Site Administrator for SharePoint. Security Auditor. Quick Start Guide

Transcription

1 Site Administrator for SharePoint Security Auditor Quick Start Guide

2 2011 Quest Software, Inc. ALL RIGHTS RESERVED. This document contains proprietary information protected by copyright. The software described in this document is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Quest Software, Inc. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA legal@quest.com Refer to our website for regional and international office information. TRADEMARKS Quest, Quest Software and the Quest Software logo are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. For a complete list of Quest Software's trademarks, please see Other trademarks and registered trademarks are property of their respective owners. DISCLAIMER The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. Site Administrator for SharePoint Security Auditor Updated March 25, 2011 Software version 1.3.6

3 CONTENTS About This Guide... 3 Overview... 3 Conventions... 3 Overview... 4 Introduction... 5 About Security Auditor... 5 Deployment... 6 How Security Auditor Works... 6 System Requirements... 7 Getting Started... 9 Setting Up Components... 9 Security Auditor Console... 9 Security Auditor Service... 9 Required Rights and Permissions Auditing Configuration Testing the Configuration Step 1: Check the Event Log Step 2: View Reports About Quest Software, Inc Contacting Quest Software Contacting Quest Support Third Party Contributions DotNetZip Library Microsoft Public License (Ms-PL) i

4

5 Quick Start Guide About This Guide Overview This document has been prepared to assist you in becoming familiar with Site Administrator for SharePoint Security Auditor. This User Guide contains the information required to configure and use Site Administrator for SharePoint Security Auditor. It is intended for network administrators, consultants, analysts, and any other IT professionals using the product. Conventions In order to help you get the most out of this guide, we have used specific formatting conventions. These conventions apply to procedures, icons, keystrokes and crossreferences. ELEMENT Select Bolded text Italic text Bold Italic text Blue text CONVENTION This word refers to actions such as choosing or highlighting various interface elements, such as files and radio buttons. Interface elements that appear in Quest products, such as menus and commands. Used for comments. Introduces a series of procedures. Indicates a cross-reference. When viewed in Adobe Acrobat, this format can be used as a hyperlink. Used to highlight additional information pertinent to the process being described. Used to provide Best Practice information. A best practice details the recommended course of action for the best result. Used to highlight processes that should be performed with care. + A plus sign between two keystrokes means that you must press them at the same time. A pipe sign between elements means that you must select the elements in that particular sequence. 3

6 Site Administrator for SharePoint Security Auditor Overview Site Administrator for SharePoint Security Auditor helps you track the activity in your SharePoint environment by providing comprehensive auditing. This document explains how Security Auditor works and details its system requirements. Then it explains how to set up Security Auditor and make sure that it is functioning properly. 4

7 Quick Start Guide Introduction About Security Auditor Site Administrator for SharePoint Security Auditor helps you track the activity in your SharePoint environment by providing comprehensive auditing using a specialized event log. The scope of Security Auditor auditing includes all activity that involves the following: Documents Folders List items Sites and site collections List and site permissions List item permissions Reports are available for all data that is audited. You can work with the reports directly in the Reporting Services Web interface or using the Site Administrator for SharePoint Security Auditor snap-in extension. 5

8 Site Administrator for SharePoint Security Auditor Deployment To deploy Site Administrator for SharePoint Security Auditor, simply install the Security Auditor Service on the SharePoint server of your choice (only one server in a farm). The components of the installed package are automatically distributed by SharePoint to all the servers in the farm, and farm-wide auditing is automatically activated. How Security Auditor Works The fully deployed Site Administrator for SharePoint Security Auditor solution works as follows: 1. The Security Auditor event handlers watch for events and record them to the SharePoint database, similar to native SharePoint auditing. 2. The Security Auditor Service gets the necessary records from the SharePoint database, converts them to event log format, and stores them locally on the SharePoint server in the Security Auditor log. 3. The Security Auditor Service transfers the data in this log to the audit database used as the SRS data source for reports. The default interval between database writes is 30 seconds. 6

9 Quick Start Guide System Requirements Security Auditor supports SharePoint environments with the following characteristics: SharePoint versions 32-bit or 64-bit SharePoint Portal Server bit or 64-bit Windows SharePoint Services bit SharePoint Foundation bit SharePoint Server 2010 SharePoint Foundation 2010 and SharePoint Server 2010 are not fully supported. For a full list of limitations, refer to the Release Notes document. SharePoint (32-bit) should be installed on a computer running one of the following operating systems: 32-bit Windows Server 2003 (Enterprise or Standard Edition) Service Pack 2 or higher 32-bit Windows Server 2003 R2 (Enterprise or Standard Edition) SharePoint (64-bit) should be installed on a computer running one of the following operating systems: 64-bit Windows Server 2003 (Enterprise or Standard Edition) Service Pack 2 or higher 64-bit Windows Server 2003 R2 (Enterprise or Standard Edition) 64-bit Windows Server 2008 (Enterprise or Standard Edition) Service Pack 1 or higher 64-bit Windows Server 2008 R2 (Enterprise or Standard Edition) SharePoint deployment configurations Standalone deployment integrated with Active Directory Farm deployment integrated with Active Directory 7

10 Site Administrator for SharePoint Security Auditor SQL Server versions 32-bit or 64-bit SQL Server 2005 (Standard Edition) Service Pack 1 or higher 64-bit SQL Server 2008 (Standard Edition) Clustered SQL Server 2005 or 2008 that meet the same requirements SQL Server (32-bit) should be installed on a computer running one of the following operating systems: 32-bit Windows Server 2003 (Enterprise or Standard Edition) Service Pack 2 or higher 32-bit Windows Server 2003 R2 (Enterprise or Standard Edition) SQL Server (64-bit) should be installed on a computer running one of the following operating systems: 64-bit Windows Server 2003 (Enterprise or Standard Edition) Service Pack 2 or higher 64-bit Windows Server 2003 R2 (Enterprise or Standard Edition) 64-bit Windows Server 2008 (Enterprise or Standard Edition) Service Pack 1 Microsoft SQL Server Reporting Services SQL Server 2005 Reporting Services Service Pack 1 Standard Edition or higher 8

11 Quick Start Guide Getting Started Setting Up Components Security Auditor Console To install the Security Auditor Console, use the QSASA.Console x.msi installation file located in the Security Auditor folder on the Quest Site Administrator for SharePoint CD. During the Security Auditor Console setup you will be asked to specify the SQL Server and database that will be used for producing SharePoint reports. Security Auditor Service Installing the Security Auditor Service First, you have to deploy the Security Auditor Console. Then install the Security Auditor Service using this console. You can also install the Security Auditor agent from QSASA.Agent.x xxx.msi or QSASA.Agent.x xxx.msi located in the Security Auditor folder on the Quest Site Administrator for SharePoint CD. Where you install the Security Auditor Service depends on your SharePoint configuration: SHAREPOINT CONFIGURATION INSTALLATION SERVER Farm deployment Standalone deployment Choose any dedicated application or front-end server The SharePoint server During the Security Auditor Service setup you will be asked to specify the following: 1. Credentials that the service will use. 2. What to do with audit data that may already be present in the SharePoint audit database: Ignore all existing data Import all data to the Site Administrator for SharePoint Security Auditor log Import data that is as recent as you specify 9

12 Site Administrator for SharePoint Security Auditor Whether to periodically clean up existing audit data from the SharePoint audit database. If you enable cleanup, you can configure how often to clear old entries and how old they must be to be deleted. 4. Specify the Quest Site Administrator Configuration Database. This step will be skipped if you run the Security Auditor Service setup from the Security Auditor Console. If gathering is set up to obtain old records from the SharePoint audit database (those recorded before Security Auditor Service deployment), then only SharePoint native events will be retrieved, and they may lack important data that is brought in by custom events. Required Rights and Permissions This section contains information about the user rights and permissions necessary to install and run Quest Site Administrator for SharePoint Security Auditor components. Security Auditor Console and Service Setup The account you use to install the Security Auditor Console must be a member of the Administrators computer local group on the Quest Site Administrator for SharePoint machine. During the Security Auditor Service setup you will be asked to specify the logon information used by the Security Auditor Service. This account must have the following rights: Membership in the local Administrators group on the computer where you run the setup. The Log on as a service right will be automatically granted to this account during the setup. Configuration Database Preparation The account under which you will run the Security Auditor Console setup or Security Auditor Service setup must have the db_owner role for the Configuration Database and the sysadmin server role on the SQL Server where the Audit Database is located. Audit Database Preparation To prepare the SharePoint Audit Database, take the following steps: Create the audit database under the SQL sysadmin user account and run the setup_sql_auditdatabase.sql (located on the product CD) script against this database. Make sure that the account under which you will run the Security Auditor Console setup has the following rights to work with newly created database: Select Connect 10

13 Quick Start Guide The SQL sysadmin user must give the following permissions to the account under which you run the Security Auditor Service to work with audit database: Connect Select Update Insert Rights and Permissions Needed on the SharePoint Server Membership in the local Administrators group on the computer where you run the Security Auditor Service setup. Membership in the Farm Administrator group in the SharePoint farm where you run the Security Auditor Service setup. The db_owner role for the SharePoint Configuration Database. The db_reader role and INSERT, DELETE, EXECUTE permissions for all SharePoint content databases, including those created after the Security Auditor Service installation. Auditing Configuration For the purposes of this document, you can use the largest auditing scope available: farm-wide auditing. It is activated automatically by Security Auditor setup, and you do not need to perform any manual configuration; changes to documents, folders, lists, sites, and site permissions are already audited in your SharePoint environment. 11

14 Site Administrator for SharePoint Security Auditor Testing the Configuration This section describes how to make sure that the necessary audit data is available in the configuration you have prepared. The data flow is shown in the following figure: Application Server or Front-End Server in a SharePoint Farm Site Administrator for SharePoint - Security Auditor Service Site Administrator for SharePoint - Security Auditor Log SharePoint Audit Database Reporting Database SSRS Server SharePoint SQL Server SQL Server Reports To verify that the configuration works, perform some actions that it is supposed to audit, and check the following: 1. Whether the related events are written to the Site Administrator for SharePoint Security Auditor log, which involves the logging functionality 2. Whether you can create a report with the events, which involves the database import functionality 12

15 Quick Start Guide Step 1: Check the Event Log To get Security Auditor audit data, deliberately perform some activity that it is designed to watch for. A quick and easy way is to do the following: 1. Upload a Microsoft Office document on a SharePoint site in the "Shared documents" document library. 2. Check out the document. 3. Edit the document. 4. Save and check in the document. 5. Rename the document. 6. Delete the document. After you have done this, wait for a few minutes, and then check the log for the corresponding events. For that, use the Event Viewer MMC snap-in (locally or remotely) to open the Site Administrator for SharePoint Security Auditor log on the SharePoint server where the Security Auditor Service is installed. Look for events 200, 201, 202, 203, 204, and 211. If these events are present, auditing is working properly. Step 2: View Reports To view reports, use the Site Administrator for SharePoint snap-in with the Security Auditor extension. The reports are available under the Security Auditor node. Check the "Document Content Changes" report to see if it reflects the changes you made on step 1. You can also run the "Raw events analysis" report if you want more details. 13

16 Site Administrator for SharePoint Security Auditor About Quest Software, Inc. Quest simplifies and reduces the cost of managing IT for more than 100,000 customers worldwide. Our innovative solutions make solving the toughest IT management problems easier, enabling customers to save time and money across physical, virtual and cloud environments. For more information about Quest go to Contacting Quest Software Mail Quest Software, Inc. World Headquarters 5 Polaris Way Aliso Viejo, CA USA Web site Refer to our Web site for regional and international office information. Contacting Quest Support Quest Support is available to customers who have a trial version of a Quest product or who have purchased a Quest product and have a valid maintenance contract. Quest Support provides unlimited 24x7 access to SupportLink, our self-service portal. Visit SupportLink at From SupportLink, you can do the following: Retrieve thousands of solutions from our online Knowledgebase Download the latest releases and service packs Create, update and review Support cases View the Global Support Guide for a detailed explanation of support programs, online services, contact information, policies and procedures. The guide is available at: 14

17 Quick Start Guide Third Party Contributions Quest Site Administrator for Share SharePoint Security Auditor contains some third party components (listed below). Copies of their licenses may be found at DotNetZip Library 1.5 This product uses DotNetZip Library 1.5, a small, easy-to-use class library for manipulating.zip files. It can enable.net applications written in VB.NET, C#, any.net language, to easily create, read, and update zip files. The source code of DotNetZip Library 1.5 is distributed under Microsoft Public License (Ms-PL) 1.0, as follows: Microsoft Public License (Ms-PL) Published: October 12, 2006 This license governs use of the accompanying software. If you use the software, you accept this license. If you do not accept the license, do not use the software. 1. Definitions The terms reproduce, reproduction, derivative works, and distribution have the same meaning here as under U.S. copyright law. A contribution is the original software, or any additions or changes to the software. A contributor is any person that distributes its contribution under this license. Licensed patents are a contributor s patent claims that read directly on its contribution. Top of page 2. Grant of Rights (A) Copyright Grant- Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free copyright license to reproduce its contribution, prepare derivative works of its contribution, and distribute its contribution or any derivative works that you create. (B) Patent Grant- Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free license under its licensed patents to make, have made, use, sell, offer for sale, import, and/or otherwise dispose of its contribution in the software or derivative works of the contribution in the software. Top of page 3. Conditions and Limitations (A) No Trademark License- This license does not grant you rights to use any contributors name, logo, or trademarks. (B) If you bring a patent claim against any contributor over patents that you claim are infringed by the software, your patent license from such contributor to the software ends automatically. (C) If you distribute any portion of the software, you must retain all copyright, patent, trademark, and attribution notices that are present in the software. (D) If you distribute any portion of the software in source code form, you may do so only under this license by including a complete copy of this license with your distribution. If you distribute any portion of the software in compiled or object code form, you may only do so under a license that complies with this license. (E) The software is licensed as-is. You bear the risk of using it. The contributors give no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this license cannot change. To the extent permitted under your local laws, the contributors exclude the implied warranties of merchantability, fitness for a particular purpose and non-infringement. 15