MIB?
10) Engine error message while trying to sync log files: rsserver[331]: Insert of PacketData failed:

Answers:

1) General platform install tips

• 2 network cards, 1 for console-to-engine TCP/IP management the other (stealth card) for network sniffing
• NT 4.0
• SP 4 128 bit
• Disable unnecessary services
  - Leave Event Logging (to report events)
  - Leave RPC Service (used by explorer to open windows on GUI)
  - Leave Protected Storage (if you are using MS Crypto API to protect/access encryption keys)
  - Leave FW-1/Raptor/RealSecure/etc security software
  - Leave Plug n' Play if you are going to be adding/remove hardware otherwise turn it off
• Disable TCP/IP and WINS from stealth adaptor (control panel,network,bindings,all protocols, tcp/ip, disable tcp/ip on stealth adaptor, same for WINS).  If you are using a Solaris engine, bring up the interface in startup scripts with 'ifconfig <dev> plumb -arp up'
• Protect management TCP/IP console card with firewall. When you try to secure NT with ISS recommendations the machine doesn't boot anymore because the recommendations are from old service packs and hot patches that don't exist.
• Remove network access for everyone (User Manger -> Policies ->User rights, "Access this computer from the network")
• Real Secure 3.0

2) General Real Secure install tips

• Invoke setup
• Use strong authentication
• Use RSA Microsoft Cryptographic Provider strong authentication as authentication engine for both console and engines
• After installing console, reinvoke the setup program to export public keys to the engines
• The first menu of setup program you have choice to export public keys. Make sure you export to new directory that you specify no matter if on hard disk or on floppy
• Then go to engines and reinvoke setup program on engines. Choose import public key and specify directory that you created in step above
• Stop and restart engines

3) Licensing questions

• License the IP addresses of the engines TCP/IP management IP address.
• On paper you can specify a range like 0.0.0-255.255.255.255 and it would work but haven't tried it. Normally i just specify IP,IP, IP address of each engine
• You need the OCN (order confirmation number) number to apply for license on web site. This number is on ISS invoice.
• The license is installed in real secure install directory on console
• When you monitor an engine, if RS doesn't see the license it prompts you for location of license and you can browse to find it

4) Is the Community Name field the write or read string?

Write.

5) What is the difference between viewing Session and Raw data?

Log Raw Data – logs the data keystroke for keystroke into the database on the engine, when the engine is full it will send the data back to the console to store the data permenantly. You can view the data through the view sessions option, indefinately.
View Session – immediately sends the data back (key stroke for keystroke) to the console for immediate playback. If you close out the session playback screen the data is gone. This data doesn’t get stored anywhere. This option is good if you have a high risk area and you will have a live person monitoring a lot of sessions, but you have a limited amount of storage for log files.

6) Where is the session and raw data kept, and how is it moved?

Log Raw Data is stored on the engine in the engine database until it is moved to console database.
View Sessions isn’t stored it is played back immediately to the console.

7) What files must be copied for backup?

Engine: rsengine.tag, rsengine.par, rsengine.raw
Console: rsntclientlog.mdb

8) How do you create a custom report?

A) To generate reports from existing data:

1. If you want to run a report using data from all the detectors currently monitored by the console, click the Synchronize All Logs option from the console’s File menu, or click the Synch Logs button on the toolbar. All of the database logs for all the current detectors are copied into the console database.
2. If you want to run a report on data from certain detectors, highlight each detector in the Detector window and click the Maintain Log option from the Detectors menu. The Maintain Detector Log dialog box appears. Click Synch All.
3. Click the View Reports button on the toolbar, or click the Reports option from the console’s View menu.
4. From the Reports window, choose the report you want to run. The window contains a list of text reports, graph reports, and any customized reports.
5. Under Report Dates, choose the starting date and the ending date for this report.

B) Creating custom reports:

1. Using Crystal Reports, create a report to be used by RealSecure. The report must have a .rpt extension.
2. Save the report in the appropriate directory. Note: Custom reports are, by default, placed in the Reports/Custom sub-directory off the RealSecure installation directory. You can change the directory for custom reports in the Custom Reports Path field from the General tab of the Console Configuration dialog box.
3. Generate the report using the same method as generating any of the default reports. Exporting report data. When you create a report, you can send it to a printer or view it on the screen, but you can also export it into something readable by another program, such as Crystal Reports or Excel.

C) Exporting report data:

1. Generate a report, clicking the Preview Report button instead of the Print Report button. The Report Viewer appears.
2. Click the Export button. The Export dialog box appears.
3. In the Format drop-down list box, choose the format into which you want to export the current report.
4. In the Destination drop-down list box, choose where you want the exported data sent. You may choose from the following: disk file, Exchange folder, Lotus cc:Mail, Lotus Notes Database, Microsoft Mail
5. Click OK. Another window may appear, asking for information specific to the format and destination you chose (i.e., which character to use to separate values in a character-separated value file).

9) Is there a Real Secure MIB?

Yes, ISS.MIB. Ensure you have the right MIB for your version of code.

10) Engine error message while trying to sync log files: rsserver[331]: Insert of PacketData failed:

Perform the following actions:  May 27 09:17:14 canyon rsserver[331]: Insert of PacketData failed: (No message ]:
# /etc/init.d/realsecure stop
# rm /opt/ISS/RealSecure/RSENGINE.*
# /etc/init.d/realsecure start

DISCLAIMER: This support site is provided as a FREE service to our customers. Every effort is made to ensure it is complete and accurate. However, due to changing versions, typos, different environments, etc. information may be inaccurate for your site. Note that we do not assume responsibility for any problems you might encounter using information provided in these pages. Please inform us of any problems you encounter we will make every effort to correct this information. Thank you.

Home | Services | Training | Support | Contact Us | Search

Copyright 2006, Security Evolution, Inc.