How to Deploy a Proxy For Bare Metal / Virtual Machine

This article offers the option to choose either the install script, or to use the manual steps listed below. Before you begin, check the prerequisites.

Minimum required hardware is 1 CPU and 1024MB of RAM. If using this as a proxy, then depending on the number of requests, you might need to increased those resources, and monitor for resource exhaustion and performance.

Minimum OS supported versions:

• CentOS 7
• RHEL 8
• Any modern Debian-based OS (Ubuntu 20.04)

Install Script

• Download and execute the installation script:

  sudo bash -c "$(curl -fsSL https://url.access.barracuda.com/proxy-linux)"

• This script can also be used for unattended installations:

  curl -fsSLo install-proxy-linux.sh https://url.access.barracuda.com/proxy-linux 
  chmod +x install-proxy-linux.sh 
  ./install-proxy-linux.sh -h 

Available parameters:

./install-proxy-linux.sh -p 443 -t "https://xxxxxxxxxxxx" -u

./install-proxy-linux.sh -p 443 -t "https://xxxxxxxxxxxx" -u -r localhost -s 6379

./install-proxy-linux.sh -n -p 443 -u

1. Install prerequisites.

   sudo yum -y install yum-utils chrony

2. Ensure chrony daemon is enabled on system boot and started.

   sudo systemctl enable chronyd
   sudo systemctl start chronyd

3. Ensure time synchronization is enabled.

   sudo timedatectl set-ntp on

4. Add CloudGen Access repository.

   sudo yum-config-manager -y --add-repo https://downloads.access.barracuda.com/fyde.repo

       

5. Install Envoy Proxy.

   sudo yum -y install envoy
   sudo systemctl enable envoy

6.  Add CAP_NET_BIND_SERVICE to Envoy using a service unit override. If you choose to configure your proxy to run in a port below 1024, you will need to add the CAP_NET_BIND_SERVICE capability to Envoy.

   sudo mkdir -p /etc/systemd/system/envoy.service.d
   sudo bash -c "cat > /etc/systemd/system/envoy.service.d/10-add-cap-net-bind.conf <<EOF
   [Service]
   Capabilities=CAP_NET_BIND_SERVICE+ep
   CapabilityBoundingSet=CAP_NET_BIND_SERVICE
   AmbientCapabilities=CAP_NET_BIND_SERVICE
   SecureBits=keep-caps
   EOF"
   sudo chmod 600 /etc/systemd/system/envoy.service.d/10-add-cap-net-bind.conf

7. Reload and start Envoy Proxy.
   

   sudo systemctl --system daemon-reload  
   sudo systemctl start envoy 

8. Install CloudGen Access Proxy Orchestrator and authz system.

   sudo yum -y install fydeproxy
   sudo systemctl enable fydeproxy

9. Configure environment using a service unit override

   sudo mkdir -p /etc/systemd/system/fydeproxy.service.d
   sudo bash -c "cat > /etc/systemd/system/fydeproxy.service.d/10-environment.conf <<EOF
   [Service]
   Environment='FYDE_ENROLLMENT_TOKEN=<paste here your CloudGen Access Proxy enrollment link>'
   Environment='FYDE_ENVOY_LISTENER_PORT=<replace with the corresponding CloudGen Access Proxy port, as configured in CloudGen Access Enterprise Console>'
   Environment='FYDE_LOGLEVEL=info'
   EOF"
   sudo chmod 600 /etc/systemd/system/fydeproxy.service.d/10-environment.conf

10. For highly available installations, access to a redis server is required for communication between CloudGen Access Orchestrators.

    sudo bash -c "cat >> /etc/systemd/system/fydeproxy.service.d/10-environment.conf <<EOF
    Environment='FYDE_REDIS_HOST=<specify redis host ip or dns>'
    Environment='FYDE_REDIS_PORT=<specify redis port, defaults for 6379 if not included>'
    EOF"

11. Reload and start CloudGen Access Proxy Orchestrator daemon.

    sudo systemctl --system daemon-reload
    sudo systemctl start fydeproxy

12. Configure the firewall (if enabled).

    sudo firewall-cmd --zone=public --add-port="<replace with the corresponding CloudGen Access Proxy port, as configured in CloudGen Access Enterprise Console>/tcp" --permanent
    sudo firewall-cmd --reload

Debian / Ubuntu - Manual Steps

1. Ensure time synchronization is enabled.

   sudo timedatectl set-ntp on

2. Add CloudGen Access repository.

   REPO_URL="downloads.access.barracuda.com"
   wget -q -O - "https://$REPO_URL/fyde-public-key.asc" | sudo apt-key add -
   sudo bash -c "cat > /etc/apt/sources.list.d/fyde.list <<EOF
   deb https://$REPO_URL/apt stable main
   EOF"
   sudo apt update

3. Install Envoy Proxy.

   sudo apt -y install envoy
   sudo systemctl enable envoy

4. Add CAP_NET_BIND_SERVICE to Envoy using a service unit override. If you choose to configure your proxy to run in a port below 1024, you will need to add the CAP_NET_BIND_SERVICE capability to Envoy.

   sudo mkdir -p /etc/systemd/system/envoy.service.d
   sudo bash -c "cat > /etc/systemd/system/envoy.service.d/10-add-cap-net-bind.conf <<EOF
   [Service]
   Capabilities=CAP_NET_BIND_SERVICE+ep
   CapabilityBoundingSet=CAP_NET_BIND_SERVICE
   AmbientCapabilities=CAP_NET_BIND_SERVICE
   SecureBits=keep-caps
   EOF"
   sudo chmod 600 /etc/systemd/system/envoy.service.d/10-add-cap-net-bind.conf

5. Reload and start Envoy Proxy.

   sudo systemctl --system daemon-reload
   sudo systemctl start envoy

6. Install CloudGen Access Proxy Orchestrator and authz system.

   sudo apt -y install fydeproxy
   sudo systemctl enable fydeproxy

7. Configure environment using a service unit override.

   sudo mkdir -p /etc/systemd/system/fydeproxy.service.d
   sudo bash -c "cat > /etc/systemd/system/fydeproxy.service.d/10-environment.conf <<EOF
   [Service]
   Environment='FYDE_ENROLLMENT_TOKEN=<paste here your CloudGen Access Proxy enrollment link>'
   Environment='FYDE_ENVOY_LISTENER_PORT=<replace with the corresponding CloudGen Access Proxy port, as configured in CloudGen Access Enterprise Console>'
   Environment='FYDE_LOGLEVEL=info'
   EOF"
   sudo chmod 600 /etc/systemd/system/fydeproxy.service.d/10-environment.conf

8. For highly available installations, access to a redis server is required for communication between CloudGen Access Orchestrators.

   sudo bash -c "cat >> /etc/systemd/system/fydeproxy.service.d/10-environment.conf <<EOF
   Environment='FYDE_REDIS_HOST=<specify redis host ip or dns>'
   Environment='FYDE_REDIS_PORT=<specify redis port, defaults for 6379 if not included>'
   EOF"

9. Reload and start CloudGen Access Proxy Orchestrator daemon.

   sudo systemctl --system daemon-reload
   sudo systemctl start fydeproxy

10. Configure the firewall (if enabled).

    sudo firewall-cmd --zone=public --add-port="<replace with the corresponding CloudGen Access Proxy port, as configured in CloudGen Access Enterprise Console>/tcp" --permanent
    sudo firewall-cmd --reload

Upgrading CloudGen Access Proxy

To upgrade your CloudGen Access Proxy to the latest version, execute one of the following.

For Debian/Ubuntu:

sudo apt upgrade fydeproxy envoy

For CentOS/RHELL:

 sudo yum upgrade fydeproxy envoy

Troubleshooting

See Troubleshooting the CloudGen Access Proxy in Barracuda Campus.