diff --git a/docs/accessanalyzer/2601/install/prerequisites.md b/docs/accessanalyzer/2601/install/prerequisites.md index c1c30efce5..b274599370 100644 --- a/docs/accessanalyzer/2601/install/prerequisites.md +++ b/docs/accessanalyzer/2601/install/prerequisites.md @@ -4,6 +4,9 @@ description: "What to gather and prepare before installing Access Analyzer" sidebar_position: 1 --- +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + # Prerequisites Gather the following before you start the Access Analyzer installer. Everything you need to know for a successful install is on this page. @@ -14,7 +17,7 @@ Gather the following before you start the Access Analyzer installer. Everything - [ ] Account with `sudo` access to the server - [ ] Outbound HTTPS access to all required domains confirmed - [ ] Server hostname is a fully qualified domain name (FQDN) that resolves to the server IP -- [ ] TLS certificate option chosen; certificate files prepared if using Bring Your Own +- [ ] TLS certificate option chosen; bring-your-own certificate files prepared - [ ] First admin name and email address decided (this provisions a local account — no AD/Entra dependency) - [ ] Netwrix license key ready - [ ] If using AD or Entra ID sign-in: service account, certificate, or app registration prepared @@ -69,11 +72,16 @@ sudo mkdir -p /etc/dspm | File | What It Is | | --- | --- | | `.crt` | Server identity certificate in PEM format. The Subject Alternative Name (SAN) list must include the hostname **in lowercase** and the server's IP address. | -| `.key` | Private key paired with the certificate (PEM). The OS user running the installer must be able to read it — not just `root`. | +| `.key` | Private key paired with the certificate (PEM). | | `ca-bundle.crt` | CA certificates that trust the server certificate. Required only if an internal or private CA signs the certificate — omit it for a publicly trusted certificate. | **SAN requirement:** Browsers normalize hostnames to lowercase during TLS validation. If the SAN entry carries any uppercase characters, sign-in fails with an HTTP 401. +These commands set ownership and permissions on the private key. If an internal or private CA signed your certificate, they also install that CA into the operating system trust store so the system can validate the Access Analyzer TLS certificate. Skip the two CA commands for a publicly trusted certificate. Use the tab for your distribution. + + + + ```bash sudo chown $(whoami) /etc/dspm/.key sudo chmod 644 /etc/dspm/.key @@ -82,8 +90,24 @@ sudo cp /etc/dspm/ca-bundle.crt /usr/local/share/ca-certificates/dspm-ca.crt sudo update-ca-certificates ``` + + + +```bash +sudo chown $(whoami) /etc/dspm/.key +sudo chmod 644 /etc/dspm/.key + +sudo cp /etc/dspm/ca-bundle.crt /etc/pki/ca-trust/source/anchors/dspm-ca.crt +sudo update-ca-trust +``` + + + + **Verifying certificate files before install:** +These commands confirm the certificate covers the right hostname and IP address, that your CA bundle signed it, and that it matches the correct private key. + ```bash # Check that the SAN includes your hostname (lowercase) and server IP openssl x509 -noout -text -in /etc/dspm/.crt | grep -A5 "Subject Alternative" @@ -96,13 +120,11 @@ openssl pkey -pubout -in /etc/dspm/.key 2>/dev/null | md5sum openssl x509 -noout -pubkey -in /etc/dspm/.crt | md5sum ``` -For the full TLS specification, including multi-CA environments, see the TLS Certificate Requirements page. - ## First admin account Identify the email address and display name of your first administrator. The installer prompts for both values during setup and provisions a **local** account automatically — it doesn't depend on Active Directory, Entra ID, or any other identity provider. -To let users sign in with their Active Directory or Entra ID credentials instead, configure an identity provider after installation. Gather the values for the directory you use before you start, so you have them ready in the installer. +To let users sign in with their Active Directory or Entra ID credentials instead, configure an identity provider after installation. Gather the values for the directory you use before you start the installer. ## Identity provider @@ -167,7 +189,9 @@ Ports the Access Analyzer server must reach on your data sources and directory s - **Outbound** from the Access Analyzer server to the target source/host — **required** for all connectors. - **Inbound** at the target source/host from the Access Analyzer server — **required** (the target must accept the connection on the listed port). -| Connector | Port | Protocol | Notes | +The table lists default ports. If a source listens on a different port, open that port instead. + +| Connector | Default Port | Protocol | Notes | | --- | --- | --- | --- | | CIFS / SMB | 445 | TCP | SMB file sharing | | Active Directory | 389 | TCP | LDAP | @@ -201,3 +225,7 @@ All outbound endpoints use HTTPS (port 443). The Access Analyzer server must rea | `get.k3s.io` | K3s / Rancher | K3s installer download | Installation only | | `rpm.rancher.io` | K3s / Rancher | K3s package repository | Installation only | | `storage.googleapis.com` | K3s / Rancher | K3s artifact storage | Installation only | + +## Before installation + +Work through the [Checklist](#checklist) and confirm every item is complete before you start the installer. The installer runs preflight checks and stops if they fail, so confirming these items first avoids a restart.