Connecting to CipherTrust Manager through a Proxy Server

You can configure a CTE client to communicate with a CipherTrust Manager through a proxy agent. This would be useful for isolating the CTE clients from the internet because a single proxy system can act as a gateway between the CTE clients and the remote CipherTrust Manager.

Only simple HTTP proxy servers are supported with this release, using the HTTP CONNECT request method.

Defining a CipherTrust Manager proxy for CTE

To prevent any issues with existing proxy configurations, the CTE client only accepts a proxy definition in the following format:

    CTE_CM_PROXY=<proxy definition>

Example

    CTE_CM_PROXY=proxy-usa.thales.com:8080

Content of Proxy definition

The proxy definition requires a minimum of two fields, and may also contain additional authorization fields if basic access authentication is required by the proxy server.

• See Basic access authentication for more information.

Required fields:

• Proxy host name or IP address, for example:

  • Host name: myproxy.datacenter.net

  • IP address IPv4: 192.168.0.1

  • IP address IPv6: [fe80::b47c:38cf:5635:766e]

• Proxy host port number, for example:

  • Port number must be between 1 and 65535

• Hostname/IP address and Port number must be separated using a colon, for example:

  • 10.0.0.1:9999

  • [fe80::b47c:38cf:5635:766e]:8080

• Optional fields are for basic authentication, and contain a username and password, separated by a colon, for example: proxyuser:secret. This combined value is added at the start of the proxy definition, separated from the host name using an the @ sign, for example:

  CTE_CM_PROXY=proxyuser:secret@10.0.0.1:9999
  

Windows Systems

To provide the proxy definition:

1. Click Search in the task bar.

2. Type: Environment Variables.

3. Click Advanced > Environment variables.

4. In the System Variables field, click New.

5. For Variable Name, type: CTE_CM_PROXY

6. For Variable Value, type the appropriate definition.

Linux and AIX Systems

To provide the proxy definition:

• Define the proxy with an environment variable before installation and/or registration, for example:

  export CTE_CM_PROXY=10.0.0.1:9999
  

• When installing and/or registering using silent mode, define the proxy using an entry in the silent control file, for example:

  CTE_CM_PROXY=10.0.0.1:9999
  

• Define the proxy using a configuration file named cm_proxy.cfg located here:

  • CTE: /etc/vormetric

  • CTE-U: /etc/cte

  This file is created, if required, during registration, and used subsequently by the vmd and vmutil programs.

Changing the proxy definition

If you need to modify an existing proxy setup:

1. Update/delete the controlling variable:

   • Windows: Change/remove the environment variable on a Windows systems

   • Linux/AIX: Update/remove the cm_proxy.cfg file content on Linux and AIX systems.

2. Linux: Restart the vmd service.

   Windows: Restart the Thales etray application.

Using CTE with a Proxy

Once you have defined the proxy, normal CTE operations such as registration, or browsing from the CipherTrust Manager, continue as normal. For example, when registering, provide the CipherTrust Manager address as you would when no proxy is in use.

When CTE connects to a CipherTrust Manager, all connections are established through the proxy server. This is true for any type of connection: single node, cluster member, load balancer, etc. This occurs when the vmd service connects to a CipherTrust Manager node, cluster member, or load balancer, and when CTE uploads log files to CipherTrust Manager. If you monitor the traffic on the proxy server, all you will see are HTTP CONNECT messages with the target CipherTrust Manager address in the message, for example:

CONNECT 10.171.47.14:443 HTTP/1.1

The content of any of the following messages cannot be seen by the proxy server since they are TLS encoded. The proxy server acts as a transparent tunnel to all such traffic.

Agenthealth (Linux and AIX only)

When the agenthealth script run, the proxy configurations is checked, and displays in the output as in the following example:

VMD is running ................................... OK
SECFSD is running ................................ OK
Checking proxy setup ............................. OK
Proxy 10.171.4.2:9999 reachable .................. OK
10.171.37.226 port 443 reachable via proxy ....... OK
10.171.44.239 port 443 reachable via proxy ....... OK
10.171.47.14 port 443 reachable via proxy ........ OK
10.171.39.126 port 443 reachable via proxy ....... OK
Can communicate to at least one server ........... OK
Time of last update from server .................. 2025-07-25 03:56:24.148

AgentInfo

• Linux or AIX: When the agentinfoscript is run on Linux or AIX, the content of any cm_proxy.cfg file is captured.

• Windows: Examine the environment variable, CTE_CM_PROXY, through any command line window.

Validating a Proxy Definition

You can use the check_host utility to perform parsing and validation of a provided proxy definition, and to output the component fields. The full syntax of the command allows any URL components to be extracted, but for proxy validation only the host name, port, user name, and password fields are relevant. These are selected using the flags h, p, u, and w. For example:

Example 1

agent/vmd/bin/check_host -f hpuw -u proxyuser:secret@testproxy.com:9999

Response

USER=proxyuser
PASSWORD=secret
HOST=testproxy.com
PORT=9999

Example 2

agent/vmd/bin/check_host -f hpuw -u testproxy.com:9999

Response

HOST=testproxy.com
PORT=9999

Example 2 shows that the optional fields can be omitted. However, any valid, but unwanted fields, or invalid fields, generate error, for example:

Example 1

agent/vmd/bin/check_host -f hpuw -u testproxy.com:9999/test

Response

Invalid URL testproxy.com:9999/test : Path in url not expected

Example 2

agent/vmd/bin/check_host -f hpuw -u testproxy.com:

Response

Invalid URL testproxy.com: Port number was not a decimal number between 0 and 65535

Ensuring that all required fields are output is the users responsibility. For example, the following is valid but not usable as there was no PORT in the output:

agent/vmd/bin/check_host -f hpuw -u testproxy.com

Response

HOST=testproxy.com