Skip to main content

Core, SAST, DAST and SCA on separate servers

Video walkthrough: Install DerScanner on a Remote Server from the DerSecur Control Panel (YouTube).

Core and scanner deployment diagram.

Core and scanner deployment diagram.

Purpose and starting point​

Keep Core on the main server and deploy scanners on separate servers. Core provides the web interface, API, task queue and database. Installing another complete DerScanner creates an independent main server; it does not add an agent to the existing Core.

The main server must already run. Prepare new servers without DerScanner, SSH access and sufficient resources for their modules. The SSH user must be root or have passwordless sudo. Scanner servers must reach the main server's task queue on TCP 61616. Restrict access to that queue to the scanner server addresses.

Add a server​

  1. Open Advanced settings → Servers → Add a remote server.
  2. Complete Name (optional), Address, SSH port, User, Sign-in and Product directory. The directory must be an absolute path on the remote server. For Key sign-in, paste Private key or select Key file on your computer. For Password sign-in, enter Password. Passphrase-protected keys are not supported.
  3. Select Save and switch. Compare Fingerprint of the server key with the fingerprint supplied by that server's administrator. Select The fingerprints match — trust the server only when they match.
  4. Select Check. Resolve errors before installation. A readiness check does not mean that a module has been installed.

Install the scanners​

  1. Select Install a module for the new server. Under Modules, select SAST, DAST and/or SCA. Repeat this procedure with the appropriate module on each server to separate them. A scanner server always runs the edition of the main server. If the form asks for the edition, choose the edition of the installed DerScanner, as stated in your contract; Install stays unavailable until you choose.
  2. Set Address of the main server to the Core address reachable from the remote server. Check the proposed value: the address used by your browser may not be appropriate.
  3. If a completed Delivery folder is available, select one with the required version and modules. Its contents are transferred over SSH. Without a folder, module installation uses the registry. If the remote server can reach it, that server downloads its images directly. Otherwise, when the panel server can reach the registry, DCP prepares the required files there and transfers them over SSH. Wait for What happens to explain the selected route and its requirements. Installation remains unavailable if the download method is refused or has not yet been determined. The form lists the modules that will be installed from the chosen folder. A node runs the version and edition of its main server, so a folder of another edition or version is refused with that reason; choose a folder of the main server's version and edition. For a folder you prepared yourself, compare the folder fingerprint shown beside it with the one noted at preparation (see Installation without internet).
  4. Select Install and wait for the operation result. If the remote server lacks disk space, DCP names the server, the directory and the space needed and does not install. Under Servers, check that the server is identified as a scanner server of this Core, with the expected version and running state. Then perform a test scan in DerScanner.

Limits and recovery​

Core is not a scanner-node module. To install a complete independent DerScanner deployment remotely, prepare a delivery folder on the panel server and choose Install DerScanner; Install a complete DerScanner deployment on a remote server describes that route. The interface does not add SAST, DAST or SCA to an already installed remote node: choose its complete module set initially or use a new server. DerAI and DerAI-Lite are the exception: they are added on the installed server's own Overview (choose the server in the list with Show this server, then Add); one DerAI or DerAI-Lite serves an installation (see Add a module).

The Setup wizard opened for a scanner node says that it is a scanner server of the main server, lists its modules and offers Open DerScanner on the main server. A node installation over an existing node is refused by the plan before anything is copied, with the way to proceed.

For SSH errors, check the address, port, user and privileges. Investigate a changed host key before trusting it. If the connection drops, reopen the current operation and wait for its state to be established; do not start a concurrent installation. State not known does not mean that the remote server has stopped. If the task queue is unreachable, correct the Core address and network rules before retrying installation. If the panel cannot open the queue port of the main server to the new server, it says so and nothing is installed; try again later. If the connection to the server breaks off or it does not answer in time, check the network and that its SSH service runs, then repeat the step.