Endpoint Standard: How to configure a Local Mirror (Linux)
book
Article ID: 290054
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Configure a Linux/Unix mirror server for Signature Updates for the CBC Sensor
Environment
Carbon Black Cloud Console: All Version
Endpoint Standard
Carbon Black Cloud Mirror Server Utility: v3.0 and Higher
Linux/Unix: All Supported Versions
Resolution
Configure Mirror Server
Ensure traffic to the Signature Update Server URL is allowed through any proxy/firewall without packet inspection (TCP/80 or TCP/443)
updates2.cdc.carbonblack.io
Downloadcbdefense_mirror_unix_x64_v3.0.zip to the Server that will provide updates
Unpack the zipped file and move the contents to a directory (these files will be used to automate mirror server updates with a cron job, so they should be stored in a permanent location such as /opt/cbupdate)
Open a command prompt and change directory to the update file location
Download the initial Signature pack set and create the Signature Mirror with this command (/var/www/html is an example directory often used when configuring Apache) NOTE: The command can also call update_defs_ssl.sh to use https for the download
bash ./update_defs.sh /var/www/html
Results will print to the command line. Confirm the following directories and files are located in the root of the directory targeted with the update command
ave2
avupdate.log
idx
x_vdf
Apache Configuration Example
Download Apache
yum install httpd
Start Apache service
systemctl start httpd
Access httpd.conf with a command line editor
vi /etc/httpd/conf/httpd.conf
Edit httpd.conf to configure Apache to listen on desired IP address and port 80 (port 443 can be used for https if Sensors are running 3.3.x.x and higher)
Listen Local_Mirror_IP:80
Restart httpd service
systemctl restart httpd
Enable httpd start on boot
systemctl enable httpd
Test connection to web server from a remote machine within the local network (Apache welcome page should load in web browser)
NOTE: If the firewall on the update Server has been configured, then allow port 80 or 443 traffic as needed
Remove the Apache welcome page
rm /etc/httpd/conf.d/welcome.conf
Create a configuration file named "cb.conf"
touch /etc/httpd/conf.d/cb.conf
Use a command line text editor to add the following values (some values require customization) to cb.conf
<VirtualHost LOCAL_MIRROR_IP:80>ServerAdmin [email protected]>
ServerName carbonblackmirror
DocumentRoot /var/www/html
<Directory "/var/www/html">
Options All Indexes FollowSymLinks
Order allow,deny
Allow from allow
</Directory>
</VirtualHost>
Restart the Apache service
systemctl restart httpd
Use a web browser to access the /idx/master.idx file to confirm mirror server functionality
Schedule update task
Create a cron file to automate Local Mirror updates
touch /opt/cbdupate/cronfile
Edit the file to fetch updates at a set interval (1 hour intervals will ensure timely updates available for Sensors)(The path to the update script may vary depending on where the files are stored)