Single Node VM FAQs

We support below virtualization platforms:

• Microsoft Hyper-V: Hyper-V in Windows Server 2019+ and Windows 10+
• VMWare: Minimum VMWare ESXi 7.0.0+
• VirtualBox: 7.0.8+

A Solid State Drive (SSD) (for better IO and performance) or a Hard Disk Drive (HDD) can be attached to the VM for the storage

16

100 GB

Yes, the logs of services running in the OS are rotated based on the default log rotation policy configured in the RedHat. `/etc/logrotate.conf` configuration file can be customise the log rotation as needed.

The logs from each pod running in the RKE2 are rotated based on the default log rotation configured in the RKE2. Maximum number of log files per container is 3 and Maximum size of log file is 2MB.

No, increasing the number of cores to the VM does not essentially increase the performance of Glasswall Halo's Synchronous API.

32 GB

• If you are deploying to VMware or VirtualBox, an OVA of approximately 5.5GB will be shared by Glasswall.
• If you are deploying to Hyper-V, a VHD of 64GB will be shared by Glasswall.

No, firewall is disabled in the Linux OS as it will conflict with Kubernetes networking.

Firewall is disabled.

• 80
• 443
• 22(SSH)
• 6443 (Kubernetes API server is allowed only from Kubernetes cluster CIDR (10.42.0.0/16) and service CIDR (10.43.0.0/16))

Yes, Fail2Ban monitors server log files (such as /var/log/auth. log, /var/log/apache/access. log) for intrusion attempts and other suspicious activity. Once a predefined number of failures have been detected from a remote host, Fail2Ban blocks their IP address automatically for a specific amount of time.

Glasswall will provide security updated image once every quarter. However, it is recommended to do security updates/patches whenever security advisories are published.

To use RHEL update mirrors, you must subscribe using RHEL Subscription Manager:

subscription-manager register --username  --password  --auto-attach

Copy the private key and certificate of the domain to the VM and Run bash configure_tls.sh    in the VM.

Update ~/.ssh/authorized_keys with your public key in the VM - Disable Password authentication:

sh sudo sed -i "s/PasswordAuthentication yes/PasswordAuthentication no/g" /etc/ssh/sshd_config sudo service sshd restart 

Yes, it is mandatory to update the password. Once you are logged into the VM, you will be prompted to update the password

• STIG hardening is applied to the base OS.
• CIS hardening is applied to the RKE2 (Kubernetes cluster).
• All Glasswall containers utilise hardened container images.
• All Glasswall software is hardened using SAST, DAST, SCA tooling.

Yes, Glasswall provides base64 encoded MD5 hash value of the file. Verify if it matches by using the command by replacing ${OVA_FILE_PATH} with the OVA file path:

sh openssl dgst -md5 -binary < ${OVA_FILE_PATH} | base64

There is no anti-virus solution installed in the VM image. If needed an anti-virus solution can be installed separately in the VM.

An anti-virus solution can interfere with the CDR process and hence the folders in the VM where files being processed should be excluded from the anti-virus scanning.

Yes, /opt/local-path-provisioner should be excluded from anti-virus scanning.

Yes, FIPS-140-2 support is built into RKE2 at the foundation level. Specifically, the functions used within RKE2 meet the stringent security requirements outlined in the FIPS-140-2 standard. This includes, the algorithms used for encryption and decription, the methods used for key generations and management, and the protections in place to prevent unauthorized access or use of the cryptographic modules.

Additional documentation regarding FIPS-140-2 enablement can be found here.

An anti-virus solution can interfere with the CDR process and hence the folders in the VM where files being processed should be excluded from the anti-virus scanning.

The banner message can be customized by updating /etc/issue file in the VM.

These are the list of OS level services running on the VM:

The RedHad OS has been gone through the STIG hardening process and any unnecessary services have been removed and no unnecessary services have been installed.

The base OS version can be found in the Release Notes.

Yes, Kubernetes cluster runs with a single node.

Kubernetes version can be found in the Release Notes.

Glasswall Halo error codes and API can be found via Glasswall API Documentation.

Health of the Glasswall Halo cluster can be monitored using the API health endpoint.

Currently x86-64 CPU processors are supported. ARM support will be available in upcoming releases.

The VM comes with syslog pre configured and this can be used to send the logs to a syslog server.

• Create a new VM from the new image from Glasswall following the deployment steps.
• Make sure the new VM is working as expected.
• Switch the DNS record from old IP address to the new IP address of the VM.

Kubernetes software updates will be done in the VM images provided by the Glasswall. However it is recommended to update the Kubernetes cluster whenever security advisories are published.

When upgrading the Kubernetes version of a cluster, we recommend that you:

• Take a snapshot.
• Initiate a Kubernetes upgrade.
• If the upgrade fails, revert the cluster to the pre-upgrade Kubernetes version. This is achieved by selecting the Restore etc and Kubernetes version option. This will return your cluster to the pre-upgrade kubernetes version before restoring the etcd snapshot.
• The restore operation will work on a cluster that is not in a healthy or active state.

Use nmcli command line utility or nmtui utility to configure the IP address, Gateway and DNS Server.

Yes, DHCP client is active in the VM and can allocate an IP address when deployed to a network with DHCP Server.

Once an IP address is configured to the VM, SSH using the username and password/private key shared by Glasswall.

None.

HTTPS, HTTP endpoints are provided within the VM.

No, the RHEL license should be obtained separately.

There is no need to purchase a license for the Kubernetes as it is open source with Apache 2.0 License.

RKE2 & RabbitMQ are the main open source components and the complete Software Bill of Materials (SBOM) can be provided on request.

• RKE2 Kubernetes cluster is licensed under Apache 2.0 License.
• RabbitMQ Cluster Kubernetes Operator is licensed under Mozilla Public License 2.0.
• RabbitMQ server is licensed under Apache 2.0 License.
• Additional licensing information can be provided by Software Bill of Materials (SBOM) on request.