Enabling SSL/TLS for OpsCenter and Agent communication - Package Installs

To enable SSL for package installations, edit the configuration file.

Enable SSL between OpsCenter and the DataStax Agent by editing the opscenterd.conf configuration file.

Note: The SSL key generation process is done automatically at package install time. Unless you need to regenerate SSL key files, skip to editing the proper configuration files to enable SSL.

opscenterd.conf

The location of the opscenterd.conf file depends on the type of installation:

Package installations: /etc/opscenter/opscenterd.conf
Tarball installations: install_location/conf/opscenterd.conf

address.yaml

The location of the address.yaml file depends on the type of installation:

Package installations: /var/lib/datastax-agent/conf/address.yaml
Tarball installations: install_location/conf/address.yaml

Prerequisites

OpsCenter requires the .der file format for SSL. If the existing [agents] ssl_certfile in is in a .pem format, run the following command to convert the format:

openssl x509 -outform der -in /var/lib/opscenter/ssl/opscenter.pem -out /var/lib/opscenter/ssl/opscenter.der

For more information about SSL cert file formats, see converting SSL certificates.

The setup.py uses /usr/share/opscenter/conf/ssl.conf, which dictates the certificate common name. Modify the ssl.conf values before using setup.py.

Example ssl.conf

[ req ]
prompt=no
distinguished_name = req_distinguished_name

[ req_distinguished_name ]
C = country_name
ST = state_abbreviation
L = city_name
O = company_name
OU = division_name
CN = common_certificate_name
emailAddress = opscenter.admin@email.com

Procedure

If the SSL files already exist in the /usr/share/opscenter/ssl directory, they are not automatically recreated. Before running setup.py in 3, remove the old SSL files from that directory.
Make sure that the /tmp directory does not have the noexec flag set.

The setup.py script requires the /tmp directory to have exec permissions. See Setting and securing the tmp directory for the agent.
Run the OpsCenter setup.py script:
```
sudo /usr/share/opscenter/bin/jython /usr/share/opscenter/bin/setup.py
```
The script generates the SSL keys and certificates used by the OpsCenter daemon and the agents to communicate with one another in the following directory: /usr/share/opscenter/ssl.
Copy the following files to /var/lib/opscenter/ssl:
- opscenter.key: OpsCenter SSL private key
- opscenter.der: OpsCenter SSL certificate
- agentKeyStore: DataStax Agent keystore
- agentKeyStore.der: DataStax Agent SSL certificate
- agentKeyStore.key: DataStax Agent keyfile
  Note: The agentKeyStore.key keyfile is necessary only for non-Java clients.
```
sudo cp /usr/share/opscenter/ssl/opscenter.key /var/lib/opscenter/ssl
```
```
sudo cp /usr/share/opscenter/ssl/opscenter.der /var/lib/opscenter/ssl
```
```
sudo cp /usr/share/opscenter/ssl/agentKeyStore /var/lib/opscenter/ssl
```
```
sudo cp /usr/share/opscenter/ssl/agentKeyStore.der /var/lib/opscenter/ssl
```
For non-Java clients, copy the agentKeyStore.key keyfile as well.
```
sudo cp /usr/share/opscenter/ssl/agentKeyStore.key /var/lib/opscenter/ssl
```

Change ownership of the files copied in the previous step to the opscenter user and the opscenter group:

sudo chown opscenter:opscenter /var/lib/opscenter/ssl/opscenter.key

sudo chown opscenter:opscenter /var/lib/opscenter/ssl/opscenter.der

sudo chown opscenter:opscenter /var/lib/opscenter/ssl/agentKeyStore

sudo chown opscenter:opscenter /var/lib/opscenter/ssl/agentKeyStore.der

For non-Java clients, change the ownership for the agentKeyStore.key keyfile as well.

sudo chown opscenter:opscenter /var/lib/opscenter/ssl/agentKeyStore.key

Open opscenterd.conf in an editor and add an [agents] section with the use_ssl option set to enable SSL. See configuring the agent for ssl for more details on the use_ssl option.

sudo vi /etc/opscenter/opscenterd.conf

[agents]
use_ssl = true
ssl_keyfile =  /var/lib/opscenter/ssl/opscenter.key
ssl_certfile = /var/lib/opscenter/ssl/opscenter.der
agent_keyfile = /var/lib/opscenter/ssl/agentKeyStore
agent_keyfile_raw = /var/lib/opscenter/ssl/agentKeyStore.key
agent_certfile = /var/lib/opscenter/ssl/agentKeyStore.der

Restart the OpsCenter daemon.
If you need to connect to a cluster in which agents have already been deployed, log in to each of the nodes and reconfigure the address.yaml file. Reconfigure the agents on all nodes.

Tip: If you do not want to manually edit all of the node configuration files, follow the procedure to install DataStax Agents automatically.
1. Copy /var/lib/opscenter/ssl/agentKeyStore from the OpsCenter machine to /var/lib/datastax-agent/ssl/agentKeyStore on each node in the cluster.
```
scp /var/lib/opscenter/ssl/agentKeyStore user@node:/var/lib/datastax-agent/ssl/
```
  Where node is either the host name of the node or its IP address and user is the user ID on the node.
2. Log into each node in the cluster using ssh.
```
ssh user@node
```
  Where node is either the host name of the node or its IP address and user is the user ID on the node.
3. Edit the address.yaml file, changing the value of use_ssl to 1.
```
sudo vi /var/lib/datastax-agent/conf/address.yaml
```
```
use_ssl: 1
```
4. Restart the agent.
```
sudo service datastax-agent restart
```
After opscenterd and all agents have been configured and restarted, verify proper agent connection through the Agent Status tab.