## Virtualisation ### Which hypervisors do you support, including the version? We support the following virtualisation platforms: - Microsoft Hyper-V: Windows Server 2019+ and Windows 10+ - VMware: ESXi 7.0.0+ - VirtualBox: 7.0.8+ ## Resources ### How is storage managed in the VM? A solid state drive (SSD) (for better I/O and performance) or a hard disk drive (HDD) can be attached to the VM for storage. ### What is the minimum number of virtual cores required? 16 ### What is the minimum disk size of the VM? 100 GB ### Does the VM self-rotate logs? Yes. Logs for services running in the OS follow the default Red Hat log rotation policy configured in `/etc/logrotate.conf`. This file can be customised as needed. Pod logs from RKE2 follow the default RKE2 log rotation: - Maximum log files per container: **3** - Maximum size per log file: **2 MB** ### Is there a benefit in assigning more vCPUs to increase performance? No. Increasing CPU allocation does **not** improve the performance of Glasswall Halo's synchronous API. ### What is the minimum memory required? 32 GB ### What is the size of the VM image? - VMware or VirtualBox: OVA approximately **5.5 GB** - Hyper-V: VHD **64 GB** ## Security ### Is an OS firewall active? No. The firewall is disabled to avoid conflicts with Kubernetes networking. ### What firewall rules are applied? None — firewall is disabled. ### What network ports remain open on the VM? - **80** - **443** - **22** (SSH) - **6443** (Kubernetes API server — restricted to cluster CIDR `10.42.0.0/16` and service CIDR `10.43.0.0/16`) ### Is there protection for brute-force SSH attempts? Yes. **Fail2Ban** monitors log files (e.g., `/var/log/auth.log`) and blocks malicious IP addresses after repeated failures. ### How do I keep the base OS patched? Glasswall provides updated VM images quarterly. To update directly from Red Hat mirrors: ```shell subscription-manager register --username --password --auto-attach ``` ### How do I configure my organisation's SSL certificate and preferred FQDN? Copy the private key and certificate of the domain to the VM and run `bash configure_tls.sh ` in the VM. ### How do I enforce certificate only authentication via SSH? Update `~/.ssh/authorized_keys` with your public key in the VM - disable password authentication: ```sh sudo sed -i "s/passwordauthentication yes/passwordauthentication no/g" /etc/ssh/sshd_config sudo service sshd restart ``` ### Does the default SSH username and password require immediate update? Yes, it is mandatory to update the password. Once you are logged into the VM, you will be prompted to update the password. ### What level of security hardening has taken place? * [STIG](https://public.cyber.mil/stigs) hardening is applied to the base OS. * CIS hardening is applied to the RKE2 (Kubernetes cluster). * All Glasswall containers utilise hardened container images. * All Glasswall software is hardened using SAST, DAST, SCA tooling. ### Do you provide hashes to authenticate the authenticity of the VM image? Yes, Glasswall provides base64 encoded MD5 hash value of the file. Verify if it matches by using the command by replacing `$ova_file_path` with the OVA file path: ```sh openssl dgst -md5 -binary < $ova_file_path | base64 ``` ### How do I enable an anti-virus solution in the VM? There is no anti-virus solution installed in the VM image. If needed, an anti-virus solution can be installed separately in the VM. ### Will an anti-virus solution impede or hang the CDR process? An anti-virus solution can interfere with the CDR process and hence the folders in the VM where files being processed should be excluded from the anti-virus scanning. ### Are there any folders which need to be out of scope for anti-virus protection? Yes, `/opt/local-path-provisioner` should be excluded from anti-virus scanning. ### Does RKE2 support FIPS 140-2 validated encryption? Yes, FIPS 140-2 support is built into RKE2 at the foundation level. Specifically, the functions used within RKE2 meet the stringent security requirements outlined in the FIPS 140-2 standard. This includes the algorithms used for encryption and decryption, the methods used for key generation and management, and the protections in place to prevent unauthorized access or use of the cryptographic modules. Additional documentation regarding FIPS 140-2 enablement can be found [here](https://docs.rke2.io/security/fips_support). ### Will an anti-virus solution impede or hang the CDR process? An anti-virus solution can interfere with the CDR process and hence the folders in the VM where files being processed should be excluded from the anti-virus scanning. ## OS configuration ### How do I configure the system banner message when I log onto the VM? The banner message can be customized by updating `/etc/issue` file in the VM. ### What OS level services are running on the VM? These are the list of OS level services running on the VM: Unit| load| active| state| description ---|---|---|---|--- Atd.service| loaded| active| running| job spooling tools Auditd.service| loaded| active| running| security auditing service Chronyd.service| loaded| active| running| NTP client/server Dbus.service| loaded| active| running| D-Bus system message bus Getty@tty1.service| loaded| active| running| getty on tty1 Irqbalance.service| loaded| active| running| irqbalance daemon Libstoragemgmt.service| loaded| active| running| libstoragemgmt plug-in server daemon Mcelog.service| loaded| active| running| machine check exception logging daemon Networkmanager.service| loaded| active| running| network manager Polkit.service| loaded| active| running| authorization manager Rhsmcertd.service| loaded| active| running| enable periodic update of entitlement certificates. Rke2-server.service| loaded| active| running| Rancher Kubernetes Engine v2 (server) Rsyslog.service| loaded| active| running| system logging service Serial-getty@ttys0.service| loaded| active| running| serial getty on ttys0 Smartd.service| loaded| active| running| self monitoring and reporting technology (SMART) daemon Sshd.service| loaded| active| running| OpenSSH server daemon Systemd-journald.service| loaded| active| running| journal service Systemd-logind.service| loaded| active| running| login service Systemd-resolved.service| loaded| active| running| network name resolution Systemd-udevd.service| loaded| active| running| udev kernel device manager Usbguard.service| loaded| active| running| USBGuard daemon User@1000.service| loaded| active| running| user manager for UID 1000 Have unnecessary OS level services been deactivated? The Red Hat OS has been gone through the STIG hardening process and any unnecessary services have been removed and no unnecessary services have been installed. ### What is the base operating system, and what version? The base OS version can be found in the release notes. ### Does Kubernetes run within the VM? Yes, Kubernetes cluster runs with a Single Node. ### What version of Kubernetes is running? Kubernetes version can be found in the release notes. ## Monitoring ### What error messages should we actively monitor? Glasswall Halo error codes and API can be found via [Glasswall API documentation](https://api.docs.glasswall.com). Health of the Glasswall Halo cluster can be monitored using the API health endpoint. ## CPU arch support ### What CPU architecture is supported? Currently x86-64 CPU processors are supported. ARM support will be available in upcoming releases. ## Log rotation & storage management ### How do I offload/aggregate logs to my preferred network location? The VM comes with _syslog_ pre configured and this can be used to send the logs to a _syslog_ server. ## Upgrade path ### What happens if I replace this VM with another VM image from Glasswall, and what would be the full upgrade path to maintain live operations? * Create a new VM from the new image from Glasswall following the deployment steps. * Make sure the new VM is working as expected. * Switch the DNS record from old IP address to the new IP address of the VM. ## Patching ### How do I update the Kubernetes software from a security perspective? Kubernetes software updates will be done in the VM images provided by Glasswall. However, it is recommended to update the Kubernetes cluster whenever security advisories are published. When upgrading the Kubernetes version of a cluster, we recommend that you: * Take a snapshot. * Initiate a Kubernetes upgrade. * If the upgrade fails, revert the cluster to the pre-upgrade Kubernetes version. This is achieved by selecting the restore etcd and Kubernetes version option. This will return your cluster to the pre-upgrade Kubernetes version before restoring the etcd snapshot. * The restore operation will work on a cluster that is not in a healthy or active state. ## Configuration changes ### Does applying configuration changes cause downtime? Configuration changes made through the setup wizard or shell scripts (such as enabling authentication, TLS, or Storage Monitoring) briefly restart the affected services. This typically takes a few seconds per service. Complete initial configuration before the appliance is in production use, or schedule changes during a maintenance window. ## Networking ### How do I manage DNS / IP range settings? Use `nmcli` command line utility or `nmtui` utility to configure the IP address, gateway and DNS server. ### Is DHCP active in the VM? Yes, DHCP client is active in the VM and can allocate an IP address when deployed to a network with DHCP server. ### How can I SSH into the VM? Once an IP address is configured to the VM, SSH using the username and password/private key shared by Glasswall. ### What are the IP addresses or internet URLs that need to be allow listed? None. ### What communication protocols are supported with the VM? HTTPS and HTTP endpoints are provided within the VM. ## Licensing ### Do I need to purchase a Red Hat subscription separately for my Glasswall Halo virtual appliance? Yes. While Glasswall Halo virtual appliances run on Red Hat Enterprise Linux (RHEL), **a RHEL subscription is not included** with the appliance. Customers are responsible for obtaining a valid RHEL subscription **directly from Red Hat or an authorized partner** to ensure access to system updates, security patches, and support. Each deployed instance must be registered with Red Hat Subscription Management (RHSM) using your own Red Hat account credentials. Without a valid subscription, your appliance may not receive critical updates and will not be eligible for Red Hat support. For more information, visit our [RHEL licensing advisory](/halo/rhel-licensing). ### Is the Kubernetes software licensed by Glasswall? There is no need to purchase a license for the Kubernetes as it is open source with [Apache 2.0 license](https://github.com/rancher/rke2/blob/master/license). ### What are the main open source components that are comprised within the overall solution? RKE2 & RabbitMQ are the main open source components and the complete software bill of materials (SBOM) can be provided on request. ### How are the open source components licensed? * RKE2 Kubernetes cluster is licensed under [Apache 2.0 license](https://github.com/rancher/rke2/blob/master/license). * RabbitMQ cluster Kubernetes operator is licensed under [Mozilla public license 2.0](https://github.com/RabbitMQ/cluster-operator/blob/main/license.txt). * RabbitMQ server is licensed under [Apache 2.0 license](https://github.com/RabbitMQ/RabbitMQ-server/blob/main/license-apache2). * Additional licensing information can be provided by software bill of materials (SBOM) on request.