Security Center:Add servers to Security Center by using the proxy access feature

Scenarios

VPC that cannot be directly added to Security Center

If your VPC has multiple access restrictions and you cannot directly add an Elastic Compute Service (ECS) instance in the VPC to Security Center, you can use the proxy access feature to add the ECS instance to Security Center for protection.

Data Center

Hybrid cloud

Limits

• You can configure only Linux servers as proxy servers.

• If you add a server to Security Center by using the proxy access feature, you can use most of the features provided by Security Center. However, you cannot use the features listed in the following table. For more information about all features supported by Security Center, see Functions and features.

  Unsupported features

  Module	Feature
  Assets	Batch O&M and CloudMonitor Container assets Cloud services Websites
  Risk Governance	Asset exposure analysis Overview Detection of AccessKey pair leaks Cloud honeypot Log analysis - network logs
  Protection Configuration	Defense rules against brute-force attacks
  	Anti-ransomware
  System Configuration	Playbook

Preparations

Step 1: Create a proxy cluster

1. Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. You can select China or Outside China.

2. In the left-side navigation pane, choose System Configuration > Feature Settings.

3. On the Agent > Proxy Access tab, click Create Cluster.

4. In the Create Cluster dialog box, configure the Cluster Name, Address, and Description parameters. Then, click OK.

   Address: Enter the IP address or domain name of your proxy server. After the proxy cluster is created, hosts and containers in the cluster connect to the proxy server at the address specified by Address.

   Important

   • If you set the Address parameter to an IP address, you can configure only one proxy server. We recommend that you use this method if you need to only add a small number of hosts or containers, such as 5, to Security Center.

   • If you want to configure multiple proxy servers, we recommend that you set the Address parameter to a domain name. Make sure that the domain name can be resolved to the IP addresses of the proxy servers, the IP addresses for load balancing, or virtual IP addresses.

   • After a proxy cluster is created, you cannot change the name or address of the cluster. We recommend that you enter an informative cluster name and a reachable address.

Step 2: Deploy a proxy server

1. On the Agent > Proxy Access tab, find the created cluster and click Deploy Proxy in the Actions column.

2. In the Deploy Proxy Server panel, select a deployment mode and complete the configurations.

   If the Security Center agent is installed on your proxy server and the agent is online, you can select Quick Deployment. If the Security Center agent is not installed on your proxy server, you must select Manual Deployment.

   • Quick Deployment

     If you select Quick Deployment, you must select a Linux server that you want to configure as a proxy server from the Select Servers section and click OK.

   • Manual Deployment

     If you select Manual Deployment, you must copy the manual deployment command based on the on-screen instructions. Then, use the administrator account to log on to the proxy server and run the manual deployment command in the command-line interface.

   Approximately 5 minutes after deployment, you can view the status of the proxy server on the Agent > Proxy Access tab.

   

Step 3: Connect a server to the proxy cluster

1. On the Agent > Proxy Access tab, find the created cluster and click Install Agent in the Actions column.

2. In the Install Agent panel, select an access mode and complete the configurations.

   If the Security Center agent is installed on the server that you want to connect to the proxy cluster and the agent is online, you can directly select the server. If the Security Center agent is not installed on the server that you want to connect to the proxy cluster, you can run an installation command on the server.

   • Select a server

     In the asset list, select the server that you want to connect to the proxy cluster and click OK.

   • Run an installation command

     1. Click Generate Installation Command.

     2. On the Agent > Installation Command tab, click Add Installation Command.

     3. In the Add Installation Command dialog box, configure the parameters and click OK.

        Parameter	Description
        Expiration Time	The time when the installation command expires.
        Service Provider	The provider of your server.
        Default grouping	The group to which you want to add the server. You can view groups on the Host page of the Security Center console.
        System	The operating system of the server.
        Making Image System	Retain the default value No. This parameter specifies whether to create an image for the server.
        Select Proxy	Select Self-managed Proxy Cluster and select the proxy cluster to which you want to connect the server.

     4. In the installation command list, view and copy the generated installation command.

     5. Log on to the server by using the administrator account and run the installation command based on the operating system of the server.

        Wait for 5 minutes after the installation command is run. Then, you can click the number in the Client Connected column to view the list of servers that are connected to the proxy cluster.

(Optional) Step 4: Configure a proxy cluster policy

By default, the Send Data Back to Management Center transmission mode is used, and the network bandwidth and frequency of transmissions are not limited. In this mode, data collected by a proxy server is sent to Security Center. To change the transmission mode or limit the network bandwidth and frequency of transmissions, perform the following steps:

1. On the Agent > Proxy Access tab, find the created cluster and click Proxy Settings in the Actions column.

2. In the Proxy Settings dialog box, configure the parameters and click OK.

   The following transmission modes are supported: Send Data Back to Management Center and Directly Cache to Specified Directory.

   Transmission mode	Description
   Send Data Back to Management Center	Data is sent to Security Center for risk and threat detection. If you select this mode, you can manually configure the network bandwidth and transmission frequency for communication between the proxy server and Security Center. Valid values: Unlimited: The network bandwidth and transmission frequency are not limited. Custom: You can specify the upper limits of network bandwidth and transmission frequency based on your business requirements. Important When you configure the upper limit of network bandwidth or transmission frequency for a proxy cluster, make sure that the required bandwidth does not exceed 60% of the total bandwidth and resources required for communication processes do not exceed 60% of the total resources.
   Directly Cache to Specified Directory	Data is cached in data centers or VPCs for risk and threat detection. Only specific data types are supported. If you select this mode, related logs are cached in the /usr/local/aegis/proxy/log/export.log file of the proxy server by default. You can change the cache directory. Note The cache directory can store up to 10 GB of data. If the upper limit is exceeded, the system cyclically overwrites the earliest logs.

What to do next

View information about the proxy cluster

1. Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. You can select China or Outside China.

2. In the left-side navigation pane, choose System Configuration > Feature Settings.

3. On the Agent > Proxy Access tab, perform the following operations:

   • View basic information about the proxy cluster

     You can view the name, address, number of connected servers, and status of the proxy cluster. A proxy cluster can be in one of the following states:

     • Online: At least one proxy server in the proxy cluster is online.

     • Offline: No proxy server exists in the proxy cluster, or all proxy servers in the proxy cluster are offline.

   • View the list of proxy servers

     Find the proxy cluster and click the icon in the Server Information column. In the panel that appears, find the proxy server whose basic information you want to view and move the pointer over the server in the Asset Information column. Agent Status indicates whether the Security Center agent is online.

   • View the list of connected servers

     Find the proxy cluster and click the number in the Client Connected column. You can view the following information about each connected server: asset information, group information, operating system type, service provider, and region. You can also view the tags that are added to the server and the status of the Security Center agent that is installed on the server.

     

Delete the proxy cluster

If you no longer need to use Security Center to protect the servers that are added by using the proxy access feature, you can perform the following operations to delete the proxy cluster:

1. Disconnect the added servers from the proxy cluster.

   1. On the Agent > Proxy Access tab, find the proxy cluster and click Install Agent in the Actions column.

   2. In the Install Agent panel, clear all selected servers and click OK.

   This operation disconnects all added servers from the proxy cluster but does not uninstall the Security Center agent from the servers. You can run commands on the servers to uninstall the Security Center agent. For more information, see Uninstall the Security Center agent by running a command.

2. Delete the proxy server.

   You can delete a proxy server only when it is offline. You can stop the aegis proxy process to bring a proxy server offline.

   1. Log on to the proxy server by using the administrator account. Then, run the following commands to stop the aegis proxy process:

      ps -ef | grep aegis
      kill PID # /usr/local/aegis/proxy/ID of the SasClientProxy process

      Note

      If you do not have permissions to stop the process, disable the client protection feature. For more information, see Enable features on the Agent Settings tab.

   2. On the Agent > Proxy Access tab, find the proxy cluster and click the icon in the Server Information column.

   3. In the Server Information panel, click Delete in the Actions column for each proxy server.

      

3. After you delete all proxy servers from the proxy cluster, find the proxy cluster in the proxy cluster list and click Delete in the Actions column.

Upgrade the version of the proxy server

To improve connection performance, Security Center continuously detects and displays the latest version of the proxy server. You can determine whether to upgrade your proxy server to the latest version based on your business requirements.

1. Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. You can select China or Outside China.

2. In the left-side navigation pane, choose System Configuration > Feature Settings.

3. On the Agent > Proxy Access tab, find the proxy cluster and click the icon in the Server Information column.

4. In the Server Information panel, find the proxy server whose version you want to upgrade and click Upgrade in the Actions column.

   If the Upgrade button is dimmed, the proxy server runs the latest version, or the Security Center agent is offline. If the Security Center agent is offline, you must troubleshoot why the agent is offline. After the agent is online, upgrade the version again. For more information, see Troubleshoot why the Security Center agent is offline.