ChangeAuditor 5.5. For LDAP User Guide

Transcription

1 ChangeAuditor 5.5 For LDAP User Guide

2 2011 Quest Software, Inc. ALL RIGHTS RESERVED This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use without the written permission of Quest Software, Inc. The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA USA legal@quest.com Refer to our Web site for regional and international office information. Trademarks Quest, Quest Software, the Quest Software logo, and ChangeAuditor are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. For a complete list of Quest Software s trademarks, please see Other trademarks and registered trademarks are property of their respective owners. Third Party Contributions ChangeAuditor contains some third party components. For a complete list, see the Third Party Components page in the ChangeAuditor online help. ChangeAuditor for LDAP User Guide March 2011 Version 5.5

3 Table of Contents About This Guide Overview Conventions About Quest Software Contacting Quest Software Contacting Quest Support Chapter 1 ChangeAuditor for LDAP Overview Introduction Client Components/Features Chapter 2 Configure LDAP Auditing Introduction Excluded LDAP Query Auditing Page LDAP Auditing Wizard LDAP Query Events Settings Chapter 3 LDAP Query Searches/Reports Introduction Run LDAP Query Reports Create Custom LDAP Query Search Appendix A LDAP Query Event Details Index

4

5 About This Guide Overview Conventions About Quest Software Contacting Quest Software Contacting Quest Support

6 ChangeAuditor for LDAP Overview This document has been prepared to assist you in becoming familiar with ChangeAuditor for LDAP. This User Guide contains information about the additional features that are available when a valid ChangeAuditor for LDAP license has been applied. It is intended for network administrators, consultants, analysts, and any other IT professionals using the product. Separate user guides are available that describe the functionality provided when a valid ChangeAuditor for Active Directory, ChangeAuditor for Exchange, ChangeAuditor for Windows File Servers, ChangeAuditor for EMC, ChangeAuditor for NetApp, ChangeAuditor for SQL Server, or ChangeAuditor for LDAP license is applied. In addition, there is a ChangeAuditor User Guide that explains the core functionality available regardless of the product license that has been applied. Conventions In order to help you get the most out of this guide, we have used specific formatting conventions. These conventions apply to procedures, icons, keystrokes and cross-references. ELEMENT Select Bolded text Italic text Bold Italic text CONVENTION This word refers to actions such as choosing or highlighting various interface elements, such as files and radio buttons. Interface elements that appear in Quest products, such as menus and commands. Used for comments. Used for emphasis. Blue text Indicates a cross-reference. When viewed in Adobe Reader, this format can be used as a hyperlink. Used to highlight additional information pertinent to the process being described. Used to provide Best Practice information. A best practice details the recommended course of action for the best result. 6

7 About This Guide ELEMENT CONVENTION Used to highlight processes that should be performed with care. Used to highlight a troubleshooting tip pertaining to the topic being described. Used to highlight permissions required to perform the action being described. + A plus sign between two keystrokes means that you must press them at the same time. A pipe sign between elements means that you must select the elements in that particular sequence. About Quest Software Quest Software simplifies and reduces the cost of managing IT for more than 100,000 customers worldwide. Our innovative solutions make solving the toughest IT management problems easier, enabling customers to save time and money across physical, virtual and cloud environments. For more information about Quest go to Contacting Quest Software Phone Mail Web site (United States and Canada) info@quest.com Quest Software, Inc. World Headquarters 5 Polaris Way Aliso Viejo, CA USA Please refer to our Web site for regional and international office information. 7

8 ChangeAuditor for LDAP Contacting Quest Support Quest Support is available to customers who have a trial version of a Quest product or who have purchased a Quest product and have a valid maintenance contract. Quest Support provides unlimited 24x7 access to SupportLink, our self-service portal. Visit SupportLink at From SupportLink, you can do the following: Review thousands of solutions from our online Knowledgebase Download the latest releases and service packs Create, update and review Support cases View the Global Support Guide for a detailed explanation of support programs, online services, contact information, and policy and procedures. The guide is available at: 8

9 1 ChangeAuditor for LDAP Overview Introduction Client Components/Features

10 ChangeAuditor for LDAP Introduction Many applications use Active Directory as an LDAP directory to provide user credentials, group membership information, and other application data. During a directory migration or restructuring project, e.g. to handle a corporate acquisition, it is important to understand the ways that applications use the directory before migrating the directory structure, to avoid unnecessary application downtime. Obtaining this information from Windows audit logs is extremely difficult, as it requires setting SACLs and aggregating security audit logs from all domain controllers in the environment. ChangeAuditor for LDAP monitors directory access across all domain controllers in the environment and aggregates that information in a central database identifying LDAP-enabled applications and how they use Active Directory. The LDAP access data gathered by ChangeAuditor for LDAP can then be used during Active Directory forest migration and restructuring projects. LDAP auditing is only available if you have licensed ChangeAuditor for LDAP. The product will not prevent you from using these features, however, associated events will not be captured unless the proper license is applied. To verify that ChangeAuditor for LDAP is licensed: 1. From the member server where ChangeAuditor is installed, launch the License Manager (Start All Programs Quest Software ChangeAuditor License Manager). 2. On the About ChangeAuditor dialog, verify that the License Status field is set to 'Installed' for ChangeAuditor for LDAP. 3. If the License Status field indicates that ChangeAuditor for LDAP is 'Uninstalled', use the Update License button to locate and apply the appropriate license. 10

11 ChangeAuditor for LDAP Overview Client Components/Features The following table lists the client components and features that require a valid ChangeAuditor for LDAP license. The product will not prevent you from using these features, however, associated events will not be captured unless the proper license is applied. To hide unlicensed ChangeAuditor features from the Administration Tasks tab (including unavailable audit events throughout the client), use the Action Hide Unlicensed Components menu command. Note this command is only available when the Administration Tasks tab is the active page. CLIENT PAGE Administration Tasks Tab FEATURE Agent Configuration Page: Configuration Setup Dialog - LDAP Query Events settings Discard results less than nn Discard elapsed less than nn milliseconds Discard duplicates that occur within nn minutes Audit Task List: Excluded LDAP Note: See Configure LDAP Auditing for information on using these settings and on excluding containers from LDAP auditing. Event Details Pane What Details: Type Scope Results SSL/TLS Occurrences Since Elapsed Sign/Seal Filter Attributes Note: See the LDAP Query Event Details appendix for a description of these fields. 11

12 ChangeAuditor for LDAP CLIENT PAGE Events Search Properties FEATURE Facilities: LDAP Query What tab: Subsystem LDAP Query Note: See LDAP Query Searches/Reports for information on using the What tab to create a custom LDAP Query search definition. Searches Page Built-in Reports: All reports that include the event in the LDAP Query facility. 12

13 2 Configure LDAP Auditing Introduction Excluded LDAP Query Auditing Page LDAP Auditing Wizard LDAP Query Events Settings

14 ChangeAuditor for LDAP Introduction Because the overhead of recording each LDAP read operation is likely to be high, ChangeAuditor allows you to optimize the process by summarizing similar operations from the same client, and only record the summary periodically. We highly recommend that you perform the following steps to optimize the LDAP auditing/reporting process to reduce the number of events being generated: Use the Excluded LDAP Auditing page to specify the containers to be excluded from LDAP auditing. Use the LDAP Query Event settings to optimize the auditing process and define the interval to be used for recording LDAP operations. This chapter provides instructions for excluding containers from LDAP auditing, as well as a description of the Excluded LDAP Auditing page and LDAP Auditing wizard. It also explains the LDAP Query Events settings available on the Configuration Setup dialog which can be used to summarize LDAP activity and reduce the number of events generated. For a more detailed description of the dialogs mentioned in this chapter, please refer to the online help. Excluded LDAP Query Auditing Page The Excluded LDAP Query Auditing page is displayed when Excluded LDAP (in the Auditing task list) is selected in the navigation pane of the Administration Tasks tab. From this page you can specify the Active Directory containers that are to be excluded from LDAP auditing. Authorization to use the administration tasks on the Administration Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to this page, refer to the ChangeAuditor User Guide for more information on how to gain access to ChangeAuditor tasks. By default, ChangeAuditor for LDAP excludes the following Active Directory containers from auditing: Schema RootDSE Configuration Due to the high volume of LDAP queries performed against these containers, it is recommended that you do NOT remove these from the exclusion list. 14

15 Configure LDAP Auditing From this page, you can add additional containers to be excluded or remove containers from the exclusion list. The Excluded LDAP Query Auditing page contains an expandable view of Active Directory containers excluded from LDAP auditing. Initially, the containers mentioned above will be listed on this page. To add a container to this list, use the Add tool bar button. Once added, the following information is provided for each container: FIELD Type Status Scope Excluded Container DESCRIPTION Displays the type of container. Indicates whether the container is temporarily excluded (enabled) or not excluded (disabled) from LDAP auditing. Displays the scope of coverage: Object - excludes this object only Subtree - excludes this object and all child objects Displays the name of the container selected for exclusion. To add a container to the LDAP Exclusion list: 1. Open the Administration Tasks tab. 2. Select the Auditing task button at the bottom of the navigation pane (left-hand pane). 3. Select Excluded LDAP (under the Global heading in the Auditing task list) to open the Excluded LDAP Auditing page. 4. Select the Add tool bar button to launch the LDAP Auditing wizard. 5. Select one of the scope options at the top of the page: RootDSE - select this option to exclude the RootDSE object. (Selecting this container will NOT exclude child objects.) 15

16 ChangeAuditor for LDAP This Object and All Child Objects - select this option to specify the container(s) to be excluded. (Selecting a container will also exclude any child objects.) 6. If the This Object and All Child Objects option is selected, use the Browse and Search pages to locate and select a directory object. Use the Add button to add the selected directory object to the Excluded Containers list at the bottom of the page. Repeat this step to add additional directory objects to the Excluded LDAP Auditing list. 7. Select the Finish button to close the wizard and return to the Excluded LDAP Auditing page, where your selections will now be listed. To disable the exclusion of a container: The disable feature allows you to temporarily stop excluding an individual container from LDAP auditing without having to remove it from the Excluded LDAP Auditing list. 1. On the Excluded LDAP Auditing page, use one of the following methods to disable the exclusion of a container: Click in the Status cell for the container to be disabled and select Disabled. Right-click the container to be disabled and select Disable. The entry in the Status column for the container will change to Disabled. 2. To re-enable the exclusion of the selected container, use the Enable option in either the Status cell or right-click menu. To delete a container from the exclusion list: 1. On the Excluded LDAP Auditing page, use one of the following methods to delete a SQL Auditing template: Select the container to be deleted and use the Delete tool bar button. Right-click the container to be deleted and select Delete. 2. A dialog will be displayed confirming that you want to delete the selected container. Select Yes. 16

17 Configure LDAP Auditing LDAP Auditing Wizard The LDAP Auditing wizard is displayed when you select the Add tool bar button on the Excluded LDAP Auditing page. This wizard consists of a single page which allows you to locate and select Active Directory containers that are to be excluded from LDAP auditing. The following table provides a description of the fields and controls in the LDAP Auditing wizard. ADD OBJECT(S) TO EXCLUDE FROM LDAP QUERIES PAGE 17

18 ChangeAuditor for LDAP RootDSE Select this option to exclude the RootDSE container. Note: Selecting this option will NOT exclude any child objects. This Objet and All Child Objects Browse page Select this option to specify the container(s) to be excluded. When this option is selected, use the Browse and Search pages as described below to locate and select a container. Displays a hierarchical view of the containers in your environment allowing you to locate and select the container(s) to be excluded from LDAP auditing. Once you have selected a container, use the Add button to move the entry to the list at the bottom of the page. Search page Use the controls at the top of the Search page to search your environment to locate the container(s) to be excluded from LDAP auditing. Once you have selected a container, use the Add button to move the entry to the list at the bottom of the page. Options page Use the Options page to modify the search options or global catalog to be used to retrieve directory objects. Note: For more information on using the Browse, Search or Options pages, refer to Directory Object Picker in the online help or ChangeAuditor User Guide. Excluded Containers List The containers selected for exclusion from LDAP auditing are displayed in the list box located across the bottom of this page. Use the buttons located above this list box to add and remove containers: Add - select a container in the Browse or Search page and select the Add button to add it to the list. Remove - select an entry in the list and then select the Remove button to remove it. 18

19 LDAP Query Events Settings Configure LDAP Auditing Use the LDAP Query Events settings on the Configuration Setup dialog to optimize the LDAP auditing process by summarizing similar operations from the same client, and only record the summary periodically. Use the following settings to summarize similar operations from the same client and only record the summary in the LDAP query event: Discard results less than nn This setting instructs ChangeAuditor to only generate an event if an LDAP query returns more or equal to the number of results specified. The default value is 0; therefore ChangeAuditor will generate an event even if the LDAP query returns no results. Discard elapsed less than nn milliseconds This setting instructs ChangeAuditor to only generate an event if the LDAP query takes longer than or equal to the specified number of milliseconds. The default value is 20 milliseconds. Discard duplicates that occur within nn minutes This setting defines how long LDAP events are to be held to determine if duplicates have occurred before they are forwarded to the ChangeAuditor client. The default is 15 minutes meaning ChangeAuditor will gather LDAP query events and hold them in a queue to determine if any duplicate queries have been generated during the specified interval. ChangeAuditor will then forward the LDAP Query event to the client specifying how many occurrences of that query where performed during the 15 minute interval. To set the LDAP Query Events settings: 1. Open the Administration Tasks tab. 2. Select the Configuration task button at the bottom of the navigation pane. 3. Select Agent in the Configuration task list to display the Agent Configuration page. 4. Select the Configurations tool bar button. 5. On the Configuration Setup dialog, select an agent configuration from the left-hand pane and then set the LDAP Query Events settings as defined above. 19

20 ChangeAuditor for LDAP 6. Once you have set these settings, select OK to save your selections, close the dialog and return to the Agent Configuration page. 7. Back on the Agent Configuration page, select the ChangeAuditor Agent(s) assigned to the selected configuration and select the Refresh Configuration tool bar button or right-click command. If you do not refresh the agent s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting. The default is every 15 minutes. 20

21 3 LDAP Query Searches/Reports Introduction Run LDAP Query Reports Create Custom LDAP Query Search

22 ChangeAuditor for LDAP Introduction ChangeAuditor for LDAP provides you with the ability to search, report and alert on LDAP-enabled applications and how they use Active Directory. This chapter explains how to run the built-in LDAP Query reports and how to create a custom LDAP query search using the What tab. For a description of the dialogs mentioned in this chapter, please refer to the online help. Run LDAP Query Reports To run the All LDAP Events report: Running this report will retrieve all the LDAP query events captured for Active Directory containers being audited. 1. Launch the ChangeAuditor Client and open the Searches tab. 2. In the explorer view (left-hand pane), expand the Shared Built-in Reports All Events Report folder. 3. Locate and double-click All LDAP Events in the right-hand pane. 4. This will display a new Search Results page displaying the LDAP Query events captured over the last seven days. To run a more specific LDAP query report: In addition to the All LDAP Events report, ChangeAuditor for LDAP ships with some additional LDAP query reports, which are located in the LDAP Query Reports folder. 1. Open the Searches tab. 2. In the explorer view, expand the Shared Built-in Reports LDAP Query Reports folder. 3. Locate and double-click one of the LDAP Query reports in the right-hand pane. 4. This will display a new Search Results page displaying the LDAP Query events that meet the search criteria defined in the selected search. By default, the LDAP Query reports display additional LDAP details (such as, LDAP Object Canonical, LDAP Occurrences, LDAP Results, etc.) in the Search Results page. 22

23 LDAP Query Searches/Reports Create Custom LDAP Query Search The following scenario explains how to use the What tab to create custom LDAP query searches. If you wanted to, you can use the other Search Properties tabs to define additional criteria: Who - allows you to define the users, computers or groups to be included (or excluded) in the search Where - allows you to define the agent, domain and/or site where the search is to be conducted (or not conducted) When - allows you to define a date/time range to limit your search Comments - allows you to search the comments for specific words or string of characters To search Active Directory container(s) for LDAP queries: 1. Open the Searches page. 2. In the explorer view, expand and select the folder where you want to save your search. Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all ChangeAuditor users. 3. Select the New tool bar button at the top of the Searches page (or right-click a folder and select the New New Search menu command). 4. On the Info tab, enter a name and description for the search. 5. Open the What tab, expand the Add tool bar button and select Subsystem LDAP Query. This will display the Add Active Directory Containers dialog. 23

24 ChangeAuditor for LDAP 6. On the Add Active Directory Container dialog, select one of the following options to define the scope of coverage: All Active Directory Objects - select to search all objects. This Object - select to search the selected object(s) only. This Object and Child Objects Only - select to search the selected object(s) and its direct child objects. This Object and All Child Objects - select to search the selected object(s) and all subordinate objects (in all levels). 7. When a scope other than All Active Directory Objects is selected, the directory object picker will be activated allowing you to select the object(s) to be included in the search definition. Use the Browse or Search page to search your environment to locate and select the Active Directory container(s) to be included. Use the Options page to view or modify the search options or global catalog to be used to retrieve directory objects. 8. In addition, you can optionally enter one or more LDAP query parameters to be included in the search definition: Filter - allows you to search for a filter string used in an LDAP query. This field uses the Like operator; therefore, you can enter a partial string of characters to have ChangeAuditor return any LDAP queries that use a filter string that contains the characters entered. Attributes - allows you to search for attributes that are being queried. This field uses the Like operator; therefore, you can enter a partial string of characters to have ChangeAuditor return 24

25 LDAP Query Searches/Reports any LDAP queries that query attributes that contain the characters entered. Results >= - allows you to search for LDAP queries that have returned a specific number of results. Enter (or use the arrow controls to specify) the number of results to be included in the search definition and ChangeAuditor will display the LDAP queries that have returned results equal to or greater than the number entered. Elapsed (ms) >= - allows you to search for LDAP queries that take a certain amount of time to complete. Enter (or use the arrow controls to specify) the number of milliseconds to be included in the search definition and ChangeAuditor will display the LDAP queries that took the specified number of milliseconds or longer to run. Transports - allows you to specify the type of transport protocols used to secure LDAP queries. To include a specific transport, clear the All Transports check box. All Transports - this option is selected by default indicating that all LDAP events regardless of the transport protocol used will be included. SSL / TLS - select (check) this option to include LDAP queries that are secured using SSL or TLS technology. Sign / Seal - select (check) this option to include LDAP queries that are signed using Kerberos-based encryption. For pre-5.5 LDAP Query events, this field is NULL in the database; therefore, All Transports will be included regardless of this setting. When you specify more than one LDAP query parameter, ChangeAuditor uses the or operator and will return LDAP query events that meet any of the LDAP query parameters specified for the selected Active Directory container. 9. Once you have selected an Active Directory container (and any LDAP query parameters) to be included, select the Add button to add it to the Selection list at the bottom of the dialog. Select the Exclude the Above Selection(s) check box if you want to search for changes to all Active Directory containers EXCEPT those listed in the what list. Select the Runtime Prompt check box on this dialog to prompt for an Active Directory container every time the search is run. 25

26 ChangeAuditor for LDAP 10. Once you have selected the Active Directory container(s) to be included in the search, use the OK button to save your selection and close the dialog. 11. Once you have defined the search criteria to be used, you can either save the search definition or run the search. To save the search definition without running it, select Save. To save and run the search, select Run. 12. When this search is run, ChangeAuditor will search for LDAP query events based on the search criteria specified on the What tab and display the results in a new search results page. To search for an object that already has an audited LDAP query event in the database: 1. Open the Searches page. 2. In the explorer view, expand and select the folder where you want to save your search. Selecting the Private folder will create a search that only you can run and view, whereas selecting the Shared folder will create a search which can be run and viewed by all ChangeAuditor users. 3. Select the New tool bar button at the top of the Searches page (or right-click a folder and select the New New Search menu command). 4. On the Info tab, enter a name and description for the search. 5. Open the What tab, expand the Add with Events tool bar button and select Subsystem LDAP Query. 6. On the Add Active Directory Container dialog, select an object from the list and use the Add button to add it to the selection list at the bottom of the page. 7. Select OK to save your selection and close the dialog. 8. Once you have defined your search, you can either save the search definition or run the search. To save the search definition without running it, select Save. To save and run the search, select Run. 9. When this search is run, ChangeAuditor will search for the LDAP Query events based on the search criteria specified on the What tab and display the results in a new search results page. 26

27 LDAP Query Event Details Appendix A LDAP Query Event Details This appendix provides a description of the What details that are provided on the Events Details pane for an LDAP Query event. WHAT FIELDS What Event Action Facility Type Scope Results SSL/TLS DESCRIPTION Shows the container that was queried. For example, on LDAP bind operations, this displays the name (DN) being bound to; on LDAP search operations, this displays the baseobject of the search; and on LDAP compare operations, this displays the entry (DN) of the object being compared. Displays LDAP Query Displays Other Displays LDAP Query Displays the type of query: LDAP GC Displays the scope of the query: This object only This object and all children Displays the number of results returned as a result of the LDAP query. Indicates whether the LDAP query is secured using the SSL (Secure Socket Layer) or TLS (Transport Layer Security) technology. 27

28 ChangeAuditor for LDAP WHAT FIELDS Occurrences Since DESCRIPTION Displays the number of times the LDAP query occurred during the specified interval. Displays the date and time when the LDAP query was first initiated. Elapsed Displays how long the LDAP query took to run. Zero (0) indicates that it took less than a millisecond to complete. Sign/Seal Filter Attributes Indicates whether the LDAP query is signed using Kerberos-based encryption. Displays the filter string used in the LDAP query. Displays the attributes that were queried. 28

29 INDEX A Administration Tasks tab Excluded LDAP Auditing page 14 LDAP Query Event settings 19 All LDAP Events Report 22 C Client components/features 11 Configure LDAP query auditing 14 Add a container to exclusion list 15 Delete container from exclusion list 16 Disable the exclusion of a container 16 Set LDAP query event settings 19 Create a custom LDAP Query search 23 R Run All LDAP Events Report 22 S Searches page Create a custom search 22 V Verify valid license 10 D Delete container from exclusion list 16 Disable exclusion of a container 16 Discard duplicates that occur within nn minutes setting 19 Discard elapsed less than nn milliseconds setting 19 Discard results less than nn setting 19 E Event details 27 Excluded LDAP Auditing page 14 Exclusion list Add container 15 Delete container 16 Disable exclusion of a container 16 L LDAP Auditing wizard 17 LDAP query auditing Configuring 14 Event details 27 Event settings 19 Overview 10 Q Quest Software Contacting headquarters 7 Contacting support 8 29

30