CyberArkActiveDirectory(AD)

BridgeCapabilitiesObjectivesBytheendofthislessonyouwillbeableto:DescribethefunctionalityADBridgeSolutionUsethePVWAtodefinetheMasterPolicyintheSystemMakebasicconfigurationchangesManageplatformsAddaccountstotheVaultADBridgeMarketCyberArkADBridgeProductFlowConfigurationMonitoringandLogsAgendaADBridgeMarketUNIX/LinuxEfficiency/costreductionSecurityComplianceBusinessdriversforADBridgeSolutionADBridgeCompetitionNISWhatActiveDirectoryBridgeProductsDoActiveDirectoryAuthenticationAllowsuserstoauthenticateusingtheirActiveDirectorycredentials(username&password)togainaccesstonon-WindowssystemssuchasUNIX,LinuxandMacsAccessControlEnablesadministratorstocontrolaccesstonon-WindowssystemsbydefininginActiveDirectorywhichusersarepermittedtologontowhichsystemsandautomaticallyprovisionthoseusersontargetsystemsAuditingandReportingDeliverscentralandsecurereportingwithbuilt-inreportsGroupPolicyExtendsthecapabilitiesofnativegrouppolicymanagementtoolstoincludespecificgrouppolicysettingsforUNIX,Linux,andMactoattainaconsistentconfigurationacrosstheenterpriseADBridgeMarketCyberArkADBridgeProductFlowConfigurationMonitoringandLogsAgendaWhyisCyberArkAddingADBridgingCapabilities?GapsinanalystscoverageShowstopperinseveralOPMdealsCustomersexpectsthistobeanintegratedpartofaUNIXSecurityprojectsIntroducingCyberArkADBridgeCapabilitiesUNIX/LinuxCyberArkVaultCentralizedgrouppolicyforUNIXusersintheCyberArkVaultandADSecureandcentralizedreportingofUNIXlogineventsintheCyberArkVaultActiveDirectoryauthenticationforUNIX/LinuxusersAutomaticprovisioningandde-provisioningofUNIXaccountsasdefinedinADConnectsUNIXaccountstoActiveDirectorythroughtheCyberArkVaultCyberArkADBridging-UniqueBenefitsZero-footprintagentlessapproachforADBridgingDynamicaccessbasedonworkflowsratherthanstaticaccesscontrolofregularADBridgingAllowUNIXadminstomanageserveraccesscontrolwithoutdependenciesontheADadminsMonitorallaccesstoUNIXserversincludingpersonalusersFullyintegratedwithPrivilegedAccountSecurityworkflowsADBridgeMarketCyberArkADBridgeProductFlowConfigurationMonitoringandLogsAgendaADBridgingThroughPSMSSHProxy(PatentPending)

sshADperiodicallysyncRunusercreationscriptUserfirsttimeloginInitiatesshsessionYesNoUserlogsintotargetsystemthroughSSHproxyUserauthenticateswithhisVault(AD)credentialsIfuserdoesnotexist,theproxytransparentlyprovisionedtheuser

(runsuseradd)ITPersonnelHowusersare

ProvisionedLoginasrootCheckifexistCreatelocaluserwithastrongrandompassword(cannotconnectremotely)Opennewsessionforthecreateduser123Vault,PSMPTargetMachineMicrosoft

ActiveDirectoryActiveDirectoryBridgingCentralizedManagementofUnixUsersADUserTargetServerPSMPAddresssshjohnjohnActiveDirectoryBridgingSingleSign-OnwithADcredentialsADPasswordssh’spassword:johnjohnActiveDirectoryBridgingUserisprovisionedtotheUnixServerssh’spassword:johnjohn

ActiveDirectoryBridging…andthesessionisbeingrecorded

ssh’spassword:johnjohnunx1~]$_________DemoScenario–LoginADusertoUnixtargetmachinePre-requisitesTheVaultisconfiguredtobesynchronizedwithADWearealreadymanagingtheroot(orotherprivileged)accountonthetargetmachineStepbystepconfiguration:AssignRetrieve+ListpermissionstoCyberArkuserprovisioningprocess(user)totherootaccountAssignUse+ListpermissionstousersthatneedaccesstothetargetaccountConfiguretheADBridgeplatformCreateanewtypeofaccount–MachineAccountEachmachinewillhaveanaccount(nousername&password)TheaccountwillbeassociatedtotherootaccountAccesscontrol(whocanconnect/provisiontothismachine)shouldbedefinedonthataccountProvisioningPlatformProvisioningAccountProvisioningActivitiesConfiguration/etc/opt/CARKpsmpadb/conf/ConfigurationLocalConfigurationfile–noeffectPSMPADBridgeConfCredFile/etc/opt/CARKpsmpadb/conf/vault/psmpadbridgeserveruser.credLogs/var/opt/CARKpsmpadb/logs/APPAudit.log–NotisuseAPPConsole.logAPPTrace.log–NewUserAPPTrace.log–UserAlreadyExistsCompetition–CompetitivetrapsObjectiveHowtohandleKerberosauthenticationRequirespecialSSHclientLocalcacheIncaseofanetworkfailurethatrequiresaconsoleloginouruserscanextracttherootpasswordfromtheVaultaftermanagerapprovalsoaccountabilityisretained.RegistrationUnixcomputertoADProvisionanewUNIXsystemyoujustneedtodefineitintheVaultandyoudon'tneedtoinstallanysoftwareonthetargetsystem.UnixmachinescanbelistedintheVaultinventoryreport.ADSinglesignontoWindowsnetworkresourcesCurrentlynotsupported.Minorusecase.CompetitionStrategyCyberArkprovidescoreADBridgecapabilitiesActiveDirectoryauthenticationforUNIX/LinuxusersEnablesadministratorstocontrolaccesstonon-WindowssystemsSecureandcentralizedreportingofUNIXlogineventsintheCyberArkVaultCentralizedgrouppolicyforUNIXusersintheCyberArkVaultandADStrategyExp