From a7cab795eae2cf2fd293726051356b709b22fac9 Mon Sep 17 00:00:00 2001 From: Evan Anandappa Date: Fri, 4 Sep 2026 13:22:06 -0400 Subject: [PATCH 1/3] Apply AA 2601 prerequisites review feedback Changes from the 09/03/2026 prereq review: - Tighten the TLS checklist item to "bring-your-own certificate files prepared" - Drop the OS-user readability note from the .key row - Split the CA trust commands into RHEL and Debian/Ubuntu tabs, since the destination path and update command differ, and add a description of what the block does - Add a description to the openssl verification block - Remove the pointer to the TLS Certificate Requirements page - Rename the connector table's Port column to Default Port - Add a closing section telling readers to confirm the checklist before install Generated with AI Co-Authored-By: Claude Code --- .../2601/install/prerequisites.md | 36 ++++++++++++++++--- 1 file changed, 31 insertions(+), 5 deletions(-) diff --git a/docs/accessanalyzer/2601/install/prerequisites.md b/docs/accessanalyzer/2601/install/prerequisites.md index c1c30efce5..56a64a6b37 100644 --- a/docs/accessanalyzer/2601/install/prerequisites.md +++ b/docs/accessanalyzer/2601/install/prerequisites.md @@ -4,6 +4,9 @@ description: "What to gather and prepare before installing Access Analyzer" sidebar_position: 1 --- +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + # Prerequisites Gather the following before you start the Access Analyzer installer. Everything you need to know for a successful install is on this page. @@ -14,7 +17,7 @@ Gather the following before you start the Access Analyzer installer. Everything - [ ] Account with `sudo` access to the server - [ ] Outbound HTTPS access to all required domains confirmed - [ ] Server hostname is a fully qualified domain name (FQDN) that resolves to the server IP -- [ ] TLS certificate option chosen; certificate files prepared if using Bring Your Own +- [ ] TLS certificate option chosen; bring-your-own certificate files prepared - [ ] First admin name and email address decided (this provisions a local account — no AD/Entra dependency) - [ ] Netwrix license key ready - [ ] If using AD or Entra ID sign-in: service account, certificate, or app registration prepared @@ -69,11 +72,27 @@ sudo mkdir -p /etc/dspm | File | What It Is | | --- | --- | | `.crt` | Server identity certificate in PEM format. The Subject Alternative Name (SAN) list must include the hostname **in lowercase** and the server's IP address. | -| `.key` | Private key paired with the certificate (PEM). The OS user running the installer must be able to read it — not just `root`. | +| `.key` | Private key paired with the certificate (PEM). | | `ca-bundle.crt` | CA certificates that trust the server certificate. Required only if an internal or private CA signs the certificate — omit it for a publicly trusted certificate. | **SAN requirement:** Browsers normalize hostnames to lowercase during TLS validation. If the SAN entry carries any uppercase characters, sign-in fails with an HTTP 401. +These commands set ownership and permissions on the private key, then install your Certificate Authority into the operating system trust store so the system can validate the Access Analyzer TLS certificate. Use the tab for your distribution. + + + + +```bash +sudo chown $(whoami) /etc/dspm/.key +sudo chmod 644 /etc/dspm/.key + +sudo cp /etc/dspm/ca-bundle.crt /etc/pki/ca-trust/source/anchors/dspm-ca.crt +sudo update-ca-trust +``` + + + + ```bash sudo chown $(whoami) /etc/dspm/.key sudo chmod 644 /etc/dspm/.key @@ -82,8 +101,13 @@ sudo cp /etc/dspm/ca-bundle.crt /usr/local/share/ca-certificates/dspm-ca.crt sudo update-ca-certificates ``` + + + **Verifying certificate files before install:** +These commands confirm the certificate covers the right hostname and IP address, was signed by your CA bundle, and is paired with the correct private key. + ```bash # Check that the SAN includes your hostname (lowercase) and server IP openssl x509 -noout -text -in /etc/dspm/.crt | grep -A5 "Subject Alternative" @@ -96,8 +120,6 @@ openssl pkey -pubout -in /etc/dspm/.key 2>/dev/null | md5sum openssl x509 -noout -pubkey -in /etc/dspm/.crt | md5sum ``` -For the full TLS specification, including multi-CA environments, see the TLS Certificate Requirements page. - ## First admin account Identify the email address and display name of your first administrator. The installer prompts for both values during setup and provisions a **local** account automatically — it doesn't depend on Active Directory, Entra ID, or any other identity provider. @@ -167,7 +189,7 @@ Ports the Access Analyzer server must reach on your data sources and directory s - **Outbound** from the Access Analyzer server to the target source/host — **required** for all connectors. - **Inbound** at the target source/host from the Access Analyzer server — **required** (the target must accept the connection on the listed port). -| Connector | Port | Protocol | Notes | +| Connector | Default Port | Protocol | Notes | | --- | --- | --- | --- | | CIFS / SMB | 445 | TCP | SMB file sharing | | Active Directory | 389 | TCP | LDAP | @@ -201,3 +223,7 @@ All outbound endpoints use HTTPS (port 443). The Access Analyzer server must rea | `get.k3s.io` | K3s / Rancher | K3s installer download | Installation only | | `rpm.rancher.io` | K3s / Rancher | K3s package repository | Installation only | | `storage.googleapis.com` | K3s / Rancher | K3s artifact storage | Installation only | + +## Before you start the installer + +Work through the checklist at the top of this page and confirm every item is complete before installation begins. Unmet prerequisites are the most common cause of failed and delayed installs, and confirming them in advance is the best way to ensure a smooth first-time setup. From fa3633000cbd906ae4052db60144d99d0d0a0f50 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 17:25:12 +0000 Subject: [PATCH 2/3] fix(vale): auto-fix style issues (Vale + Dale) --- docs/accessanalyzer/2601/install/prerequisites.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/accessanalyzer/2601/install/prerequisites.md b/docs/accessanalyzer/2601/install/prerequisites.md index 56a64a6b37..af2b6e7a07 100644 --- a/docs/accessanalyzer/2601/install/prerequisites.md +++ b/docs/accessanalyzer/2601/install/prerequisites.md @@ -106,7 +106,7 @@ sudo update-ca-certificates **Verifying certificate files before install:** -These commands confirm the certificate covers the right hostname and IP address, was signed by your CA bundle, and is paired with the correct private key. +These commands confirm the certificate covers the right hostname and IP address, that your CA bundle signed it, and that it matches the correct private key. ```bash # Check that the SAN includes your hostname (lowercase) and server IP @@ -124,7 +124,7 @@ openssl x509 -noout -pubkey -in /etc/dspm/.crt | md5sum Identify the email address and display name of your first administrator. The installer prompts for both values during setup and provisions a **local** account automatically — it doesn't depend on Active Directory, Entra ID, or any other identity provider. -To let users sign in with their Active Directory or Entra ID credentials instead, configure an identity provider after installation. Gather the values for the directory you use before you start, so you have them ready in the installer. +To let users sign in with their Active Directory or Entra ID credentials instead, configure an identity provider after installation. Gather the values for the directory you use before you start the installer. ## Identity provider @@ -226,4 +226,4 @@ All outbound endpoints use HTTPS (port 443). The Access Analyzer server must rea ## Before you start the installer -Work through the checklist at the top of this page and confirm every item is complete before installation begins. Unmet prerequisites are the most common cause of failed and delayed installs, and confirming them in advance is the best way to ensure a smooth first-time setup. +Work through the [Checklist](#checklist) and confirm every item is complete before installation begins. Unmet prerequisites are the most common cause of failed and delayed installs — confirm them in advance. From fe090bcfc330764415e033d88650a815166ad633 Mon Sep 17 00:00:00 2001 From: Evan Anandappa Date: Fri, 4 Sep 2026 13:54:21 -0400 Subject: [PATCH 3/3] Address editorial review on prerequisites - Make Debian / Ubuntu the first and default tab; the page names Ubuntu 24.04 LTS as the primary tested platform - Scope the CA trust-store step to internal/private CAs, matching the ca-bundle.crt row that already marks the file optional for public certs - Note that the connector table shows default ports and what to do when a source listens elsewhere - Replace the unverifiable "most common cause" sentence with the actual consequence (installer preflight stops on failure); retitle the section Generated with AI Co-Authored-By: Claude Code --- .../2601/install/prerequisites.md | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/docs/accessanalyzer/2601/install/prerequisites.md b/docs/accessanalyzer/2601/install/prerequisites.md index af2b6e7a07..b274599370 100644 --- a/docs/accessanalyzer/2601/install/prerequisites.md +++ b/docs/accessanalyzer/2601/install/prerequisites.md @@ -77,28 +77,28 @@ sudo mkdir -p /etc/dspm **SAN requirement:** Browsers normalize hostnames to lowercase during TLS validation. If the SAN entry carries any uppercase characters, sign-in fails with an HTTP 401. -These commands set ownership and permissions on the private key, then install your Certificate Authority into the operating system trust store so the system can validate the Access Analyzer TLS certificate. Use the tab for your distribution. +These commands set ownership and permissions on the private key. If an internal or private CA signed your certificate, they also install that CA into the operating system trust store so the system can validate the Access Analyzer TLS certificate. Skip the two CA commands for a publicly trusted certificate. Use the tab for your distribution. - + ```bash sudo chown $(whoami) /etc/dspm/.key sudo chmod 644 /etc/dspm/.key -sudo cp /etc/dspm/ca-bundle.crt /etc/pki/ca-trust/source/anchors/dspm-ca.crt -sudo update-ca-trust +sudo cp /etc/dspm/ca-bundle.crt /usr/local/share/ca-certificates/dspm-ca.crt +sudo update-ca-certificates ``` - + ```bash sudo chown $(whoami) /etc/dspm/.key sudo chmod 644 /etc/dspm/.key -sudo cp /etc/dspm/ca-bundle.crt /usr/local/share/ca-certificates/dspm-ca.crt -sudo update-ca-certificates +sudo cp /etc/dspm/ca-bundle.crt /etc/pki/ca-trust/source/anchors/dspm-ca.crt +sudo update-ca-trust ``` @@ -189,6 +189,8 @@ Ports the Access Analyzer server must reach on your data sources and directory s - **Outbound** from the Access Analyzer server to the target source/host — **required** for all connectors. - **Inbound** at the target source/host from the Access Analyzer server — **required** (the target must accept the connection on the listed port). +The table lists default ports. If a source listens on a different port, open that port instead. + | Connector | Default Port | Protocol | Notes | | --- | --- | --- | --- | | CIFS / SMB | 445 | TCP | SMB file sharing | @@ -224,6 +226,6 @@ All outbound endpoints use HTTPS (port 443). The Access Analyzer server must rea | `rpm.rancher.io` | K3s / Rancher | K3s package repository | Installation only | | `storage.googleapis.com` | K3s / Rancher | K3s artifact storage | Installation only | -## Before you start the installer +## Before installation -Work through the [Checklist](#checklist) and confirm every item is complete before installation begins. Unmet prerequisites are the most common cause of failed and delayed installs — confirm them in advance. +Work through the [Checklist](#checklist) and confirm every item is complete before you start the installer. The installer runs preflight checks and stops if they fail, so confirming these items first avoids a restart.