Introduction

The Corelight Software Sensor installation guide assumes direct internet connectivity when downloading packages and dependencies. In environments where outbound traffic is routed through an enterprise proxy, additional configuration is required for package managers, Docker, Git, Python, and other installation components.

This guide supplements the official Corelight Software Sensor installation documentation by highlighting the additional proxy configuration required for a successful deployment.

Note: The examples in this guide were validated on Red Hat Enterprise Linux (RHEL) 8.8. They are intended to supplement, not replace, the official Corelight installation guide.

Configure the Corelight Package Repository

Download the Repository Installation Script

Instead of executing the installation script directly, download it first so it can be modified if necessary.

curl --proxy http://proxy:port -O https://packages.corelight.com/install/repositories/corelight/stable/script.rpm.sh

Modify the Repository Installation Script

Depending on your environment, you may need to add proxy support to the curl command contained within the script.

Edit the script:

vim script.rpm.sh

Modify the repository download command:

curl --proxy "http://proxy:port" -sSf "${yum_repo_config_url}" > $yum_repo_path

Install Missing Dependencies

If package installation fails because dependencies cannot be downloaded through the proxy, manually install the required repositories and packages.

Example:

subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms

dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

yum install gpgme

Note: During testing, gpgme required manual installation after enabling the EPEL repository.

Complete the Repository Installation

chmod +x script.rpm.sh

./script.rpm.sh

Configure YUM for Proxy Access

Edit the YUM configuration:

vim /etc/yum.conf

Example configuration:

proxy=http://proxy:port
no_proxy=*.domain

Configure Suricata Update

Configure the required proxy environment variables before installing suricata-update.

export http_proxy=http://proxy:port
export https_proxy=http://proxy:port

pip3 install --proxy http://proxy:port suricata-update

Configure Docker and Grafana

Add the Docker repository:

yum-config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo

Modify the Docker repository if required:

vim /etc/yum.repos.d/docker-ce.repo

Install Docker:

yum install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin --allowerasing

Configure the Docker service to use the proxy:

vim /usr/lib/systemd/system/docker.service

Add:

Environment="HTTP_PROXY=http://proxy:port"

Install Docker Compose:

pip3 install --proxy http://proxy:port --upgrade --ignore-installed pip setuptools

pip3 install --proxy http://proxy:port docker-compose

Configure Git:

git config --global http.proxy http://proxy:port

Configure Docker Compose

Add proxy environment variables to the docker-compose.yml file.

Example:

prometheus:
  environment:
    http_proxy: http://proxy:port
    https_proxy: http://proxy:port
    no_proxy: "*.domain"

grafana:
  environment:
    http_proxy: http://proxy:port
    https_proxy: http://proxy:port
    no_proxy: "*.domain"

Configure Docker Client Proxy Settings

Create or edit:

~/.docker/config.json

Example:

{
  "proxies": {
    "default": {
      "httpProxy": "http://proxy:port",
      "httpsProxy": "http://proxy:port",
      "noProxy": "*.domain"
    }
  }
}

Configure System-Wide Proxy Variables

Create:

/etc/profile.d/http_proxy.sh

Example:

export HTTP_PROXY=http://proxy:port
export HTTPS_PROXY=http://proxy:port
export NO_PROXY=*.domain

Known Issues

At the time of testing, Grafana was accessible on TCP port 3000 after applying the proxy configuration. Access to the Corelight service on TCP port 8989 remained under investigation.