Scenario 2

Consider the following scenario:

  • A user role needs access to a set of Windows Agents over weekdays with Privilege elevation. Administrator wants to monitor the activity as well as controlling file access and blocking certain applications from execution.

  • The same user role needs access on those resources over weekends without elevation.

Steps to provide privileged access in this scenario:

Resource Pools

  • Link the Agents to appropriate Credential Vaults, where all the required credentials are present.

  • Create a Resource Pool with all the required Windows Agents in it.

User Roles

  • Create a User Role with all the required users.

Assignments

  • Create an Assignment between the created Resource Pool and User Role.

Permissions

  • Create a Credential Provider Permission with below options

    1. Privilege Elevation as required (Example: Administrator).

    2. Define Time Restrictions with Monday 00:00 to Saturday 00:00.

    3. Enable Session Capture and Video Capture.

    4. Configure Enhanced Access Control for Files. Directories and Executables and add it in this permission.

  • Create another Credential Provider Permission with below options:

    1. Privilege Elevation with any other account which does not have any higher privileges.

    2. Define Time Restrictions with Saturday 00:00 to Monday 00:00.

    3. Disable Session Capture and Video Capture.

A sample procedure is listed below:

Configure the LDAP Repository

  1. Click Settings on the Administration Console.

  2. Click LDAP Servers on the left pane and click Add New.

  3. Perform the following actions:

    1. Specify Domain Name of the LDAP Server.

    2. Type is set to Active Directory Services, by default.

    3. Specify Host Name/IP Address of the LDAP Server.

      NOTE:Port is set to 636, by default.

    4. Select SSL and Verify Certificate to secure the connection via SSL by using the CA certificate.

    5. Click GetBaseDN to fetch the appropriate details.

    6. Set Scope to Subtree.

    7. Specify User DN, User Name, and Password that are required for retrieving the user details and domain details for authentication.

  4. Click Save.

Add a Resource

A resource is a network device, application, repository, or data storage device to which users can get privileged access.

  1. Click Credential Vault on the Administration Console.

  2. Click +Add > Windows > Windows Host.

  3. In Name, specify a name for Windows Server.

    For this example, the resource name is set to winsrv16.intech.com.

  4. Click Next.

  5. Perform the following actions to configure the Connection details:

    1. In Host Name/IP Address, specify the host name or IP address of Windows Server.

      NOTE:Port is set to 3389, by default.

    2. Select Active Directory Domain displays the list of domains if the specified host name is associated to a domain.

      In this example, Windows Server is a standalone device and does not need to be associated to any Active Directory Domain.

  6. Click Next.

  7. Click Finish.

  8. Click the resource that you have added and click Credentials tab.

  9. Click Add.

  10. Specify the User Name, Password, and Privilege Type required to access Windows Server.

Defining a User Role

  1. Click Access Control > User Roles > Create.

  2. Specify the role name in Name and additional information about the role in Description.

  3. Click Next.

  4. Click +Add > LDAP Users and Groups.

  5. Select the domain and select the preferred user or group.

    In this example, the user AlbertJ is selected.

  6. Click Add > Create.

Create a Resource Pool

  1. Click Access Control > Resource Pools > Create.

  2. Specify Name and Description for this resource pool.

    For this example, the resource pool name is set to Windows Server with AD Users.

  3. Select Type as Windows Servers under Agentless.

  4. Click Next.

  5. Click Add and select the resource that you added in .

  6. Click Add.

  7. Select Default Credentials that is required to allow users to access the resource.

  8. Click Create.

Create an Assignment and Grant Permission

  1. Click Access Control > Assignments > Create.

  2. Select the Resource Pool that you created in .

  3. Select the User Role that you defined in .

    The Description gets generated with the name that you have provided for Resource Pool and User Role.

  4. Click Add and select Web RDP permission in the Privilege Elevation window.

    NOTE:By default, Credential is set to Default to allow users to access Windows Server with the default credentials that is configure for the resource.

  5. Click Next.

  6. Select Custom Days and set the days and time frame as follows:

    1. Select Mon to Fri as the days.

    2. Specify 9 to 6 as time frame for the selected days.

  7. Click Next.

  8. Disable Secondary Authentication.

  9. In User Message, specify a message that is displayed to users on connecting to the resource.

  10. Click Next > Finish > Create.

Add LDAP Repository

  1. Click Settings on the Administration Console.

  2. Click LDAP Servers on the left pane and click Add New.

  3. Perform the following actions:

    1. Specify Domain Name of the LDAP Server.

    2. Specify Host Name/IP Address of the LDAP Server.

      NOTE:By default, Type is set to Active Directory Services and Port is set to 636.

    3. Select SSL and Verify Certificate to secure the connection via SSL by using the CA certificate.

    4. Click GetBaseDN to fetch the appropriate details.

    5. Set Scope to Subtree.

    6. Specify User DN, User Name, and Password that are required for retrieving the user details and domain details for authentication.

  4. Click Save.

Add Linux System as a Resource

  1. Click Credential Vault on the Administration Console.

  2. Click +Add > Linux/Unix/Network Device > SSH.

  3. In Name, specify a name for the Linux system.

    For this example, the resource name is set to lnx-mchs.intech.com.

  4. Click Next.

  5. Perform the following to configure the Connection details:

    1. In Host Name/IP Address, specify the host name or IP address of the Linux system.

      NOTE:Port is set to 22 by default.

    2. Click Get Host Key to get the key of the specified machine.

  6. Click Next.

  7. Click Finish.

  8. Click Count of the resource that you have added.

  9. Click Add in the Credentials tab.

    NOTE:Credential Type is set to Password by default, this grants elevated access to the resource using the specified Password.

  10. Specify the User Name, Password, and Privilege Type required to access Linux system.

  11. Click Add.

Defining a User Role

  1. Click Access Control > User Roles > Create.

  2. Specify the role name in Name and additional information about the role in Description.

  3. Click Next.

  4. Click +Add > LDAP Users and Groups.

  5. Select the domain and select the preferred user or group.

    In this example, the user Silvia is selected.

  6. Click Add > Create.

Create a Resource Pool

  1. Click Access Control > Resource Pools > Create.

  2. Specify Name and Description for this resource pool.

    For this example, the resource pool name is set to lnx-ssh-pool.

  3. Select Type as SSH Servers under Agentless.

  4. Click Next.

  5. Click Add and select the resource that you added in Add Linux System as a Resource.

  6. Click Add.

  7. Select Default Credentials that is required to allow users to access the resource.

  8. Click Create.

Create an Assignment and Grant Permission

  1. Click Access Control > Assignments > Create.

  2. Select the Resource Pool that you created in Create a Resource Pool.

  3. Select the User Role that you defined in Defining a User Role.

    The Description gets generated with the name that you have provided for Resource Pool and User Role.

  4. Click Add and select Web SSH permission.

    NOTE:By default, the Credential is set to Default in the Privilege Elevation window.

  5. Click Next.

    NOTE:Time Restriction is set to All Days (24 hours) by default, allowing Linux system to be accessible for 24 hours without any restriction.

  6. Click Next.

  7. Disable Secondary Authentication.

  8. In User Message, specify a message that is displayed to users on connecting to the resource.

  9. Click Next > Finish > Create.