Salt Security
Deployment Options

Prerequisite

• Architecture: x64
• Python version: 2.7
• The latest version of EPEL

Instructions

Run the following commands on a Linux server:

sudo yum install -y salt-linux-sensor-{SENSOR_VERSION}.x86_64.rpmsudo /usr/local/bin/salt-sensor start

Prerequisite

• Ensure you have access to Docker Hub and have considered the options for permissions listed in the Salt Security Sensor Deployment Guide.

Instructions

Edit the pod YAML file and add the snippet provided by Salt Security to the “containers” section to add the sensor as a sidecar in your Kubernetes cluster.

Redeploy the Pod:

kubectl apply -f <pod name="">.yaml</pod>

Verify the sidecar by querying the Salt Security Sensor for status:

kubectl exec -c salt-sensor — salt-sensor status

Possible outcomes running the status command are:

Prerequisite

Prior to installing a new policy on Apigee, or modifying an existing one, the following items should be understood fully and addressed.

Salt Security Mirroring Policy File

Salt Security will provide two javascript files that will be imported into the Apigee proxy. This will allow Salt Security services to receive all requests and responses to the API proxy.

Salt Host and Authentication

The policies will access the Salt Security HTTP Mirroring API, which requires authentication to prevent unauthorized access. Authentication is done by the basic authentication scheme, which is sent in the request’s authorization header. For example:

‍Authorization: Basic {TOKEN Base64}

The token value is unique per customer, and will be provided by the Salt Security team. In addition, Salt Security will provide the proper host name.

Instructions

Prepare the policy files:

• Place the salt-security-mirroring-policy.tar.gz file in a folder of your choice. Note that this file will be provided to you by Salt Security.
• Unzip and untar the file. This will create a folder named salt-security-mirroring-policy with the two policy files in it.

Create the request policy:

• Note that depending on your particular implementation, it may instead be necessary to modify an existing policy.
• From the API-Proxy list on Apigee, select the relevant proxy, and click the Develop tab.
• Under Proxy Endpoints, click PreFlow.
• Above Request flow, click +Step.
• Scroll down to select JavaScript under the Extension group.
• Set the display name to “Salt Security Request Mirroring Policy”.
• From the Script File option, select Import new script.
• Click Choose File and select the “requestPolicy.js” file from the decompressed policy package.
• When complete, click the Add button.

Creating the Response policy:

• Under Proxy Endpoints, click PostFlow.
• Below Response flow, click +Step.
• Scroll down to select JavaScript under the Extension group.
• Set the display name to “Salt Security Response Mirroring Policy”.
• From the Script File option, select Import new script.
• Click Choose File and select the “responsePolicy.js” file from the decompressed policy package.
• When complete, click the Add button.

Configure the request and response policies:

This step configures the communication settings between Apigee and the Salt Security HTTP Mirroring API.

From the Policies List, select the Salt-Security-Request-Mirroring-Policy, and replace the empty <Properties/> entity with the values provided to you by Salt Security.Repeat this process for the Salt-Security-Response-Mirroring-Policy. Please note that the example below uses the response endpoint in the URL; it is otherwise identical to the example above.Be sure to click Save when all changes are complete.

Validate traffic:

• At this point, the API Proxy is now configured to send all requests and responses to the Salt Security service (Hybrid or Saas).
• The final step is to send traffic to Apigee and work with Salt Security to ensure that data is being received.

Connectivity Check

In order to verify connectivity between Apigee Node and Salt Mirroring APIs, use hello RESTful API. To ease connectivity checks on Hybrid environments, the Hello RESTFul API will not force authentication. However if given, the Hello RESTful API will respond with an indication of whether authentication succeeded.

CURL Example:

curl -k -X GET \
‘https://{SALT_MIRRORING_API_DOMAIN}:{SALT_MIRRORING_API_PORT}/api/vi/http/hello’ \-H ‘Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l’

Success-Response Example:

HTTP/1.1 200 OK
It Works! Welcome To Salt Security HybridAuthentication Succeeded

Prerequisite

Mule version 4.1.1 and later is required

Authentication

Accessing the Salt Security HTTP mirroring API requires authentication to prevent unauthorized access. Authentication is done by a basic authentication scheme, which is sent via the request’s authorization header:

• Authorization: Basic {TOKEN}

NOTE: The TOKEN value is unique per customer, and shall be provided by the Salt Security team.

MuleSoft Firewall Considerations

Option 1: Mirroring from MuleSoft → Salt Security Hybrid Server

In your private network firewalls/security settings, make sure traffic is allowed to the Salt Security Hybrid Server. Below is the list of ports required for communication from your MuleSoft to the Salt Security Hybrid Server (NOTE: this is only required if traffic is being sent to the Salt Security Hybrid Server):

Option 2: Mirroring from MuleSoft → Salt Cloud Service

Instructions

The Policy

Salt Security Mirroring Policy consists of a maven package, which results in a deployable JAR file that contains the policy implementation.

The package contains:

• Salt-mirroring-policy.yaml – A configuration File, where the policy parameters and metadata are defined
• pom.xml – Defines policy dependencies
• template.xml – An XML file which contains the implementation of the policy using Mule’s XML schema language

Applying the Policy

See the official MuleSoft guide covering how to upload the policy to the exchange server: https://docs.mulesoft.com/api-manager
/2.x/custom-policy-uploading-to-exchange

In the Anypoint Platform, search your organization’s ID to use in the following steps:

• Go to Access Management > Organization, click the name of your organization. Copy the UUID from the browser address.
• Update the settings.xml file in your Maven .m2 directory with your Exchange credentials.
• In the pom.xml perform the following steps:
  a. Replace the groupId with the organization ID from the previous step.
  b. Replace the {orgId} in the exchange URL with the organization ID:
• Upload the policy to the organization exchange account by running the mvn deploy command from the policy directory.
• From API Manager go to Automated Policies, and click on “Apply new Automated Policy”. Choose Salt Mirroring Policy, and update it with the address of the Mirroring API address and the authentication token. NOTE: Target URL should contain domain names only.
• After clicking on the “Apply” button, the policy will be added to the Automated Policies list.