LDAP and LDAP Groups for Snare Central - User Information

Transcription

1 LDAP and LDAP Groups for Snare Central - User Information Intersect Alliance International Pty Ltd. All rights reserved worldwide. Intersect Alliance Pty Ltd shall not be liable for errors contained herein or for direct, or indirect damages in connection with the use of this material. No part of this work may be reproduced or transmitted in any form or by any means except as expressly permitted by Intersect Alliance International Pty Ltd. This does not include those documents and software developed under the terms of the open source General Public Licence, which covers the Snare agents and some other software. The Intersect Alliance logo and Snare logo are registered trademarks of Intersect Alliance International Pty Ltd. Other trademarks and trade names are marks' and names of their owners as may or may not be indicated. All trademarks are the property of their respective owners and are used here in an editorial context without intent of infringement. Specifications and content are subject to change without notice. Page 1 of 5

2 This document is designed to assist a systems/security administrator with configuration of LDAP (Lightweight Directory Access Protocol) and LDAP Groups within the Snare Central from v Snare Central Server is capable of delegating user authentication and optionally group authorization to an external LDAP Directory or Active Directory server. Configure LDAP Navigate to System Administrative Tools Configuration Wizard Security Setup Snare Central LDAP authentication. The following parameters are available: LDAP Active Directory - To enable LDAP select the checkbox. When enabled, all local Snare accounts will be temporarily disabled with the exception of the ADMINISTRATOR account, and all access to Snare will be authenticated and authorised from the LDAP server regardless if the user name exists as a Snare account or not. LDAP Options - Select from LDAP, LDAP/SSL, LDAP/TLS or SASL/TLS. A CA root certificate required for TLS, this will typically be from the Active Directory Domain internal certificate authority. Server - The IP address (or DNS name, as long as the Snare Central Server has been configured to use your local DNS) of your target LDAP or Active Directory server. Ensure the FQDN is exactly as in the server's certificate presents as or authentication will fail. Domain - If specified, the domain will be added to the end of the username for authentication purposes. For example a username of 'auser' and a domain of 'test.local' will imply an LDAP/AD authentication of auser@test.local. Only 'auser' will be used locally on the Snare Central to determine access control settings whenever LDAP Groups option is disabled. Intersect Alliance International Pty Ltd Page 2 of 5

3 Port - The port to your LDAP server. Port 389 is the standard unencrypted port. Enable compatibility mode for Win Server 2012 R2 - Selecting this option will force a lower version of TLS. There is a known issue when trying to bind Snare Central to a MS Active Directory using LDAP/TLS on a Windows Server 2012 R2. OpenLDAP s GnuTLS and Microsoft s SChannel implementations are not compatible for TLS 1.2 negotiation during AD/LDAPS binding, therefore it s necessary to disable TLS1.2 before attempting binding. Enable LDAP Groups for Snare Central - Selecting this enables the authorization of groups defined in the Active Directory server for Snare. Please note that when LDAP Groups option is enabled, all local accounts are temporarily disabled with the exception of the ADMINISTRATOR account. As Snare Central Server 7.2 does not support for both kinds of users authentication simultaneously. If enabled, any valid LDAP user that belongs to one or more of the Snare groups, will have access to Snare Central Web interface but will not be able to see any objectives until the correct access rights are granted to each objective. This is set via the System Administrative Tools Manage Access Control configuration objective. LDAP Username and LDAP Password - Enter a valid LDAP user name and password to test authentication and retrieve the valid groups that are set. Info When Enable LDAP Groups for Snare Central option is enabled the first time, Snare Central needs to retrieve the group's information from the LDAP or AD server. This can be done specifying a valid user and password with enough access rights to retrieve this information. Please note that both user name and password will not be stored by Snare. NOTE: Before retrieval, a super group Snare_Central and all defined subgroups need to be defined first, so have to exist in the LDAP or AD server before the roles can be configured. These new groups must be members of Snare_Central group to be recognized by the Snare Central Server. Test - This button is available to help verify that LDAP setup values are correct, verified by an overlay screen with a success or error message will be displayed to the user. Note When Enable LDAP Groups for Snare Central option is disabled the user must still have an account on the Snare Central Server with the same name as the one in LDAP/AD server, in order to log in. However this requirement is overridden when LDAP Groups option is enabled. LDAP/AD Server Configuration Requirements First, a group called Snare_Central needs to be defined in the LDAP server. This name is a requirement as Snare server will search for this super group for retrieving all other Snare Server groups. Snare Central Server can retrieve any number of groups required as long as they are defined in the LDAP server and they are all member of the super group Snare_Central. Any user account belonging to (is member of) any of the above groups will be granted access to but will not have permission to access any Objective until Objectives access rights have been established on a group level basis via the LDAP Access Control tool (see corresponding section further down). Users belonging to (member of) Snare_Central super group will not have access to Snare Server as this group is for group membership only. So no user should be member of Snare_Central super group. All password complexity and password expiry verifications will need to be carried out in the LDAP server. Manage Access Control Navigate to System Administrative Tools Manage Access Control. This interface provides an easy and flexible Intersect Alliance International Pty Ltd Page 3 of 5

4 tool for changing Objectives Access Rights at the group level for both local groups or LDAP defined groups. Every objective on the Snare Central can be individually secured so that only authorised staff have access to it. Access is granted at group level; therefore, an LDAP user must be attached to an LDAP group in order to view or change an objective. This also applies to local users and groups. Manage Access Control detects if Snare is in LDAP mode or not, and will change access rights for objectives accordingly. One of two access rights levels can be granted: Access permissions. This provides a user with read to view the output of this objective, and also regenerate the objective. Change permissions. This provides a user with the ability to change the configuration settings for the objective as well as view and regenerate the function. A single, multiple or complete tree structures of existing objectives are able to be selected, to add or delete Access permissions (Read access) and/or Control permissions (Write access) to those objectives for a group or set of groups. By selecting in the Objective name (or Objective directory) at the tree representation on the left (see image above) will select or deselect the objective(s). Once selected, one or more groups are required to be highlighted from the list provided and at least one access level to be checked in order to apply to selected objectives. For example, in the above image a single objective named Flag Changes is selected and Access Control (Read access) for the Snare_Server_Default group is about to be granted. In addition, users who create, or clone an objective, are identified as the owner of the objective. Both the owner, and Snare Server ADMINISTRATOR have the ability to Delete the objective and Add new users to the objective. Note When LDAP Active Directory and Enable LDAP Groups for Snare Central options are enabled in Configuration Wizard, Manage Access Control will affect only LDAP users and groups and will have no effect on local Snare users or groups, hence all legacy options for access control like the Access Control (lock icon) in Snare s top panel and setting Folder Permissions on directories in the Reports navigation tree will have no effect on LDAP permissions for the same objectives. Info pre v7.2.0 Prior to Snare Central Server v7.2, only remote user authentication was available with the constraint that the remote user should correspondingly have a local Snare account. This still remains to be true when the option for remote LDAP Groups support is disabled (in Configuration Wizard). Intersect Alliance International Pty Ltd Page 4 of 5

5 About Intersect Alliance Intersect Alliance, part of the Prophecy International Holdings Group, is a team of leading information technology security specialists. In particular, Intersect Alliance are noted leaders in key aspects of IT Security, including host intrusion detection. Our solutions have and continue to be used in the most sensitive areas of Government and business sectors. Intersect Alliance intend to continue releasing tools that enable users, administrators and clients worldwide to achieve a greater level of productivity and effectiveness in the area of IT Security, by simplifying, abstracting and/or solving complex security problems. Intersect Alliance welcomes and values your support, comments, and contributions. For more information on the Enterprise Agents, Snare Server and other Snare products and licensing options, please contact your local Prophecy Group office as follows: The Americas +1 (800) Toll Free +1 (303) Denver Asia Pacific Adelaide Australia Europe and the UK +44 (797) intersect@intersectalliance.com Visit Intersect Alliance International Pty Ltd Page 5 of 5