Security

Both usernames of logged-on users and usernames within the software metering (i.e. users who have used applications on the computer) can be replaced with SHA-1 hash. The same encrypted string will be used for the same user each time, even if the user uses multiple computers, no duplicate entries are created.

To enable the anonymous user data option, the following system setting needs to be added to the configuration file:

privacy.hide_user=true

Example 17.

Default setting (not anonymous)

With privacy.hide_user=true (anonymous)

The IP addresses assigned to the network interfaces of the computer can be replaced with SHA-1 hash. Add the following system setting to the configuration file:

privacy.hide_ip=true

If your server uses a self-signed certificate for TLS, it is best practice to ensure that the root CA for the self-signed certificate is present and available to the agent so that certificate verification can be performed.

If no trusted root CA is present on the client machine, and therefore no certificate verification can be performed, you must disable the validation check. This is however insecure and strongly discouraged.

To disable the validation check, set http.ssl_verify in the agent configuration file to false:

<SystemSettings>
    <Setting key="http.ssl_verify" value="false" />
</SystemSettings>

The Snow Inventory Agent supports the use of client certificates. The certificates need to be password protected, and the password must be stored (encrypted) in the agent configuration file.

A common practice is to distribute the client certificate alongside the agent as part of the update package. The agent is then configured to look for a certificate.pfx file that contains the client certificate for client authentication and use that (provided it has the correct password).

If the server endpoint is used with a client certificate and the password does not match, an error is generated in the snowagent.log. The agent will continue with other server endpoint configurations if any have been set.

To use Transport Layer Security (TLS) for the communication between the Snow Inventory Agent and the Snow Inventory endpoint (a Snow Inventory Server or Snow Extender), the below requirements must be met.

TLS versions supported by the agents are listed in Security considerations in Snow Inventory. From a security point of view, using the latest stable version is always advisable.

<SystemSettings>
    <Setting key="http.ssl_capath" value="/etc/ssl/certs/mycert.pem" />
</SystemSettings>

If any of the following error messages are shown in the Unix agent log, follow the instructions to enable the connection between the agent and the Snow Inventory endpoint.