vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The subsequent description presents an overview of the features that are implemented for the Ubuntu OS offered with Hyper Protect Virtual Servers.

As part of the hardening, IBM installed and configured AIDE (Advanced Intrusion Detection Environment), which is a file and directory integrity checker. With the implemented configuration, AIDE is run as a cron job every 5 minutes while the server is running.

The firewall allows all outgoing TCP, UDP, and ICMP traffic. Incoming traffic is only accepted on ports 22 (the TCP port) and with protocol ICMP.

For firewall configurations based on IPtables, IBM provided an systemd-service, which is located within /usr/lib/systemd/system/iptables.service and added to the multi-user target.

To adjust the firewall, configure your IPtables and override the existing configuration file by using the following command:

iptables-save > /etc/iptables/iptables.conf

It is in your responsibility to configure the firewall correctly and to protect your network traffic. Configure the firewall as restrictively as possible to secure your virtual server and data. For example, ensure that your network traffic is encrypted and limit port access for the network interface.

The following commands open the firewall for incoming traffic on a specified protocol and port:

iptables -A INPUT -p <protocol> --dport <port> -mstate --state NEW -j ACCEPT

To make the configuration persistent, save your changes as described. Otherwise, all configuration updates are lost after a restart.

Another part of the hardening is that the server is configured in such a way that the password expires after 90 days. After your password expires, you have 30 days to change it. If you don't change your password within the 30 days, your account becomes inactive and it is no longer possible to log in with SSH even if you are using SSH-keys. This restriction also includes system-accounts, for example, accounts created by using the command, useradd --system.



 Monitoring a virtual server 

It is best practice to:
* Each customer receives unlimited SSL VPN connections to IBM's private network. These connections can be established by clicking the VPN link at the top of the page while logged in to the Cloud Catalog console.
* IBM Cloud also offers a basic multi-tenant IPsec VPN service.
* The FortiGate Security Appliance 1 Gbps provides SSL and IPsec VPN options with Public network access only (no access to the IBM Cloud private network).
* The Network Gateway provides SSL, IPsec, and OpenVPN capabilities on the public or private network.
* The NetScaler products can provide SSL and IPsec VPN on the public or private network.
* Customers can also deploy a VPN solution on to a server within their IBM Cloud environment.



* When I select the High Availability option, what steps do I have to take to leverage this feature?

None. When ordered in HA, IBM Cloud automatically provisions the appliances in HA configuration. If the primary device fails, a secondary passive device takes over as the primary active instance and begin passing traffic. While this failover is typically automatic, it is best practice to monitor servers and ensure that traffic is being passed successfully.
* Which firewall products support public-to-private NAT and/or private VLAN segmentation?

None of the Hardware Firewall products have access to the private network. A Network Gateway is required to supply these capabilities inline and the NetScaler products have access to both the public and private networks.
* What are the default DNS servers of FortiGate 1 Gbps?

By default, FortiGate 1 Gbps uses the following FortiGuard DNS servers:



* Primary: 208.91.112.53
* Secondary: 208.91.112.52





FortiGate Security Appliance 10 Gbps



* What is the difference between FortiGate Security Appliance (FSA) 10 Gbps and FSA 1 Gbps? What about Virtual Router Appliance?

FSA 10 Gbps provides faster throughput compared to FSA 1 Gbps. It allows the customer to protect multiple VLANs (both private and public).
Non-disruptive changes
: Fixes GNU binary utilities (binutils) vulnerabilities - [CVE-2018-6543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6543) - [CVE-2018-6759](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6759) - [CVE-2018-6872](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6872) - [CVE-2018-7208](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7208) - [CVE-2018-7568](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7568) - [CVE-2018-7569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7569) - [CVE-2018-7570](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7570) - [CVE-2018-7642](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7642) - [CVE-2018-7643](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7643) - [CVE-2018-8945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8945)

Disruptive
: None





 09 August 2019
VRVDR-44634 8.8 DSA-4349-1 CVE-2017-11613, CVE-2017-17095, CVE-2018- 10963, CVE-2018-15209, CVE-2018-16335, CVE- 2018-17101, CVE-2018-18557, CVE-2018-5784, CVE-2018-7456, CVE-2018-8905:Debian DSA-4349- 1 : tiff - security update 
 VRVDR-44633 7.5 DSA-4348-1 CVE-2018-0732, CVE-2018-0734, CVE-2018-0735, CVE-2018-0737, CVE-2018-5407: Debian DSA-4348- 1 : openssl - security update 
 VRVDR-44611 9.8 DSA-4347-1 CVE-2018-18311, CVE-2018-18312, CVE-2018- 18313, CVE-2018-18314: Debian DSA-4347-1 : perl - security update 
 VRVDR-44348 9.8 DSA-4338-1 CVE-2018-10839, CVE-2018-17962, CVE-2018- 17963: Debian DSA-4338-1: qemu security update 
 VRVDR-43264 5.6 DSA-4274-1 CVE-2018-3620, CVE-2018-3646: Debian DSA-4274- 1: xen security update 









 1801u 



 Issues Resolved 



Issues resolved for 1801u

 Issue Number Priority Summary 

 VRVDR-44406 Critical With multiple subnet on same VIF low rate of transit traffic observed when compared to 5400 performance 
 VRVDR-44253 Minor MSS clamping on bonding interface stops functioning after reboot 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801u

 Issue Number CVSS score Advisory Summary
Replace the variables in the example request according to the following table.





Table 1. Describes the variables that are needed to view a dual authorization policy for a key with the Key Protect API.

 Variable Description 

 keyID_or_alias Required. The unique identifier or alias for the key that has an existing rotation policy. 
 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM Token, including the Bearer value, in the curl request. <br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. <br> <br>For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 



A successful request returns dual authorization policy details that are associated with your key. The following JSON object shows an example response for a key that has an existing dual authorization policy.

{
"metadata": {
"collectionTotal": 1,
"collectionType": "application/vnd.ibm.kms.policy+json"
},
"resources": [
{
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
When a regional disaster occurs, you can use failover crypto units to ensure production workloads and avoid data loss.

Currently, failover crypto units are available only in the region of Dallas (us-south) and Washington DC (us-east). If you create your instance in either of the two regions, you can choose whether to enable the failover crypto units with [extra charges](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-pricing).

For more information about the Hyper Protect Crypto Services components, see [Components and concepts](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-concepts).





 Hyper Protect Crypto Services workload isolation 

Hyper Protect Crypto Services is a single-tenant, regional service that supports complete tenant-based workload isolation with the following characteristics:



* Dedicated keystore in Hyper Protect Crypto Services is provided to ensure data isolation and security.
* You have exclusive control to your hardware security module (HSM) and your master key. Privileged users are locked out for protection against abusive use of system administrator credentials or root user credentials.
* [Secure Service Container (SSC)](https://www.ibm.com/marketplace/secure-service-container) provides the enterprise level of security and impregnability that enterprise customers expect from [IBM LinuxONE](https://www.ibm.com/it-infrastructure/linuxone) technology.



The following diagram illustrates how Hyper Protect Crypto Services workload of each tenant is isolated.

Zoom

![Hyper Protect Crypto Services workload isolation](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/architecture-workload-isolation.svg)

Figure 2. Hyper Protect Crypto Services workload isolation





 Service dependencies 

Hyper Protect Crypto Services has dependencies on the following IBM Cloud services:
Dual region Disaster Recovery design 

The design uses the following structure:



* Network
* vCenter
* VMware NSX® Manager
* Caveonix RiskForesight™
* VMware Aria Operations™ for Logs
* VMware Aria Operations™ for Networks
* VMware Aria® Operations™ Manager
* AD/DNS/NTP
* Veeam®
* KMIP for VMware®
* Hyper Protect Crypto Service





 Network design 

As the design uses two VMware Regulated Workloads instances, the network design is at each region and is documented at [Underlay networking](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-underlay-network) and [Overlay networking](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-overlay-network).

The key design element at the network level is the adoption of cross-region network for the use of the VMware Aria Operations Manager analytic cluster. The cross-region network is a layer 3 construct that allows the use of the same IP subnet space at either the protected region or the recovery region. In normal operations, the cross-region network is tethered to the vSRX or FortiGate in the protected region that is, the default gateway for this network is the vSRX or FortiGate. The protected region vSRX or FortiGate then advertises this network so that it is reachable from other networks. In recovery operations, the cross-region network is tethered to the vSRX or FortiGate in the recovery region. The recovery region vSRX or FortiGate then advertises this network so that it is reachable from other networks. The use of the cross-region network allows the VMware Aria Operations Manager Analytic cluster to retain the same IP addresses when they are recovered to the recovery region.

Review the following network design decisions:



* The IBM Cloud® classic network environment does not allow the stretching of VLANs across data centers. Therefore, this design does not use stretched VLANs at the physical network infrastructure level.
https://nvd.nist.gov/vuln/detail/CVE-2020-8285), [CVE-2020-8286](https://nvd.nist.gov/vuln/detail/CVE-2020-8286), [CVE-2016-10228](https://nvd.nist.gov/vuln/detail/CVE-2016-10228), [CVE-2019-25013](https://nvd.nist.gov/vuln/detail/CVE-2019-25013), [CVE-2019-9169](https://nvd.nist.gov/vuln/detail/CVE-2019-9169), [CVE-2020-27618](https://nvd.nist.gov/vuln/detail/CVE-2020-27618), [CVE-2021-3326](https://nvd.nist.gov/vuln/detail/CVE-2021-3326), [CVE-2020-26116](https://nvd.nist.gov/vuln/detail/CVE-2020-26116), [CVE-2020-27619](https://nvd.nist.gov/vuln/detail/CVE-2020-27619), [CVE-2021-23336](https://nvd.nist.gov/vuln/detail/CVE-2021-23336), [CVE
20a_20preferred_20cipher_20suite_20for_20your_20HTTPS_20application_20_7C_20IBM_20Cloud_20Docs_p_https_3A_2F_2Fcloud.ibm.com_2Fdocs_2Floadbalancer-service_3Ftopic_3Dloadbalancer-service-choosing-a-preferred-cipher-suite-for-your-https-application_r_lt_764_evt_pageLoad_sv_1_rn_797259](https://bat.bing.com/action/0?ti=146001191&Ver=2&mid=9643ccda-1ae4-4e3f-9c88-29293bed697b&sid=cca51480229211eeac887b94c5a6c542&vid=cca50460229211ee874f7dc32b9b9a8d&vids=0&msclkid=N&pi=918639831&lg=en-US&sw=3840&sh=2160&sc=30&nwd=1&tl=Choosing%20a%20preferred%20cipher%20suite%20for%20your%20HTTPS%20application%20%7C%20IBM%20Cloud%20Docs&p=https%3A%2F%2Fcloud.ibm.com%2Fdocs%2Floadbalancer-service%3Ftopic%3Dloadbalancer-service-choosing-a-preferred-cipher-suite-for-your-https-application&r=&lt=764&evt=pageLoad&sv=1&rn=797259)
However, they have the following major differences:



* EP11 is built to allow high availability and scalability by design.
* EP11 is a stateless protocol, whereas PKCS #11 is stateful. The stateless design of EP11 allows for the use of external keystores as well as scaling to multiple backends.
* EP11 over gRPC (GREP11) defines a network protocol that can be directly used in cloud applications.



For more information, see

[Comparing the PKCS #11 API with the GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-cloud-hsmcompare-grep11-pkcs11).





 What EP11 mechanisms are supported by the GREP11 functions? 

Mechanisms can vary depending on the level of firmware in the crypto card, see [Supported mechanisms](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-refgrep11-mechanism-list). For more information about the EP11 mechanisms, see the

[IBM 4768 Enterprise PKCS #11 (EP11) Library structure guide](https://www.ibm.com/security/cryptocards/pciecc3/library) and

[IBM 4769 Enterprise PKCS #11 (EP11) Library structure guide](https://www.ibm.com/security/cryptocards/pciecc4/library).





 What compliance standards does Hyper Protect Crypto Services meet? 

Hyper Protect Crypto Services meets controls for global, industry, and regional compliance standards, such as GDPR, HIPAA, and ISO. As the HSM used by Hyper Protect Crypto Services, the IBM 4768 or IBM 4769 crypto card is also certified with Common Criteria EAL4 and FIPS 140-2 Level 4. For more information, see [Security and compliance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliance).





 Can I monitor my service instance?
2020-8231](https://nvd.nist.gov/vuln/detail/CVE-2020-8231), [CVE-2020-8284](https://nvd.nist.gov/vuln/detail/CVE-2020-8284), [CVE-2020-8285](https://nvd.nist.gov/vuln/detail/CVE-2020-8285), [CVE-2020-8286](https://nvd.nist.gov/vuln/detail/CVE-2020-8286), [CVE-2020-24330](https://nvd.nist.gov/vuln/detail/CVE-2020-24330), [CVE-2020-24331](https://nvd.nist.gov/vuln/detail/CVE-2020-24331), [CVE-2020-24332](https://nvd.nist.gov/vuln/detail/CVE-2020-24332), [CVE-2020-29361](https://nvd.nist.gov/vuln/detail/CVE-2020-29361), [CVE-2020-29362](https://nvd.nist.gov/vuln/detail/CVE-2020-29362), [CVE-
(5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 Next steps 



* [Accessing external resources from the Satellite location](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-connectivity-to-external)
(5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 Next steps 



* [Application provider connectivity to management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management)
: Hyper Protect Crypto Services now supports loading master key parts and signature keys from smart cards for service instance initialization. It ensures the highest level of protection for master key parts and signature keys.

The Management Utilities are two applications that use smart cards to configure service instances. The Smart Card Utility Program sets up and manages the smart cards used. The Trusted Key Entry (TKE) application uses those smart cards to configure service instances. To use the Management Utilities, you need to order IBM-supported smart cards and smart card readers.

For more information, see [Understanding the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeunderstand-management-utilities) and [Initializing service instances by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities).

Updated: IBM Cloud service integration
: Hyper Protect Crypto Services can now be integrated with more IBM Cloud services:



* Hyper Protect DBaaS for MongoDB
* Hyper Protect DBaaS for PostgreSQL
* HyTrust DataControl
* IBM Cloud Kubernetes Service
* Red Hat OpenShift on IBM Cloud



For more information, see [Integrating services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).





 31 August 2019 

Added: Hyper Protect Crypto Services adds support for private endpoints
: You can now connect to Hyper Protect Crypto Services over the IBM Cloud private network by targeting a private endpoint for the service.

To get started, enable [virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) for your infrastructure account. For more information, see [Using service endpoints to privately connect to Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connection).
System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 Next steps 



* [Connectivity to IBM Cloud services with private endpoints](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-to-services)
Regions and endpoints 

Review region and connectivity options for interacting with IBM® Key Protect.



 Available regions 

Key Protect is available in the following regions (borders and geographic features in the illustration are artistic representations):

Zoom

![Regions where the Key Protect service is available.](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/key-protect/images/world-map.svg)

Figure 1. Displays the regions where you can create and manage Key Protect resources.

You can create Key Protect resources in one of the supported IBM Cloud regions, which represent the geographic area where your Key Protect requests are handled and processed. To learn more, see [Locations, tenancy, and availability](https://cloud.ibm.com/docs/key-protect?topic=key-protect-ha-dravailability).





 Connectivity options 

Key Protect offers two connectivity options for interacting with its service APIs.



 Public endpoints 

By default, you can connect to resources in your account over the IBM Cloud public network. Your data is encrypted in transit by using supported ciphers of the Transport Security Layer (TLS) 1.2 and 1.3 protocol. For more information about TLS and these ciphers, check out [Data encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-security-and-compliancedata-security).





 Private endpoints 

For added benefits, you can also enable [virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) for your infrastructure account.

When you enable VRF for your account, you can connect to Key Protect by using a private IP that is accessible only through the IBM Cloud private network.
Currently, Key Protect supports user-owned on-prem Satellite locations associated with the IBM Cloud us-east region only. In this tutorial, to reduce network latency, we create other IBM Cloud services needed also in the us-east region.



* Read through the [About Key Protect on Satellite](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-about) to understand the products and restrictions.
* [Create an on-prem Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-locations) in us-east.
* [Create an IBM Cloud Database for PostgreSQL instance](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-satellite-on-prem) in us-east and deploy it in your Satellite location.
* [Set up two on-prem HSMs](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-hsm-deploy) to work with Key Protect and gather the [information needed](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-hsm-deploysatellite-hsm-ui-values) for Key Protect on Satellite.
* [Create an IBM Cloud Activity Tracker instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-aboutsatellite-about-before-begin-activity) in us-east for activity logging. You also need to pass the ingestion key to Key Protect during the deployment.
* [Create a Hyper Protect Crypto Services with Unified Key Orchestrator instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision&interface=uiprovision-uko) in us-east and [initialize the service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-initialize-instance-mode).







 Task flow 

To complete this solution, let's walk through the following steps:



1.