Examining the Elevated SSH Session without the Thick Client

Let us assume an organization, Intech Data, Inc. wants to assess the user actions during the elevated session to the Linux system that functions as the Web Server of the organization. The Linux system is accessed without the thick clients, such as PuTTy, MobaXterm, and so on. In the elevated session, an employee can access Linux system with the root permissions.

This example refers to the following user profiles:

  • Markus: An administrator of Intech Data, Inc.

  • Silvia Pereria: An employee of Intech Data, Inc.

Markus wants to implement Linux Agentless Web SSH to secure the elevated session from internal misuse. With this implementation, authorized employees can access Linux system through the User Console for elevated access and each Keystore is captured and recorded for auditing purposes. Also, Markus has the authority to inspect the live session and perform the following upon noticing any suspicious activity, such as changing the system configuration, installing an unauthorized application, and so on:

  • Terminate the active session and send a notice to the user

  • Block access to the elevated session

The following diagram depicts the requirement of this use case:

This section explains the prerequisites, flow of actions, and step-by-step configuration details to achieve this requirement.

Flow Diagram

The following diagram illustrates the sequential flow of configuration required for implementing the Linux Agentless Web SSH:

To achieve this requirement, Markus performs the following tasks:

  1. Add LDAP Repository

  2. Add Linux System as a Resource

  3. Defining a User Role

  4. Create a Resource Pool

  5. Create an Assignment and Grant Permission

Prerequisites

  • The Privileged Access Manager is installed with the required Agentless module.

    NOTE:The agentless component of Privileged Access Manager (agentless) is supported only on SLES 12 (64-bit), SLES 15 (64-bit), Oracle Linux 8 (64-bit), and RHEL 8(64-bit).

  • Ensure to enable the Access Control Engine option in Server Settings > Policy Engine.

  • Import the CA certificate on the system where you have installed Privileged Access Manager to enable communication over Secure Sockets Layer (SSL).

    For more information, see Exporting the Certificate From the Active Directory Server.

Add LDAP Repository

  1. Click Settings on the Administration Console.

  2. Click LDAP Servers on the left pane and click Add New.

  3. Perform the following actions:

    1. Specify Domain Name of the LDAP Server.

    2. Specify Host Name/IP Address of the LDAP Server.

      NOTE:By default, Type is set to Active Directory Services and Port is set to 636.

    3. Select SSL and Verify Certificate to secure the connection via SSL by using the CA certificate.

    4. Click GetBaseDN to fetch the appropriate details.

    5. Set Scope to Subtree.

    6. Specify User DN, User Name, and Password that are required for retrieving the user details and domain details for authentication.

  4. Click Save.

Add Linux System as a Resource

  1. Click Credential Vault on the Administration Console.

  2. Click +Add > Linux/Unix/Network Device > SSH.

  3. In Name, specify a name for the Linux system.

    For this example, the resource name is set to lnx-mchs.intech.com.

  4. Click Next.

  5. Perform the following to configure the Connection details:

    1. In Host Name/IP Address, specify the host name or IP address of the Linux system.

      NOTE:Port is set to 22 by default.

    2. Click Get Host Key to get the key of the specified machine.

  6. Click Next.

  7. Click Finish.

  8. Click Count of the resource that you have added.

  9. Click Add in the Credentials tab.

    NOTE:Credential Type is set to Password by default, this grants elevated access to the resource using the specified Password.

  10. Specify the User Name, Password, and Privilege Type required to access Linux system.

  11. Click Add.

Defining a User Role

  1. Click Access Control > User Roles > Create.

  2. Specify the role name in Name and additional information about the role in Description.

  3. Click Next.

  4. Click +Add > LDAP Users and Groups.

  5. Select the domain and select the preferred user or group.

    In this example, the user Silvia is selected.

  6. Click Add > Create.

Create a Resource Pool

  1. Click Access Control > Resource Pools > Create.

  2. Specify Name and Description for this resource pool.

    For this example, the resource pool name is set to lnx-ssh-pool.

  3. Select Type as SSH Servers under Agentless.

  4. Click Next.

  5. Click Add and select the resource that you added in Add Linux System as a Resource.

  6. Click Add.

  7. Select Default Credentials that is required to allow users to access the resource.

  8. Click Create.

Create an Assignment and Grant Permission

  1. Click Access Control > Assignments > Create.

  2. Select the Resource Pool that you created in Create a Resource Pool.

  3. Select the User Role that you defined in Defining a User Role.

    The Description gets generated with the name that you have provided for Resource Pool and User Role.

  4. Click Add and select Web SSH permission.

    NOTE:By default, the Credential is set to Default in the Privilege Elevation window.

  5. Click Next.

    NOTE:Time Restriction is set to All Days (24 hours) by default, allowing Linux system to be accessible for 24 hours without any restriction.

  6. Click Next.

  7. Disable Secondary Authentication.

  8. Enable File Transfer/Upload to allow file transfer from the SSH session.

    NOTE:When the File Transfer/Upload is enabled the Clipboard toggle enables automatically.

  9. In User Message, specify a message that is displayed to users on connecting to the resource.

  10. Click Next > Finish > Create.

After Markus implements Linux Agentless Web SSH, the following are possible scenarios:

Scenario

Result

Silvia logs in to the User Console and accesses the elevated session on Linux. Later, she executes some commands.

Each command is recorded and the live session video is captured. No malicious activity is detected.

Silvia installs malware on Linux SSH unintentionally.

The install procedure is recorded. When Markus goes through the recorded session and notices malware installation, he notifies Silvia to uninstall the identified malware.

Markus is monitoring the live session and Silvia attempts to modify the security controls.

Markus terminates the session and blocks access to Linux SSH. Later, he drafts a mail with the reason and sends it to Silvia.

Silvia deletes a configuration file.

The action is recorded and saved in the Reports. Markus can take relevant actions while auditing the report.