DDC agents

This document provides procedures for installing and upgrading DDC agents (DDC Standard agent and DDC ML agent) in the operating systems required by your Data Stores. Agents should always be upgraded to be aligned with the latest server version. To upgrade an agent, simply re-install it. Before reinstalling, you have to uninstall the older version of the agent.

DDC standard agents

1. Download the DDC Agents ZIP file corresponding to the CipherTrust Manager version from the Thales Customer Support.

2. Check the Agent compatibility matrix to find a matching agent to the desired Data Stores.

3. Extract the agent Installer Package from DDC Agents ZIP and save it on the host machine where you want to install the agent.

4. Follow the appropriate procedure for your Operating System.

   • RHEL agents

   • Debian agents

   • Windows agents

Agent compatibility matrix

The following table lists supported agent installers for different types of data stores for different platforms and databases to help you select an appropriate installer depending on your data store requirements.

Data Store Category	Data Store Type	Agent Configuration	Debian	RHEL	Windows
Local Storage	RHEL 7 and above	Local
Local Storage	Debian based distros	Local
Local Storage	Windows	Local
Database Storage	IBM DB2 11.1 and above	Proxy
Database Storage	Microsoft SQL 2012 and above	Proxy			1
Database Storage	Oracle 9 and above	Proxy		2
Database Storage	PostgreSQL 13 and above	Proxy	3	3	3
Database Storage	SAP HANA 2.0 and above	Proxy			4
Database Storage	MySQL 5.0 and above	Proxy	5	5	5
Database Storage	MongoDB 6.0 and above	Proxy
Network Storage	Unix File Share (NFS)	Proxy
Network Storage	Windows Share (SMB, CIFS)	Proxy
Cloud Storage	AWS S3 (Amazon Web Services)	Proxy
Cloud Storage	Office 365: Sharepoint Online	Proxy
Cloud Storage	Office 365: Exchange Online	Proxy
Cloud Storage	Office 365: OneDrive for Business	Proxy
Cloud Storage	Azure Blobs	Proxy
Cloud Storage	Azure Tables	Proxy
Cloud Storage	G-Suite (G-Mail and G-Drive)	Proxy
Cloud Storage	Salesforce	Proxy
Server	SharePoint Server 2013 and above	Proxy
Server	Exchange Server 2013 and above	Proxy			6
Big Data	Hadoop 2.7.3 and above	Proxy		7
Big Data	Teradata 16.20 and above	Proxy			8

DDC supports two types of agent configurations:

• Local: Agent is installed and configured directly on the machine that contains sensitive data. Agent completes the scan accessing the files directly from the file system.

• Proxy: Agent is installed and configured on a proxy machine that is used to scan sensitive data on other machines. Agent completes the scan accessing the information stored in the data store using the configured port and protocol. Please note that a proxy agent can be installed on the same host as an in-house data store.

RHEL agents

The table below lists all RedHat Linux agent installer packages included in this release.

RHEL 6 is no longer supported. If you are running this Operating System, please consider upgrading.

Installing agents on RHEL

To install the Linux 3 database runtime node agent on RHEL:

1. Install the epel-release package:

   sudo yum install epel-release
   

2. Install the required packages:

   sudo yum install libxml2 libgsasl openssl \
   libcurl libuuid protobuf krb5-libs libaio libnsl
   

3. Navigate to the location where the agent installation package (.rpm) is stored.

4. Install the agent by using the following command:

   sudo rpm -ivh er2-2.x.x-linux3-rh-x64_database-runtime.rpm
   

   For example:

   rpm -ivh er2-2.11.0-linux3-rh-x64_database-runtime.rpm
   

5. Connect the agent to the active CipherTrust Manager node:

   er2-config -i <hostname|ip_address>
   

   where, <hostname|ip_address> represents the IP address or hostname of the CipherTrust Manager node.

6. Test the connection settings (on the data store that is using this host).

   er2-config -t
   

   If the connection has been correctly configured, you should see the following message:

   Testing connection setting...
   Test SUCCESS. Saving settings
   Configuration updated, please restart agent service
   The configuration has been saved. Please restart the agent for the changes to take effect.
   

   Tip

   To be able to scan Oracle DB Data Stores, make sure that the agent can resolve its own hostname. If it cannot, add it to its hosts file. For example, if its hostname is 'agent123', add this line:

   127.0.0.1 localhost agent123

7. Restart the agent:

   • Option 1

     sudo /etc/init.d/er2-agent restart
     

   • Option 2

     sudo /etc/init.d/er2-agent stop
     sudo /etc/init.d/er2-agent start
     

Uninstalling agents from RHEL

To uninstall a DDC agent:

1. Stop the DDC agent.

   sudo /etc/init.d/er2-agent stop
   

2. Remove the existing packages:

   sudo rpm -e er2
   

Debian agents

The table below lists all Debian Linux agent installer packages included in this release.

Debian 10 is no longer supported. If you are running this Operating System, please consider upgrading.

Installing agents on Debian

1. Navigate to the location where the agent installation (.deb) package is stored.

2. Install the required packages:

   sudo apt-get install libaio1 libaio-dev krb5-user \
   libgsaslxx libcurlxx libprotobufxx
   

   Here, xx represents the version of the library package that is compatible with the corresponding Ubuntu version you are using. For example, libprotobuf23 is compatible with Ubuntu 22.10, while libprotobuf10 is compatible with Ubuntu 18.04. Refer to the official Ubuntu documentation to identify the appropriate package version.

   The example below shows package installation for Ubuntu 18.04:

       sudo apt-get install libaio1 libaio-dev krb5-user \
       libgsasl7 libcurl14 libprotobuf10
   

3. Install the agent by using the following command:

   sudo dpkg -i er2-2.x.xx-xxxx_xxxx.deb
   

   For example:

   sudo dpkg -i er2-2.11.0-linux3-x64_database-runtime.deb
   

   The package name that you use with the command may be different and depends on your system's architecture and agent type.

4. Connect the agent to the active CipherTrust Manager node:

   sudo er2-config -i <hostname|ip_address>
   

   where <hostname|ip_address> represents the IP address or hostname of the CipherTrust Manager node.

5. Test the connection settings (on the data store that is using this host).

   sudo er2-config -t
   

   If the connection has been correctly configured, you should see the following message:

   Testing connection setting...
   Test SUCCESS. Saving settings
   Configuration updated, please restart agent service
   The configuration has been saved. Please restart the agent for the changes to take effect.
   

6. Restart the agent:

   • Option 1

     sudo /etc/init.d/er2-agent restart
     

   • Option 2

     sudo /etc/init.d/er2-agent stop
     sudo /etc/init.d/er2-agent start
     

Uninstalling agents from Debian

To uninstall a DDC agent:

1. Stop the DDC agent.

   sudo /etc/init.d/er2-agent stop
   

2. Remove the existing packages:

   sudo dpkg --remove er2
   

Windows agents

The table below lists all Windows agent installer packages included in this release.

Windows 8/8.1 64-bit is no longer supported. If you are running this operating system, please consider upgrading.

Installing agents on Windows

1. Log in to the host machine where you want to install the agent as administrator.

2. Run the agent installer.

3. In the Welcome screen of the setup wizard, click Next to continue.

4. The End-User Licence Agreement (EULA) screen is displayed.

   1. Read the license agreement and select I accept the terms in the Licence Agreement.

   2. Click Next to continue.

5. In the Choose Setup Type screen, select the Install option for the standard installation and click Next to continue.

6. The Ready to Install screen is displayed.

   1. Click Install to install the product in the default location.

   2. If the User Access Control dialog box appears, click Yes to confirm.

   The installation begins and the progress is shown under the Status progress bar.

7. During the installation, in a separate Node Configuration window, you are asked for the connection details of the active CipherTrust Manager node.

   1. Master server IP address or host name: specify the IP address or host name of the CipherTrust Manager node.

   2. Master server public key and Target Group: skip this configuration part as it is optional and currently not used.

   3. Click Test Connection to test the connection between the agent and CipherTrust Manager.

      • If the connection is properly configured, a confirmation will appear stating "Connectivity test is successful". Click OK to close the prompt.

      • If the connectivity test fails, click OK to close the prompt, make sure that CipherTrust Manager is reachable from the agent host, and retry the test.

   4. Click Finish to complete the configuration.

8. After a successful agent installation, click the Finish button to exit the wizard and complete the installation.

   Note

   The installer creates a service called Enterprise Recon 2 Agent that runs under the Local System user account.

9. For scanning MS SQL DB make sure to install the latest ODBC drivers package from the Microsoft site.

Uninstalling agents from Windows

To uninstall a DDC agent, you must be logged on as Administrator to the host where the agent is running.

1. Navigate to the Control Panel > Programs and Features.

2. Locate the Enterprise Recon 2 Agent in the list of installed programs.

3. Right click the agent and select Uninstall.

4. In the dialog box that is displayed, select to automatically close the Enterprise Recon 2 Agent application, and click OK to continue.

5. Walk through the wizard.

DDC ML agent

DDC ML agent can be installed on both Windows and Linux machines. The DDC ML agent has capabilities of both DDC and DDC ML. Once the agent is installed, you can continuously monitor its connectivity status in the CipherTrust Manager.

Agent compatibility matrix

Data Store Category	Data Store Type	Agent Configuration	Ubuntu	Debian	RHEL	Windows
Local Storage	RHEL 7 and above	Local
Local Storage	Debian based distros	Local
Local Storage	Ubuntu	Local
Local Storage	Windows	Local
Network Storage	Unix File Share (NFS)	Proxy
Network Storage	Windows Share (SMB, CIFS)	Proxy

Agent installer packages

Installation on Windows

This procedure describes how to install DDC ML agent on the Windows machine.

Prerequisites

• JRE 1.8

• If VERIFY_HOSTNAME configuration parameter is set to 'Y', ensure that IP and hostname mappings for CipherTrust Manager is configured in \etc\hosts. See step 3 of Silent installation of DDC ML agent for the list of configuration parameters.

• Ensure following system environment variables are set.

  1. HADOOP_HOME = <INSTALL_DIR>\hadoop

  2. PATH variable contains the following paths:

     • <INSTALL_DIR>\lib

     • <INSTALL_DIR>\hadoop\bin

     • C:\Program Files\Java\jre-1.8\bin\server (modify as per JRE installation location in your system)

• Get registration token from the CipherTrust Manager for registering the DDC ML agent.

• Download the trusted CA server certificate. The path to the downloaded server CA certificate is specified in the CA_CERT parameter. See step 3 of Silent Installation of DDC ML Agent for the list of configuration parameters.

• Configure MLaaS.

• Ensure that the agent recognizes the signer CA chain of the web server certificate as a trusted CA.

• DDC ML agents will be installed with administrator privileges, so administrator credentials and logins on the ML agent host must be secured with appropriate access controls.

Silent installation of DDC ML agent

1. Obtain the DDC ML agent installer package in zip format from the customer support site.

2. Extract the content of Windows_agent_xxx.zip to say C:/DDC_ML. Ensure that installation scripts and MSI installers are extracted.

3. Create a reg_conf.txt file at C:\DDC_ML and add the following configuration parameters to it.

   Parameter	Description
   REG_TOKEN	Registration token obtained from CipherTrust Manager.
   CM_URL	IP address or hostname of CipherTrust Manager.
   AGENT_HOSTNAME_IP	IP address or hostname of DDC agent.
   VERIFY_HOSTNAME (optional)	Defines whether hostname verification will be performed or not. Possible Values: Y (Default) /Yes /N /No. If set to 'Y', you must add CipherTrust Manager IP and hostname mapping in \etc\hosts\
   VERIFY_PEER (optional)	Defines whether verification of web server certificate signing CA will be performed or not. Possible values: Y(Default) /Yes /N /No.
   CA_CERT (optional)	Certificate chain of trusted signing CA. Required when VERIFY_PEER is set to 'Y'.

   Example:

   REG_TOKEN = WymtZNG4vPwvQqcI6QmbdUvWJZzF7gNNXoJbID37meB4mpZNEFucIjD2WwElmOyI
   
   CM_URL = 10.191.16.101
   
   AGENT_HOSTNAME_IP = agent-1
   
   VERIFY_HOSTNAME = Y
   
   VERIFY_PEER = Y
   
   CA_CERT = C:\certs\ca_cert.pem
   

   Note

   Agent name or hostname must only contain letters (a-z, A-Z), digits(0-90), hyphen (-), or dot (.).

4. Run the following command with admin privileges to install the agent. The default installation directory is C:\Program Files\Thales\DDC_Agent.

   install.bat -INSTALLDIR="<installation_directory>" -CONF="<agent_reg_conf_path>"
   

   Example:

   install.bat -INSTALLDIR="C:\Thales\DDC_Agent\" -CONF="C:\reg_conf.txt"
   

   INSTALLDIR is an optional argument. Modify its value to install the agent in a different directory.

5. (Optional) After successful installation, you can check the DDC ML agent logs at C:\ProgramData\thales\ddc_agent .

   Following log files are available:

   • MLAgentReg.log: DDC ML agent registration logs

   • agent.{timestamp}: DDC ML library logs

   • ddc_agent_spark.log: Spark logs generated during scan

   • service.log: DDC ML agent service logs

Uninstalling DDC ML agent on Windows

To uninstall DDC ML agent, run the uninstall.bat command in the command prompt. This command will unregister the DDC ML agent from the CipherTrust Manager and uninstall it from the host machine.

Installation on Linux

This procedure describes how to install DDC ML agent on Linux machine.

Prerequisites

• JRE 1.8

• RPM

• If VERIFY_HOSTNAME configuration parameter is set to 'Y', ensure that IP and hostname mappings for CipherTrust Manager is configured in /etc/hosts. See step 4 of of the Silent Installation of DDC ML Agent section for the list of configuration parameters.

• Get registration token from the CipherTrust Manager (using root domain) to register the DDC agent.

• Ensure Client Profile name is available, if you are using a profile other than the default Client Profile.

• Download the trusted CA server certificate. The path to the downloaded server CA certificate is specified in the CA_CERT parameter. See step 4 of of the Silent Installation of DDC ML Agent section for the list of configuration parameters.

• Configure MLaaS.

• Ensure that the agent recognizes the signer CA chain of the web server certificate as a trusted CA.

• Ensure JAVA_HOME is set properly to find the JRE folder.

  For example, if JRE is available at /usr/lib/jvm, set JAVA_HOME by adding export JAVA_HOME=/usr/lib/jvm to the .bash_profile or .bashrc and restart the terminal.

• DDC ML agents will be installed with root privileges, so root credentials and logins on the DDC ML agent host must be secured with appropriate access controls.

Silent installation of DDC ML agent

1. Log on to the host machine as a root user for installing the agent.

2. Download the agent installer package from the customer support site.

   Naming convention:

   Product Name - Product Version - File Format

   Example:

   ddc_agent-1.0.0-0000.x86_64.rpm.bin

3. Copy or mount the installation file to the host system. If required, make the file executable with the chmod command.

   chmod 0755 ddc_agent-1.0.0-0000.x86_64.rpm.bin

4. Create a “reg_conf.txt” file and add the following configuration parameters to it:

   Parameter	Description
   REG_TOKEN	Registration token obtained from CipherTrust Manager.
   CM_URL	CipherTrust Manager IP address or hostname.
   AGENT_HOSTNAME_IP	DDC agent IP address or hostname.
   VERIFY_HOSTNAME (optional)	Defines whether hostname verification will be performed or not. Possible Values: Y (Default) /Yes /N /No. If set to 'Y', you must add CipherTrust Manager IP and hostname mapping in /etc/hosts/
   VERIFY_PEER (optional)	Defines whether web server certificate signing CA verification will be performed or not Possible values: Y(Default) /Yes /N /No.
   CA_CERT (optional)	Certificate chain of trusted signing CA. Required when VERIFY_PEER is set to 'Y'.

   Example:

   REG_TOKEN = WymtZNG4vPwvQqcI6QmbdUvWJZzF7gNNXoJbID37meB4mpZNEFucIjD2WwElmOyI
   
   CM_URL = 10.152.17.112
   
   AGENT_HOSTNAME_IP = agent-1
   
   VERIFY_HOSTNAME = Y
   
   VERIFY_PEER = Y
   
   CA_CERT = /root/certs/ca_cert.pem
   

   Note

   Agent name or hostname must only contain letters (a-z, A-Z), digits(0-90), hyphen (-) or dot (.).

5. Use the following command to install the agent.

   ./ddc-ml-1.0.0-1234-rh7.rpm.bin -s "reg_conf.txt"
   

   Installer will display the Thales License Agreement. When prompted, type 'Y' and press Enter to accept and continue. By default, DDC ML agent is installed at /opt/thales/ddc_agent.

   To view other installation options, run ./ddc_agent-1.0.0-0000.x86_64.rpm.bin –h command.

   Sample output:

   ./ddc_agent-1.0.0-0000.x86_64.rpm.bin: [-d <dir>] [-e] [-i] [-h] [-m] [-r] [-s <file>] [-t <path>] [-u] [-v] [-y]
       -d Install in specified directory (option not supported on Ubuntu)
       -e Extract to the current working directory; don't install
       -h This help message
       -s <file> Register using silent mode; file has environment vars
       -v Verbose
       -y Answer YES to installation questions (for registration use -s)
   

6. (Optional) Check the installation logs of DDC ML agent at /var/log/thales.

   The log file is named in the following format /install.ddc_agent.log.{timestamp}.

   Tip

   If installation fails, check the installation logs for error details.

7. (Optional) See additional agent logs at /var/log/thales/ddc_agent/.

   The directory contains the following log files:

   • MLAgentReg.log: DDC ML agent registration logs

   • agent.{timestamp}: DDC ML library logs

   • ddc_agent_spark.log: Spark logs generated during scan

   • service.log: DDC ML agent service logs

8. (Optional) After successful installation, verify the status of DDC ML agent service using the following command.

   systemctl status ddc_agent
   

   Sample Output:

   [root@sjdpe03ddc015]# systemctl status ddc_agent
   
   ddc_agent.service - DDC ML Agent Service
   
   Loaded: loaded (/usr/lib/systemd/system/ddc_agent.service; enabled; vendor preset: disabled)
   
       Active: active (running) since Tue 2023-02-07 05:42:07 EST; 3s ago
   
       Process: 3374 ExecStart=/opt/thales/ddc_agent/bin/ddc_agent -s start (code=exited, status=0/SUCCESS)
   
   Main PID: 3380 (ddc_agent)
   
   CGroup: /system.slice/ddc_agent.service
   
       └─3380 [go-service ddc_agent_service]
   

Uninstalling DDC ML agent on Linux

To uninstall DDC ML agent, run /<INSTALL_DIR>/ddc_agent/bin/uninstall command. For example, if the agent is installed at the default location of /opt/thales, run /opt/thales/ddc_agent/bin/uninstall command to uninstall the agent.

After running the command, a confirmation message will be displayed asking for the permission to uninstall the agent. Press 'Y' to continue with the uninstall and 'N' to cancel the process.

Downloading trusted CA server certificate

1. Log on to CipherTrust Manager.

2. Go to Admin Settings > Interfaces.

3. Check the "Server Certificate Autogen" column entry corresponding to the "Web" interface. Note down the Signer CA of the web server certificate.

4. In the left navigation pane, go to CA > Local.

5. Click the ellipsis icon (...) corresponding to the Signer CA you identified in step 3.

6. Select Copy or Download.

7. Save the trusted CA certificate on the agent machine.

Re-register DDC ML agent

To re-register the DDC ML agent with the same Hostname or IP:

1. Remove any data stores associated with the deleted agent using the CipherTrust Manager GUI or API.

2. Clean up the DDC ML agent state by running the uninstall command. See Uninstalling DDC ML agent on Windows or Uninstalling DDC ML agent on Linux for more details.

3. Re-install the same DDC ML agent and register it with CipherTrust Manager. See Installing DDC ML Agent on Windows or Installing DDC ML agent on Linux for details.