Secret Server Frequently Asked Questions

Transcription

1 Secret Server Frequently Asked Questions Licensing How is Secret Server licensed? 1. Each named user (not concurrent user) needs a user license. User licenses are a one-time fee and more user licenses can be purchased at any time. The number of passwords you need to store and the total devices on your network do not impact licensing costs. 2. There are 4 editions. Express, Professional, Enterprise and Enterprise Plus. All editions are onetime fees except the Express edition, which is charged annually, at $ Support licensing is the only recurring Secret Server cost. It applies to all editions except Express. It is an annual subscription based on a percentage of the User + Edition cost. All user licenses must have an accompanying support license for the account to be considered supported; a customer cannot only purchase support for one of their users. The support costs give customers access to technical support, software updates and other improvements and feature enhancements. Do I have to buy Express/ Professional / Enterprise / Enterprise Plus Edition? Secret Server comes in four different editions. The key differences between editions are summarized below: Express Professional Enterprise Enterprise Plus Encrypted Password Vault Organize and share enterprise passwords Auditing of user and Secret usage Active Directory integration Automatic Backups and Mobile Apps Limited to 10 users, 100 Secrets, and cost is fixed at $10 annually and donated to charity. All Express edition features plus: All Professional edition features plus: All Enterprise edition features plus: Active password Manage Service Clustering changing capabilities Accounts Event subscriptions Custom reports Session recording Require comment for Secret access Discovery of local accounts Scheduled reports Checkout (OTP) Request access Discovery of service accounts SIEM integration Discovery rules Application Server API AND MORE AND MORE AND MORE Is it licensed based on the number of passwords stored?

2 No. You can store as many passwords as you would like. What does technical support cover? It covers technical support via /phone and all upgrades (including major releases). Supported clients greatly benefit from the most up-to-date version of Secret Server. Support is renewed annually. Certified Partners commit to providing Tier 1 Tech Support to all of their Secret Server customers. Contact the partner team for more information on Tier 1 Tech Support for partners. Is it licensed by named or concurrent users? It is licensed by named user. Each person logging in to Secret Server needs to have their own user license. Installation / Requirements On which operating systems can Secret Server be installed? Windows Server 2008 and R2, Windows Vista, Windows 7,,. This can be a virtual machine. Can it be installed on UNIX or Linux? No. Appliance or application/software? Secret Server is an application/software. No appliance is required. Does it need a Windows client? No. It is all web-browser based. Is there an MSI installer for Secret Server? Yes. please reach out to the partner team for trial licenses. What are the system requirements for Secret Server? Windows server (versions specified above). Needs IIS 6.0 or 7.0, ASP.NET 3.5, Microsoft SQL Server 2005 / 2008 (including Express Editions). Can be a virtual machine. Can I install Secret Server with an internet hosting company? Yes. You do need to have Full Trust (for the.net runtime) on your internet hosting server.

3 General What types of passwords should be stored in Secret Server? Privileged account passwords, such as local administrator accounts on Windows workstations, server or UNIX root accounts or any password that is shared among different IT members. You can also store other passwords, pin codes, combinations and even file attachments, such as private key files, SSL certificates, Microsoft Word documents, etc. Can Secret Server actually change passwords? Yes. Starting with the Professional edition. Can Secret Server change UNIX or Linux passwords? Yes. Starting with the Professional edition. Can Secret Server change UNIX root account passwords? Yes. It can login as a local account and then change root's password. How does UNIX password changing work? Secret Server connects to the UNIX host using SSH or Telnet using the current username and password. Then it calls "passwd" to change the password on the account. These commands can also be customized in Secret Server if needed. Does Secret Server need a service account to do password changes? How does it work? No. A service account is not used. Secret Server can import existing passwords from different spreadsheet formats and will connect to the different machines directly using the current username and password; it then calls the "native" mechanism to change that password. You can also use a service account to do the password change in the situation where the account is not permitted to change its own password. Is an agent required to do password changes? No. Secret Server connects directly to the account and changes the password. Agents can be used for changing passwords on remote networks. How does the AD integration work? What does it do? AD integration provides two things: (1) Your admins can log in to Secret Server using their AD password, and (2) you can assign permissions on passwords to AD users and groups. Does Secret Server do Single Sign-On?

4 No. not really. This is really a tool for storing and managing privileged accounts, such as local administrator accounts on Windows workstations or servers, or UNIX root accounts. What encryption is used? AES 256. (Advanced Encryption Standard the Rijndael algorithm using a 256 bit key.) Is it a hosted service or can we install it on our network? You can install it on your own network. We also offer a SaaS / hosted solution, but it has some limitations compared to the Installed / On-premise solution and it is not part of Thycotic s partner reseller incentive program. How long does it take to install Secret Server? minutes. It is pretty simple it just needs IIS, ASP.NET and a Microsoft SQL Server; Secret Server ships with an MSI installer. If you need any help, our Technical Support is able to guide you through the process. Where does Secret Server store the passwords? In a Microsoft SQL Server database. Does Secret Server write any information into the AD schema? No. Everything is stored in the relational database (Microsoft SQL Server). Secret Server does not extend AD schema. Is it a Microsoft-based solution? Yes. Secret Server uses Microsoft Windows, Microsoft SQL Server and Microsoft.NET. Can a Database Administrator see the passwords in the database? No. Everything is encrypted using AES256 bit encryption at the application level; all data saved in the database is already encrypted. What information does Secret Server encrypt in the database? All fields in the Secret template are encrypted, such as the password, username, notes and other fields. Secret Names may look like they are part of the Secret template in the Secret Server interface, but technically are not. Secret names are also not encrypted in the database because (1) they have to be visible on the dashboard and in reports, and (2) they are not considered sensitive information. Do I need Active Directory to use Secret Server? No. You can use local users and groups. However, many customers choose to use the integration with AD. Can Secret Server work with multiple ADs / domains?

5 Yes. It can work with as many as you d like. How does Secret Server manage service accounts? Enterprise and Enterprise Plus editions can change the passwords of Windows service accounts. Secret Server does this by changing the password in AD and then updating the password in all places that it is used (such as Windows Services, Windows Scheduled Tasks and IIS Application Pool Users). To make this process seamless, Secret Server scans the network to find all the places where your Windows service accounts are being used. Can Secret Server manage local Windows accounts? Yes. Starting at the Professional edition, Secret Server can discover local accounts, connect directly to the Windows box and change the local passwords on the machine. Can Secret Server manage Windows boxes that are not domain joined? Yes. It can change passwords on boxes that are not domain joined. What passwords can Secret Server automatically change? AD, Windows, UNIX/Linux, Oracle, Sybase, Microsoft SQL Server, Cisco devices, Juniper, HP ILO, Dell DRAC, Enterasys and any other device that allows password changing through SSH or Telnet protocols. This list of platforms is continually growing. What is the RADIUS feature? Secret Server supports any RADIUS-compatible authentication such as RSA tokens. This means your admins can use their RSA tokens to authenticate when signing into Secret Server. Does Secret Server have an API? Yes, a web services API and an Application Server API. The Application Server API can be used from practically any programming language Java, Perl, C++,.NET. They can even be used from a PowerShell script. There are several code examples on the Knowledge Base. Does my Secret Server need to be connected to the internet / publicly accessible to use the mobile apps? Yes. if you want to access Secret Server from outside the organization s intranet, it does need internet/public accessibility. Also, your organization has to allow mobile access in the Secret Server settings. Is there an option to do offline caching of the passwords with Secret Server? Yes. there is offline caching in our mobile applications. This feature is customizable and can be turned off completely. What is an example of managing a service account with Secret Server?

6 Here is an example: An admin is provisioning (setting up) a new database server. He installs Oracle and needs a Windows service account to run the Oracle application on the server. He creates the service account in AD, adds the Secret to Secret Server and includes the Dependency for the Windows Service. He specifies that Secret Server change the password every 30 days. Secret Server will then change the password in AD every 30 days and update the password on the server for the Oracle Windows Service. It will also stop and restart the Oracle Windows Service. (Benefit: the service account password can now be changed automatically on a 30-day basis without disrupting the Oracle Windows Service.) What is an example of managing a local Windows admin accounts with Secret Server? Here is an example: An admin is provisioning (setting up) a new server. He needs to set a password for the local Windows admin account on the server. He adds the password to Secret Server and sets it to be changed every 90 days. Secret Server will now connect to the new server every 90 days and change the password on the admin account to a new random value. (Benefit: The password is automatically changed on the admin account with no manual intervention a compliance requirement.) Can I store files inside of Secret Server? If so, are they encrypted? Yes. Files are encrypted using AES256. You can store any type of file private keys, SSL certificates, Word documents, Excel spreadsheets, etc. Can Secret Server store images? Yes. Secret Server can store any type of file. What ports need to be opened to do password changes? There is a Knowledge Base article on our website that documents the ports required. Is there a maximum number of Secrets that Secret Server can store? Not really. It is probably a very large number based on disk space, memory, etc. What if someone deletes all the Secrets? Deletions of Secrets in Secret Server are soft deletes (think Recycle Bin). This means that they can always be undeleted if necessary. This is an important requirement for customers in the financial industry. How does Secret Server synchronize with AD by user, group or OU? By user and group (not OU). What is a Secret Template? It is a blueprint for different types of data that you want to store in Secret Server, e.g. Windows Accounts, Oracle Accounts, private key files, etc.

7 Where is the encryption done? The encryption is done in the application tier. This means that the data going to and from the database is already encrypted. What if I store the same password twice, will the encrypted values be the same? No. Each value stored in Secret Server is given a random salt before it is encrypted. This means the same passwords will have different encrypted values when they are stored. Can Secret Server change passwords on a Mac? Yes. Secret Server can change passwords on a Mac because it is UNIX-based. Can you access Secret Server from a Mac? Yes. You can use Safari, Firefox or Chrome. What phone / mobile platforms are supported by Secret Server? iphone, BlackBerry, Android and Windows. Is there a free trial available for Secret Server? Yes. 30 days with full access to technical support. How frequently are updates for Secret Server released? Updates are released every weeks. Can I import passwords into Secret Server? Yes. Secret Server can import CSV (comma separated values) or XML format. Can Secret Server figure out passwords from network accounts? No. This is not possible within Windows, AD or most platforms. What is DoubleLock? Why would I need it? DoubleLock allows you to have custom encryption keys that can be used to encrypt very sensitive Secrets (such as safe combinations or bank account information). It is useful to prevent an AD admin from granting access to an AD group which then allows the user to see Secrets they shouldn't have access to. By having DoubleLock they would need an additional password to get access to the custom encryption key. What happens if I forget to log out of Secret Server? There is an inactivity timer that can be turned on to log users out of the application at a desired interval. Does Secret Server support multiple languages?

8 Yes. It ships with English, Spanish, Dutch and French. It is possible to localize Secret Server to other languages. There is a Knowledge Base article that describes the process. Does Secret Server support multiple date/time formats? Yes. For example: dd.mm.yyyy. You can set a default for the system and each user can pick their own preferred date/time format. Can Secret Server be themed to match a company s logo and colors? Yes. This can be done by copying one of the existing themes and customizing it (changing images, CSS, etc.). Disaster Recovery What about Disaster Recovery? Secret Server comes with different Disaster Recovery options for emergency situations. To access the Secret Server Recovery Guide click here. 1. Automatic backups can be scheduled, and a specified number of backups can be kept and copied offsite. 2. Hot Backups can be performed manually at any time. 3. Database mirroring is supported for Microsoft SQL Server database. 4. Front-end clustering is supported for web servers in the Enterprise Plus edition. 5. Cleartext Export allows certain admins to export all passwords as cleartext. These can then be printed to paper and kept securely offsite. 6. Unlimited admin mode allows an administrator access to all Secrets and Folders without explicit permission 7. Offline caching can be enabled for the mobile phone applications, allowing admins to keep a local copy of all passwords on their mobile. Can Secret Server be clustered? Yes. Front-end web clustering is available with our Enterprise Plus edition. Can I export passwords from Secret Server? Yes. Passwords can be exported by certain admins with the Cleartext Export feature. What happens if the server running Secret Server goes down? Refer to the Disaster Recovery options above. What happens if my AD server fails? How do I log in to Secret Server? You will have to use a local account to log in to Secret Server. General Technical Questions

9 What is a port? A virtual point of connection for a computer to interface with other computers or devices. Each port is assigned an identification number. Connections come in on that "port" for a specific service, such as web, mail, ping, or telnet and SSH connections. For example, Secret Server typically runs on port 443 (https) while SMTP typically runs on port 25. What is Active Directory (AD)? A central directory for a company's internal user accounts, workstations, servers, printers, routers almost anything on the network is listed in the Active Directory. This creates a central place to store credentials. When users or other types of accounts log in, their credentials and access privileges are checked against the Active Directory before they receive network access. What is an appliance? It is a pre-packaged combination of hardware and software to provide a service. For example, Google puts their search engine on a server that you install on your network and this allows you to search company documents, etc. What is a service account? It is an AD account or a local account used to run an application. It doesn't represent the identity of a real person and it is used on a regular basis to run applications (or services) that are provided to the company. For example, an AD account called SCAN1 may be created to run a Windows scheduled task that weekly runs Windows updates on a server. What is a privileged account? Accounts with elevated access rights. Typically not mapped to an individual user, but shared by many administrator staff (e.g. local Administrator account on a Windows workstation or server). What is an admin account? It is an administrator account that can be considered a privileged account (more of a Windows term). What is a root account (also called "su" or super user mode)? A privileged account, typically on UNIX systems. What is an end user? Generally non-it staff using a computer within a company (e.g. HR, Finance, Sales, Marketing, Product Development, etc). What is a domain (within the context of AD)?

10 A grouping of items within Active Directory to form a "domain." These are usually geographically based (e.g. Philadelphia, Pittsburgh, Cleveland), but could also be by business unit. It is simply a logical grouping of items within Active Directory when the total size of items becomes too large. What is a system admin? Person usually in charge of installing, supporting and maintaining servers, computer systems or networks. What is a domain admin? Person managing an Active Directory domain. What is UNIX? Operating System that was started in the 60s. Developed by AT&T. Alternative to Microsoft Windows. Many see it as very secure, and possibly more secure than Windows. However, this is heavily debated, similarly to the Mac versus PC arguments. What is open source? Are Thycotic products open source? Open source means that the programming code is publicly available for use. The Android operating system is an example of open source software. Thycotic products not open source; they are closed source. What is Linux? UNIX-like operating system, known for being open source. What is Sybase? Relational database management system (RDBMS), which is a database used to store information such as ecommerce data, Facebook, ebay, etc. Commonly referred to as a "relational database." Sysbase is a commercial product, not very widely used. Not as popular as Oracle or Microsoft SQL Server. Another declining database product is DB2 (made by IBM). What is Microsoft SQL Server? Same type of product as Sybase, Oracle or DB2, but made by Microsoft. One of the most popular databases in the world. Used by the business community worldwide. Almost all Microsoft shops will use SQL Server. What is Oracle? Relational database product made by Oracle Corporation. What is MySQL? Free, open source database product. Not typically used in a business environment, especially Microsoft shops.

11 What is a named user? (licensing) When each person (actual individual) will need a license to access an application or service. For instance, if David, Paul and Tom were going to use the software, then you would need three licenses. Thycotic products are licensed by named user. What is a concurrent user? (licensing) When each license can be used by multiple people, but only a certain number of people can use/access the system at the same time. For example, if a company has 20 people, but only five concurrent user licenses, then all employees can use the software, but only five can use the software at a time. Thycotic products do not use concurrent licensing. Instead, products are licensed by named user. What is DR? Disaster recovery. A backup plan, tools or processes to protect against a worst case situation. For example, when a server's hard drive won't power on and you have to access the data on it. Disaster recovery is the plan for how to recover the applications, data and services to another, functioning machine. What is SQL? Database computer language designed for managing data in a relational database management system (RDBMS). Structured Query Language (e.g. SELECT * FROM tbuser WHERE Username = 'jonathan@thycotic.com'). What is a one way hash and why would you use it? A mathematical algorithm to convert text to a fixed representation that cannot be reversed (e.g. Yagni12# => AB3541CD459812DEAB0012). Useful to store a representation of a password that can be checked during a login process, but cannot be reversed to know what the actual password is. What is SHA512? What is SHA1? Pronounced "Shah." These are the Secure Hash Algorithms used to do one way hashing. SHA512 (512 bit) is more secure than SHA1 (160 bit). What is symmetric encryption? What is an example? Uses a secret key to encrypt or decrypt data. Both the receiver and the sender know the secret key. Data is encrypted and decrypted using the same secret key (that is why it is called symmetric ). An example of symmetric encryption is AES256. What is asymmetric encryption? Encryption using a public and private key. The public key can be shared with anyone, but the private key should never be shared. Each party has their own public/private key set. If you encrypt data with the public key, it can only be decrypted with the corresponding private key and vice versa.

12 The problem with this encryption is that it is slower than symmetric encryption. Therefore, it is often only used to establish a secure connection between two known parties. Once the secure connection is established, a symmetric key is sent between the two people. The symmetric key is then used for the rest of the communication. Why is asymmetric encryption useful? Makes it possible to send data to someone in encrypted format while ensuring the information is going to the correct party. Where is one example of asymmetric encryption in the everyday world? Ordering online with a credit card (SSL / HTTPS). What is SSL? Secure Socket Layer--cryptographic protocol to provide secure communication over networks. Typically used by web browsers and web servers for websites. What is HTTPS? HyperText Transfer Protocol Secure. Uses SSL. Typically uses port 443. What is AES? Advanced Encryption Standard. It is a symmetric encryption algorithm developed by NIST (National Institute of Standards and Technology). Originally developed by Rijndael ("rhinedal"). It is used by governments and military worldwide. Generally seen as a very secure algorithm. How is AES256 different from AES128? Which is more secure? AES256 uses a 256 bit key and AES128 uses a 128 bit key; it refers to the key size or key length (measured in bits). The 256 bit is more secure. What is a private key file? It is a file that stores a user's private key. What is salting? It is an arbitrary chunk of random data that is added to a value before it is hashed. This prevents identical hash values that could then be figured out. In Secret Server, we use salts with symmetric encryption to prevent encrypted values from being identical. How it works: salt(jshdkjf&r ) + password12345 => AB3541CD459812DEAB salt(jshdkjf&r ) What is an API? How would it be used? Application Programming Interface. A way for other applications to integrate with an application at the programming level. This allows another program to store a password in Secret Server.

13 What is an.msi? The extension of a file used by the Windows Installer. It is a simple wizard-based way to install software. What is a.zip file? A single archive that is compressed. It is a convenient way to group a bunch of folders and files. What is Windows 8? A version of the Windows Operating System. What is Windows 7? A version of the Windows Operating System. What is Windows Vista? The predecessor of Windows 7. What is R2? It is the operating system Windows Server 2008 R2. (Release 2 or Version 2) What is 32 bit and 64 bit? They are different processor architectures (analogy: double lane highway versus single lane highway inside the CPU). 64-bit is typically used in business whereas many home computers as 32 bit. What is Chrome? Web browser from Google. What is Safari? Web browser from Apple. What is clear text? It is unencrypted data that you can read without a decryption code. What is an Agent? A piece of a software application. It acts on behalf of its main application to access network equipment. It is typically installed on each machine on a network to gather data or make changes on that machine. However, it is NOT required when using Secret Server, unless a company needs to change a password on a network that is not domain-joined (e.g. an IT firm needs to change passwords on their client s network their client is a doctor s office that is off site). What is an OU?

14 Organizational Unit. It is way of organizing information in an Active Directory. It is a hierarchy for organizing the company structure and business units. Secret Server doesn't really work with OUs (it uses AD groups instead), but Password Reset Server and Group Management Server do use OUs for specifying security policies. What is a DBA? Database administrator. The person responsible for the design, implementation or maintenance of an organization's databases. Typically this role is separated by platform (e.g. a SQL Server DBA, an Oracle DBA or Sybase DBA). What is database mirroring? Primarily a software solution for increasing database availability. Keeps a copy of the data in two places and keeps them up-to-date so there is always a backup copy ready. What is clustering? Clustering is a high availability feature available in the Enterprise Plus edition of Secret Server. It allows you to have multiple servers running a particular application this is good for redundancy (ensuring high uptime) since if one server fails (network card, hard drive, etc.) then the other servers keep running and the application is available for the users. What is an MSP or Managed Service Provider? MSP s are good prospects for Secret Server. An MSP is an IT service company who provides a defined set of IT services to their client. Typical examples would be setting up servers, troubleshooting network issues, configuring printers, setting up new workstations, configuring an AD for a customer, providing a backup solution. They might manage a doctor's office, dentist, accounting or law firm--pretty much any company that is too small to have its own IT department. Typically they have a lot of client passwords and high staff turnover great reasons to use Secret Server. What is a Windows workstation? Any computer that is running a Windows operating system (e.g. Windows XP, Windows Vista or Windows 7). If it is running Windows Server 2003 or 2008 then it is more likely to be a server. Servers are typically higher powered and more critical to a network s operations than a single workstation. What are web services? (shown in the Secret Server architecture diagram) Web services provide a way for other applications to interact with Secret Server. Example interactions include viewing, creating or modifying Secrets and folders. The flexible nature of Web Services allows Secret Server to be accessed using mobile apps, third party applications, and scripts. Proper authentication is required to access the Secret Server Web Services and all actions are audited.

15 What is an RSA token? A form of authentication. It is a hardware token that displays a number that changes every few minutes. When entering in your credentials, the system compares the RSA token number given with the number expected to determine if the person actually has the token. RSA tokens are created using the RADUIS protocol. Secret Server works with any RADIUS based authentication, including RSA tokens. What is two-factor authentication? Something you know (e.g. password), something you have (e.g. token), something you are (e.g. retina scan) or somewhere you are (e.g., GPS location). Two-factor is having two of these things-- typically something you know and something you have. Sometimes this can be referred to as multifactor. What is an SSL certificate? Secure Socket Layer certificate. Small data file that contains a digital, cryptographic key assigned to your company. It is used on the web to prove that a website is really what it says it is (e.g. a banking website really is Wells Fargo). It is also used as part of the encryption mechanism for securing communication from the web browser to that website and back (public key). Thycotic recommends Secret Server users run Secret Server with an SSL-secured connection. What is IIS? (Internet Information Server) It is the web application server from Microsoft. It can serve up documents, web pages, images and also applications such as Secret Server. The alternative to IIS in most UNIX shops is Apache. What is an IIS Application Pool? A way of allocating resources on a server when running websites. For example, an admin would create a service account to run an IIS App Pool which will be running a website such as Secret Server. What is a Windows Scheduled task and why would I use it? Gives the ability to run programs or scripts at a specific time. An example would be kicking off a backup of a system, defragging a hard drive, etc. What is PuTTY and what would I use it for? It is a terminal application to access a computer using a command line interface. It typically connects on SSH to UNIX or Linux boxes. What is ASP.NET? It is a web application framework. It allows developers to build web applications and web services. It is provided by Microsoft and is the defacto standard for building web applications in Microsoft shops. Secret Server uses ASP.NET.

16 What is XML? extensible Markup Language -- it is a self-describing language using tags, e.g., <groceries><apples>2</apples><oranges>1</oranges></groceries> What is Remote Desktop? Remote Desktop is a tool made by Microsoft that allows administrators to connect to the desktop of a remote computer or server. It opens a new window showing the desktop of the remote computer and allows an administrator to do various maintenance/configuration tasks on the remote computer. It is a common tool used by Windows Server Administrators. What is Session Recording? Session Recording is where computer sessions (e.g. an admin logging in to the desktop of a server using Remote Desktop to do various maintenance/configuration tasks) are recorded so that managers or auditors will be able to tell what the admin did during that session. What is Discovery? Discovery is when a software application is able to be aware of its location/surroundings and can automatically interact with servers, workstations and network equipment on the local network. Customers typically want these types of capabilities since it makes applications more dynamic and able to adapt to their environment it also usually makes their job easier when they need to manage different computers or accounts on the network. Secret Server Professional edition discovers local Windows accounts. The Enterprise edition discovers Windows service accounts. With the Enterprise Plus edition, you can set Discovery rules on local Windows admin accounts and Windows service accounts within Secret Server.