How to download a file from the RSA sftp website directly to a NetWitness appliance?

[#1]

Article Number

000039776

Applies To

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 11.x
Platform: CentOS
O/S Version: 7

Issue

Want to download a file directly to the NetWitness appliance from the RSA sftp website, sftp.rsa.com

This may be because it will be quicker, or it is not possible to download the file to a PC and then WinSCP the file to the NetWitness appliance.

Resolution

• In order to download a file directly from the RSA sftp website, sftp.rsa.com to a NetWitness appliance, the appliance needs access to the internet.

The following test from the NetWitness appliance can confirm if the RSA sftp website, sftp.rsa.com can be reached.
 

[root@NW ~]# nc -zv --ssl sftp.rsa.com 443
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: SSL connection to 216.162.240.155:443. Dell
Ncat: SHA-1 fingerprint: 1EB6 CFB9 A355 F5E6 BB0A 0E04 D83B 36B5 08D4 1353
Ncat: 0 bytes sent, 0 bytes received in 0.87 seconds.

Where the above output is an example of a good connection result.
Whilst getting a "Connection timed out" output is a sftp.rsa.com site unreachable response.
 

• Downloading a file from the RSA sftp website, sftp.rsa.com requires the File ID of the file to be downloaded.

Obtain the File ID of the file which is on the RSA sftp website from RSA Customer Support.

Example File ID from the RSA sftp website.

Image description
 

• From the NetWitness appliance, run the following command to download the file from the RSA sftp website.

read -p 'File ID: ' ID; wget --content-disposition "https://sftp.rsa.com/human.aspx?Username=support&password=Password1&arg12=downloaddirect&transaction=signon&quiet=true&arg01=${ID}"

Enter the File ID number when asked.

For example,
 

[root@NW ~]# read -p 'File ID: ' ID; wget --content-disposition "https://sftp.rsa.com/human.aspx?Username=support&password=Password1&arg12=downloaddirect&transaction=signon&quiet=true&arg01=${ID}"
File ID: 713382253
--2021-06-28 00:35:15--  https://sftp.rsa.com/human.aspx?Username=support&password=Password1&arg12=downloaddirect&transaction=signon&quiet=true&arg01=713382253
Resolving sftp.rsa.com (sftp.rsa.com)... 216.162.240.155
Connecting to sftp.rsa.com (sftp.rsa.com)|216.162.240.155|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: /MOVEitDownload/arg01=713382253!arg02=31!arg03=[OriginalFilename]!arg04=0!noattch=1/ [following]
Warning: wildcards not supported in HTTP.
--2021-06-28 00:35:17--  https://sftp.rsa.com/MOVEitDownload/arg01=713382253!arg02=31!arg03=[OriginalFilename]!arg04=0!noattch=1/
Reusing existing connection to sftp.rsa.com:443.
HTTP request sent, awaiting response... 302 Found
Location: /MOVEitISAPI/MOVEitISAPI.310/action=hu_downld!parm=e1544157341827165828!NoAttach=1/rsa-nw-11.5.0.0.15521-x86_64.ova [following]
--2021-06-28 00:35:17--  https://sftp.rsa.com/MOVEitISAPI/MOVEitISAPI.310/action=hu_downld!parm=e1544157341827165828!NoAttach=1/rsa-nw-11.5.0.0.15521-x86_64.ova
Reusing existing connection to sftp.rsa.com:443.
HTTP request sent, awaiting response... 200 OK
Length: 585741824 (559M) [application/octet-stream]
Saving to: ‘rsa-nw-11.5.0.0.15521-x86_64.ova’

100%[========================================================================================================================================>] 585,741,824  672KB/s   in 18m 6s

2021-06-28 00:53:23 (527 KB/s) - ‘rsa-nw-11.5.0.0.15521-x86_64.ova’ saved [585741824/585741824]

 

• If using a proxy is required for the NetWitness appliance to access the internet then modify the above wget command using the following format.

https_proxy=http://username:password@proxy_host:proxy_port wget https://fileurl

Reference: NwHost Update failing due to proxy settings