Installing DEX Server

This is the central component responsible for orchestrating data ingestion and communication between MSSQL, ClickHouse, and NATS JetStream. It must be deployed only once per DEX environment.

Install the DEX Server using the #32-Install DEX Server (WIN) Fixlet.

Input parameters required during the installation

In BigFix Console, go to Fixlet and Tasks and provide the following details:

TLS Mode Values (NATS JetStream / ClickHouse / MSSQL):
  • 0 – disabled (No encryption)
  • 1 – permissive (TLS enabled, skips certificate validation)
  • 2 – strict (TLS with system certificate store validation)

    The same applies to all other components.

MSSQL Auth Type Values:

  • Mode 0 (SQL Authentication): Connects to the SQL Server instance using a dedicated SQL login with username and password stored in the DEX configuration; credentials are managed and rotated independently of the Windows environment.

  • Mode 1 (Windows Authentication): Connects to the SQL Server instance using the Windows service account identity via SSPI/Kerberos; no SQL credentials are stored — authentication is delegated to Active Directory.

  • Installation Path: Default: C:\\Program Files (x86)\\BigFix Enterprise\\DEXServer
  • NATS JetStream Configuration: Host IP, port (Default: 4222), TLS Mode (Default: 0), user credentials (Default: dex_user)
  • DEX Instance Owner Credentials: Default: dexuser

    This user is used by the BigFix UI to connect to the DEX Server, so it will be used later during the configuration of the BigFix UI.

  • mTLS and Basic Auth: mTLS port (default 9443), Basic Auth Port (default 8081)
  • ClickHouse Configuration: Hostname, Port (Default: 9000), Database Name (Default: dex), Admin User credentials, Runtime User credentials (Default: dexuser), TLS Mode (Default: 0)
  • MSSQL Configuration: Hostname, Port (Default: 1433), Database Name (Default: dex), Admin User credentials, Authentication Type (Default: SQL Authentication), Runtime User (Default: dexuser) or Service Account User, TLS Mode (Default: 0)
Note: By default, the basic-auth port 8081 is used for the mTLS certificate exchange but it can be kept open after the exchange by setting IS_REQUIRED_WITHOUT_mTLS=1 in the DEX Server configuration. This is required for the ServiceNow integration, which calls the DEX Server with the dexsn over basic authentication.

MSSQL user password must follow those rules

  • Minimum length: As configured in the Windows security policy (often at least 8 characters).
  • Complexity: Must contain characters from at least 3 of the following 4 categories:
    • Uppercase letters (A-Z)
    • Lowercase letters (a-z)
    • Numbers (0-9)
    • Special characters (! @ # $ % & ;)