How to configure agent to server connection
Agent to server connection is a TLS tunnel carrying virtual server to agent connections.
Server Preparation
For TLS tunnel operation server needs certificate (with private key) as well as CA certificate. Take the following steps to prepare server for using agent tunnels:
1. Issue server certificate by your certificate authority. 2. Store CA certificate and server certificate somewhere on server file system. Certificates should be in PEM format, server certificate file should contain private key as well. 3. Add the following lines to netxmsd.conf:
ServerCACertificate = /path/to/ca.crt ServerCertificate = /path/to/server.crt ServerCertificatePassword = server_pk_password
4. Restart server.
Agent Configuration
Add the following line to nxagentd.conf:
ServerConnection = server.hostname
DNS name or IP address can be used. Server listed in ServerConnection parameter will automatically get minimal access to agent as if listed in Servers parameter. If higher access level is required server should be listed in ControlServers or MasterServers as usual.
Server Configuration
When agent establishes connection with the server it will create unbound tunnel (not associated with any node). List of active tunnels can be obtained via server debug console using command
show tunnels
To associate unbound tunnel with node use command
tunnel bind tunnel_id_here node_id_here
When tunnel is bound server will issue new certificate to agent and agent will restart tunnel. After bound tunnel is established server will use it for all communications with that agent.
If node expected to be reachable only via agent established tunnel you can set it's IP address to 0.0.0.0 to indicate that direct communications are disabled.