Page Comparison

...

When the Abiquo remote services will connect to the Abiquo Server over the internet, these communications should use TLS. When users upload or download templates, they need a direct connection to the Appliance Manager remote service, and this connection must be made with TLS.

{"diagramDefinition":"flowchart LR\nA--HTTP-->P(RemoteServices)\nsubgraph Abiquo Platform \n    A\n    P\nend\nX(Cloud User)<--HTTPS-->P\nX(Cloud User)--HTTPS-->A(Abiquo Server)\nY(Remote RS)--HTTPS-->A\nX(Cloud User)<--HTTPS-->Y\n        style A fill:#ec9032,stroke:#666,stroke-width:2px,color:#fff\n        style P fill:#ec9032,stroke:#666,stroke-width:2px,color:#fff\n        style Y fill:#ec9032,stroke:#666,stroke-width:2px,color:#fff"}

...

Import certificates on Remote RS

For a test environment, create a self-signed certificate for remote RS and import it. You can also use a wildcard certificate for your test environment.

1. Log in to the Remote Services server as an administrator

2. Go to the /

...

1. etc/pki/tls/ folder

2. Copy your self-signed Remote Services certificate (and API certificate(s)), or wildcard certificate to the certs folder and your private key to the private folder

3. Convert your certificates to PCKS12 format. For a wildcard certificate, do this for each server and enter its fully qualified domain name.

   1. For the Remote services server, replace ${DOMAIN} with your certificate name and replace ${REMOTE_SERVICES_FQDN} with the domain name of your

...

1. 1. remote RS server.

      Code Block

...

1. 1. openssl pkcs12 -export -in

...

1. 1. ${DOMAIN}.crt -inkey

...

1. 1. ${DOMAIN}.key -name

...

1. 1. ${REMOTE_SERVICES_FQDN} -out import_cert_key

...

1. 1. _rs

   2. For the API server, replace ${DOMAIN} with your certificate name and replace ${ABIQUO_SERVER_FQDN} with the domain name of your Abiquo API server.

      Code Block
      openssl pkcs12 -export -in ${DOMAIN}.crt -inkey ${DOMAIN}.key -name ${API_SERVER_FQDN} -out import_cert_key_server

2. Go to the /opt/abiquo/tomcat/conf folder

...

1. Create a .jks keystore with the same name as the hostname of your Remote services server. This keystore configuration is suitable for a test environment only

   Code Block
   keytool -genkey -keyalg RSA -keystore

...

1. {REMOTE_SERVICES}.jks -keysize 2048

2. Import the Remote services certificate into the

...

1. keystore

...

1. for Tomcat to use

   Code Block
   keytool -importkeystore -deststorepass changeit -destkeystore

...

1. ${REMOTE_SERVICES}.jks -srckeystore import_cert_key_rs -srcstoretype PKCS12

2. Import the API server certificate

...

In the remote RS server’s .jks keystore, there should also be an entry for API server.

Copy the API server certificate to the remote RS server.

Import it in the same way as the RS server certificate in the previous steps.

Convert your certificate to PKCS12 format:

openssl pkcs12 -export -in myapiserver.bcn.abiquo.com.crt -inkey myapiserver.bcn.abiquo.com.key -name myapiserver.bcn.abiquo.com -out import_cert_key

Import it to your .jks keystore file:

...

1. into the keystore for Tomcat to use

   Code Block
   keytool -importkeystore -deststorepass changeit -destkeystore

...

1. ${REMOTE_SERVICES}.jks -srckeystore import_cert_key_server -srcstoretype PKCS12

...

Verify API server location path on remote RS server

On remote RS server, check in the abiquo.Check that your Remote RS server has the correct API path set.

1. Log in to the Remote RS server as an administrator

2. View the Abiquo properties file at

...

1. Code Block
   /opt/abiquo/config/abiquo.properties

...

1. If the abiquo.server.api.location property

...

1. is not set to a value with https and no port number, then edit the file and update it.
   For example, abiquo.server.api.location=https://myapiserver.bcn.abiquo.com/api.

...

Define a new HTTPS connector in remote RS Catalina

On the remote Remote RS server, edit the Tomcat server configuration file at:

...

Replace the current remote RS catalina Catalina connector for port 8009 with a new connector.

...

Also configure the other parameters according to your environment.

<Service name="Catalina">

        <Connector
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8009" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="/opt/abiquo/tomcat/conf/remoters.jks" 
           keystorePass="changeit" 
           keyAlias="myremoters.bcn.abiquo.com"
           clientAuth="false" secretrequired="false" 
           sslProtocol="TLS"/>

...

Log in to the API server that will connect to the remote RS via HTTPS as administrator.

For Import the Remote RS certificate, for example, for the default cacerts keystore in a test environment.

keytool -import -trustcacerts -alias myremoters.bcn.abiquo.com${REMOTE_SERVICES_FQDN} -file /etc/pki/abiquo/myremoters.bcn.abiquo.com.${DOMAIN}.crt -cacerts

If you are using your own keystore on the API server, use the -keystore option to specify ita self-signed certificate, also import your CA certificate.

...

Enable SSL proxy for Apache

For AM connections to work with TLS (for template upload and download), check or enable SSL proxy for Apache.

1. Log in the API/UI server as an administrator.

2. Edit the Apache configuration at /etc/httpd/conf.d/abiquo.conf.

3. In the Apache virtual host configuration, add the following.
   

   Code Block
   ####APACHE SSL PROXY########## SSLProxyEngine On SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off ##############################

...

Apply and verify

At this point all configurations are done. Restart both abiquo-tomcat services where changes have been made (in this scenario, remote RS and Abiquo Server) and restart the httpd service on the Abiquo server.

...