Security Configuration - Revision history

Qadmin: EDR: OSNEXUS recommended GravityZone package modules and performance guidance

2026-09-29T05:06:32Z

EDR: OSNEXUS recommended GravityZone package modules and performance guidance

← Older revision		Revision as of 05:06, 29 September 2026
Line 721:		Line 721:

	Before starting, create an installation package for Linux servers in your Bitdefender GravityZone console and note either the '''package id''' or the full '''setup downloader URL''' the console provides. The feature set of the agent (which protection modules are enabled) is chosen in the GravityZone console when the package is created, and QuantaStor reads that selection back from the installer. Individual protection modules can optionally be overridden from the QuantaStor side at install time -- see the {{Code\|1=--feature-flags}} argument in the CLI section below.		Before starting, create an installation package for Linux servers in your Bitdefender GravityZone console and note either the '''package id''' or the full '''setup downloader URL''' the console provides. The feature set of the agent (which protection modules are enabled) is chosen in the GravityZone console when the package is created, and QuantaStor reads that selection back from the installer. Individual protection modules can optionally be overridden from the QuantaStor side at install time -- see the {{Code\|1=--feature-flags}} argument in the CLI section below.

			OSNEXUS recommends a package with Antimalware, Advanced Threat Control, Advanced Anti-Exploit, Network Attack Defense and the EDR Sensor enabled. These are our recommended settings, but you may find further customization is needed for your environment. In our testing we did not find that Bitdefender was using much CPU and other resources, but depending on your configuration settings you may need to narrow scanning and other options to reach a fair compromise of strong security with minimal performance impact.

	{{Navigation\|Security → EDR Agents → Install Agent ''(toolbar)''}}		{{Navigation\|Security → EDR Agents → Install Agent ''(toolbar)''}}

Qadmin: EDR CLI: --module takes the module's vendor name, case-sensitive (Bitdefender); the lowercase example failed on a 6.9.0 system

2026-09-29T04:27:17Z

EDR CLI: --module takes the module's vendor name, case-sensitive (Bitdefender); the lowercase example failed on a 6.9.0 system

← Older revision		Revision as of 04:27, 29 September 2026
Line 751:		Line 751:
	qs edr-agent-list		qs edr-agent-list
	qs edr-agent-get --edr-agent=<name-or-id>		qs edr-agent-get --edr-agent=<name-or-id>
	qs edr-agent-create --system-list=<systems> --module=~~bitdefender~~ \		qs edr-agent-create --system-list=<systems> --module=Bitdefender \
	--registration-key=<package-id-or-url>		--registration-key=<package-id-or-url>
	qs edr-agent-delete --edr-agent=<name-or-id>		qs edr-agent-delete --edr-agent=<name-or-id>
	qs edr-agent-rescan		qs edr-agent-rescan
	</pre>		</pre>

			{{Code\|1=--module}} takes the module's vendor name exactly as <code>qs edr-agent-module-list</code> shows it -- {{Code\|1=Bitdefender}}, with a capital B. The match is case-sensitive.

	The create command also accepts an optional {{Code\|1=--feature-flags}} argument taking a JSON object, to override individual protection modules without changing the GravityZone package:		The create command also accepts an optional {{Code\|1=--feature-flags}} argument taking a JSON object, to override individual protection modules without changing the GravityZone package:

	<pre style="font-size: smaller">		<pre style="font-size: smaller">
	qs edr-agent-create --system-list=qs-node-a --module=~~bitdefender~~ \		qs edr-agent-create --system-list=qs-node-a --module=Bitdefender \
	--registration-key=aabbccdd \		--registration-key=aabbccdd \
	--feature-flags='{"FileScan":1,"Firewall":0}'		--feature-flags='{"FileScan":1,"Firewall":0}'
Line 769:		Line 771:
	<pre style="font-size: smaller">		<pre style="font-size: smaller">
	qs edr-agent-module-list		qs edr-agent-module-list
	qs edr-agent-module-get --module=~~bitdefender~~		qs edr-agent-module-get --module=Bitdefender
	</pre>		</pre>

Qadmin: Okta: API token as Integration Key with no Secret Key; link the new Okta Multi-Factor Authentication page

2026-09-29T01:22:26Z

Okta: API token as Integration Key with no Secret Key; link the new Okta Multi-Factor Authentication page

← Older revision		Revision as of 01:22, 29 September 2026
Line 788:		Line 788:

	* '''Cisco Duo''' -- see [[Duo Multi-Factor Authentication\|Cisco Duo Multi-Factor Authentication]] for the full setup walkthrough		* '''Cisco Duo''' -- see [[Duo Multi-Factor Authentication\|Cisco Duo Multi-Factor Authentication]] for the full setup walkthrough
	* '''OKTA'''		* '''OKTA''' -- see [[Okta Multi-Factor Authentication]] for the full setup walkthrough

	Creating a configuration takes a '''Provider''', a '''Name''', an optional '''Description''', the '''API Host''' for your tenant, and the ~~'''Integration Key''' and '''Secret Key'''~~ issued by the provider~~. Obtain those values from your Duo or Okta administration console.~~		Creating a configuration takes a '''Provider''', a '''Name''', an optional '''Description''', the '''API Host''' for your tenant, and the keys issued by the provider:

	Once a configuration exists, enable MFA per account with '''Enable Multi-Factor Auth''' and '''Multi-Factor Auth Config''' on the Add User or Modify User dialog. The '''Force (required when in use)''' option in the manager ~~makes the second factor mandatory rather than optional~~.		* '''Cisco Duo''' -- the '''Integration Key''' and '''Secret Key''' from your Duo Auth API application.
			* '''OKTA''' -- an Okta API token as the '''Integration Key''', and no '''Secret Key''' (the field is disabled when OKTA is selected). The '''API Host''' is your Okta org host name, such as {{Code\|1=yourcompany.okta.com}}. QuantaStor finds each user in Okta by the account's '''Email Address''', so every Okta-protected account needs one that matches its Okta user.

			Once a configuration exists, enable MFA per account with '''Enable Multi-Factor Auth''' and '''Multi-Factor Auth Config''' on the Add User or Modify User dialog. The '''Force (required when in use)''' option in the manager applies to '''Delete...''': it allows deleting a configuration that is still assigned to accounts, and turns MFA off on those accounts.

	Contact OSNEXUS at info@osnexus.com for guidance on additional MFA options.		Contact OSNEXUS at info@osnexus.com for guidance on additional MFA options.

Qadmin: Restore Umbe's rev 28163 wording '(por refers to pending-object-request)', dropped by my previous audit-logging edit

2026-09-28T20:46:40Z

Restore Umbe's rev 28163 wording '(por refers to pending-object-request)', dropped by my previous audit-logging edit

← Older revision		Revision as of 20:46, 28 September 2026
Line 199:		Line 199:
	</pre>		</pre>

	Manage requests with the {{Code\|1=por-*}} commands. <code>qs por-list</code> shows each request's object, status ({{Code\|1=pending}}, {{Code\|1=approved}}, {{Code\|1=running}}, {{Code\|1=completed-success}}, {{Code\|1=completed-failed}}, {{Code\|1=rejected}} or {{Code\|1=expired}}), current and required counts, expiry time and request ID, and <code>qs por-approve</code> and <code>qs por-reject</code> take a comma-separated list of request IDs:		Manage requests with the {{Code\|1=por-*}} (por refers to pending-object-request) commands. <code>qs por-list</code> shows each request's object, status ({{Code\|1=pending}}, {{Code\|1=approved}}, {{Code\|1=running}}, {{Code\|1=completed-success}}, {{Code\|1=completed-failed}}, {{Code\|1=rejected}} or {{Code\|1=expired}}), current and required counts, expiry time and request ID, and <code>qs por-approve</code> and <code>qs por-reject</code> take a comma-separated list of request IDs:

	<pre style="font-size: smaller">		<pre style="font-size: smaller">

Qadmin: Audit Logging: trim to a summary and link the new Audit Logging page (7.0 RFC 5424 format)

2026-09-28T20:46:05Z

Audit Logging: trim to a summary and link the new Audit Logging page (7.0 RFC 5424 format)

← Older revision		Revision as of 20:46, 28 September 2026
Line 86:		Line 86:
	=== Audit Logging ===		=== Audit Logging ===

	Audit logging ~~of management operations~~ is on ~~by default on all QuantaStor systems and cannot be disabled~~. Every ~~API, CLI~~, and ~~web interface operation passes through the same core service and~~ is recorded.		Audit logging is always on. Every management operation, login attempt and authorization decision is recorded in {{Code\|1=/var/log/qs/qs_audit.log}} on the appliance that handled it. Starting with QuantaStor 7.0 the records are RFC 5424 syslog records, signed with a chained HMAC-SHA256 so that tampering can be detected with {{Code\|1=qs audit-log-verify}}. The record format, facility settings, rotation, verification, SIEM forwarding and the Audit Log Analyzer are covered on their own page: '''[[Audit Logging]]'''.

	~~The audit log is at:~~

	~~<pre style~~=~~"font-size: smaller">~~
	/var/log/qs/qs_audit.log
	~~</pre>~~

	~~It is written in~~ a ~~NIST compliant CEE JSON format, one JSON object per line,~~ so it can be ~~ingested directly by a~~ log ~~aggregator or SIEM without custom parsing~~. ~~Each~~ record ~~identifies the operation~~, ~~the user account that invoked it~~, ~~the source address~~, and the ~~outcome.~~

	~~To ship the audit log to a central collector, point your syslog or log agent at this file; QuantaStor does not rotate it out from under a reader~~.

	=== Sending Logs to Support ===		=== Sending Logs to Support ===
Line 209:		Line 199:
	</pre>		</pre>

	Manage requests with the {{Code\|1=por-*}} ~~(por refers to pending-object-request)~~ commands. <code>qs por-list</code> shows each request's object, status ({{Code\|1=pending}}, {{Code\|1=approved}}, {{Code\|1=running}}, {{Code\|1=completed-success}}, {{Code\|1=completed-failed}}, {{Code\|1=rejected}} or {{Code\|1=expired}}), current and required counts, expiry time and request ID, and <code>qs por-approve</code> and <code>qs por-reject</code> take a comma-separated list of request IDs:		Manage requests with the {{Code\|1=por-*}} commands. <code>qs por-list</code> shows each request's object, status ({{Code\|1=pending}}, {{Code\|1=approved}}, {{Code\|1=running}}, {{Code\|1=completed-success}}, {{Code\|1=completed-failed}}, {{Code\|1=rejected}} or {{Code\|1=expired}}), current and required counts, expiry time and request ID, and <code>qs por-approve</code> and <code>qs por-reject</code> take a comma-separated list of request IDs:

	<pre style="font-size: smaller">		<pre style="font-size: smaller">

Umbe: /* Multi-admin approvals from the CLI */

2026-09-28T20:33:17Z

Multi-admin approvals from the CLI

← Older revision		Revision as of 20:33, 28 September 2026
Line 209:		Line 209:
	</pre>		</pre>

	Manage requests with the {{Code\|1=por-*}} commands. <code>qs por-list</code> shows each request's object, status ({{Code\|1=pending}}, {{Code\|1=approved}}, {{Code\|1=running}}, {{Code\|1=completed-success}}, {{Code\|1=completed-failed}}, {{Code\|1=rejected}} or {{Code\|1=expired}}), current and required counts, expiry time and request ID, and <code>qs por-approve</code> and <code>qs por-reject</code> take a comma-separated list of request IDs:		Manage requests with the {{Code\|1=por-*}} (por refers to pending-object-request) commands. <code>qs por-list</code> shows each request's object, status ({{Code\|1=pending}}, {{Code\|1=approved}}, {{Code\|1=running}}, {{Code\|1=completed-success}}, {{Code\|1=completed-failed}}, {{Code\|1=rejected}} or {{Code\|1=expired}}), current and required counts, expiry time and request ID, and <code>qs por-approve</code> and <code>qs por-reject</code> take a comma-separated list of request IDs:

	<pre style="font-size: smaller">		<pre style="font-size: smaller">

Qadmin: Add Multi-admin Approvals section (verified end to end on a 6.9.0 grid: request, approve, reject, CLI). Corrects the earlier one-line description, which said a single second administrator approves and pointed at a Security toolbar

2026-09-28T16:40:27Z

Add Multi-admin Approvals section (verified end to end on a 6.9.0 grid: request, approve, reject, CLI). Corrects the earlier one-line description, which said a single second administrator approves and pointed at a Security toolbar

Show changes

Qadmin: note that Old Password is disabled for the admin session and that the length range comes from the policy, folded in from User Set Password (QSTOR-12352)

2026-09-04T03:43:03Z

note that Old Password is disabled for the admin session and that the length range comes from the policy, folded in from User Set Password (QSTOR-12352)

← Older revision		Revision as of 03:43, 4 September 2026
Line 325:		Line 325:

	The new password must satisfy the grid password policy. Use at least 10 characters with upper and lower case letters and numbers -- or raise the policy first with '''Suggested Defaults''' so the requirement is enforced for every account rather than relying on convention.		The new password must satisfy the grid password policy. Use at least 10 characters with upper and lower case letters and numbers -- or raise the policy first with '''Suggested Defaults''' so the requirement is enforced for every account rather than relying on convention.

			'''Old Password''' is disabled while the session is logged in as <code>admin</code>, so changing that account's password needs only the new password and its confirmation. For every other account the field is required and the current password has to be entered as well. The permitted length range comes from the grid password policy rather than being fixed by the dialog.

	Unlike '''qadmin''', this is a grid-wide management account: changing it once changes it for the whole Storage Grid.		Unlike '''qadmin''', this is a grid-wide management account: changing it once changes it for the whole Storage Grid.

Qadmin: Remove version-era language: drop the QuantaStor v4 Tomcat upgrade note and de-anchor the permission counts from a release (wiki-docs rule 13, QSTOR-12352)

2026-09-03T03:13:30Z

Remove version-era language: drop the QuantaStor v4 Tomcat upgrade note and de-anchor the permission counts from a release (wiki-docs rule 13, QSTOR-12352)

← Older revision		Revision as of 03:13, 3 September 2026
Line 147:		Line 147:
	The '''Permission Assignments''' grid lists every permission as a row of '''Object Type''', '''Operation''', and '''Permission Scope'''.		The '''Permission Assignments''' grid lists every permission as a row of '''Object Type''', '''Operation''', and '''Permission Scope'''.

	~~On QuantaStor 6.9 there~~ are '''207 object types''' and '''662 individual permissions''', covering everything from the common types such as Storage Volume, Network Share, and Object Bucket through to internal types such as Acl, AlertConfiguration, and TargetPort.		There are '''207 object types''' and '''662 individual permissions''', covering everything from the common types such as Storage Volume, Network Share, and Object Bucket through to internal types such as Acl, AlertConfiguration, and TargetPort.

	Because that list is long, use the '''<Show All Object Types>''' filter above the grid to narrow it to the object type you are working on, then set the operations for that type.		Because that list is long, use the '''<Show All Object Types>''' filter above the grid to narrow it to the object type you are working on, then set the operations for that type.
Line 359:		Line 359:

	QuantaStor serves the web management interface, the REST API, and the internal grid communication channels over TLS. The web management interface is served by '''nginx''' and the TLS settings, ciphers, and certificates are all managed by QuantaStor.		QuantaStor serves the web management interface, the REST API, and the internal grid communication channels over TLS. The web management interface is served by '''nginx''' and the TLS settings, ciphers, and certificates are all managed by QuantaStor.

	'''Note for administrators upgrading from QuantaStor v4:''' older releases served the web interface from Apache Tomcat and required generating a Java keystore with {{Code\|1=keytool}}. That is no longer the case. There is no keystore, no {{Code\|1=server.xml}}, and no tomcat service on QuantaStor v5 and newer -- use the procedures below instead.

	=== Web Access Mode ===		=== Web Access Mode ===

Qadmin: Re-fit screenshot widths to half the captured size (capped at 800px) so 2x captures display at their true on-screen size (wiki-docs rule 5)

2026-09-03T01:24:17Z

Re-fit screenshot widths to half the captured size (capped at 800px) so 2x captures display at their true on-screen size (wiki-docs rule 5)

← Older revision		Revision as of 01:24, 3 September 2026
Line 34:		Line 34:
	== Security Settings Management ==		== Security Settings Management ==

	[[File:security_manager_general.png\|thumb\|right\|~~546px~~\|Security Manager, General tab -- grid-wide password and login policy.]]		[[File:security_manager_general.png\|thumb\|right\|530px\|Security Manager, General tab -- grid-wide password and login policy.]]

	The '''Security Manager''' holds the password and login policy for the entire Storage Grid. These settings apply to all user accounts on all systems in the grid, not per-system.		The '''Security Manager''' holds the password and login policy for the entire Storage Grid. These settings apply to all user accounts on all systems in the grid, not per-system.
Line 65:		Line 65:
	=== LDAP Single-Sign-On Authentication ===		=== LDAP Single-Sign-On Authentication ===

	[[File:security_manager_advanced.png\|thumb\|right\|~~546px~~\|Security Manager, Advanced Settings -- Web Access Mode and LDAP single sign-on.]]		[[File:security_manager_advanced.png\|thumb\|right\|530px\|Security Manager, Advanced Settings -- Web Access Mode and LDAP single sign-on.]]

	The Advanced Settings tab can connect the Storage Grid to an LDAP or Active Directory domain for '''management user''' authentication.		The Advanced Settings tab can connect the Storage Grid to an LDAP or Active Directory domain for '''management user''' authentication.
Line 128:		Line 128:
	=== Role Management ===		=== Role Management ===

	[[File:security_role_create.png\|thumb\|right\|~~586px~~\|Create Role, showing the permission assignment grid.]]		[[File:security_role_create.png\|thumb\|right\|570px\|Create Role, showing the permission assignment grid.]]

	{{Navigation\|Security → Management Roles → Role → Create ''(toolbar)''}}		{{Navigation\|Security → Management Roles → Role → Create ''(toolbar)''}}
Line 179:		Line 179:
	=== Adding New Users ===		=== Adding New Users ===

	[[File:security_user_add.png\|thumb\|right\|~~626px~~\|Add User dialog, General tab.]]		[[File:security_user_add.png\|thumb\|right\|610px\|Add User dialog, General tab.]]

	{{Navigation\|Security → Management Users → User → Add ''(toolbar)''}}		{{Navigation\|Security → Management Users → User → Add ''(toolbar)''}}
Line 197:		Line 197:
	==== Alert Subscriptions ====		==== Alert Subscriptions ====

	[[File:security_user_alerts.png\|thumb\|right\|~~626px~~\|Add User, Alert Subscriptions tab.]]		[[File:security_user_alerts.png\|thumb\|right\|610px\|Add User, Alert Subscriptions tab.]]

	Entering a user's email address and selecting the alert severity levels to subscribe to routes email alerts to that administrator. Several users can subscribe at different severities, so that (for example) only critical alerts page the on-call administrator while an operations mailbox receives everything.		Entering a user's email address and selecting the alert severity levels to subscribe to routes email alerts to that administrator. Several users can subscribe at different severities, so that (for example) only critical alerts page the on-call administrator while an operations mailbox receives everything.
Line 205:		Line 205:
	==== Web Interface Customization ====		==== Web Interface Customization ====

	[[File:security_user_webcustom.png\|thumb\|right\|~~626px~~\|Add User, Web Interface Customization tab.]]		[[File:security_user_webcustom.png\|thumb\|right\|610px\|Add User, Web Interface Customization tab.]]

	In larger deployments with many administrators, or on systems built for a narrow use case, it can help to hide the interface tab panels and sections a given user does not need. This reduces complexity and makes the interface clearer for admins with a narrow remit.		In larger deployments with many administrators, or on systems built for a narrow use case, it can help to hide the interface tab panels and sections a given user does not need. This reduces complexity and makes the interface clearer for admins with a narrow remit.
Line 215:		Line 215:
	==== User Account Advanced Settings ====		==== User Account Advanced Settings ====

	[[File:security_user_advanced.png\|thumb\|right\|~~626px~~\|Add User, Advanced Settings tab.]]		[[File:security_user_advanced.png\|thumb\|right\|610px\|Add User, Advanced Settings tab.]]

	The '''Advanced Settings''' tab holds three things:		The '''Advanced Settings''' tab holds three things:
Line 237:		Line 237:
	=== Modifying Users ===		=== Modifying Users ===

	[[File:security_user_modify.png\|thumb\|right\|~~626px~~\|Modify User dialog.]]		[[File:security_user_modify.png\|thumb\|right\|610px\|Modify User dialog.]]

	{{Navigation\|Security → Management Users → ''select a user'' → User → Modify ''(toolbar)''}}		{{Navigation\|Security → Management Users → ''select a user'' → User → Modify ''(toolbar)''}}
Line 249:		Line 249:
	=== Removing Users ===		=== Removing Users ===

	[[File:security_user_remove.png\|thumb\|right\|~~406px~~\|Remove User dialog.]]		[[File:security_user_remove.png\|thumb\|right\|390px\|Remove User dialog.]]

	{{Navigation\|Security → Management Users → ''select a user'' → User → Remove ''(toolbar)''}}		{{Navigation\|Security → Management Users → ''select a user'' → User → Remove ''(toolbar)''}}
Line 263:		Line 263:
	== User Group Management ==		== User Group Management ==

	[[File:security_usergroup_create.png\|thumb\|right\|~~550px~~\|Create User Group dialog.]]		[[File:security_usergroup_create.png\|thumb\|right\|534px\|Create User Group dialog.]]

	User Groups collect users under a common POSIX GID, which is useful when several users need to be owners of the same Network Share.		User Groups collect users under a common POSIX GID, which is useful when several users need to be owners of the same Network Share.
Line 318:		Line 318:
	==== Change Management Administrator Account 'admin' Password ====		==== Change Management Administrator Account 'admin' Password ====

	[[File:security_set_password.png\|thumb\|right\|~~377px~~\|Set Password dialog.]]		[[File:security_set_password.png\|thumb\|right\|361px\|Set Password dialog.]]

	Log in to the web management interface as '''admin''' and change the default password, which is '''password'''.		Log in to the web management interface as '''admin''' and change the default password, which is '''password'''.
Line 330:		Line 330:
	== Firewall Configuration ==		== Firewall Configuration ==

	[[File:security_firewall.png\|thumb\|right\|~~616px~~\|Storage System Modify, Firewall tab.]]		[[File:security_firewall.png\|thumb\|right\|600px\|Storage System Modify, Firewall tab.]]

	QuantaStor has an integrated firewall management system that controls protocol access both at the system level and per network port. For high-security environments it is recommended to block every protocol that will not be used.		QuantaStor has an integrated firewall management system that controls protocol access both at the system level and per network port. For high-security environments it is recommended to block every protocol that will not be used.
Line 610:		Line 610:
	=== Installing an EDR Agent ===		=== Installing an EDR Agent ===

	[[File:security_edr_install.png\|thumb\|right\|~~516px~~\|Install EDR Security Agent dialog.]]		[[File:security_edr_install.png\|thumb\|right\|500px\|Install EDR Security Agent dialog.]]

	Before starting, create an installation package for Linux servers in your Bitdefender GravityZone console and note either the '''package id''' or the full '''setup downloader URL''' the console provides. The feature set of the agent (which protection modules are enabled) is chosen in the GravityZone console when the package is created, and QuantaStor reads that selection back from the installer. Individual protection modules can optionally be overridden from the QuantaStor side at install time -- see the {{Code\|1=--feature-flags}} argument in the CLI section below.		Before starting, create an installation package for Linux servers in your Bitdefender GravityZone console and note either the '''package id''' or the full '''setup downloader URL''' the console provides. The feature set of the agent (which protection modules are enabled) is chosen in the GravityZone console when the package is created, and QuantaStor reads that selection back from the installer. Individual protection modules can optionally be overridden from the QuantaStor side at install time -- see the {{Code\|1=--feature-flags}} argument in the CLI section below.
Line 669:		Line 669:
	== Multi-factor Authentication ==		== Multi-factor Authentication ==

	[[File:security_mfa_manager.png\|thumb\|right\|~~631px~~\|Multi-Factor Authentication Manager.]]		[[File:security_mfa_manager.png\|thumb\|right\|615px\|Multi-Factor Authentication Manager.]]

	Multi-factor authentication (MFA) requires a user to present a second factor, such as a device, in addition to their password. QuantaStor supports MFA for management logins.		Multi-factor authentication (MFA) requires a user to present a second factor, such as a device, in addition to their password. QuantaStor supports MFA for management logins.