Customizing the server listening port Port

Products

• Carbon Black EDR

Issue/Introduction

How to customize the listening port that the EDR uses to communicate with sensor. 

Environment

• EDR Console: All Versions
• EDR Server: All Versions

Resolution

Important: These steps should be performed on all Primary and Secondary server nodes before moving the system into production.  

Here are the steps post-install to change the sensor communication port:

1. Rename the nginx cb.conf file with mv to back it up:

   mv /etc/cb/nginx/conf.d/cb.conf /etc/cb/nginx/conf.d/cb.conf.default

2. Copy and rename multi-home template configuration file:

   cp /etc/cb/nginx/conf.d/cb.multihome.conf.example /etc/cb/nginx/conf.d/cb.multihome.conf

3. Backup the nginx http.conf file:

   cp /etc/cb/nginx/conf.d/http.conf /etc/cb/nginx/conf.d/http.conf.default​​​​

4. Edit /etc/cb/nginx/conf.d/cb.multihome.conf.
   
   • On 7.5.0+ Only, comment out the cb.server.error line in red if it exists in the file on your server: 
     

     server
     {
     # This server configuration is used for communications between the sensors
     # and the server.
     
     # IMPORTANT: If this configuration file is used, NginxSensor#### parameters in
     # /etc/cb/cb.conf MUST be updated to match this file.
     # Port 80 is defined in the http.conf. By default it redirects all trafic
     # to the https://$host$request_uri; If this behaviour needs to change update http.conf
     listen [::]:8443 ssl ipv6only=off;
     
     include /etc/cb/nginx/conf.d/includes/cb.server.body;
     include /etc/cb/nginx/conf.d/includes/cb.server.sensor;
     
     # Include content of custom server configuration file
     include /etc/cb/nginx/conf.d/includes/cb.server.custom;
     }
     
     server
     {
     # This server configuration is used for VMware Carbon Black EDR Server's Web UI
     
     # IMPORTANT: If this configuration file is used, NginxWebApi#### parameters in
     # /etc/cb/cb.conf MUST be updated to match this file.
     # Port 80 is defined in the http.conf. By default it redirects all trafic
     # to the https://$host$request_uri; If this behaviour needs to change update http.conf
     listen [::]:443 ssl ipv6only=off;
     
     include /var/cb/nginx/props/nginx.runtime.ssl_certificate.prop;
     include /var/cb/nginx/props/nginx.runtime.ssl_certificate_key.prop;
     
     include /etc/cb/nginx/conf.d/includes/cb.server.body;
     include /etc/cb/nginx/conf.d/includes/cb.server.api;
     #include /etc/cb/nginx/conf.d/includes/cb.server.error;
     
     # Include content of custom server configuration file
     include /etc/cb/nginx/conf.d/includes/cb.server.custom;
     }

5. Edit /etc/cb/cb.conf:

      NginxSensorHttpPort=443
   Change to...
      NginxSensorHttpPort=8443

6. Update the firewall to include 8443 (you may not need to do this as it may already be there)
   

      firewall-cmd --permanent --add-port=8443/tcp
      firewall-cmd --reload

7. Note: There should only be one cb*.conf file. Nginx will fail to start if there are two. Confirm there is only one ending in .conf by running: ls -lh /etc/cb/nginx/conf.d | grep 'cb\.'

   cb.conf.default
   cb.multihome.conf

8. Restart the server services: How to restart server services
9. Confirm the UI is still accessible on port 443 and the sensors are able to communicate on port 8443