Sensor Proxies

Required Tenable Security Center User Role: Administrator

The Sensor Proxies page contains a list of all Sensor Proxy instances linked to Tenable Security Center.

Tenable Sensor Proxy provides an on-premises cache and single point of traffic between your sensors and Tenable Security Center. You must link a Sensor Proxy to Tenable Security Center before you can link a Tenable Nessus scanner to the Sensory Proxy. For more information about Sensor Proxy, see the Tenable Sensor Proxy User Guide.

For information about linked scanning in Tenable Security Center, see Linked Scanning Overview.

Before you begin:

  • Confirm that the Sensor Proxy server is a separate server from your Tenable Security Center server.

  • Confirm that the Sensor Proxy server can reach your Tenable Security Center server on TCP port 8837.

  • Confirm that the Tenable Security Center certificate includes the hostname or IP address you plan to use with the -host parameter as a Subject Alternative Name (SAN). Sensor Proxy validates the certificate against the -host value and rejects the link if there is no match.

    Note: In (Undefined variable: Tenable.Enclave Security) deployments, the auto-generated Tenable Security Center certificate on port 8837 may only include internal cluster names. If you are connecting via an external hostname, regenerate the certificate before continuing. On the Tenable Security Center server, run:

    /opt/sc/support/bin/php /opt/sc/src/tools/installSSLCertificate.php -h <external_hostname_or_ip>

    Then restart Tenable Security Center:

    /scbase/SC.sh stop

    /scbase/SC.sh start

    After the restart, copy the updated TenableCA.crt to the Sensor Proxy server before proceeding.

  • Confirm that your Sensor Proxy is version 1.1.0 or later. To check the version, run /opt/sensor_proxy/sbin/sidecar -version. If you have version 1.0.11 or earlier, download and upgrade to the latest Sensor Proxy RPM from the Tenable Downloads site before you continue.

To link a Sensor Proxy to Tenable Security Center:

  1. With root privileges on your Tenable Security Center server, run the following command to copy the Tenable Security Center certificate to /root on your Sensor Proxy server:

    Copy 
    scp /opt/sc/data/CA/TenableCA.crt root@<ip_address_of_Sensor_Proxy_server>:/root

  2. Log in to Tenable Security Center as an administrator.

  3. Navigate to Resources > Sensor Proxies.

    The Sensor Proxies page appears.

  4. At the top of the table, click + Add.

  5. Copy the linking key.

  6. Run the following command with root privileges on the Sensor Proxy server.

    Copy 
    /opt/sensor_proxy/sbin/configure -link -key=<linking_key>
    -host=<ip_address_of_Security_Center_server> -port=8837
    -ca-path=/root/TenableCA.crt [-name=<Sensor_Proxy_name>]

    • Replace <linking_key> with the key you copied in step 5.

    • Replace <ip_address_of_Security_Center_server> with the hostname or IP address of your Tenable Security Center server. The value must match a Subject Alternative Name (SAN) in the Tenable Security Center certificate on port 8837. Sensor Proxy rejects the link if the value does not match.

    • You can use the optional -name parameter to change the name of the Sensor Proxy listing in Tenable Security Center. If your custom name includes spaces, you must enclose the name in quotation marks.

      If you do not specify the -name parameter, the name of the Sensor Proxy appears as "Sensor Proxy" in Tenable Security Center. You can change the name later.

    For example:

    [root@sp ~]# /opt/sensor_proxy/sbin/configure -link

    -key=b421118229f81c38d1fbdb3bb94f9fdd08c5a27fe2e14de764b299697b686868

    -host=10.1.2.3 -port=8837 -ca-path=/root/TenableCA.crt -name="SP 1"

    [info] [link] Linked successfully to 10.1.2.3:8837

  7. Run the following command with root privileges to enable and start the Sensor Proxy service:

    Copy 
    # systemctl enable --now sensorproxy

What to do next: