How to install a Responder with Relay Server support

When deploying a new responder to an asset, you will encounter a configuration option that allows you to choose a connection route. This allows you to deploy a responder that either directly connects to the AIR console or utilizes a connection route via a Relay Server.

By selecting the "Relay Server Connection" radio button, you will be presented with a list of registered Relay Servers associated with this organization. From this list, select one option and proceed with the configuration.

The subsequent steps remain the same as when deploying a new responder, regardless of the connection route chosen (Relay Server). Once you have successfully installed a new asset using the Relay Server connection, you will observe the newly deployed asset associated with the Relay Server on the "Organization Detail" page.

How to install a Responder with Relay Server support: Organization Detail

After selecting the installed Relay Server from the list on the "Organization Detail" page, you can access your associated assets by clicking on the "Assets" tab. Additionally, you can view comprehensive details of your Relay Server on this page by clicking on the "Information" tab.

How to install a Responder with Relay Server support: Relay Server Details

Updating the Connection Route address

Furthermore, you can view and manage assets that are connected through this Relay Server. To modify the connection routing of your assets, navigate to the "Assets" tab. Simply select the asset that you would like to view or edit.

Within the "Connection Route" setting, you have the option to choose between a direct connection to the AIR console or selecting another Relay Server for your asset to connect to. This action will bring up the same settings page for connection routing that you encountered when deploying a new asset.

Updating Connection Route addresses for multiple assets

To update the connection route addresses for multiple assets in the same organization, follow these steps:

1. Go to the organization's page (the organization where you want to update the assets) or the Assets page.

2. Selected the desired assets within the same organization.

3. Edit the connection route by selecting the icon at the end of the connection route row.

4. Modify the connection route addresses or choose a Direct connection.

By following these steps, you can easily update the connection route addresses for multiple assets in the same organization.

How to install a Responder with Relay Server support: Connection Route

Updating the responder’s connection route address using the command line

Even if you manually update your connection route, during the next visit to the AIR console from the responder, the responder will retrieve and set the old connection route address. This occurs because the AIR console is unaware of the address you have set. To avoid this, any changes to the connection route must be made directly from the AIR console. The configure command mentioned below is primarily utilized for troubleshooting and testing the connection to the Relay Server.

To manually update the connection route of your responder, you can run the responder with the "configure" flag. Follow these steps:

1. Open a Terminal.

2. Navigate to the directory where the responder is located.

3. Run the configure command as shown below:

$ cd /opt/binalyze/air/responder 

$ sudo ./air configure relay --address 192.168.1.XX 

Failed to acquire lock. An instance of the AIR responder is running. Trying to stop the service... 
Checking lock if it is still held... 
Lock is held. AIR responder is not running 
AIR responder service started 
Completed 

$ cat config.yml | grep ConnectionRouteAddress 
ConnectionRouteAddress: 192.168.1.XX

Upon running the configuration command, the responder service will automatically restart with the updated configuration, including the new connection route that has been set. This ensures that the responder incorporates the changes and operates according to the new configuration.