admin - Manage administration services and accesses
[1] admin [(snmp | ssh | ssh password | wadmin | waudit) [on | off]]
[2] admin tls [<tls-id>[:<ca-id>]]
[3] admin [ssh [fingerprint | generate [on | off] | key [raz | (add | del | show) <key-id> | load <key-id> (ftp | sftp | tftp) <file-server> <file-path> | set ’<ssh-public-key>’]]]
[4] admin topology (internal | external | auxiliary | vpnipsec) [on | off]
[5] admin user [raz | (add | del) <admin-name> [<admin-password>]]
[6] admin snmp [(user [<user-name>]) | (community [<community-password>]) | (privacy [<privacy-password>]) | (udp | tcp | tls [(on | off)]) | engine | (mode [(on | off)])]
[7] admin snmp certificate [raz | load (ftp | sftp | tftp) <file-server> <file-path>]
[8] admin snmp [trap [raz | add (v1 | v2c) <receiver-server> [<port> [<community>]] | del (v1 | v2c) <receiver-server> [<port>] | test]]
[9] admin snmp [trap [raz | add v3 <receiver-server> <port> <user-name> (sha256 | sha384 | sha512) (des | aes) [<auth-password> [<privacy-password>]] | del v3 <receiver-server> <port> <user-name>]]
[10] admin [2fa [on | off]]
The first [1] usage form allows you to activate or deactivate administration and management services. To activate a service, use its name (snmp, ssh, wadmin or waudit) followed by the on keyword. Use the off keyword to deactivate it. Available services are as follows:
• snmp: the SNMP agent with the ability to send SNMP traps.
• ssh: the SSH server.
• wadmin: the Web Administration GUI.
• waudit: the Web auditing GUI.
The usage form ssh password allows you to activate or deactivate SSH password authentication.
The Web Administration and Auditing GUIs allow you to configure and audit the system using a web browser. The auditing service provides a live summary view of the available logs (virus, access, etc.) and allows inspection of web requests on reverse websites (only available when the waf mode is activated). The web auditing service is intended for debugging purposes only and should not be activated under normal circumstances, as it may weaken the security of the appliance. The auditing interface is available at the URL https://<admin-ip>:<waudit-port> where <admin-ip> and <waudit-port> are respectively the administration IP address and the waudit port number. The administration IP address may be the internal, external or auxiliary IP address of the appliance, depending on the configured administration topology (see below). When vlan mode is activated, the native internal IP address can no longer be used. Instead, the IP address associated with the administration 802.1q pseudo device must be used (see the vlan command for further information).
The second [2] usage form allows you to set the TLS certificate to use for the web GUI and the SNMP agent over TLS. The TLS certificate is specified by providing a TLS server identifier. You may optionally specify an intermediate CA certificate by providing its identifier, separated from the TLS server identifier by a colon. In this case, the specified intermediate CA certificate will be used for the web GUI.
The third [3] usage form allows you to:
• Show the fingerprint of the RSA and DSA keys used by the SSH server.
• Schedule the regeneration of those RSA/DSA keys.
• Manage public SSH keys.
To display the SSH server fingerprints, use the keywords admin ssh fingerprint. To schedule the regeneration of the SSH server keys, use the keywords admin ssh generate on. Use the keyword off instead of on to cancel the scheduled regeneration.
It is also possible to import an SSH public key into the system. This allows the owner of the corresponding private SSH key to log in to the system without having to enter a password. The keywords ssh key without any additional arguments display the list of defined public SSH keys, each identified by a unique identifier. The keywords key raz reset that list. To remove a public SSH key, use the keywords ssh key del followed by the identifier of the key to delete. The usage form ssh key show followed by an SSH key identifier displays the content of that public key.
Importing an SSH public key is done in two steps. First, an empty public SSH key entry must be added using the keywords ssh key add followed by an identifier for that public SSH key. In a second step, the public SSH key content can be set inline using the keywords ssh key set followed by the SSH key identifier and the SSH public key put between quotes. It is also possible to load the public SSH key content from a trusted file server. To do so, use the keywords ssh key load followed by the public SSH key identifier and the public SSH key location. The public SSH key location is specified by three arguments: the protocol to use (ftp, sftp or tftp), the IP address (or name) of the file server on which the public SSH key file is located, and the public SSH key file path. The specified file must contain a valid SSH public key.
The system supports SSH protocol version 2 only. Public SSH keys take effect after applying the configuration with the apply command. If you attempt to load an SSH key that already exists in the system, the operation is silently ignored.
The fourth [4] usage form allows you to define the access topology for administration services. The access topology defines the logical network interfaces on which administrators (or SNMP manager systems) are allowed to connect. To enable administration on a logical network interface, use its name (internal, external, auxiliary or vpnipsec) followed by the keyword on. To disable administration on that interface, use the keyword off instead. Enabling administration on the vpnipsec virtual network interface allows administration access via the internal network interface through an IPsec VPN tunnel.
The fifth [5] usage form allows you to add or remove unprivileged administrator users. Unprivileged administrators have read-only rights (i.e. they can only view the configuration). Without any arguments, this command displays the list of unprivileged administrators. To add an unprivileged administrator, use the keyword add followed by the user name. To delete an unprivileged administrator, use the keyword del followed by the name of the administrator to remove. A valid administrator name must begin with an alphabetic character followed by alphanumeric characters and the characters "_" and "-". To erase all unprivileged administrators, use the keyword raz.
In interactive mode, when a new unprivileged administrator is added, the privileged administrator (admin user) is prompted to set a password for the new unprivileged administrator. The first time an unprivileged administrator logs in, they are prompted to change their password. The new password applies to both the console and the web GUI interfaces. Note that administrator passwords are not part of the configuration and are therefore not saved when the configuration is saved.
In non-interactive mode (for instance when a configuration file is loaded from a file server), if the unprivileged administrator being added does not already exist, a password is automatically generated as follows: the administrator user name (<admin-name>) followed by the character @ (at sign), the string "appliance", the character - (dash) and the current year. For example, for an unprivileged administrator named foo added during the year 2023, the automatically generated password would be foo@appliance-2023.
The sixth [6] usage form of the admin command allows you to configure the internal SNMP (Simple Network Management Protocol) agent. The keyword community allows you to set the community string for SNMP-v1 and SNMP-v2c. With SNMP-v3 the community string takes the role of the authentication password. The keyword user allows you to set the SNMP-v3 user name. When using SNMP-v3, the data portion of messages may be encrypted using AES (Advanced Encryption Standard). The keyword privacy allows you to set the encryption password for the encryption algorithm. Note that privacy encryption is not mandatory and the agent accepts requests without encryption. The keywords udp, tcp and tls allow you to activate or deactivate SNMP over UDP, TCP and TCP tunnelled over TLS (for encryption) respectively. Note that the SNMP agent listens on the following ports:
• SNMP over UDP: port 161
• SNMP over TCP: port 161
• SNMP over TCP tunnelled over TLS: port 10161
Note that only trusted monitoring managers are allowed to access the SNMP agent. Use the access command to define allowed SNMP managers.
The SNMP agent supports TLS over TCP connections using mandatory client and server SSL certificates. The SSL server certificate is the same as the one used for the web GUI (see the second usage form above). The seventh [7] usage form allows you to associate the defined SNMP-v3 user name (see above) with a client SSL certificate. The client certificate can be loaded from a trusted file server. Trusted file servers are defined with the access command.
The eighth [8] and ninth [9] usage forms allow you to configure SNMP trap receivers to which SNMP traps and notifications are sent. The system uses TCP to send SNMP notifications (not UDP). The system supports the following SNMP versions for traps and notifications: v1, v2c and v3, corresponding respectively to SNMP-v1 traps, SNMP-v2c inform notifications and SNMP-v3 inform notifications. SNMP traps and notifications are sent to receivers identified by their IP addresses (or network names) and port numbers. For SNMP-v1 and SNMP-v2c, if the port number is omitted, it defaults to 162 (the standard SNMP trap port). To send SNMP-v1 traps and SNMP-v2c inform notifications, a community string must be specified (a community string acts as a password for SNMP versions prior to v3). To send SNMP-v3 inform notifications, the user name, the authentication hash function (sha256, sha384 or sha512) and the encryption algorithm (des or aes) must be specified. Depending on the security level required by the SNMP-v3 receiver, an authentication password and optionally a privacy encryption password may also be required. If the receiver does not require those security levels, simply omit the related parameters from the command. Note that when passwords are specified, they must be at least 8 characters long.
To verify connectivity with SNMP receivers, you can send test traps to all configured receivers using the admin snmp trap test command. Note that the configuration must be applied using the apply command before test traps can be sent.
The following is a brief description of the notifications sent by the system:
• During installation, the system reserves the required space on HDDs to store various logs based primarily on the number of users and reverse websites. If a log file grows abnormally fast (for example due to a DoS attack), an SNMP trap is sent to report the anomaly.
• During installation, the system reserves space for the various filesystems according to the HDD capacities, so the system should never run out of disk space. If for any reason (for example a software defect) the free disk space on a filesystem falls below 5%, an SNMP trap is sent to report the anomaly.
• All network links are monitored. In the event of a link going up or down, an SNMP trap is sent to report the change.
• The system load average is continuously monitored and load averages for the past 5 and 15 minutes are calculated. If the averages exceed thresholds of 99% and 95% respectively for the past 5 and 15 minutes, an SNMP trap is sent to report the overload.
• All essential services are monitored. In the event of a failure, disruption or insufficient hardware resources to start enough service processes to support the current load, an SNMP trap is sent to report the disruption.
• A health checker service continuously monitors all vital services and attempts to restart any failed service. An SNMP trap is sent to report each restart attempt, and a subsequent SNMP trap reports the result of that attempt (failure or success). If the High Availability mode is activated (see the mode ha command) and the restart attempt fails, an additional SNMP trap is sent to report the failure, and all VRRP interfaces are shut down to explicitly remove the failed node from the pool of HA nodes.
• During automatic URL list loading, if one or more URL list files cannot be loaded, an SNMP trap is sent to report the failure.
• If the antivirus mode is activated and the virus signature database is more than one day out of date, an SNMP trap is sent to report the anomaly.
• If the hardware hosting the system includes HDDs with SMART (Self-Monitoring, Analysis and Reporting Technology) capabilities, they are monitored and SNMP notifications are sent in the event of HDD failures.
• If the system has been installed with software RAID capabilities, the RAID array is monitored and SNMP notifications are sent in the event of HDD failures.
• If a USB Ethernet adapter is plugged in or unplugged, an SNMP trap is sent. A similar SNMP trap is sent during appliance startup if a NIC is added to or removed from the system.
• If the IP routing table contains multi-gateway routes, an SNMP trap is sent in the event that one or more of those gateways becomes unreachable.
The system supports standard MIBs used to monitor Linux systems and also includes a dedicated MIB called CACHEGUARD-MIB. The ASN.1 MIB description of the CacheGuard MIB can be found on the original installation CD-ROM or on the official CacheGuard website.
The tenth [10] usage form allows you to activate or deactivate the 2FA (Two-Factor Authentication) mode for remote logins (SSH and web administration GUI). 2FA is a method in which the administrator is granted access only after successfully presenting two types of authentication evidence. The 2FA implementation in this system works in conjunction with an Authenticator App such as Google® Authenticator, available on Apple® and Android® based devices.
When 2FA mode is activated, you must provide a verification code in addition to your usual credentials (login and password) each time you log in as an administrator. The verification code is time-based and must be obtained from your Authenticator App.
The first time you activate 2FA mode as a privileged administrator, your secret key is displayed so that you can enter it into your Authenticator App. An equivalent QR code for that secret key is also available in the web GUI at ’[GENERAL] > [Administration Settings] > [Administration Services]’. Additionally, a set of emergency scratch codes is displayed, allowing you to log in if you do not have access to your Authenticator App. It is important that you save those codes in a safe place. The secret key and emergency scratch codes will no longer be available after the new configuration has been applied with the apply command.
To activate 2FA, use the 2fa keyword followed by the on keyword. Use the off keyword to deactivate it. IT IS IMPORTANT TO NOTE that when 2FA is in use, the system clock must be set to the correct current time in the correct time zone. Please refer to the clock, ntp and timezone commands for further information on setting the system clock.
access(1), apply(1), clock(1), file(1), mode(1), ntp(1), password(1), system(1), timezone(1), tls(1), vlan(1), vrrp(1)
CacheGuard Technologies <www.cacheguard.com>
Send bug reports or comments to the above author.
Copyright (C) 2009-2026 CacheGuard Technologies - All rights reserved