Rebasoft Auditor Administration Guide

Transcription

1 Copyright Rebasoft Limited:

2 Release 2.1, Rev. 1 Copyright Notice Copyright 2009,2010 Rebasoft Ltd. All rights reserved. REBASOFT Software, the Rebasoft logo, Rebasoft Auditor are registered trademarks of Rebasoft Ltd in the United Kingdom and other countries. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. All specifications are subject to change without notice. Rebasoft assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Rebasoft reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Disclaimer THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR REBASOFT REPRESENTATIVE FOR A COPY. Copyright Rebasoft Limited:

3 Table of Contents Introduction... 5 New features for V Compliance...6 Application structure...7 Using Rebasoft Auditor Browsing sites and devices Filtering the list of sites & devices IP Forensics VLAN overview MAC forensics User forensics Searches Events Watch list White list Tagging rd Party Integration Calling Rebasoft Auditor from other applications Installation and Configuration Minimum System Requirements System parameters Installing Rebasoft Auditor Logging in for the first time Installation of License key Licensing User administration System settings administration System SNMP Community strings Syslog settings for Alert output OID Vendor database MAC Address - Company ID Device administration Add a device Changing device settings Sites administration User Lookup administration Copyright Rebasoft Limited:

4 User lookup with LDAP User lookup with Active Directory Active Tests Appendices Appendix 1: Rebasoft Auditor V2.1 Release notes Appendix2: Glossary Appendix 3: System settings and information Performance Appendix 4: Troubleshooting Knowledgebase Rebasoft Auditor log SNMP Problems Interface display problem Known Issues Appendix 5: Third Party Software Components Appendix 6: End User Licence Agreement Copyright Rebasoft Limited:

5 Introduction Rebasoft Auditor is designed to report on users and devices connected to your network and where they are located. The system uses your network switches, routers and firewalls as the principle data source, collecting information using SNMP. This makes Rebasoft Auditor quick and cheap to deploy. In addition to networking data, Rebasoft Auditor can collect UserID information via Active Directory and LDAP and relate it to the devices. Once the data has been processed, the information is available, and searchable, to Rebasoft Auditor users for a variety of purposes. In addition to information collected by Rebasoft Auditor it is also possible to relate external data to the network for example HR or asset information, and have this reported and searchable along with networking information, providing a real-world dimension. Rebasoft Auditor s information can be used by operations staff, on help desks for example, or security teams or compliance officers. In all cases, the powerful search and reporting facilities will save time and money. In addition to capturing and reporting information, Rebasoft Auditor has revolutionary alerting capabilities to show the presence of watched devices and, on a per-site basis, alert on unknown devices accessing the network. Active Tests and 3 rd party integration capabilities can show what those devices are capable of and what they are doing on your network. Key features of Rebasoft Auditor include: Track all devices accessing the network by MAC address IP and DNS Resolution to MAC Address UserID resolution to IP from LDAP & Active Directory Manual and automatic tagging of information from external systems MAC address resolved to physical ports and locations via user defined sites User selectable maps for Sites Instant Active Tests to verify remote IP and ports Watch list alerting for specific MAC addresses accessing the network White list alerting on new devices accessing the network at monitored sites Extensive executive and operations graphical reporting SNMP real-time and historic interface status for devices Powerful searches on MAC, IP, UserID and other text strings Free port tracking and reports Unlimited data retention User configurable device grouping Extensive 3 rd party integration and full URL control Low system resource and overhead with extensive configuration options Simple and quick deployment Rebasoft Auditor can help assist with incident management, distinguishing between moves, changes and normal operations. Laptop Management is eased; allowing identification of roaming devices and even blacklisted devices on the network. Rebasoft Auditor can help ensure mobile devices comply with security policy, identifying devices and relating them to physical/network locations. Rebasoft Auditor can also assist in monitoring and planning network changes. Rebasoft Auditor can help: Copyright Rebasoft Limited:

6 1) Security professionals see a history of device access to (or tried to access) the network, thus assisting with compliance regulations. 2) Network managers see unused ports in their network, driving up asset utilisation, and reducing costs. 3) Security professionals to be alerted when a blacklisted device or user accesses the network preventing rogue access and loss of data. New features for V2.1 Rebasoft Auditor V2 sees the introduction of new features built upon the previous release and based upon customer requests and requirements: 1) Tagging the ability to index and report on information imported and associated in Auditor 2) The ability to store and search on DNS cached results for the network 3) User lookup for Windows Active Directory on from Auditor on Linux 4) Various performance and small usability enhancements. To support these new features, there have been a number of minor changes to the application which are described in the sections below. A list of changes can be viewed in Appendix 1: Rebasoft Auditor V2.1 Release notes Compliance On 15 March 2006 the European Union formally adopted Directive 2006/24/EC, on "the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC" The Directive requires Member States to ensure that communications providers must retain, for a period of between 6 months and 2 years, necessary data as specified in the Directive: to trace and identify the source of a communication; to trace and identify the destination of a communication; to identify the date, time and duration of a communication; to identify the type of communication; to identify the communication device; to identify the location of mobile communication equipment. Most organisations have a requirement, whether by legislation or via corporate governance that means recording network access is required. Rebasoft Auditor can be a valuable information and forensics source. Copyright Rebasoft Limited:

7 Application structure Rebasoft Auditor has been designed with ease of use in mind. Information is displayed both graphically and in table form depending on user requirements. The reports view shows summary level in graphical form at the Network, Site and Device levels, providing an easily assimilated view of Interfaces and MAC addresses. The Operations view allows a workflow drill down from Site to Device to details via VLAN, Interfaces or MACs. Alternatively users can take advantage of the powerful search function. The screen shot below shows the main areas for interacting with Rebasoft Auditor: The Searches input allows searching in the selected month on any string. See Searches for more information on searching. The Admin selector is only shown to admin class users and provides the navigation to the Admin & configuration functions in Rebasoft Auditor. The Sites and Device selector lists the sites tree structure and devices contained within site. VLANs, interfaces and MAC s see on each device can be directly accessed from the tree view. See Sites administration for more details in setting up and administering sites. Information selected in the sites and devices frame is then displayed in the Display frame. Finally, the Status frame displays system information, including license status and utilisation and a link to system event alerts. Table sorting Most of the tables in Rebasoft Auditor can be sorted by column; simply click the mouse on the desired column heading. The first click will sort from low to high, the second from high to low: Copyright Rebasoft Limited:

8 To aid comprehension, lists are paginated. To navigate around a list, the table modifier is displayed at the foot of the table: By default, 10 list items are displayed, but this can be increased by changing the Show: value from the dropdown. The first page of the list can be displayed by clicking: The last page of the list can be displayed by clicking: The previous page of the list can be displayed by clicking: The next page of the list can be displayed by clicking: CSV exporting of data is available from paginated reports Navigating reports From each of the graphical reports, it is possible to zoom the time frame in and out by selecting in the graph. Simply left click at the start & drag the mouse to the desired end time frame. The menu will automatically appear showing the options available. Note: When zooming on Dashboard, Site or Device overview on one selected report, Rebasoft Auditor will automatically zoom other visible reports to the same timeframe In addition to zooming, it is possible to select reports for the selected site and timeframe. Copyright Rebasoft Limited:

9 Timeline manipulation In the User, IP, MAC and VLAN forensics reports, Rebasoft Auditor displays timelines for easy visual assimilation of information. It is possible from these time lines to move back and forward along the time line at a particular resolution, and to zoom in or out. The default display for all time-lines is 8 days To move back along time at the current resolution click To move forward along the timeline click the right arrow To Zoom out (to view more data on the time line) click To Zoom in for more detailed data on the time line click It is also possible to view the detailed data behind the time line by clicking Details underneath the timeline. To aid visualising information on screen, it is also possible to arrange timelines and details to suit user requirements in lining up IP and MAC over time. Copyright Rebasoft Limited:

10 Using Rebasoft Auditor Once Rebasoft Auditor is set-up and collecting information, it can be reported upon. There are three main methods accessing data and drilling into reports: Browsing sites and devices used for collection Searching Events such as Watch list or White list alerts Browsing sites and devices Rebasoft Auditor allows users to logically drill down from Sites to Devices to VLANs, Interfaces or MACs within a few clicks. Navigation is simply an exercise in expanding or collapsing sites that you have defined, clicking hyperlinks or through the Site visuals. An expanded view of all sites/devices can be seen using the collapse/expand all controls at the top of the list: If a site is selected, a preselected image is displayed in the display frame and child sites and/or devices at that level are displayed in the display frame. For example, when USA is clicked, a map of the USA, and the sites contained within the USA site are displayed. Filtering the list of sites & devices To help with getting rapidly to the right device, V2.1 introduces list filters. To access the Sites & Devices filter, click the icon next to the heading To find the device of interest, simply start keying the start of the ID, Rebasoft Auditor will dynamically compress the list Copyright Rebasoft Limited:

11 A site summary is displayed above the map including any White list alerts have been seen. It is also possible for users to position sites and devices on the visuals and save them for the next user using the save icon next to the Site visual. Within the Site overview, a series of time based summary reports for the site are display: MAC Addresses seen Top 5 Devices over time IP Addresses seen Devices seen in use Interfaces seen in use Interfaces by MAC count Interfaces by IP count It is also possible to report on Down interface, (this can be used as the basis of a free ports report), MAC s by Vendor, MAC s by IP count, MAC s by Interface count and IP s by MAC count. Rebasoft Auditor will, during initial device discovery, poll the interface clock for last used status and use this as a start point for last used information. Where interface last used status is unavailable, Rebasoft Auditor will use the polling information. Subsequent polling for interface status will update Rebasoft Auditor down interface reports. From the Sites and devices menu, selecting a device will show a device overview, key reports, interface statistics and lists of the interfaces and VLANs on the device: Copyright Rebasoft Limited:

12 Device attributes provides device level information; showing the hostname, IP address/dns name, OiD type and a description. All information in the device attributes area is searchable within the database. For each device, below the device attribute, users can view statistics for the device. Please note the Tools line this is where 3rd Party Integration for devices appears. We have shown a java SSH/Telnet in the image as an example Below the device attributes are a series of reports and a list of the active and inactive interfaces for the device. In the same way as with Site overview, the reports can be zoomed and selected for additional detailed reporting Rebasoft Auditor also shows the active and inactive interfaces on a device the image below shows areas of interest: 1) To filter on an interface, simply click the interface name for the Inteface overview this will report on MAC address seen over time on that interface, IP s seen, MAC Address vendors. 2) To directly list the MAC addresses on the interface click on the number under the MAC s column Copyright Rebasoft Limited:

13 3) If you move the cursor over the Last Changed column, Rebasoft Auditor will display the MAC, IP/Netmask (if any) configured for the interface 4) Recent shows the last 30 minutes of the interface status in the image above, you can see FastEthernet0/3 has been going up and down, possibly indicating an issue. IP Forensics From any screen it is possible to drill into IP forensics, where details on DNS, UserID, ARP and interfaces are shown for the IP address. New in V2.1 is the ability not only to display DNS, but to cache and search on it in the database. IP information can be located now via MAC, User and DNS. Where possible, Rebasoft Auditor will show last seen MAC to IP association. If the ARP information for the Last Seen MAC is not collected by the system, Rebasoft Auditor cannot display this information. Below the Last Seen entry, Rebasoft Auditor will show if there is any user association with the IP address, and show, over time, which users have been associated with the IP address. The User or green bar can be clicked to navigate to User forensics. IP forensics shows the ARP information for IP relation to MAC address, and where that MAC address has been seen over time. Copyright Rebasoft Limited:

14 On IP forensics and IP address lists Active Tests, if configured for the IP range selected, are executed, and the results displayed. See Active Tests for a detailed description on how this operates. VLAN overview VLAN overview details for the selected VLAN, including device information. Note: VLAN is local is the default VLAN that appears in many devices even if no VLAN s are configured. Rebasoft Auditor displays the MAC Addresses, IP Addresses and Interfaces that the VLAN has been seen: Copyright Rebasoft Limited:

15 MAC forensics MAC forensics allows users to review the IP and connection history of a MAC address: Rebasoft Auditor shows the MAC address, and from the Vendor lookup facility, the Vendor or Manufacturer that has the IP Address assigned. Copyright Rebasoft Limited:

16 If there is an ARP entry on a device for the MAC address, Rebasoft Auditor will show the IP address allocation history of the MAC address. The IP details show the history of IP address assignment to the MAC address. The Connection history shows the connections over time. This is available in graphical timeline view, or tabular view if details are selected. Connections show the interfaces (and device) that the MAC address has been seen on (The MAC Count shows the total number of unique MAC s also on the interface). User forensics User forensics can be used to find the IP and hence the MAC history of a UserID. User forensics whill show the last seen connection for the user relating UserID, to IP address, to MAC Address to Device and interface. Device and Interface details will only be shown if Rebasoft Auditor is collecting information from the device that the users is connected to. Copyright Rebasoft Limited:

17 User forensics will be populated only if has been correctly configured, and Rebasoft Auditor has had sufficient time to start collecting user data from LDAP or security event log sources. Searches Rebasoft Auditor s powerful search engine allows users to search for any string in the currently database. Most users will use the search as way to quickly navigate to the point of interest. Searches return results in for MAC, User ID, IP address, Devices, Interfaces and VLANS: Tip: If you click the search button without entering any parameters, Rebasoft Auditor returns a search of all entries in the database for the current month. Copyright Rebasoft Limited:

18 From here it is matter of clicking on the area of interest to drill down to detailed forensic information. Searching is not limited by time for results, hence any information associated with IP, Users, MACs, device details, interface details or vlan details are catalogued for searching. Tip: You can search for multiple IP addresses by entering a comma between desired IP s Only when you select a search result does Rebasoft Auditor query the database (default 8 days) to see when the item occurred. Information displayed in timelines allows users to view longer or short periods of time as required. Using this method Rebasoft Auditor, for example, does require users to know when someone was on the network to see if they've ever logged in. Searching can be improved by specifying a string or partial string match to be searched on. For example, searching on will bring up all the matching records with the string in this case matching IP addresses and devices. Searching the database in this way would allow help desk staff to quickly identify a user from Active directory, to IP address to MAC to physical location and network port. Active test can then verify the status of the device. Events Rebasoft Auditor alerts users and logs these events to the web console or, optionally, one or more syslog servers. Copyright Rebasoft Limited:

19 Events are classified by type (System, User, Watchlist, Whitelist and device). Clicking any of the hyperlinks will filter the event list to display the relevant information. Events can be deleted, acknowledged or un-acknowledged. These actions do not affect any events that have already been forwarded to any external syslog received configured in Syslog settings for Alert settings. Watch list Rebasoft Auditor is able to help track devices on the network. Whether users require alerts about a rogue access point, or a stolen Laptop, as soon as it is seen on the network, a Watch list alert is displayed and an syslog alert is optionally generated. Clicking on the hyperlink shows a list of watched devices and when seen on the network: Users can click manage the alert or click on the MAC address link to see further details on the device. Copyright Rebasoft Limited:

20 Watch lists can be added via 2 methods. From the MAC forensics screen by clicking the Add Watch entry link: Or via the Watch list admin drop down: Note: Only administrators can add a watch entry Watch lists are configured in the following screen: Copyright Rebasoft Limited:

21 1. Add device (plus a description) to the watch list. 2. Once the watch list device is added, decide on an alerting setting if required. 3. Alerts for watch lists can be multiple and can be deleted without the Watch list entry being deleted. Alerts are only sent when a MAC address is first seen by the Rebasoft Auditor Note: Restarting Rebasoft Auditor does not cause generation of new alerts as the system retains Watchlist status information in the database. If a previously seen MAC address leaves the network (for the CAM hold down period) and Rebasoft Auditor is then restarted you will, of course, generate an alert as this would be classed as a new Watchlist hit. The syslog message will be sent as: messages.2:sep 1 17:32: Rebasoft Auditor Watch Entry Seen:00:1f:c5:ed:ae:23 on Device: ifindex:3 Reason:Wii Copyright Rebasoft Limited:

22 The MAC Forensics screen now also alerts users as to whether the particular device is being watched. White list While list is selectable by site, and is a facility to generate alerts on new devices accessing the network at that site. For example if you have a locked down standard build for a remote location, you can use Rebasoft Auditor to alert on any device not previously seen connecting to the network at that site. White list alerts are reported to the Site overview screen, the events system and, optionally, a syslog receiver. White lists are configured by accessing the admin selector: White list settings provide the ability to start, stop and reset White list monitoring. If a configured site has one or more devices being polled by Rebasoft Auditor, monitoring can be activated by clicking the Monitor button. Copyright Rebasoft Limited:

23 If an asset system already records the MAC address of devices, these can be manually added to Rebasoft Auditor via the Add button. Once monitoring has been activated new devices seen are alerted to the event subsystem, where the device, interface and MAC address are shown. Users can click the MAC address to view MAC forensics White lists, once set up can be changed and updated via the White list administration dialog: Copyright Rebasoft Limited:

24 Newly discovered MAC addresses can be automatically included in the White list by clicking the Reset button. Users can also add a list of MAC addresses by clicking the Add button. MAC addresses can be added singly to the White list by selecting them from the new list Individual MAC addresses can be added by clicking Add to White list Tagging To a non-technical user, a network can be a difficult thing to decipher and understand. Rebasoft Auditor can help with this via the ability to Tag an item with additional information. This information may be something as simple as the ability for a note to be manually entered for example a MAC Address with Mike s desktop pc - through to the same MAC address being associated with data imported or updated from an asset management system. With the right information, It is possible to answer a question like how many dell pc s running Windows XP service pack 3 do I have on my network? Administrators can set any number of extra dimensions available for tagging. There are two methods of tagging within Rebasoft Auditor: 1. Manually set via the Tagging administration dialog 2. CSV import from, for example, excel spread sheet, also set via Tagging administration As soon as a tag has been stored in Rebasoft Auditor it is searchable and available for reporting. In the same way tags can also be deleted (permanently) from the database. As tagged information is available Copyright Rebasoft Limited:

25 from external sources, Rebasoft Auditor also has a way to make that information permanent or transient depending on how the data is imported. Tagging is accessed via the Admin dropdown: Manual tag building and data entry Manual tagging allows administrators to add a category to data types within Rebasoft Auditor. The tagging administration screen allows administrators to add tag categories that can be used within the application. The image below shows the available manual tag types and categories. So for instance, you might want to record the Operating system for a MAC Address (Say Windows 7 ). To build this, you simply key the desired name into the field next to the tag type and hit the green plus button. Copyright Rebasoft Limited:

26 The moment the tag category is added, it is available for use by users: To add information via Auditor, simply click the plus button in this case to add OS details to this Dell MAC Address: If there is more than one category, simply select from the drop-down, key in the information and click add Once the information is added, it is available for search. Information can be deleted by mousing over the tag, and clicking the small red cross to delete: CSV Clearly manual tagging has somewhat limited scope, especially when there are thousands of devices, users and IP s connected to the network. In the case where larger quantities of data need to be added, an import method is needed. If data is available in csv format, the information can be imported into Auditor: Copyright Rebasoft Limited:

27 Simply browse to the spreadsheet (in csv format) and upload to Auditor. Once successfully uploaded, administrators can click on the filename and complete the import process. The workflow confirms: 1. the file-type; CSV (Commas Separated Values) or TSV (Tab Separated Values), 2. whether you wish to include the header line as a value or not. 3. (After pressing the Test button, the data is displayed) 4. Simply select the Tag type where you want the data displayed 5. Enter the category name, and which columns represent the item reference column and the Value column this case, what is the MAC address we wish to associate the data with, and the data column we wish to insert. A future version of Rebasoft Auditor will include the ability to use XML to reference external applications (such as HR or an Asset management system) as the source to replicate the data from. 3rd Party Integration Rebasoft Auditor is an open application and has been designed with powerful integration facilities. Integration can be at the MAC, IP, Interface or Device level. Integration can be selected via the Admin dropdown: Copyright Rebasoft Limited:

28 To enable integration, select the type required, and provide a name. This name will be displayed on the appropriate page under tools: Simply add the desired URL. Rebasoft Auditor provides four main variables: REBA_MAC passes the current MAC address to the URL REBA_IP passes the current IP address to the URL REBA_DEVICE passes the device IP address to URL REBA_INTERFACE passes the interface index to the URL Integrations can be added or deleted, or if the same name is inputted for an existing device, MAC, IP or interface integration, overwritten. Once added, the integration appears as a tool at the IP, MAC, Device or interface level: Copyright Rebasoft Limited:

29 While there are no limits to the number or types of integrations available, Rebasoft recommend no more than 4 or 5 per level be configured to maintain clarity during application use. Calling Rebasoft Auditor from other applications In order to comply with the design goal of being open, all reports and links within Rebasoft Auditor are accessible via a URL. Hence it is possible to call Rebasoft Auditor from any web application. For example, a search with a search parameter can be called via a URL from any web application: argument> To aid security, and prevent users accessing Auditor from a system which they have already authenticated to, there is now the ability to embed portal users credentials into the url of a link called by the 3 rd party application. The portal user settings are set within User administration by simply adding a user name and IP address to the portal users dialog. The url called must include the portaluser=<user Name> parameter within the string. Where the <user name> is configured as above. Security is also provided by the addition of the source IP address from which the portal user is called from. Installation and Configuration Rebasoft Auditor is provisioned using a simple installer that can be run on Windows Server operating systems. This installer can be used for initial installation, software version upgrades and changes in system parameters. Minimum System Requirements The type of system required to run Rebasoft Auditor depends on the number of devices to be polled for management reporting. The following requirements are a guideline; the only way to determine Copyright Rebasoft Limited:

30 requirements is by testing the software s performance in a specific network environment. To this end Rebasoft has packaged a 7-day trial download. Dual core Intel Xeon or AMD similar processor. 2Gb RAM, although performance will benefit from increased RAM, as data is cached in memory prior to writing to the database. 120 Gb SATA 7200rpm+ disk (or greater depending on network size and period of storage). Windows 2003/2008 server. Java Runtime (JRE) V1.6 (or later) installed. PostgreSQL Internet Explorer V6 or later, Mozilla V3 or later (JavaScript must enabled in the browser) x 1024 pixel screen resolution is recommended for client devices accessing Rebasoft Auditor. Rebasoft Auditor is supported in a VMware environment. System parameters Rebasoft Auditor relies on SNMP polling device CAM tables as part of information collection. The software has been extensively tested in large networks and against different device types and vendors. System parameters are set as a result of the testing and in line with system recommendations below. Experience shows that it takes around 1 minute for a device to respond to poll of the CAM table. The system default is for the polling cycle to be completed every 30 minutes. The objective therefore is to set the number of concurrent poller threads to be sufficient to complete to information collection and processing within the allotted time. We recommend that 1 thread be allowed for each 10 devices to be polled. The installation default is for 20 threads, this would allow support of up to 200 devices (with between 5000 and 8000 interfaces). The thread count can be increased subject to network and server load considerations. Installing Rebasoft Auditor Installation is achieved by executing the Rebasoft Auditor installation wizard. This wizard guides administrators through the installation or updating process and allows the specification of a number of parameters it should only take a few minutes to install the system. The installer can be run whether performing a new installation or updating an existing system. In the case of an upgrade, data is preserved; Rebasoft does, however, advise administrators to perform a data backup regularly and especially prior to system upgrade. Note: Due to windows security, we recommend that the installer be run as the Local Administrator To start installation, simply execute the installer: 1) Copyright Rebasoft Limited:

31 2) Click next. Click I Agree to accept the licence agreement. 3) Select components to install and click next. 4) Copyright Rebasoft Limited:

32 Note: The Java installer does not permit spaces in the specification of the destination folder Specify installation directory for installation and click next. 5) For threads setting please see System parameters for more details. If the http or https ports entered are already in use by another application, the installation will prompt you to select an alternative port Click next (If upgrading the installer will stop the Rebasoft Auditor service) Copyright Rebasoft Limited:

33 6) If not installed Rebasoft Auditor will install PostgreSQL and JRE Sometimes, due to windows permissions, postgres will not install. The installer will terminate and a message will request that postgres be installed manually. 7) Copyright Rebasoft Limited:

34 Rebasoft Auditor installs as a system service, a command window should appear during this process 8) Once Rebasoft Auditor installation is complete (administrators can view the details of where files have been installed by clicking the details button) click next.. Logging in for the first time Users and administrators can access Rebasoft Auditor from a workstation with a compliant browser by opening the following address: or DNS address of server>:<port> Copyright Rebasoft Limited:

35 To access Rebasoft Auditor, at the login screen enter the default username and password of admin and admin. We recommend administrators change the default installation password from admin via the User administration function. Until devices are configured, you will see the message below: License Administration Rebasoft Auditor's license is deeply embedded within the application. License information is constantly evaluated as devices are polled for SNMP information. The active interfaces for a device are updated and added to the total count for all devices polled; so from hour to hour and day to day, the number of active interfaces will vary. When the number of active interfaces polled exceeds the licensed number of interfaces, the data for interfaces in excess of the license maximum are not stored in the database for that polling period. If, subsequently, the total number (including the extra ones fall below the license level, data will once again be written to the database) Polling of Copyright Rebasoft Limited:

36 interfaces from a device happens in the order the device presents the data to Auditor, this varies by vendor. Devices are polled in sequence, typically every 30 minutes. Licensing Rebasoft license Rebasoft Auditor on the number of interfaces counted on the devices that are polled by it to collect information. For an 1. The interface must be up (down interfaces do not count towards license) 2. The interface must have a MAC address (virtual interfaces which do not have a MAC address assigned by the device do not count) 3. The MAC address must be unique (MAC addresses that are used across a number of interfaces are only counted once) Rebasoft Auditor shows, for each device configured in Device administration how many interfaces are counted. The license evaluation is re-calculated each Adding a License key When accessing the Rebasoft Auditor web interface for the first time, it runs in trial mode this means it will operate for a period of 7 days unless a license key is applied to the system. License administration is accessed from the Admin dropdown in the top frame, by clicking the arrow: To add a license, simply cut and paste the license string into the New License box and click load license. Copyright Rebasoft Limited:

37 The license will validate and confirmation of the system license will be displayed. If the license level is exceeded, Rebasoft Auditor will not collect information from the additional interfaces until a new key is obtained from a Rebasoft Auditor reseller. Note: After applying the license key, the Rebasoft Auditor service must be restarted to activate the new license level and re-enable device polling. Note: If an invalid license is applied, or a version mismatch is detected, Rebasoft Auditor will write a message to the Rebasoft Auditor log, located in SYSTEM32 directory and will not perform any further polling until a valid license is loaded Licensing Rebasoft license Rebasoft Auditor on the number of interfaces counted on the devices that are polled by it to collect information. For an interface to be counted for license purposes it must conform to the following: 1) The interface must be up (down interfaces do not count towards license) Copyright Rebasoft Limited:

38 2) The interface must have a MAC address (virtual interfaces which do not have a MAC address assigned by the device do not count) 3) The MAC address must be unique (MAC addresses that are used across a number of interfaces are only counted once) Rebasoft Auditor shows, for each device configured in Device administration how many interfaces are counted. The license evaluation is re-calculated each time the device is polled: User administration Rebasoft Auditor offers two levels of security normal user or admin user. Admin users have the ability to create and manage sites, users, devices and communities. Normal users are just able to view reports and information captured by Rebasoft Auditor. This way, administrators could grant access to helpdesk staff without granting privileges to change the Rebasoft Auditor system settings. Users administration is accessed from the Administration dropdown in the top frame; clicking the arrow: Administrators are then presented with Users administration in the information frame: Copyright Rebasoft Limited:

39 To add a user, simply type a name and password and select whether this user is an admin user via the Admin tick box and then click Add user. To reset password or delete a user, click on the username from the list (administrators can also promote or demote a user from admin privileges at this stage). Note: It is possible to remove the default admin user but you must always have at least 1 user with admin rights in the system. Copyright Rebasoft Limited:

40 System settings administration One of the first actions recommended is the configuration of system settings. System level settings are used throughout the application. Here administrators can set-up: System SNMP Community strings Syslog settings for alert output Systems settings (these settings are reserved for future use) Database settings MAC Vendor table OID Vendor database Log level settings System settings are accessed from the Administration dropdown in the top frame (clicking the arrow): A summary of the current system settings and directory locations are shown at the bottom of the system settings page: System SNMP Community strings System level SNMP community strings are used during initial device polling. SNMP strings, if entered during device input, are used first. In the absence of a specified SNMP community string, system level SNMP communities are used in turn until a successful poll is performed. Rebasoft Auditor then stores the successful string with the device, this reduces the number of alerts that a device might generate if a community is used unsuccessfully. It is only necessary to use Read-only strings. Copyright Rebasoft Limited:

41 To add a new community simply type the string into the box & click Add community To remove a community, simply click the cross next to the string to be removed: Syslog settings for Alert output The current release of Rebasoft Auditor has provision for alerting using syslog. Administrators can set multiple syslog servers depending on network preferences. To enter a syslog server, simply specify a name, required level and facility together with the target address. Administrators can also set the syslog level and facility to suit any log processing or alert handling system.. Syslog server receivers can be removed by simply clicking the cross next to the syslog to be removed OID Vendor database The OID Vendor database is used for vendors where Auditor needs to create a specific polling scheme, This dialog allows the Rebasoft development team to rapidly deliver a specific polling type for new types of Copyright Rebasoft Limited:

42 vendor hardware. MAC Address - Company ID IEEE maintains an index of MAC address prefixes in relation to Vendors. This index changes from time-totime, and any new release of Rebasoft Auditor will contain the latest index. If, however, you search Rebasoft Auditor and see a MAC address without a vendor entry, it may be that the index is out-of-date. Since this file is a large file, a facility to download and update Rebasoft Auditor on request if available: Device administration Any device that has a CAM table can be a data source for Rebasoft Auditor this might be Layer 3 switch, Router or Firewall. Rebasoft Auditor uses SNMP to poll device MIB parameters using RFC standards to retrieve the required information from the device. Where a device is not compliant, it is possible to use a custom MIB Rebasoft will consider adding vendor MIBs to Rebasoft Auditor to support customer requirements. We have also provided an over-ride to cater to devices where the MIB definitions present inconsistent results. To add, delete or manage existing devices, administrators should select Devices from the administration dropdown & click the arrow: Copyright Rebasoft Limited:

43 Add a device Devices can be added either directly from their IP address or from their assigned DNS name. Administrators can add up to 10 devices via the add device button. To add more than 10 devices, it is advisable to use the bulk loading dialog. Note: To add a device (or devices) directly to a site, simply select from the site dropdown. If the site selector is none, the device will be added to the All devices site only. To add multiple devices, simply separate with a comma; for example router1, switch1, firewall8 will add 3 devices DNS will resolve the device to the current IP address. Up to 10 devices may be added using this method using IP addresses. To add a range of devices, simply add the start of the range and the end of the range separated with a space; for example will add and scan fifty devices from to For multiple ranges, it is recommended that the bulk load facility is used Copyright Rebasoft Limited:

44 Devices can be bulk loaded by cutting and pasting lines into the Bulk load dialog. The format of the load is shown below: <ipaddress>:<snmpcommunity>:<sitename> This loads a single IP address per line. If snmpcommunity is omitted, Rebasoft Auditor uses the system defaults in turn to contact the device. If SiteName is omitted, device is added to All devices. The colon ( : ) is a field delimiter. If the site does not currently exist, it will be created dynamically <ipaddress_start> <ipaddress_end>:snmpcommunity:sitename In this case the space between the 2 IP addresses indicates that Rebasoft Auditor should add the range of addresses between the two. The same provisions apply for snmpcommunity & SiteName <ipaddress_1>,<ipaddress_2>,<ipaddress_3>:<snmpcommunity>:<sitename> A set of IP addresses separated by commas constitutes a list to be processed. If more than 90 devices are loaded at a time, then the list of devices can be up loaded in a file, the same format rules apply as in single device Changing device settings Once a device has been added to the Rebasoft Auditor database, certain settings can be overridden or adjusted. The list of devices in the Auditor database is shown, a filter is provided to narrow down the list if a large number of devices is present. To select a device to view or edit, simply highlight it from the list. A summary of the device is show, and options, as below, are available for view or override. Copyright Rebasoft Limited:

45 It is possible to enable or disable a device, simply tick the enable box, and then click the Save device button. Failure to click the save device button will cause changes to be lost if navigating away from the page: Rescan will cause the device to be polled using SNMP. Save device will cause the device updated information to be to be saved to the database. Navigation away from this page without saving changes causes them to be lost. Remove device deletes the device from Rebasoft Auditor, but does not delete the device data collected in the current month. Removing a device will stop it being polled for information. A removed device / interface will not count towards the license count, but will still appear in the sites/devices list. Remove device and data removes all device and information collected via that device from the Rebasoft Auditor system for the current month. Any data collected via a different device will still remain in the database. Hence MAC, IP and UserID data will still remain in the system if it has been collected via another device. Test device sends an SNMP get command immediately to the device this helps when troubleshooting SNMP issues while adding devices where for example a firewall port might need to be opened (port 161) to enable successful SNMP polling Reset interfaces reverts any manual changes back to those collected via SNMP from the target device Test bridge table returns the output from the CAM/Bridge table on the target device thus providing a direct cross check that Auditor is returning information from the target device. It is also possible to override standard interface names and add descriptions to aid users: Copyright Rebasoft Limited:

46 If the interface index, or retrieved parameter does not match the desired display, administrators can override the ifindex, name and description displayed. Note: The labels in the reports will be marked with * to differentiate the interface from polled information. Use of this facility should be carefully considered as reports against interfaces may not be accurately shown. Sites administration Rebasoft Auditor provides administrators the ability to model their real-world network with Sites. A Site is simply a container that can comprise devices and/or other sites (child sites). The network can therefore be related to physical or logical locations with, for example, locations being divided into sub-locations that contain devices. A site can contain both devices and sub-sites. Consider the example below: Copyright Rebasoft Limited:

47 In this case, the administrator has defined USA as a top level (or parent) site and New York and San Francisco as sub (or child) sites. New York and San Francisco could themselves contain child sites and/or devices. Note: A site can also be assigned a Visual. A Visual is an image file that is displayed when the site is selected. Visuals are uploaded and assigned when the site is selected. To access Sites administration, select Sites from the administration dropdown in the top frame and click the arrow: To add a site, simply type a name and click the Add New Site button. Once a site has been added it will appear in the Existing sites list. Administrators can add or remove a device by using the cursor to select a device and add or remove it from the members list. Copyright Rebasoft Limited:

48 To remove a site, simply highlight the site & click the Remove site button. Removing a site does not remove the device or data for that device. The device will remain in any other site it is a member of, or will appear in Unallocated devices To rename a site, simply highlight the site, type in the new name and click the Rename Site button. If any device is not a member of a parent site, it is accessible via a dynamically created site named Unassigned Devices. This can be a useful way of tracking any device that is not a member of any site. In the same way a device can be a member of more than one site, so a site may be a child of one or more parent sites. In the display frame, as sites are selected, the configured visual is shown. Child sites or devices can be selected and viewed either by clicking through the map or from the Site and device selector. Copyright Rebasoft Limited:

49 Images can be uploaded via the Visual upload button User Lookup administration A powerful feature of Rebasoft Auditor is the associating of user login information. This allows organisations to search on UserID as well as IP address and MAC. The association of this information makes it easy to find users on the network for help desk and audit purposes. Copyright Rebasoft Limited:

50 Rebasoft Auditor supports user lookup via LDAP systems, such as Novell edirectory, and Windows 2003 & 2008 Active Directory. Since Active Directory does not store user login requests in the directory; rather Microsoft records user logon/logoff information in the system security log, the log must be accessible to the user configured in the User lookup settings. User details are fully searchable once stored in the database. Please note that Rebasoft Auditor polls the directory service configured once per hour, and looks for login records. Hence it may be some time before UserID information appears in the system. To access user lookup, select from the Admin menu: The TAG used in setting up LDAP and Active Directory look up is a label used in reporting. If you have multiple LDAP or PDC/BDC servers, you could tag them with one or more names. For example you have an internal domain of "abccompany.local", but use multiple authentication servers on your network, using "abccompany.local" as a tag for each server being polled will allow Rebasoft Auditor to group all user entries for that group of DC's into a single report. User lookup with LDAP Rebasoft Auditor supports user lookup via LDAP. To add LDAP lookup, administrators should complete the LDAP form below, providing credentials and LDAP parameters. Note: Rebasoft recommends the polling period of milliseconds be left as default, and that a filter of logindisabled=false be applied Copyright Rebasoft Limited:

51 Following configuration, an entry similar to below should be saved: java.naming.provider.url:ldap://x.x.x.x:389 java.naming.factory.initial:com.sun.jndi.ldap.ldapctxfactory java.naming.security.principal:cn=company,ou=servers,o=ldap-servers java.naming.security.authentication:none java.naming.security.credentials:******** java.naming.ldap.attributes.binary:networkaddress Polling Period: Filter:loginDisabled=FALSE User lookup with Active Directory User lookup for Active Directory login information is available for both Windows 2003 or 2008 platforms. Windows authentication lookup allows you to specify a UTC offset for the logs. This is dues to the fact that Windows stores the timestamp in UTC, and an offset may need to be manually set in order for the correct time period to be collected (this being due to the Auditor clock being local server time). To add a lookup, simply specify a tag this identifies which server Rebasoft Auditor has used for the lookup. Specify the server address, domain name and user ID & password. If a polling period different from 10 minutes is required, this can be overridden. It is not recommended to change the UserExcludeFilter period. Copyright Rebasoft Limited:

52 Note: Windows Authentication 2003/2008 lookup uses the System Security Log as the data source. Rebasoft recommend creation of a new user with access privileges to the system security event logs. More information on Manage auditing and security log properties can be found at There are also some direct links to the Rebasoft website with specific information related to Windows 2008 R2 security To verify that a user lookup is working correctly, you can press the test button next to the user lookup entry: The output of the test will be shown in the status area: If required, an existing user lookup configuration can be edited: Active Tests Active test provides the ability to immediately test the presence of an IP address and availability of TCP ports on that IP address or subnet in real time. With SNMP methods of polling IP addresses, the data can be 5 minutes or more out of date and typically just provides a record of an IP address being present on the network in the past. Copyright Rebasoft Limited:

53 Active Test goes further; in that an administrator can define a series of tests to verify the availability of a TCP port, and the response time of those tests. Note: Active Test is only initiated by the operator via the web browser session. Active test is activated only from IP forensics in a subnet with Active tests configured, or commanded via the Active Test All button when displaying a list of IP addresses in a search result. Active Test works by sending a SYN to the target IP address and port. If the port connection is made, Rebasoft Auditor closes the session and records the response time. If the IP/port does not respond, only the single packet is sent and no retransmission occurs. This way, the network overhead is negligible. Active Test provides 2 key benefits: 1) In the absence of any other tools, active test verifies the instant status of a remote IP address, avoiding the need to deploy cable test for initial diagnosis. This speeds up the process of problem solving. The port test can also verify the correct services are showing as available a possible indication of correct functioning of the remote device. 2) Active test can also verify which ports at the end device are available. Active Test can therefore be a security tool to identify end device ports that should not be available a possible indication of miss-configuration, presence of malware or even presence of a rogue device. To access Active Test administration, select from the Admin menu: Active Test administration list tests that are available and the ability to remove them by clicking the delete under action: Copyright Rebasoft Limited:

54 To add a new test select the test type the current version of Rebasoft Auditor supports TCP type tests only. Complete the fields and click the Add Active Test button. The table below describes the settings available for Active test: Field Name Description Settings Subnet Subnet Mask length Description The name is displayed in IP forensics it is recommended that is be short A description of the active test The desired destination TCP port of the Active test. IANA publishes a list of well known port numbers: If a subnet is entered here, only an IP address matching the subnet number and mask (below) will be tested. Enter a bit mask to complete the subnet definition. Copyright Rebasoft Limited:

55 Appendices Appendix 1: Rebasoft Auditor V2.1 Release notes Build 966 Change to site overview graphs to speed up initial display Build 962 Added fwsm arp support Build 961 Changed hourly summary builder to look at collection data rather than database figures, significantly faster for large systems Move launch of summary builder until after all devices have been discovered Build 960 Added the ability to stop a sweep Build 956 Removed bottleneck in summary runner Build 950 Added table partitioning for VoIP Build 948 Fixed time resolution selection on graphs for individual clicks Build 945 Added save parameter feature to System settings Build 940 Changed DNS lookups to be every 1 minute rather than every 5 seconds. Build 922 Fixed watchlist, not adding mac Build 921 Fixed issue whereby if you logout, you had to remove the dologout param from the url. Build 920 Fixed issue with 0 macs, issue with overridden last and first seen being 0 Build 917 Fixed issue with user credentials showing in the url of MA, caused by use of a get instead of a post. Build 916 Fixed issue with dns cache being deleted too early Build 914 Final 2.1 build Build 913 Fixed css issue where tags weren't being coloured correctly, searched for tags should be highlighted Build 909 Added day of week to graphs Build 892 Fixed issue with active tests not being accepted when the description is blank Build 865 Support for Alcatel Build 861 Added file upload option for devices to bulk import Build 859 Changes to nsi file for installer so it correctly detects failed postgresql installer Build 858 Added change to Watch Lists so that the device is highlighted as being watched in MAC Forensics Build 848 Fix for time-bias not being set correctly during Security Event log lookup Build 778 Adding logging to the Security Event log lookups Build 777 Fixed bug whereby delete devices button wasn t appearing in IE when multiple devices were selected Build 773 Device overview page can now be called using either the devicename as collected by snmp or device DNS as resolved by dns Build 772 Added sorting to the devices and site names on the main page site list Build 771 Added CSV export to the paginated tables. Build 769 Adding IP Overview page to site reports Build 762 Enabled Java LDAP Queries for user lookup Build 761 portaluser now implemented. Accessible through the user settings page. You can select users and assign IP addresses for where they can come from without requiring further authentication. url must have the parameter portaluser=username for it to take effect. User rights are maintained so be sure not to enable admin rights for the portal user. Build 760 Tag uploading complete for IPS, users and MACs. Build 755 DNS Caching is now searchable using the normal search input box. Now provides a link to the number of dns names which have been cached and are include the word or number being searched on. Copyright Rebasoft Limited:

56 DNS Cache is updated every 24 hours for all entries. Build 750 Fixed issue whereby drill downs from overview pages were running across the entire server rather than just for that pages elements Build 748 Changes to LastSeen to improve speed Build 745 Changed Last Seen connection to only look in the last 24 hours of data for all components. Build 743 Changed MA to use JInterop rather than vbscripts, this should allow for polling of wmi data from any machine (not just windows) Build 738 Added feature to allow filtering on IP address, Name, SNMP community or SNMP version within the device settings page device selection list. Build 688 Added new fields to the vlantoifindex table to store the latest mac count Build 682 Added ability to filter sites and devices list using the new spyglass beside the sites and devices link Build 680 Forced GC to improve memory usage Build 677 Change to DB pool to improve memory usage. Build 676 Ability to multi select devices in the device settings page for bulk removal. Build 655 Error message given when user trys to add a device whose name can't be resolved to an IP address. User is now alerted about the offending device. Build 633 Add ability to test wmi Build 622 Ability to run MAC Vendor report from VLAN overview pages Build 611 Add ability to set logging level (done from systems settings page) Build 587 can't install MA postgress on servers with VStrong password policy Build 561 Change passwords so they are always hidden (ldap and user) Add new count option to paginator, now has 10,25,50,100,200 and 400 options.* Build 538 Comma separated IP search added for multiple exact ips Appendix2: Glossary ARP Table DNS CAM Table LDAP MAC MIB SNMP Address Resolution Protocol (ARP) Table is a mapping of MAC addresses to IP addresses. This table is needed by hosts in order to send information in a network. ARP is defined in RFC 826. Domain Name System or Domain Name Server an IP protocol via which names for computers or applications can be resolved to the correct IP address. Content Addressable Memory (CAM) table is used by a layer 2 Ethernet switch to copy bits from one port to another where the destination network device resides. The MAC addresses for the CAM table are populated using ARP. Lightweight Directory Access Protocol is an application protocol for querying and modifying directory services running over TCP/IP. LDAP is used by Rebasoft Auditor to determine the user and relate to the MAC or IP Address. Media Access Control address is a unique identifier assigned to most network adapters or network interface cards (NICs) by the manufacturer for identification. Unlike IP V4, there are 2 48 possible addresses Management Information Base (MIB-II) is an area of device memory where system parameters and other relevant information can be written by a device and retrieved using SNMP to other systems. The MIB may include CPU, bandwidth utilisation or CAM table entries. The MIB data is often volatile and can be overwritten or lost if a device loses power Simple Network Management Protocol is used to monitor network-attached devices for conditions that warrant administrative attention. Rebasoft Auditor Copyright Rebasoft Limited:

57 Site DBMS uses SNMP to obtain information from managed devices in the network. Site is simply a logical grouping of devices. Data Base Management System software used to store, organise and retrieve information for example PostgreSQL Appendix 3: System settings and information Performance Performance is used to monitor the system and provide information on collection from devices. The system presents a list of Devices, Interfaces, VLANs, CAMs, MACs, ARPs and other parameters at the system level. Graphs also provide system memory use information. Since Rebasoft Auditor caches data in RAM, the more memory available, the better system performance is. A chart also shows the amount of free disk space on the current server, so that administrators can ensure that data storage problems are avoided. Appendix 4: Troubleshooting Knowledgebase A comprehensive knowledge base is available at Most issues related to installing, configuring and using Rebasoft Auditor can be resolved here. Copyright Rebasoft Limited:

58 Rebasoft Auditor log By default Rebasoft Auditor outputs messages to the C:\WINDOWS\SYSTEM32 directory. If users experience a problem, we recommend that this file be copied and included when making a support request. SNMP Problems Users may see a device, where the VLAN, Interfaces and MAC s columns have question marks. This may indicate an SNMP problem (can be viewed in events with the device filter): Resolutions: 1) Verify that the a valid community is configured in System SNMP Community strings for the device 2) Assuming IP connectivity to the device is possible, ensure: the device is enabled for SNMP polling the SNMP ACL has the source address of the Rebasoft Auditor server any firewall or NAT device is passing port 161/162 traffic Interface display problem If Rebasoft Auditor is unable to determine a value, it will display?? (double question mark) in place of a value. For example in the device overview, the interface list is shown below: The cause of this may be due to the fact that the logical configuration for that interface has been removed or changed. Other unknown device or status conditions may be due to the fact that the device stopped responding to Rebasoft Auditor polling in the current month. Resolution: a) Verify the device is currently responding to SNMP polling from Rebasoft Auditor b) Verify the configuration is still valid you may wish to make a note on devices administration to indicate the interface configuration has been removed or changed. c) Remove device from the Rebasoft Auditor devices list. Known Issues Juniper Networks ScreenOS based firewall devices have inconsistent reporting of ARP & CAM in relation to interfaces. Rebasoft have provided an override mechanism to provide a work around. See Changing Copyright Rebasoft Limited:

59 device settings for further details, but still interface status may not be determined for the interface depending on the screenos version used. Appendix 5: Third Party Software Components Rebasoft Auditor makes use of several third party libraries, distributed under various licenses. Copyright Rebasoft Limited: