Security Center:Use proxy access

Use cases

Limitations

Only Linux servers can serve as proxy servers.

Servers connected through proxy access support most Security Center features, but do not support the following features. For the full feature list, see Functions and features.

Security Center features not supported through proxy access

Prerequisites

• Prepare one or more servers that can access the internet to serve as proxy servers, meeting the following requirements:

  • Reserve sufficient network bandwidth. Each connected server requires 10 Kbit/s of bandwidth. For example, connecting 50 servers requires 500 Kbit/s of reserved bandwidth on the proxy server.

  • Ports 80, 443, and 8080 are open on the proxy server for connections from hosts or containers.

• If you use multiple servers as proxies, use domain name access. Make sure you have a domain name for the proxy servers and it resolves to the proxy server IP addresses, load balancing IPs, or virtual IP addresses (VIPs).

• For hybrid cloud scenarios, establish network connectivity between third-party cloud servers and Alibaba Cloud VPCs.

Step 1: Create a proxy cluster

1. Log on to the Security Center console.

   • In the left-side navigation pane, choose System Configuration > Feature Settings. In the upper-left corner of the console, select the region for the assets to protect: Chinese Mainland or Outside Chinese Mainland.

2. On the Agent > Proxy Access tab, click Create Cluster.

3. In the Create Cluster dialog box, configure the cluster name, communication address, and description, then click OK.

   • Address: Enter the IP address or domain name of the proxy server. After the cluster is created, hosts or containers in the cluster connect to the proxy server through this Address.

   • When Address is set to a proxy server IP address, you can configure only one proxy server. Use this method when connecting a small number of hosts or containers (for example, 5).

   • To configure multiple proxy servers, use a domain name as the Address and make sure the domain name resolves to the proxy server IP addresses, load balancing IPs, or virtual IP addresses (VIPs).

   • After cluster creation, the cluster name and communication address cannot be modified. Enter a meaningful cluster name and a reachable communication address.

Step 2: Deploy a proxy server

1. On the Agent > Proxy Access tab, in the Actions column of the target cluster, click Deploy Proxy.

2. In the Deploy Proxy Server panel, select a deployment mode and complete the configuration.

   If the proxy server already has the Security Center agent installed and online, select quick deployment. If the proxy server does not have the Security Center agent installed, use manual deployment.

   • Quick deployment

     When you select Quick Deployment, select the Linux server to use as the proxy server from the asset list, then click OK.

   • Manual deployment

     When you select Manual Deployment, copy the manual deployment command from the page, log on to the proxy server as administrator, and run the command.

   About 5 minutes after deployment, you can view the proxy server online status on the Agent > Proxy Access tab.

   After deploying the proxy server, if the Security Center agent is not installed, the server only has proxy capabilities and cannot use security features such as vulnerability detection and baseline checks. To protect the proxy server, install the Security Center agent. For more information, see install the Security Center agent.

Step 3: Connect servers to the proxy cluster

After creating the cluster and deploying the proxy server, add servers as clients to the proxy cluster to connect them to Security Center through proxy access.

1. On the Agent > Proxy Access tab, in the Actions column of the target cluster, click Install Agent.

2. In the Install Agent panel, select an access mode and complete the configuration.

   If the server already has the Security Center agent installed and online, select the server directly. If the server does not have the Security Center agent installed, use the installation command.

   • Select servers directly

     In the asset list, select the servers to connect, then click OK.

   • Use installation commands

     1. Click Generate Installation Command.

     2. On the Agent > Installation Command tab, click Create Installation Command.

     3. In the Create Installation Command dialog box, configure the parameters, then click OK.

        Parameter	Description
        Expiration Time	The expiration time of the installation command.
        Service Provider	The service provider of the server.
        Default Group	The group of the server in the Security Center host asset list.
        OS	The operating system of the server.
        Create Image System	Whether to create an image for the server. Keep the default option.
        Select Proxy	Select Self-managed Proxy Cluster, then select the proxy cluster to connect to.

     4. In the installation command list, view and copy the installation command. After generating the command, confirm that the Proxy Access field shows the selected proxy cluster name, then click the copy icon in the upper-right corner of the command area.

     5. Log on to the server to connect as administrator and run the installation command based on the operating system.

About 5 minutes after installation, click the number in the Client Connected column of the proxy cluster to view the list of servers connected through the proxy.

(Optional) Step 4: Configure a proxy cluster policy

By default, Security Center sends data collected by proxy servers back to the server without bandwidth or frequency limits. To change the data transmission mode or set bandwidth and frequency limits, follow these steps.

1. On the Agent > Proxy Access tab, in the Actions column of the target cluster, click Proxy Settings.

2. In the Proxy Settings dialog box, configure the settings, then click OK.

   The data transmission mode supports Send Data Back to Management Center and Directly Cache to Specified Directory.

   Transmission mode	Description
   Send Data Back to Management Center	Sends data to Security Center for risk and threat detection. You can manually set the bandwidth and frequency for communication between the proxy server and Security Center. Options: Unlimited: No bandwidth or frequency limits. Custom: Set custom bandwidth and frequency limits. Keep bandwidth usage and communication processes below 60% of total resources.
   Directly Cache to Specified Directory	Performs risk and threat detection for specified data types within your business network (on-premises IDC, VPC, etc.). Logs are stored at /usr/local/aegis/proxy/log/export.log on the proxy server by default. You can change the cache directory. The cache directory supports up to 10 GB. When storage exceeds 10 GB, the system overwrites the earliest logs in a circular manner.

Related operations

FAQ