Additional Topics on

Memory Usage of the AP Python

Mon, 01 Jan 0001 00:00:00 +0000

The memory used for the different policy sizes using a sample python application is described in this section.

Sample application

The following is a sample python application.

from appython import Protector
if __name__ == "__main__":

 # Initialize the protector
 protector = Protector()

 # Create session with policy user
 session = protector.create_session("USER1")

 # Protect operation
 p_out = session.protect("Protegrity1", "TE_AN_SLT13_L0R0_N")
 print("Protected Data: %s" %p_out)

 # Reprotect operation
 r_out = session.reprotect(p_out, "TE_AN_SLT13_L0R0_N", "TE_AN_SLT13_L0R0_N")
 print("Reprotected Data: %s" %r_out)

 # Unprotect operation
 org = session.unprotect(r_out, "TE_AN_SLT13_L0R0_N")
 print("Unprotected Data: %s" %org)

Expected memory usage

The process to find the policy size and expected memory usage for different policy sizes used by the python application is described in this section.

Setting Up AP Python on Linux in a Development Environment

Mon, 01 Jan 0001 00:00:00 +0000

The steps to set up the AP Python on a Linux platform in a development environment are described in the section.

Verifying prerequisites

Ensure that the following prerequisites are met:

Python 3, version from 3.7 to 3.11, must be installed on the machine.
Latest version of pip, the Python package manager, must be installed.

Extracting the AP Python installation package

To set up the AP Python on the Linux platform in development environment.

DevOps Approach for Application Protector Python

Mon, 01 Jan 0001 00:00:00 +0000

The DevOps approach enables immutable package deployment. It uses a REST API call to download packages from the ESA in an encrypted format.

Note: The RP Agent should not be installed for immutable package deployments using DevOps.

For more information about package deployment approaches, refer to Resilient Package Deployment.

A REST API call is used to download the package on your local machine. Configure the package path in the config.ini file within the DevOps section and the decryptor class.

Application Protector API Return Codes

Mon, 01 Jan 0001 00:00:00 +0000

When an application is developed using the APIs of the Protegrity Application Protector Suite, you may encounter the Application Protector API Return Codes. For more information about log return codes, refer to Log return codes.

Sample Log for AP Return Codes

The following is a sample log generated in Discover on the Audit Store Dashboards in the ESA.

Protection audit logs are stored in the Audit Store. Select the pty_insight_*audit* index to view the protection logs.

Config.ini file for Application Protector

Mon, 01 Jan 0001 00:00:00 +0000

The Application Protector can be configured using the config.ini file. By default, this file is located in the <installation directory>/sdk/<protector>/data/ directory.

The various configurations required for setting up the Application Protector are described in this section.

Sample config.ini file

The following represents a sample config.ini file.

# -----------------------------
# Protector configuration
# ----------------------------- 
[protector]

# Cadence determines how often the protector connects with shared memory to fetch the policy updates in background.
# Default is 60 seconds. So by default, every 60 seconds protector tries to fetch the policy updates.
#
# Default 60.
cadence = 60

# The time during which an session object is valid. Default = 15 minutes.
session.sessiontimeout = 15

###############################################################################
# Log Provider Config
###############################################################################
[log]

# In case that connection to fluent-bit is lost, set how audits/logs are handled
# 
# drop : (default) Protector throws logs away if connection to the fluentbit is lost
# error : Protector returns error without protecting/unprotecting 
# data if connection to the fluentbit is lost
mode = drop

# Host/IP to fluent-bit where audits/logs will be forwarded from the protector
#
# Default localhost
host = localhost

Different configurations for Application Protector

The following are the various configurations:

Multi-node Application Protector Architecture

Mon, 01 Jan 0001 00:00:00 +0000

The multi-node Application Protector (AP) architecture, its individual components, and how logs are collected using the Log Forwarder are described in this section.

The following figure describes the multi-node AP architecture.

For example, some AP nodes are connected to an ESA, which includes the Audit Store component. Each AP node contains a Log Forwarder, RP Agent, and AP instance for sending logs to the ESA.

Protector: The AP can be configured using the config.ini file.
For more information about the configurations, refer to Config.ini file for Application Protector.

Uninstalling the Application Protector

Mon, 01 Jan 0001 00:00:00 +0000

Uninstalling Application Protector (AP) Python from Linux in Production Environment

The steps to uninstall the different components of the AP Python in production environment are described in this section.

Uninstalling the Log Forwarder from Linux

To preserve all the configurations while upgrading the Log Forwarder, ensure that all the files present under the /opt/protegrity/logforwarder/data/config.d directory are backed up.

To uninstall the Log Forwarder from a Linux platform:

Navigate to the /opt/protegrity/logforwarder/bin directory.