Can Proxy Settings Be Changed After Sensor Install?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

After defining proxy settings during command line installation, can those proxy settings be changed?

Environment

• Carbon Black Cloud Sensor: 3.2.x.x and Higher
• Microsoft Windows: All Supported Versions

Resolution

Yes. The proxy credentials can changed by using the sensor's "cfg.ini" file:

1. Place sensor into bypass mode by running commands:

   cd c:\Program Files\Confer\
   repcli bypass 1

2. Shutdown the sensor service:

   repcli stopCbServices

3. Open the cfg.ini file with a text editor
4. If present, remove:

   ProxyServer=
   ProxyServerCredentials=

5. Add:

   ProxyServer=[PROXY_IP_OR_DOMAIN]:[PROXY_PORT]
   ProxyServerCredentials=[USERNAME]:[PASSWORD] (Optional- if proxy requires authenitcation)
   PreferStaticProxyOverLastUsed=true
   

Example:

ProxyServer=TestProxy.net:8080
ProxyServerCredentials=TestUsername:TestPassword
PreferStaticProxyOverLastUsed=true

Replace PROXY_IP_OR_DOMAIN, PROXY_PORT, USERNAME and PASSWORD with the corresponding values.

6. Start the sensor service, this will force the sensor to update its proxy internal configuration, with the caveat that should the sensor be unable to connect to the proxy server/appliance, it may attempt to bypass it

   sc start CbDefense

7. Reload/refresh the sensor configuration with the recently-made changes:

repcli updateconfig

8. Remove device from bypass:

repcli bypass 0

9. To force an immediate check-in (optional):

repcli cloud hello

 

Additional Information

• If attempting to remove a proxy configuration to send traffic out the default route, remove/rename the `C:\ProgramData\CarbonBlack\Datafiles\db_cfg` file after Step 5 so that when the service is restarted in Step 6 a new `C:\ProgramData\CarbonBlack\Datafiles\db_cfg` file will be created with the updated details from the cfg.ini file.
• PreferStaticProxyOverLastUsed (available in 3.6 October Maintenance build) is optional if the intent is making a successful connection to the cloud.  However, if the goal is for the sensor to prioritize the new proxy connection provided  over other previously used, then PreferStaticProxyOverLastUsed should be used.
• Important: repcli functionality needs to be enabled (see KB), in order to follow the steps above
• If the current cloud communications are all still successful, the proxy won't re-evaluate it's current proxy settings. Restarting the CbDefense service might be needed for immediate re-evaluation.