Installation Guide Release 1.1

Transcription

1 February 24, 2012 Installation Guide Release 1.1

2

3 Revision/Update Information: February 24, 2012 Software Version: PowerBroker Servers Windows Edition 1.1 Revision Number: 0 COPYRIGHT NOTICE Copyright 2012 BeyondTrust Software, Inc. All rights reserved. Use of this software and/or document, as and when applicable, is also subject to the terms and conditions of the license between the licensee and BeyondTrust Software, Inc. ( BeyondTrust ) or BeyondTrust s authorized remarketer, if and when applicable. TRADE SECRET NOTICE This software and/or documentation, as and when applicable, and the information and know-how they contain constitute the proprietary, confidential and valuable trade secret information of BeyondTrust and/or of the respective manufacturer or author, and may not be disclosed to others without the prior written permission of BeyondTrust. This software and/or documentation, as and when applicable, have been provided pursuant to an agreement that contains prohibitions against and/or restrictions on copying, modification and use. DISCLAIMER BeyondTrust makes no representations or warranties with respect to the contents hereof. Other than, any limited warranties expressly provided pursuant to a license agreement, NO OTHER WARRANTY IS EXPRESSED AND NONE SHALL BE IMPLIED, INCLUDING WITHOUT LIMITATION THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR USE OR FOR A PARTICULAR PURPOSE. LIMITED RIGHTS FARS NOTICE (If Applicable) If provided pursuant to FARS, this software and/or documentation, as and when applicable, are submitted with limited rights. This software and/or documentation, as and when applicable, may be reproduced and used by the Government with the express limitation that it will not, without the permission of BeyondTrust, be used outside the Government for the following purposes: manufacture, duplication, distribution or disclosure. (FAR (g)(2)(Alternate II)) LIMITED RIGHTS DFARS NOTICE (If Applicable) If provided pursuant to DFARS, use, duplication, or disclosure of this software and/or documentation by the Government is subject to limited rights and other restrictions, as set forth in the Rights in Technical Data Noncommercial Items clause at DFARS TRADEMARK NOTICES PowerBroker, PowerPassword, and PowerKeeper are registered trademarks of BeyondTrust. PowerSeries, PowerADvantage, PowerBroker Password Safe, PowerBroker Directory Integrator, PowerBroker Management Console, PowerBroker Desktops, PowerBroker Virtualization, PowerBroker Express, PowerBroker Databases, PowerBroker Windows Servers, PowerBroker Windows Desktops, and PowerBroker Identity Services are trademarks of BeyondTrust. ssh is a registered trademark of SSH Communications Security Corp in the United States and in certain other jurisdictions. The SSH logo, Tectia and tectia logo are trademarks of SSH Communications Security Corp and may be registered in certain jurisdictions. This application contains software powered by PKAIP, the leading solution for enabling efficient and secure data storage and transmission. PKAIP is provided by PKWARE, the inventor and continuing innovator of the ZIP file format. Used with permission. FICTITIOUS USE OF NAMES All names of persons mentioned in this document are used fictitiously. Any resemblance to actual persons, living or dead is entirely coincidental. BeyondTrust February 24,

4

5 Contents Contents Introduction 7 Where to Go Next? 7 Documentation Set for PowerBroker Servers Windows Edition 7 Getting Additional Help 7 Product Overview 9 Installation Overview and Terms 10 Step 1: Configuring the Domain Controller 11 Prerequisites for the Domain 11 Configure the DC 11 Step 2: Configuring the Proxy Host 12 Prerequisites for the Proxy Host 12 Install PowerBroker Servers on the Proxy Host 12 Step 3: Configuring a Run Host 16 Prerequisites for a Run Host 16 Install PowerBroker Servers on a Run Host 16 Step 4: Configuring a Submit Host 17 Prerequisites for a Submit Host 17 Configure a Submit Host for PowerBroker Servers 17 Step 5: Configuring Policy 18 BeyondTrust February 24,

6

7 Introduction Introduction Where to Go Next? This guide shows system administrators and security administrators how to install BeyondTrust PowerBroker Servers Windows Edition (PBWS). This guide provides an overview of how PowerBroker Servers works and instructions for PowerBroker Servers installation. For instructions about how to use PowerBroker Servers Windows Edition, see the PowerBroker Servers Windows Edition Administration Guide. Documentation Set for PowerBroker Servers Windows Edition The complete PowerBroker Servers Windows Edition documentation set includes the following: PowerBroker Servers Windows Edition Installation Guide PowerBroker Servers Windows Edition Administration Guide Getting Additional Help If you encounter problems that are not covered in the documentation, contact BeyondTrust technical support. When contacting technical support, provide the following information: Your company name Telephone and address where you can be contacted Description of the problem and the steps you have taken to resolve it You can contact BeyondTrust technical support by or through the BeyondTrust website. If you are located in the United States, you can also contact technical support by telephone. Support is staffed 24 hours per day, seven days per week. Telephone: Web: To submit a support request online: 1. Browse to 2. Click Login and log into the BeyondTrust website using the password provided to you by BeyondTrust. 3. After reading the Welcome message, scroll to the top of the BeyondTrust Partner Portal pane and click Customer Support Center. BeyondTrust February 24,

8 Introduction 4. Scroll down to the Add/View Incidents section and click the + icon. 5. In the View Your Incidents pane, click Add Incident, enter the details requested, and click Submit Incident to file your request for technical support. BeyondTrust February 24,

9 Product Overview Product Overview PowerBroker Servers Windows Edition delivers simplified privilege identity management (PIM) for Microsoft Windows Server based computers and applications that leverage Windows PowerShell the emerging standard for contemporary Windows Server administration to improve both security and auditing. This document assumes the reader is familiar with Microsoft PowerShell. PowerBroker Servers enables Windows system administrators and security administrators to define policy for which administrators may run certain tasks (such as PowerShell cmdlets or functions) with elevated full administrative privilege. The result is that responsibility for such tasks as adding administrator accounts and managing mailboxes can be safely assigned to the appropriate people without disclosing the full administrative password. The full power of full administrative access is thus protected from potential misuse or abuse outside their specified job responsibilities, such as stopping services, erasing disks, or doing more subtle damage. Furthermore, PowerBroker Servers can provide augmented event logs that include all actions that were performed with elevated privilege and by whom they were performed. This audit trail, combined with the safe partitioning of full administrative privilege, provides an extremely secure means of controlling administrative access to computers running Windows Server and applications and meeting compliance driven auditing requirements. BeyondTrust February 24,

10 Installation Overview and Terms Installation Overview and Terms Prior to installing PowerBroker Servers Windows Edition, it is important to understand the architecture of the solution. It is recommended that you review the overview of the PowerBroker Servers architecture in the Administrators Guide prior to installation. When installing PowerBroker Servers, you must configure or install software on at least the following four computers: Computer Description domain controller (DC) Proxy Host Run Host Submit Host A computer that responds to security authentication requests (such as logging in and checking permissions) within the Windows domain. The domain controller is used by PowerBroker Servers to authenticate access to the Run Host or applications that reside on the Run Host. Also called PowerBroker Servers Proxy Host. The Proxy Host is the computer where the core PowerBroker Servers policy control engine resides. The Proxy Host intercepts remote PowerShell commands from any Submit Host that has had the appropriate web service redirected to the proxy. Also called PowerShell-enabled application or server. The Run Host is the computer where the application being controlled (such as Microsoft Exchange) resides. To follow a least privilege principle, access to the Run Host should be restricted and controlled by the PowerBroker Servers Proxy Host. Also called administrator s computer or administration client (application specific). The Submit Host is any computer that emits remote PowerShell tasks to a Run Host. PowerShell tasks may be emitted by either a Windows PowerShell command line environment or using a management application (such as Microsoft Exchange) that uses remote PowerShell under the hood of the applications administrative administrator interface. Installation or configuration instructions for each of these computers is provided in this guide. For a new installation, you should install and configure the components in the order in which they are presented. BeyondTrust February 24,

11 Step 1: Configuring the Domain Controller Step 1: Configuring the Domain Controller The following are the prerequisites of PowerBroker Servers Windows Edition for the domain controller (DC) and the domain, along with guidance for configuration. Prerequisites for the Domain PowerBroker Servers Windows Edition has the following prerequisites for the domain: The domain must be configured to use a Windows Server 2003 functional level, regardless of the operating system running on the DC. The domain must use a standalone domain structure. Trusted domain structure is not supported. Configure the DC Ensure that the DC is configured according to instructions from Microsoft. For PowerBroker Servers, no specific configuration tasks are required on the DC other than setting the Active Directory domain functional level to Windows Server See Microsoft TechNet ( for information about Active Directory domain functional levels. You will need the name of the domain when installing and configuring other components of PowerBroker Servers. BeyondTrust February 24,

12 Step 2: Configuring the Proxy Host Step 2: Configuring the Proxy Host The following are the prerequisites of PowerBroker Servers Windows Edition for the PowerBroker Servers Proxy Host, along with guidance for installation and configuration. Prerequisites for the Proxy Host PowerBroker Servers Windows Edition has the following prerequisites for the Proxy Host: Hardware: 64-bit, dual core (or more) CPU, with at least 4GB of RAM and 5GB of available hard disk space Operating System: Windows Server 2008 R2 x64.net Framework V4.0 Java for Windows V6 (Available for download from the Java website ( Verify that the following system variable is present: JAVA_HOME = C:\Program Files (x86)\java\jre6 IIS Application Request Routing (ARR) V2.5. (If ARR is not installed, you will be prompted to install it and a link will be provided during the installation process on the Proxy Host.) For more information about ARR, see the IIS website ( To download ARR, see the Microsoft website ( Firewall: Ensure that TCP ports 8090 and 8989 are open. Membership in a domain with a Windows Server 2003 functional level Install PowerBroker Servers on the Proxy Host The installation of the Proxy Host component of PowerBroker Servers accomplishes the following tasks: Verifies the presence of prerequisites and enables required features and roles. Deploys and registers applications for the Proxy Host in Microsoft Internet Information Services (IIS). Installs the PowerBroker Servers policy engine. Encrypts and stores credentials for the Full Privilege Windows Administrator in the registry on the Proxy Host. BeyondTrust February 24,

13 Step 2: Configuring the Proxy Host On the computer that will serve as the Proxy Host, log on using an account that has local administrator or greater privileges and install the Proxy Host component of PowerBroker Servers: 1. Run PBWS_Proxy_Setup.exe. 2. On the Welcome page, click Next. 3. On the License Agreement page, accept the license agreement and click Next. BeyondTrust February 24,

14 Step 2: Configuring the Proxy Host 4. On the Account Information page, enter credentials for the Full Privilege Windows Administrator account (such as a Domain Administrator account) that you want PowerBroker Servers to use to provide Full Privilege Windows Administrator rights to Elevated Privilege Windows Administrators. The credentials will be encrypted and stored in the registry on the Proxy Host. The Proxy Host will elevate the execution rights for each Submit Host administrator who is permitted to connect to the Run Host to the level of access provided to the account for which you have entered credentials. Only one set of credentials can be stored. (For information about changing these credentials after installation, see the PowerBroker Servers Windows Edition Administration Guide.) Optional. To check whether the credentials entered meet the requirements, click Verify User Credentials. BeyondTrust February 24,

15 Step 2: Configuring the Proxy Host 5. On the Ready to Install the Program page, click Install. 6. After installation is complete, click Finish. To open the PowerBroker Servers Management Interface at this time, select the Launch PowerShell to configure PBWS check box. BeyondTrust February 24,

16 Step 3: Configuring a Run Host Step 3: Configuring a Run Host The following are the prerequisites of PowerBroker Servers Windows Edition for a Run Host, along with guidance for installation. Prerequisites for a Run Host PowerBroker Servers Windows Edition has the following prerequisites for a Run Host: The operating system must be one of the following: Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 R2 Windows Server 2003.NET Framework V3.5 Windows PowerShell V2.0 Firewall: Ensure that TCP ports 5985 and 80 are open. Membership in a domain with a Windows Server 2003 functional level Install PowerBroker Servers on a Run Host On the computer that will serve as the Run Host, log on using an account that has local administrator or greater privileges and install the Run Host component of PowerBroker Servers: 1. Run RunHost_Setup.exe. 2. On the Welcome page, click Next. 3. On the License Agreement page, accept the license agreement and click Next. 4. On the Ready to Install the Program page, click Install. 5. After installation is complete, click Finish. BeyondTrust February 24,

17 Step 4: Configuring a Submit Host Step 4: Configuring a Submit Host The following are the prerequisites of PowerBroker Servers Windows Edition for the Submit Host, along with guidance for configuration. Prerequisites for a Submit Host PowerBroker Servers Windows Edition has the following prerequisites for a Submit Host: Membership in a domain with a Windows Server 2003 functional level Configure a Submit Host for PowerBroker Servers To be able to establish a Proxy Host session from a Submit Host to a Run Host, you must define a proxy configuration setting on each computer that will act as a Submit Host. To define the proxy configuration setting, on each computer to be used as a Submit Host, run one of the following commands one time from an account that has local administrator or greater privileges: If the computer is running Windows 7, Windows Vista, Windows Server 2008 R2, or Windows Server 2008, run the following command at a Windows command. Substitute the IP address of the Proxy Host for ProxyHostIP. netsh winhttp set proxy proxy-server = ProxyHostIP:8989 If the computer is running Windows XP, Windows Server 2003 R2, or Windows Server 2003, run the following command at a Windows command prompt. Substitute the IP address of the Proxy Host for ProxyHostIP. proxycfg p ProxyHostIP:8989 Because the Proxy Host redirects traffic for only the defined port used by the proxy (8989), the proxy itself intercepts only PowerShell traffic, allowing the rest of HTTP traffic to pass. Tip: Changing the PowerBroker Servers Port For information about how to change the port on which PowerBroker Servers listens, see "Changing the PowerBroker Servers Port" in the PowerBroker Servers Windows Edition Administration Guide. BeyondTrust February 24,

18 Step 5: Configuring Policy Step 5: Configuring Policy When installed and configured according to this guide, PowerBroker Servers Windows Edition is configured so that all Windows PowerShell commands from a Submit Host to a Run Host are restricted by default. You now must add policy to allow a specific Submit Host administrator or group of administrators to run tasks on specific Run Hosts. For more information, see the PowerBroker Servers Windows Edition Administration Guide. BeyondTrust February 24,