Contents

There are several ways to access the Charon-SSP AWS Instance.

...

GCP Security Overview

Access to an GCP cloud instance can be controlled by 

• an external firewall,
• the operating system firewall of the instance,
• GCP-specific firewall settings.

In addition to allowing SSH access, the different firewall levels must be configured to permit at least access to any required license servers.

GCP Firewall Rules

In addition to firewall rules created by the customer, there are other rules that can affect incoming or outgoing traffic:

• Certain IP protocols, such as GRE, are not allowed within a VPC network. For more information, see always blocked traffic.

• Communication between a VM instance and its corresponding metadata server (169.254.169.254). Is always allowed.

• Every network has two implied firewall rules that permit outgoing connections and block incoming connections. Firewall rules that you create can override these implied rules.

• The default network is pre-populated with firewall rules that can be deleted or modified.

VPC firewall rule characteristics:

• Each rule is either for incoming or outgoing traffic. It can allow or deny traffic.
• Only IPv4 traffic is supported.
• Firewall rules are stateful (return traffic for an established connection is allowed).
• If TCP traffic is fragmented, a rule is only applied to the first fragment of a packet.

Connecting to the Cloud Instance

During the configuration of your instance you should have created a security group allowing at the minimum SSH access to the instance. If this has been done correctly, you can, for example, use SSH from the command-line or from a tool such as PuTTY to access the command-line of the user sshuser (for Charon-SSP prepackaged marketplace images) or your custom user (for RPM installations) on the Charon-SSP instance. If you select your instance in the instance list and then click on Connect, you will see the instructions for connecting via SSH.

In particular, you will see

• the name of the private key that must be used to connect to the instance, and
• the public DNS name of the instance.

The following image shows an example:

Image Removed

 Note that the

You will need the following:

• Access to the private key associated with the public key you uploaded during the configuration of the instance.
• The public IP address of the instance.
• If you did not create the instance from a Charon-SSP marketplace image, you will also need the username created during instance launch (based on the uploaded SSH key).

Please note:

• The file permissions of the private key file must be set such that the file is only readable by the user

...

To connect to the instance as the user sshuser, use the following command:

...

The parameter ServerAliveInterval will protect the connection from timing out.

Below, you see sample output of a login:

$ ssh -o ServerAliveInterval=30 -i ./we-test-key2.pem sshuser@3.81.64.139
Last login: Tue May 21 05:34:33 2019 from myhost.example.com
[sshuser@ip-172-31-38-252 ~]$ pwd
/home/charon

...

This will open the login window of the Charon-SSP Manager.

...

...

...

On this tab perform the following steps:

• Enter the public IP address or the private VPN IP address of your Charon-SSP instance.
• Enter the Charon-SSP management password (default: stromasys).
• Enable the SSH tunnel configuration unless you use a connection across a secure VPN.

...

If using the Manager's integrated SSH tunnel: On this tab perform the following steps:

• Enter the Charon-SSP user (sshuser).
• Enter the path to the private key file (click on the three dots to open a file browser),
• In rare cases, you may need to add the path to the public key on the local system.
• Enter the passphrase for the private key if required. 
• Adjust the server port (default 22) if required.

 The public key of the AWS keypair can copied from the .ssh/authorized_keys file of the sshuser of the instance

...

If the information is correct, the Charon-SSP Manager welcome screen will be displayed:

Image Removed

...

...

• (e.g.,

...

File transfer using SFTP

The SSH security group definition is also used to allow SFTP access to the Charon-SSP AWS instance. This allows file transfers to and from the Charon-SSP AWS instance. The user for file transfers is the charon user.

To connect to the instance as the user charon, use the following command:

...

$ sftp -i ./we-test-key2.pem charon@3.81.64.139
Connected to storage@3.81.64.139.
sftp> ls
media             ssp-snapshot

...

Connecting with the Charon-SSP Manager

To manage Charon-SSP and the emulated SPARC systems, you must connect to the Charon-SSP AWS instance with the Charon-SSP Manager. The Charon-SSP Manager is the main interface to all important functions of the Charon-SSP software.

Prerequisites:

• The Charon-SSP Manager must be installed on your local system.
• For access via the public IP address of the instance:
  • The Security Group on your local system must at least allow SSH access. This allows the built-in SSH tunneling of the Charon-SSP Manger to work. Should you not use SSH tunneling, you must open up additional ports (9091 for the Manager communication, any ports used for the emulated system serial console ports, and ports used for the graphical emulation). However, if the connection runs over the Internet, Stromasys recommends strongly to use SSH tunneling. Otherwise, your Charon-SSP cloud instance and any emulated systems running on it can easily be compromised.
  • Public IP address of the Charon-SSP AWS instance.
• For access via an SSH-based VPN:
  • Active SSH-based VPN (see SSH VPN - Connecting Charon Host and Guest to Customer Network)
  • Private IP address of the Charon-SSP host in the VPN

Start the Charon-SSP Manager

Start the Charon-SSP Manager using the following command:

...

• # chmod 400 <private-key-file>).
• PuTTY uses a different key file format. It comes with tools to convert between its own .ppk format and the format of OpenSSH used by the default Linux tools.

There are several ways to connect to your Charon-SSP cloud instance using this basic SSH protocol access. Some of them are described in the following sections below. GCP also offers additional ways of connecting to your instance (e.g., in a browser window). Please refer to the Google cloud documentation for more information about these methods.