CloudPassage FAQs

Yes, however... the customer will be responsible for tracking new releases of the Halo Daemon and updating your own distribution mechanisms accordingly. (Customers will be notified of new releases via email and the banner in the Halo portal).Distribution of the Halo Daemon needs to be compliance with the CloudPassage Terms of Service and EULA, in addition to any applicable laws like ITAR

Windows:

The download link is available in the Halo portal, Assets --> Servers, Actions --> Add Server. Choose agent as Software and Windows, the following is provided:

https://production.packages.cloudpassage.com/windows/cphalo-4.2.7-win64.exe

Linux:

The following information is available in the product documentation, https://library.cloudpassage.com/help/halo-repositories-and-code-signing

Setting up an APT repository

If you are setting up a non-secure repo, then one tool that makes it easy to create repos is reprepro. However, if you need to use create a local copy of a secure APT repo, you will need to use one of the common apt mirroring tools to create a repo mirror. This is required due to the signing of various repo files that are needed to ensure the security of the package and repo files. There are quite a few tools that can do APT repository mirroring. The steps listed here use the apt-mirror tool. Here are the steps to setting up a repo mirror for a secure APT repo:

On an Ubuntu server, run the following:sudo apt-get install apt-mirror

Create a directory to hold the repo mirror data:sudo mkdir /cp-repo(or whatever you would like to call the directory)

Modify the apt-mirror config to point to the CloudPassage repo (/etc/apt/mirror.list)

Comment out all of the lines that begin withdeborcleanand replace with the following contents:

set base_path /cp-repo

deb-amd64 https://production.packages.cloudpassage.com/debian debian main

deb-i386 https://production.packages.cloudpassage.com/debian debian main

Your mirrored files are now in /cp-repo/mirror(you can ignore theskelandvardirectories), and they are ready for you to put them on your internal repo server.

Setting up a YUM repository

Here are the steps you would take to create your own YUM repo:

On a RHEL server: Install the repo syncing/creation software:sudo yum install yum-utils createrepo

Create a directory to store the mirrored contents:mkdir /cp-repo/rhel

Create a file called:/etc/yum.repos.d/cloudpassage.repo

Put the below lines in the file (copy and paste will work).

[cloudpassage]

name=CloudPassage Halo Repository

baseurl=https://packages.cloudpassage.com/redhat/$basearch

enabled=1

gpgcheck=1

gpgkey=https://packages.cloudpassage.com/cloudpassage.packages.key

Then run:reposync --repoid=cloudpassage --download_path=/cp-repo/rhel

The mirrored data should be in/cp-repo/rhelif the command succeeds.

Question: When the Halo agent is placed into debug mode, the log file will contain specific error messages. What is the meaning of the individual messages?

Answer: The following list details the Halo agent debug messages and their meanings.

Message

Meaning

Error - DNS failed: alive.

Unable to resolve grid IP address due to some kind of DNS error

Information - Controller starting up ...

Controller process starting up (linux only)

Information - Agent registered with core!

Agent has successfully connected with the Grid

Information - Agent starting up ...

Agent is beginning its startup routine

Information - Shutting down ...

Agent is beginning its shutdown routine

Information - Terminating

Agent is stopping

Information - child will not be restarted

Controller has decided to not restart the Agent

Warning - Agent failed to register with core!

Connectivity issue, bad ID (or ID for wrong grid), etc

Warning - Failed to initialize. Will retry ...

Agent was unable to start up successfully, it will wait and retry

Debug - Calling core with action: alive

Notifying grid that the Agent's alive

Debug - Calling core with action: event

Reporting results of the command (includes scans)

Debug - Calling core with action: facts

Reporting results of facts collection (will be deprecated)

Debug - Calling core with action: messages

Hearteat

Debug - Flushed DNS cache

Flushed DNS Cache

Debug - Setting state to RUNNING

Agent started successfully

Debug - Setting state to STARTING

Agent beginning startup sequence

Debug - Setting state to TERMINATED

Agent completely stopped

Debug - Setting state to TERMINATING

Agent beginning shutdown process

Debug - Starting main loop...

Agent beginning it's heartbeat cycle

Debug - Starting scheduling.

Debug - Trying grid.cloudpassage.com

Attempting to reach grid

Debug - Uninitializing subsystem: Logging Subsystem

Stopping the Agent's logging.

Debug - controller got signal 15

SIGTERM 15 = Termination signal? Agent process got a kill signal?

Debug - controller got signal 17

Debug - controller waiting for signal

Debug - got executable script facts command_id 24340635

Gathered facts from execute command id <blah> (Facts = system attributes like OS/interfaces?)

Debug - got executable script sam command_id 24340629

Downloaded SAM scan script

Debug - got executable script sca command_id 24340627

Downlaoded SCA scan script

Debug - got executable script sv command_id 24340634

Downloaded Self Verification script

Debug - got executable script svm command_id 24340628

Downloaded SVM (SVA) scan script

Debug - got library script checks command_id 24340638

Lua library supporting sca, sva

Debug - got library script fimlib command_id 24340641

Lua library supporting fim

Debug - got library script firewall command_id 24340640

Lua library supporting firewall

Debug - got library script json command_id 24340636

Lua library to encode/decode json payload

Debug - got library script lidslib command_id 24340642

Lua library to support lids

Debug - got library script server command_id 24340637

Lua library to support facts collections about the server (distro, version, etc..)

Debug - got library script utils command_id 24340639

Lua library of misc utils

Debug - monitoring grid communication health

Agent is watching for stalled sockets connected to grid

Debug - running task 'facts'

Running facts - uses server library

Debug - running task 'sam'

Running SAM check

Debug - running task 'sca'

Running SCA check

Debug - running task 'sv'

Self-verification

Debug - running task 'svm'

Running SVA check

Debug - script 'facts' scheduled with delay 0, interval 3600000

Facts scripted to run every 360000 seconds, starting immediately

Debug - script 'sam' scheduled with delay 86398000, interval 86400000

SAM scripted to run every 86400000 seconds, starting in 86400000

Debug - script 'sca' scheduled with delay 86398000, interval 86400000

SCA scripted scheduled

Debug - script 'sv' scheduled with delay 0, interval 3600000

Self-verification scheduled

Debug - script 'svm' scheduled with delay 86398000, interval 86400000

SVM scheduled

Debug - task 'facts' finished

Facts task complete

Debug - task 'sam' finished

SAM scan complete

Debug - task 'sca' finished

SCA scan complete

Debug - task 'sv' finished

Self-verification complete

Debug - task 'svm' finished

SVA scan complete