Secure Access to Hawkeye Server

Hawkeye Server by default is enabled for HTTP access using port 80. Some organizations prefer to block HTTP (port 80) access and only allow HTTPS (port 443). The Hawkeye Server has a configuration file /opt/hawkeye/conf/configuration.txt which has the parameter WebServerPort set to 80. You can edit this file and change this to 443 to enforce HTTPS for browser access. This will force all web browser access to the Hawkeye server to use HTTPS but Hawkeye server can still use port 80 by the Nginx process. In order to prevent all HTTP access you must edit the file /etc/nginx/snippet/hawkeye-server.conf and comment out the first two lines, listen 80 default_server; and listen [::]:80 default_server; ,by preceding it with # symbol.

After you change either one or both files, stop the Hawkeye service and restart it to apply the changes. Refer to the section Hawkeye Services on how to do this.

It is not recommended, but for the advanced security conscious organization the SSL protocol and the cipher algorithms to be used can be configured/restricted by changing the /etc/httpd/conf.d/ssl.conf file. Examples of changes are to exclude SSL protocol 1.0 and 1.1 and only use 1.2. Another example is to prioritize a list of ciphers to be used (negotiated) for the connection. Important to note as this is a Linux system file not maintained by Hawkeye it can be replaced by an upgrade thus requiring the user to restore any previously saved changes to the file following the upgrade.

Customer Certificates for Hawkeye Server

When using secure access to a Hawkeye Server (HTTPS), you can avoid a certificate warning when logging into the Hawkeye Server web page by using a certificate. The Organization may have port 80 blocked for security or may have a Corporate requirement only to use HTTPS for the Organizations web servers. There are two steps:

Generate a signed SSL certificate for the Hawkeye Server.
Configure the Hawkeye Server to use the certificate.

The following sections describe this process.

Create Certificate Signing Request (CSR) on Hawkeye Server

Users seeking to purchase a signed SSL certificate from a Certification Authority will require a Certificate Signing Request be generated by the Server with both a Public and Private key. While pursuing, the signed SSL certificate, a customer will need to generate a Certificate Signing Request (CSR) file to be provided to the Certification Authority (CA) as part of their application.

To generate the CSR from the Hawkeye server you will need to log into the server via SSH and generate a configuration file (for the now required SAN extension) and run a command to generate the certificate request to be sent to a CA authority.

openssl req -new -newkey rsa:2048 -nodes -out YourServerName.csr -keyout YourServerName.key

Some attributes may be changed to meet the customer security standards or the recommendations or requirements of the CA. For example, rsa:2048 indicates 2048 bit key.

Upon completion, your system will have two new files in the directory from which you ran the openssl command. YourSeverName.csr and YourServerName.key. Please move YourServerName.key to /etc/pki/tls/private/ for use later.

The YourServerName.csr contains your Certificate Signing Request to be submitted to the Certification Authority of your choice.

You can view the contents of your certificate request before sending with the following command:

# openssl req -noout -text -in YourServerNameServer.csr

Add signed SSL certificate to Hawkeye Server

If your certificate was delivered with the Root certificate and Intermediate certificate as separate files from the Server certificate, the files must be bundled into a single file. You can do this with the following command by replacing the file names with the names of your certificates.

# cat your_domain.crt intermediate.crt root.crt >> hawkeye-bundle.crt

The CA Signed SSL Certificate (.crt file) will need to be copied in /etc/ssl/certs/ . The associated key file must be copied to /etc/ssl/private/

Use cp (copy) to place the files in their new directories. Do not use mv (move) for this purpose.

After the files are in the correct directories, edit the following file with vi or your favorite Linux text editor:

vi /etc/nginx/snippets/hawkeye-ssl.conf

ssl_ciphers HIGH:!3DES:!aNULL:!MD5:!SEED:!IDEA;

ssl_protocols SSLv3 TLSv1.2 TLSv1.3;

# select our certificates.

# We default to the ones created

# during install (snakeoil),

# but should be replaced

# with proper customer certs as:

#ssl_certificate <path_to_pem>;

#ssl_certificate_key <path_to_key>;

include snippets/snakeoil.conf;

Uncomment the following lines and update the path to point to your signed files:

ssl_certificate <path_to_pem>;

ssl_certificate_key <path_to_key>;

Do not remove the ; at the end of each line.

Comment out the following line to stop using the provided self-signed certificates.

# include snippets/snakeoil.conf;

Add the following lines to the bottom of /usr/local/Ixia/endpoint.ini

NG_SSL_CERTIFICATE_FILE_PATH /etc/ssl/certs/<file.crt>

NG_SSL_PRIVATE_KEY_FILE_PATH /etc/ssl/private/<file.key>

If endpoint.ini does not exist in /usr/local/Ixia, it can be created by running cp /usr/local/Ixia/endpoint.ini.newest /usr/local/Ixia/endpoint.ini command.

After editing both files, restart the Hawkeye Services with the hawkeyeServices command.

Following the restart of all services you should be able to reload the Hawkeye website by going to https://www.YourServerName.com. This time you should not be prompted about having an unsigned certificate.