Protect Deep Security Agent

To improve security, you can bind Deep Security Agent to a specific Deep Security Manager. The procedure vary depending on if you are using manager-initiated activation or agent-initiated activation:

During agent-manager communications, Deep Security Agent can authenticate the identity of its manager. It does this by comparing your trusted manager's certificate to the connecting manager's certificate. If they do not match, the manager authentication fails and the agent does not connect.

This prevents agents from activating with or connecting to a malicious server pretending to be your Deep Security Manager. This is recommended especially if agents connect through an untrusted network such as the Internet.

To protect your agents, you must configure each agent so it can recognize its authorized manager before the agent tries to activate:

If you reset or deactivate an agent, it deletes the Deep Security Manager certificate. Repeat these steps if you want to reactivate the agent.

  1. On Deep Security Manager, run the command to export its server certificate:

    dsm_c -action exportdsmcert -output ds_agent_dsm.crt [-tenantname TENANTNAME | -tenantid TENANTID]

    where

    • ds_agent_dsm.crt is the name of the manager's server certificate. You must use this exact file name.

    • -tenantname TENANTNAME is the name of a Deep Security tenant. If Deep Security Manager is multi-tenant, either this or the -tenantid parameter is required. See also Set up a multi-tenant environment.
    • -tenantid TENANTID is the ID of a tenant.

    If you have multiple tenants, run the command to export the first tenant's certificate:

    dsm_c -action exportdsmcert -output ds_agent_dsm.crt -tenantname TENANT1

    and continue to the next step. Note that you may not run the export command again for TENANT2 and others until you are finished with the certificate for TENANT1, because the command overwrites the file.

  2. On each agent's computer, put the ds_agent_dsm.crt file in the following location:

    • On Windows: %ProgramData%\Trend Micro\ Deep Security Agent\dsa_core
    • On Linux or Unix: /var/opt/ds_agent/dsa_core

    If you have multiple tenants, copy each tenant's certificate file only to its own agents, as agents cannot be activated by other tenants.

  3. If you have a multi-tenant Deep Security Manager, repeat the previous steps for each tenant.

Initially, after completing these steps, the agent enters a preactivated state. Until the agent is fully activated, operations initiated by other Deep Security Managers or by entering commands to the agent via dsa_control do not work. This is intentional, and the regular operation resumes upon activation.

During agent activation, Deep Security Agent can authenticate the identity of its Deep Security Manager by pinning the manager's certificate to the agent. It does this by validating the connecting manager’s certificate path and ensuring it is signed by a trusted Certificate Authority (CA). If the certificate path is validated, the manager authentication passes and activates the agents. This prevents agents from activating with a malicious server that is pretending to be your Deep Security Manager.

To protect your agents, you must configure each agent so it can recognize its authorized manager before the agent tries to activate.

Import a Deep Security Manager certificate chain issued by a public CA

  1. Prepare a chain.pem file based on the following specifications:
    • The X509 certificate that corresponds to the private key.
    • Any other intermediate X509 certificates to build a chain of trust to a certificate to a trusted certificate authority (CA) root. Each certificate must sign the certificate that directly precedes it, so the order is important. See certificate_list in the RFC.
  2. On Deep Security Manager, run the following command to import the certificate chain:

    3. /opt/dsm/dsm_c -action agentHBPublicServerCertificate -set ${path_to_pem_file}

    ${path_to_pem_file} must be an absolute path.

  1. Copy the public CA certificate and rename it to ds_agent_dsm_public_ca.crt.
  2. On the agent computer, place the ds_agent_dsm_public_ca.crt file in one of these locations:
    • On Windows: %ProgramData%\Trend Micro\Deep Security Agent\dsa_core
    • On Linux or Unix: /var/opt/ds_agent/dsa_core
If you have installed Deep Security Manager 20.0.262 and are activating Deep Security Agent 20.0.1540 or later, the following error message appears upon activation, which indicates you have not pinned the manager's certificate to the agent:

"[Warning/2] | SSLVerifyCallback() - verify error 20: unable to get local issuer certificate"

Pinning a trusted certificate is optional, so you can ignore this error if it does not apply to you. However, if you want to use a trusted certificate, follow the preceding steps before activating Deep Security Agent.

To confirm that the certificate chain has been imported, enter the following command:

/opt/dsm/dsm_c -action agentHBPublicServerCertificate -isSet

Delete the imported certificate chain

To stop using a Deep Security Manager certificate chain issued by a public CA, enter the following command:

/opt/dsm/dsm_c -action agentHBPublicServerCertificate -delete

By default, Deep Security Manager reverts to using a self-signed certificate.