The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Content Classification Manager is a customized server running various modules as containers on top of the microservices platform. This server is deployed as a virtual machine (VM) using either OpenStack or VMware ESXi.
Content Classification Manager 21.6 has been qualified on Red Hat OpenStack Release 8 (OpenStack Liberty) and VMware ESXi 6.5.
This release has been qualified for use with StarOS Release 21.6.
The Content Classification Manager includes the following modules:
Updater – This container manages external connections with the Talos Security Intelligence (TSI) database update server. It pulls updates from update server and places them in a directory with secure FTP access.
Secure FTP – This container provides secure FTP functionality for StarOS systems to retrieve TSI database files.
File Cleanup – This container cleans up old TSI DB files and reclaims disk space. A cron job removes files (oldest first) when the amount of free space falls below 20%, and continues until the free space is no longer below 20%.
Orchestrator – This container launches and manages the lifecycle of the other containers. It also exports a ConfD CLI interface for configuring various application parameters.
Consul – This container is an application that provides key-value storage and retrieval for the system.
Content Classification Manager installation files are provided in two parts:
a VM image in a qcow2 or vmdk format for OpenStack or VMware deployments respectively
a product ISO file.
For OpenStack deployments, perform the following steps to install the Content Classification Manager. It is assumed that an OpenStack installation exists with the physical networking configuration for external network connectivity.
| Step 1 |
Ensure there is IPv4 connectivity to the internet and to the StarOS gateways from the Openstack installation. It is highly recommended to separate the traffic between the VM and the backend internet server from the traffic between the VM and the StarOS systems using separate provider networks. If the StarOS systems are configured to pull updates from the Content Classification Manager at the same time each day, the Content Classification Manager should be configured with a high bandwidth connection (for example a 10 Gbps port) between the VM and the StarOS systems. |
|||||||||||||||||||||||||||
| Step 2 |
Create the Project and User under which the Content Classification Manager VM will be launched. |
|||||||||||||||||||||||||||
| Step 3 |
Define a flavor, such as TSI, with the following minimum specifications:
|
|||||||||||||||||||||||||||
| Step 4 |
Download the base qcow2 image and product ISO, and then upload them to Glance. For example: The image name in this example can be anything as long as the same name is specified in the VM launch (nova boot) command. The image name in this example can be anything as long as the same name is specified when creating a volume as shown in the subsequent steps. |
|||||||||||||||||||||||||||
| Step 5 |
Create a volume containing the product ISO: The volume size must be large enough to fit the ISO. 3 GB (--size 3) is sufficient since the ISO is approximately 1 GB. The volume name (tsi-iso in the example) can be anything as long as the right volume ID is specified in the VM launch command. |
|||||||||||||||||||||||||||
| Step 6 |
Create the cloud init file. Refer to the following example: The “chpasswd:” directive specifies that a user named “cps” be created with password “cisco123”. Replace with a secure password. The user is set up with sudo access; this is helpful when collecting various troubleshooting information. The SSH key facilitates password-less login; this will need to be generated anew. The IP 172.16.2.x IP addresses specified under swarm.json refer to the internal network, so edit as appropriate:
bash_aliases file is optional. It provides a convenience alias to access the CLI once logged into the VM. Replace weavePw value in swarm.json with a secure password. Other values should be left as is in the above example. |
|||||||||||||||||||||||||||
| Step 7 |
Configure tenant networks:
|
|||||||||||||||||||||||||||
| Step 8 |
Configure a security group, for example ‘tsi’, with the following TCP ports:
|
|||||||||||||||||||||||||||
| Step 9 |
Launch the Content Classification Manager VM. For example using the nova boot command:
Once the instance is launched, associate floating IPs if used. This can be done via the Horizon GUI or using neutron and nova CLI commands. Console should show the VM booting up and provide a bash login prompt. |
For VMware deployments, perform the following steps to install the Content Classification Manager. It is assumed that a VMware installation exists with the physical networking configuration for external network connectivity
| Step 1 |
Ensure there is IPv4 connectivity to the internet and to the StarOS gateways from the VMware installation. It is highly recommended to separate the traffic between the VM and the backend internet server from the traffic between the VM and the StarOS systems using separate provider networks. If the StarOS systems are configured to pull updates from the Content Classification Manager at the same time each day, the Content Classification Manager should be configured with a high bandwidth connection (for example a 10 Gbps port) between the VM and the StarOS systems. |
|||||||||||||||
| Step 2 |
Using the vSphere client, create a virtual machine with the following minimum specifications:
To clone with vmkfstools command line utility: |
|||||||||||||||
| Step 3 |
Attach the Content Classification Manager product ISO as a CD/DVD drive. |
|||||||||||||||
| Step 4 |
Set up user data ISO for cloud init. The VM can be initialized with openstack config drive version 2 formatted data. Cloud init expects a specific directory layout. Refer to the following recommended cloud init configuration: Directory Layout: A forward slash (‘/’) at the end of the line indicates a directory. Description of the files and example content: meta_data.json: hostname, name and uuid can be modified as required. user_data: The “chpasswd:” directive specifies that a user named “cps” be created with password “cisco123”. Replace with a secure password. The user is set up with sudo access; this is helpful when collecting various troubleshooting information. The SSH key facilitates password-less login; this will need to be generated anew. The IP 172.16.2.x IP addresses specified under swarm.json refer to the internal network, so edit as appropriate:
bash_aliases file is optional. It provides a convenience alias to access the CLI once logged into the VM. Replace weavePw value in swarm.json with a secure password All other values should be left as is. 0000: As meta_data.json indicates, contents of content/0000 populate /etc/network/interfaces file on the VM. The example configures 3 networks, an internal network (ens192), one for communication with StarOS gateways (ens224), and one for internet access (ens160). |
|||||||||||||||
| Step 5 |
Once the above configuration files and corresponding directory hierarchy is setup, generate an ISO using the following command: This command must be run from the parent directory of config-drive directory. The -V argument value has to be config-2 per config drive naming convention. The ISO (-o argument value) can be named differently if so desired. |
|||||||||||||||
| Step 6 |
Specify network interfaces for the VM. It is recommended to use at least 3 separate network interfaces:
|
|||||||||||||||
| Step 7 |
Open the following ports. The VM expects to receive traffic to the following TCP ports, so any firewall along the path needs to permit traffic to them:
|
|||||||||||||||
| Step 8 |
Save the settings and power on the virtual machine. The console should display the VM booting and then provide a login prompt. |
When the VM is first started, it takes approximately 10-15 minutes for all the containers to launch. The command prompt may not be accessible at this time. There are approximately 35 container instances which run on a normal system.
The system provides the following predefined accounts:
admin: Administrative privileges. Default password: admin
oper: Operator-level privileges allow application-specific configuration. Default password: oper
An operator cannot configure new users or modify existing users, so initial configuration must be done using admin account.
| Step 1 |
To access the command line interface (CLI), SSH to port 2024 as user admin. |
| Step 2 |
Enter configuration mode: |
| Step 3 |
Configure the Network Time Protocol server: |
| Step 4 |
Configure the Domain Name Service server: |
| Step 5 |
Configure the Secure FTP Group: StarOS systems download DB files using Secure FTP. This command configures the name of the group of users allowed to use Secure FTP. The name of this group must be sftp. This command requires administrative privilege. |
| Step 6 |
Configure the Secure FTP user: This command configures the name of the SFTP user. This user name must match what is configured in the secure FTP group configuration. This name must also match what is is configured in StarOS systems which connect to this Content Classification Manager. This name is case-sensitive and must be unique. This command requires administrative privilege. Secure FTP also requires the following other parameters:
These additional parameters are not used in the context of the Content Classification Manager, so configuring the following example values are sufficient. The following example assumes a user name of “beaker”. |
| Step 7 |
Configure new passwords for the admin and oper accounts as follows: Change the default passwords to strong, secure passwords. The system prompt for the new password. The user input is not reflected on the screen for security reasons. |
| Step 8 |
Commit these changes by exiting the config mode as shown in the following example: |
The default settings for Updater are typically sufficient for proper functioning. See the updater command in the CLI Commands chapter for more information about the Updater settings.
Any configuration changes to the updater parameter values triggers a restart of the updater (beaker) process. During this restart, existing connections with StarOS systems will be dropped temporarily. These connections automatically reconnect after the restart has finished. This restart typically takes a few seconds. Cisco recommends making updates during a maintenance window or outside the daily update time configured on the StarOS systems.
By default, the updater configuration can be modified by any user. Cisco recommends restricting access by configuring an access control rule (nacm rule-list). At a minimum, the sftp group must be prevented from having configuration change privileges.
The following example denies access to the root path and everything below to users belonging to the group “sftp”:
nacm rule-list sftp
group [ sftp ]
rule sftp
path /
action deny
!
!
See the CF Administration Guide for instructions to configure a StarOS system to connect to the Content Classification Manager.
 Note |
In this release, the Content Classification Manager module port is fixed at 5341 and the SFTP port is fixed at 2222. While these ports are configurable in the StarOS commands, you must specify port 5341 and 2222 respectively. |
The following example show the StarOS commands to configure a connection with the Content Classification Manager. Replace the IP address in the example (1.1.1.1) with the IP address for your Content Classification Manager.
configure
security
server talos-intelligence my-server
ip 1.1.1.1 port 5341
sftp port 2222 username my-username password my-password
exit
category server my-server
end
For issues related to the Updater (beaker) process, evaluate or collect the following command outputs.
From the Content Classification Manager VM (you may need to be root user or have sudo access to collect these outputs):
docker ps
docker logs orchestrator
docker logs beaker
docker inspect beaker
docker inspect cleanup
docker logs cleanup
journalctl --no-page –u docker
ss –tnpl
docker exec –it cleanup cat /var/log/cleanup
docker exec –it cleanup ps –ww –ef
From the CLI:
show running-config
show system
show docker
All log files collected in /data/tsi/logs directory.
From the beaker container:
supervisorctrl status
ps –ww -ef
cat /etc/beaker/updater.cfg
You can log on to the container by running docker exec –it beaker bash from the VM. Once you have collected the necessary logs, exit the container using the exit command.
In case of issues relating to SFTP, evaluate or collect the following command outputs.
From the Content Classification Manager VM (you may need to be root user or have sudo access to collect these outputs):docker ps
docker logs orchestrator
docker logs sftp
docker inspect sftp
docker inspect cleanup
docker logs cleanup
journalctl --no-page –u docker
ss –tnpl
docker exec –it cleanup cat /var/log/cleanup
docker exec –it cleanup ps –ww –ef
From the CLI:
show running-config
show system
show docker
All log files collected in /data/tsi/logs directory.
From the sftp container:
ps –ww -ef
cat /var/log/supervisor/supervisord.log
cat /etc/sshd_config
cat /etc/ssh_config
You can log on to the container by running docker exec –it sftp bash from the VM. Once you have collected the necessary logs, exit the container using the exit command.
In case of issues with containers starting for the first time, evaluate or collect the following logs and command outputs.
Output of the following logs from the VM:
/var/log/cloud-init.log
/var/log/cloud-init-output.log
/var/log/syslog
Output of the following commands on the VM:
systemctl status docker
journalctl --no-page –u docker
docker ps
From the CLI:
show running-config
show system
show docker
All log files collected in /data/tsi/logs directory.
From the VM:
docker logs beaker
docker logs sftp
docker logs cleanup
docker logs orchestrator
Feedback