Hardening Workflow

This section describes the overall workflow needed to harden the OMi environment.

1. Check the hardening prerequisites. To best use the hardening guidelines given here for your particular organization, do the following before starting the hardening procedures:

   • Evaluate the security risk/security state for your general network, and use the conclusions when deciding how to best integrate OMi into your network.

   • Before starting the hardening process, define what areas of your environment you want to secure.

   • To implement advanced hardening (for example, reverse proxy setup), install OpenSSL 1.0.1 or later on the OMi host systems.

2. Obtain certificates from your Certificate Authority (CA).

   Server certificates must be issued to the name of the external access point (FQDN) that OMi users and data collectors use to access OMi. The SubjectAlternativeName field of the certificate must contain the FQDN of the system for which the certificate is issued. In a distributed environment you will need certificates for the gateway servers, the data processing servers, and if available the load balancer or reverse proxy.

   In addition, obtain the root CA certificates from the root and any intermediate authorities that issued the server certificates above.

   For more information on obtaining server certificates from a CA, see Obtain server certificates from a CA.

   Alternatively, if you do not wish to use an external CA, you can use the OMi configuration wizard to generate the certificates required for the TLS configuration. For more information, see Configure TLS for OMi.

3. Install the server certificates on the external access point of OMi. This may be a load balancer or reverse proxy. If it is the gateway server, run the configuration wizard as described in the following step.

4. Run the configuration wizard to enable TLS on the OMi servers. This secures the communication to OMi from UI clients, web service clients, command-line interfaces, and to the JMX console.

   For more information, see Configure TLS for OMi.

5. Optional. In the configuration wizard, enable client certificate authentication. Client certificate authentication configures OMi to require a client certificate when users log into OMi or when web services connect to OMi.

   For more information, see Configure Client Certificate or Smart Card Authentication.

6. Verify the secure connection. From a web browser, open the Default Virtual Gateway Server for Application Users and Default Virtual Gateway Server for Data Collectors URLs that you secured using the configuration wizard. If the log-in page appears, this verifies that the secure connection is configured.

7. Establish trust to the CA that issued the OMi web server certificate by importing the certificate to the truststore used by the browser.

   For more information, see Establish trust in the browser.

8. Update the data collectors:

   • Connect data collectors to the secure OMi. Now that the OMi servers are secured, you configure other servers to communicate securely with OMi:

     1. Import root CA certificate(s) obtained in step 2 into the JVM used by the data collector. If you are using OMi-generated certificates, use the opr-cert-mgmt command-line interface to export the OMi CA certificate from the OMi certificate inventory:

        opr-cert-mgmt.bat ‑export "OMi Webserver CA Certificate" PEM "C:\ca_certificate.crt"

     2. Configure the connection to OMi using HTTPS.

     3. Make sure data flows over the secure connection.

     For more detailed descriptions of the procedure required for each of the data collectors, see:

     • Data Flow Probe. The default UCMDB TLS port, 8443, must be changed to the OMi TLS port, 443, in the DiscoveryProbe.properties file.

       For more information, see the RTSM - Data Flow Management section.

     • SiteScope. See the SiteScope Help.

   • If OMi is configured to require a client certificate, you must also reconfigure the data collectors. To enable data collectors to connect to the OMi front end server that now requires a client certificate, see the following documentation:

     • Data Flow Probe. See the RTSM - Data Flow Management section.

     • SiteScope. See the SiteScope Help.