Can Proxy Settings Be Changed After Sensor Install?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

• After defining proxy settings during command line installation, can those proxy settings be changed?
• Yes. The proxy credentials can changed by using the sensor's "cfg.ini" file

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

1. Place sensor into bypass mode by running commands:

   cd c:\Program Files\Confer\
   repcli bypass 1

2. Shutdown the sensor service:

   repcli stopCbServices

3. Open the cfg.ini file with a text editor
4. If present, remove:

   ProxyServer=
   ProxyServerCredentials=

5. Add:

   ProxyServer=[PROXY_IP_OR_DOMAIN]:[PROXY_PORT]
   ProxyServerCredentials=[USERNAME]:[PASSWORD] (Optional- if proxy requires authenitcation)
   PreferStaticProxyOverLastUsed=true
   

Example:

ProxyServer=TestProxy.net:8080
ProxyServerCredentials=TestUsername:TestPassword
PreferStaticProxyOverLastUsed=true

Replace PROXY_IP_OR_DOMAIN, PROXY_PORT, USERNAME and PASSWORD with the corresponding values.

6. Remove/rename the `C:\ProgramData\CarbonBlack\Datafiles\db_cfg` as a new file will be created with the updated details from the cfg.ini file
7. Start the sensor service, this will force the sensor to update its proxy internal configuration, with the caveat that should the sensor be unable to connect to the proxy server/appliance, it may attempt to bypass it

   sc start CbDefense

8. Reload/refresh the sensor configuration with the recently-made changes:

repcli updateconfig

8. Remove device from bypass:

repcli bypass 0

9. To force an immediate check-in (optional):

repcli cloud hello

 

Additional Information

• PreferStaticProxyOverLastUsed is optional if the intent is making a successful connection to the cloud. However, if the goal is for the sensor to prioritize the new proxy connection provided  over other previously used, then PreferStaticProxyOverLastUsed should be used.
• Important: repcli functionality needs to be enabled, in order to follow the steps above
• If the current cloud communications are all still successful, the proxy won't re-evaluate it's current proxy settings. Restarting the CbDefense service might be needed for immediate re-evaluation.