Press CTRL+K to open search

On-Prem Connectivity Utility Install Instructions

  • 4 minute(s) read
Prev Next

Hardware and Operating System Requirements

Requirement

Details

Operating Systems

A modern Linux distribution that natively supports systemd and includes a ssh client

Nucleus officially supports Red Hat Family distributions; other systemd distros should be compatible.

CPU

1 Core

Memory

4 GB RAM

Storage

20 GB

Firewall

Open port 2222 outbound from the server you are installing the On-Prem Connectivity utility on to the Connectivity Manager FQDN provided by the Nucleus support team.

Misc

root access (or full sudo privileges) on the machine you are installing the On-Prem Connectivity utility on. This procedure assumes you are logged in as the root user.

On-Prem Connectivity Utility Configuration Elements

You will also need the following data elements and services available to complete the Connectivity Utility installation process.

Requirements

Details

Username

Unique identifier allowing access to your Nucleus instance.

FQDN

Fully Qualified Domain Name, the most complete and accurate network address for your instance’s Connectivity Manager.

Ports

The Nucleus Ports that manage your tools.

ssh

Secure Shell (ssh) client used to securely connect log into, and manage remote servers or devices over an encrypted network.

systemd

System and service manager for Linux. This standard package initializes user space, acts as PID 1, and manages system resources.

Installation

Before proceeding, please submit a support request. Nucleus Support will ensure you have all the proper information for a successful Connectivity Utility install.

You will be provided with the following information by Nucleus Support:

  • Your Connectivity Utility username for authentication.

  • The FQDN of the Connectivity Manager for your instance (referred to as <Connectivity Manager fqdn> in this procedure).

  • Port numbers for your internal services.

  • On request, Nucleus Support can provide IPs for firewall rule configuration.

Note

Your firewall must be configured to allow outbound SSH access on port 2222 from the server you are installing the Connectivity Utility on to this FQDN.

Warning

The Connectivity Utility uses key-based authentication. We will never ask for an account password or private key. We will require your public key, covered below.

Note

Standard Connectivity Utility provisioning allows for five internal sources. If you are connecting to more than five internal tools, contact Nucleus Support for additional allocation. Nucleus will assign a list of ports for your internal services. Each internal tool that Nucleus will be connecting to will use one of these assigned ports.

Once you have the above information, proceed to the next section.

Install Dependencies

To install the Connectivity Utility, you’ll need a SSH client and systemd suite. These are standard packages available on supported Linux operating systems. If they are not available, you will need to install them to continue.

Obtain Your Public Key File

# Setup SSH keys for authentication
mkdir /home/<username>/.ssh
ssh-keygen -t rsa -b 4096 -C <username>
Enter the file in which to save the key: /home/<username>/.ssh/id_rsa
Enter the passphrase: <Leave Blank>
Enter the same passphrase again: <Leave Blank>

Stop Here!

Send your public key file to your Nucleus Support representative before continuing. You can provide the file directly to your representative or by including the information on your open support ticket.

Description of Fields

The following fields are referenced during the Connectivity Utility installation process.

  • <internal tool name>: The name of the internal tool you are connecting to (e.g. Nessus, Jira, etc.)

  • <NUCLEUS_PORT>: One unused port from the range of ports that Nucleus assigned to your organization. If you need more ports, reach out to your Nucleus support representative.

  • <TARGET_HOST>: The internal IP of the internal tool/application that you would like to expose to Nucleus. If you are installing the Connectivity Utility on the server that runs the internal tool, use 127.0.0.1

  • <TARGET_PORT>: This is the port that the internal tool/application listens on. For example, Nessus Professional listens on port 8834 by default.

  • <Connectivity Manager fqdn>: This is the FQDN of the Connectivity Manager given to you by Nucleus Support. nucleus-mgr.nucleussec.com)

Install & Configure the Connectivity Utility

Ports, IP addresses, user information, etc. in the following instructions are examples only. Please use your account-specific details.

  1. Create the necessary files

Create the file /etc/systemd/system/nucleus-agent.slice with the following contents.

[Unit]

Description=Connectivity Utility tunnels

Create the file /etc/systemd/system/[email protected] with the following contents:

[Unit]

Description=Connectivity Utility tunnel for %i

After=network.target

[Service]

Type=simple

EnvironmentFile=/etc/nucleus-agent/%i

ExecStart=ssh -NT -o StrictHostKeyChecking=no \

${NUCLEUS_AGENT_USER}@nucleus-mgr.nucleussec.com -p 2222 \

-R ${NUCLEUS_PORT}:${TARGET_HOST}:${TARGET_PORT} \

-i ${NUCLEUS_SSH_KEY} \

-o ExitOnForwardFailure=yes \

-o ServerAliveInterval=30 \

-o ServerAliveCountMax=3

RestartSec=5

Restart=on-success

RestartForceExitStatus=255

Slice=nucleus-agent.slice

[Install]

WantedBy=multi-user.target

  1. Create nucleus-agent directory and place config files

Create a directory /etc/nucleus-agent/ and place config files

NOTE: Customize the filenames as desired/necessary, ensuring they are referenced correctly in step 4. Also remember to use your own IP addresses, ports, usernames, and keys.

  1. tunnel_config1:

TARGET_HOST="10.1.66.195"

TARGET_PORT="1234"

NUCLEUS_PORT="8282"

NUCLEUS_AGENT_USER="sample_username"

NUCLEUS_SSH_KEY="/path/to/id_rsa"

  1. tunnel_config2: (IF NEEDED)

TARGET_HOST="172.16.16.156"

TARGET_PORT="5637"

NUCLEUS_PORT="1212"

NUCLEUS_AGENT_USER="sample_username"

NUCLEUS_SSH_KEY="/path/to/id_rsa"

  1. Run systemctl daemon-reload

  2. Run systemctl enable --now nucleus-agent@tunnel_config1, repeat for each config file added above.

  3. Each tunnel is now managed as a standard system-native service; there is no need for external dependencies.

Checking Tunnel Status:

  • To see the status of all tunnels at once: systemctl status nucleus-agent.slice

  • To check a specific tunnel: systemctl status nucleus-agent@tunnel_config5

Managing individual tunnels:

  • Stop a tunnel: systemctl stop nucleus-agent@tunnel_config5

  • Restart a tunnel: systemctl restart nucleus-agent@tunnel_config1

  • Start a tunnel: systemctl start nucleus-agent@tunnel_config1

Managing all tunnels:

  • All tunnels can be targeted via the slice name: systemctl stop nucleus-agent.slice

If the service is not starting correctly, please refer to the Troubleshooting guide in this folder

If you need any assistance, we're always close at [email protected].

Next Steps

Now that you've set up the Connectivity Utility, it's time to set up a Connector through the UI. 

Here's how