Proxy User Security Mechanism (Virtual Users)

Transcription

1 Prxy User Security Mechanism (Virtual Users) June 28, 2012 RepliWeb, Inc., 6441 Lyns Rad, Ccnut Creek, FL Tel: (954) , Fax: (954) Supprt:

2 Attunity Prxy User Security Guide 2012 Attunity Ltd. All rights reserved. The infrmatin in this manual has been cmpiled with care, but Attunity Ltd. makes n warranties as t its accuracy r cmpleteness. The sftware described herein may be changed r enhanced frm time t time. This infrmatin des nt cnstitute a cmmitment r representatin by Attunity and is subject t change withut ntice. The sftware described in this dcument is furnished under license and may be used and/r cpied nly in accrdance with the terms f this license and the End User License Agreement. N part f this manual may be reprduced r transmitted, in any frm, by any means (electrnic, phtcpying, recrding r therwise) withut the express written cnsent f Attunity Ltd. Windws, Windws XP and Windws Vista are trademarks f Micrsft Crpratin in the US and/r ther cuntries. UNIX is a registered trademark f Bell Labratries licensed t X/OPEN. Any ther prduct r cmpany names referred t in this dcument may be the trademarks f their respective wners. Please direct crrespndence r inquiries t: RepliWeb, Inc Lyns Rad Ccnut Creek, Flrida USA Telephne: (954) Fax: (954) Sales & General Infrmatin: Dcumentatin: Technical Supprt: Website: inf@repliweb.cm dcs@repliweb.cm ii

3 Attunity Prxy User Security Guide Table f Cntents Intrductin Security Rules... 2 Security Rules Parsing Users and Rules Management... 4 Defining Users... 5 Updating the Submit Cmmand... 7 Managing Rules Examples User Cnfiguratins Mapping All Users t One User Rules Cnfiguratins Allwing Cnnectin frm the Web UI Only Allwing SSL-nly cnnectins: Allwing Backup & Restre in SSL mde: iii

4 Attunity Prxy User Security Guide Intrductin The RepliWeb User Accunt Prxy is a layer within the RepliWeb R-1 and RDS platfrms that acts as bth an incming security reference mnitr and as a User prxy. Nte: The samples prvided in this dc are applicable t R-1 and RDS, using the respective cnsle and cmmand lines. A system administratr can cntrl R-1 and RDS peratins n any system cmpnent (Cntrller, Satellite, Center, Edge) thrugh the Prxy Security Mechanism. Whenever a request fr an R-1 and RDS peratin is received, it activates a security check, which cmpares the details f the requested peratin against a rule base. Based n the administratr-defined rules recrded in this file, the peratin is apprved r refused. The Prxy Security Mechanism plays tw majr rles: It is an administrative tl, allwing administratrs t cntrl hw users use R-1 and RDS and its related prgrams. It is a security tl, allwing administratrs t cntrl all incming R-1 and RDS requests frm utside. The Prxy Security Mechanism serves here as a data transfer firewall, allwing remte users access withut expsing any system accunt and passwrd infrmatin. T understand hw the Prxy Security Mechanism carries ut these functins, it is useful t knw hw it perfrms the security check. Fr each requested peratin, a number f parameters are examined during a security check. These include the requester's nde, user name and netwrk address, the lcal user name and passwrd given fr the peratin, the type f peratin r cmmand, the affected files and directries, the time f day, and any special cdes r identifying signs used in the peratin. Any f these prperties can be used as criteria t determine if a given rule shuld apply t the peratin. A matching rule can instruct the checking applicatin t refuse r apprve the requested peratin. The rules can als tell the applicatin t mdify the peratin's prperties, such as changing the lcal user accunt the peratin is carried under. Once a particular requested sessin has been apprved, the actin taken is t frk the child prcess that handles the request under the specified lcal user cntext defined in the security file. This is the Virtual User functinality. 1

5 Attunity Prxy User Security Guide 1. Security Rules The Prxy Security Mechanism perates n the principal f Active Security: instead f passively relying n the system's built-in security measures, it actively takes any infrmatin it has n the requested peratin and decides if it shuld be refused, apprved r mdified, based n any relevant rules defined in ne r mre security files. Because f this, security is nt based n what the remte user knws abut a system (like ftp r rcp passive security), but n what the administratr actively allws t be dne n the system thrugh the security rule base. This means that sensitive system infrmatin such as user accunt names r passwrds dn t have t be given t remte users r passed ver the netwrk. The administratr decides exactly wh is allwed t cnnect frm where, what authenticatin prcess they must pass, and what exactly they will r will nt be allwed t d. Active Security can be used t limit access based n remte user's name, remte nde's name, netwrk address, and ther identifiers. Cmplete sub-netwrks and user grups can be identified and restricted in a single rule. The administratr can define Rules t divert remte users t specific lcal accunts, regardless f infrmatin they might pssess. By default, the security file in the R-1 and RDS evaluatin kits allws all users with real username and passwrds t have full access and cntrl. Belw is a brief descriptin f each part f the rule fllwed by a shrt example f a secure set-up. Nte: The Security File ~rds/cnfig/rw_security.cf must have restricted permissins set n it (600 n UNIX and Administratr nly n Windws) therwise an errr wuld be returned cnnectin. 2

6 Attunity Prxy User Security Guide Security Rules Security Rules Parsing Rules cmprise 3 majr parts: WHO is the User - this part includes infrmatin t match the user trying t access the server. This includes the requester's nde, user name and netwrk address, the lcal user name and passwrd given fr the peratin, the type f peratin r cmmand, the files and directries affected, the time f day, etc. WHAT is the Rule this part specifies if the rule accepts r denies the user. Is this the LAST Rule As part f the rule definitin, it is specified if t keep lking fr ther rules that match this user, r t stp the rule parsing and act upn this rule s specificatin. This is applied nly if the user matches the requesting user s specificatin. The security rule based is parsed in the fllwing way: 1. The rules are parsed in an ascending rder. 2. The user is cmpared against the first rule s specificatins. 3. If the rule applies t this user: a. The user is granted r denied access accrding t the rule s specificatin. b. If this rule is marked stp the user s access is granted r denied accrding t that rule. Otherwise, parsing f the rules cntinues t the next rule. 4. If the rule des nt apply t this user, cntinue t the next rule. Nte: The Rule base is parsed such that later rules will verwrite and take precedence ver earlier nes. 3

7 Attunity Prxy User Security Guide 2. Users and Rules Management The Cnsle GUI - Manage ptin and the RepliWeb Tplgy Manager - RTM enable yu t define virtual users and the rules t cnvert them t real users. It can be used n Windws systems nly. Fr RDS - T use a virtual user between the Cntrller and a Satellite, yu shuld cnnect t the Satellite. If yu want t use a virtual user between yur Cnsle and Cntrller, cnnect t the Cntrller. Fr R-1 - T use a virtual user between the Center and an Edge, yu shuld cnnect t the Edge. If yu want t use a virtual user between yur Cnsle and Center, cnnect t the Center. The virtual user and the rules are defined n the machine accepting the cnnectin. This way, the machine initiating the cnnectin knws nly virtual infrmatin and nly virtual infrmatin is sent n the netwrk. Real infrmatin never leaves the machine accepting the cnnectin. 4

8 Attunity Prxy User Security Guide Users and Rules Management Defining Users The Virtual Users tab enables yu t define virtual users t cnvert them t real users. These users may be used fr cnnectin between the Cnsle and Center. Virtual users are defined n the machine accepting the cnnectin. This way, the machine initiating the cnnectin knws nly virtual infrmatin and nly virtual infrmatin is sent n the netwrk. Real infrmatin never leaves the machine accepting the cnnectin. Figure 1: Define Virtual Users 1. Click the leftmst buttn t add a new user. 2. Add the virtual user and virtual passwrd. Leave the dmain field blank. 5

9 Attunity Prxy User Security Guide Users and Rules Management Nte: There is n virtual dmain. If yu put smething there it will lk fr that user in a real dmain. 3. Select the Virtual radi buttn and click OK. 4. Nw add anther user, this time the real user that the virtual user is translated t. Check the Real radi buttn and fill a real Dmain: 5. Click the Save buttn. 6

10 Attunity Prxy User Security Guide Users and Rules Management Updating the Submit Cmmand Assuming that yu have defined virtual users n an R-1 Edge r RDS Satellite, yu can g back t yur submit cmmand n the Cnsle, and change the user/passwrd cmbinatin fr the remte cnnectin: Instead f: > r1 submit -user=real-user passwrd=xxx dmain=cmpdmain yu can nw specify: > r1 submit -user=vuser passwrd=vpass ( n dmain) 7

11 Attunity Prxy User Security Guide Users and Rules Management Managing Rules The Security Rules tab enables yu t define rules that apply t real and virtual users. These rules apply fr cnnecting frm the Cnsle t the Center. Security rules are defined n the machine accepting the cnnectin, as this is where access t real and virtual users is granted r denied. Here yu define the cnnectin between the virtual user and the real user. Figure 2: Security Rules Tab 8

12 Attunity Prxy User Security Guide Users and Rules Management T define a new security rule: 1. Click the leftmst buttn New Rule t add a new rule. Enable Rule Specify if this rule is enabled r nt. If this ptin is nt selected the rule is nt taken int accunt while evaluating a user. Descriptin Fill in a descriptin f that rule. This field has n effect n the rule s functinality. Incming User - specify the user name perfrming the cnnectin. This user name will be translated t a real user n the target machine. Specify if the incming user is Virtual r nt. If the incming user is a virtual user, yu may define a virtual dmain as well. The dmain will be then used in the actual cnnectin cmmand. Nte: In UNIX, yu can nly define virtual users. N need t define real users t be used in the Rules Tab. In Windws, in rder t map a virtual user t a real user, the real user must be defined in the User Definitin tab as well. In a Cnsle Center / Hst cnnectin, the incming user is the ne used in the Cnsle Cnnectin screen. In a Center Edge cnnectin, the incming user is the ne used in the jb definitin. SSL - Specify if SSL is cnsidered during the cnnectin: With SSL - The cnnectin must be with SSL 9

13 Attunity Prxy User Security Guide Users and Rules Management Withut SSL - The cnnectin must be withut SSL. Actin - specify if the rule is psitive apprve the user t cnnect (Accept), r negative deny access t that user (Reject). Transfrm T - specify the real target user the Incming User is translated t. If applicable, specify Dmain. Nte: If the virtual user was defined with a dmain (a virtual ne), yu shuld als specify that dmain name here. This is a basic rule. As we defined nly ne user, all yu have t d is click OK t say that the user vuser, will be examined as a virtual user and translated t the real user james frm the dmain cmp_dmain. Stp Search D nt check that user using ther rules. If the incming user matches that rule, accept r deny accrding t that rule. Advanced Rules may be further enhanced t tighten security and limit accessibility t R-1/RDS machines. These features describe the perating system envirnment frm which the cnnectin request is cming frm. Requester Users - Wildcard and multiple values are supprted. In a Cnsle Cntrller / Center cnnectin, this is the ACTUAL ACCOUNT frm which the R-1/RDS cmmand came frm, i.e. Windws r UNIX accunt, nt the Cnsle lgin. In a Cntrller / Center Satellite / Edge cnnectin, this is the user used in the Cnsle lgin t the Cntrller / Center. Requester Dmains Wildcard and multiple values are supprted. 10

14 Attunity Prxy User Security Guide Users and Rules Management In a Cnsle Cntrller / Center cnnectin, this is the ACTUAL Windws dmain frm which the R-1/RDS cmmand came frm. In a Cntrller / Center Satellite / Edge cnnectin, this is the dmain f the user used in the Cnsle lgin t the Cntrller / Center. Requester Ndes The machine name frm which the request cmes frm. Wildcard and multiple values are supprted. In a Cnsle Cntrller / Center cnnectin, this is the netwrk name f the Cnsle machine. In a Cntrller / Center Satellite / Edge cnnectin, this is the netwrk name f the Cntrller / Center. Requester Subnets The subnet frm which the request cmes frm. Wildcard and multiple values are supprted *- fr example. In a Cnsle Cntrller / Center cnnectin, this is the subnet f the Cnsle machine. In a Cntrller / Center Satellite / Edge cnnectin, this is the subnet f the Cntrller / Center. Requester Netmasks The netmask frm which the request cmes frm. Wildcard and multiple values are supprted fr example. In a Cnsle Cntrller / Center cnnectin, this is the netmask f the Cnsle machine. In a Cntrller / Center Satellite / Edge cnnectin, this is the netmask f the Cntrller / Center. Requester Applicatins The applicatin name frm which the request cmes frm. Multiple values are supprted, and ALL can be selected meaning the request can cme frm any f the listed applicatins. This field can have the fllwing ptins: Cnsle (R-1 r RDS) Cmmand Line API Replicatin Jb Multicast Distributin Backup Restre Target Applicatins The target applicatin receiving the cnnectin request. This field can have the fllwing ptins: R-1 Center / RDS Cntrller R-1 Edge / RDS Satellite 11

15 Attunity Prxy User Security Guide Users and Rules Management In the screen-sht abve, nly users that their name begins with cmp, frm dmain cmp_dmain, and that are cnnecting frm machines whse IP address begins with are allwed t cnnect. Other users will nt pass that rule and their cnnectin request will be denied. 2. Click the Save buttn. 3. Defining a few rules, yu can determine the rder in which the rules are applied when a user tried t cnnect t the machine. T update the lcatin f a rule, right-click the rule, and in the flating menu select the Mve ptin. A windw will pen, enabling t mve the rule up and dwn between the existing rules. 12

16 Attunity Prxy User Security Guide 3. Examples This chapter prvides examples f mapping users and delegating applicatin access. User Cnfiguratins Mapping All Users t One User A Linux Team Manager wuld like t map all incming Web users t user web_accunt fr a specific Server. This can be achieved in tw ways: 1. Map all real users t the Web Accunt user web_accunt. This way all users cntinue t use their wn user name and passwrd, but prcesses n that server run as web_accunt. 2. Create a virtual accunt t be used by all users while cnnecting, and map it t the Web accunt user n the server. In the RTM cnsle, duble click the Edge t manage. Enter the username and passwrd in the prmpt. T edit the security cnfiguratin n Linux, cnnect as rt. 13

17 Attunity Prxy User Security Guide Example: Mapping All Users t One User Mapping all real users t the Web Accunt user web_accunt 1. If using Windws, the real user web_accunt has t be added in the User Definitin tab as a Real user. 2. Under the Rules tab, create a rule that maps all incming users t user web_accunt. All access t that server will be dne using real system users and passwrds, but all prcesses will be transfrmed t run under the user cntext f the web_accunt user. 3. Als, edit the first tw rules t reject access frm any user accunt. 14

18 Attunity Prxy User Security Guide Example: Mapping All Users t One User Mapping a Virtual user t the Web Accunt user web_accunt. 1. Under the User Definitin tab, create a new virtual user. 15

19 Attunity Prxy User Security Guide Example: Mapping All Users t One User 2. If using Windws, the real user web_accunt has t be added in the User Definitin tab as a Real user. 3. In the Rules tab, create a rule that maps the virtual repliweb user t user web_accunt. All access t that server will be dne using that virtual user, but all prcesses will be transfrmed t run under the cntext f the web_accunt user. 16

20 Attunity Prxy User Security Guide Example: Mapping All Users t One User 4. Als, edit the last tw rules t reject access frm any user accunt. 17

21 Attunity Prxy User Security Guide Example: Mapping All Users t One User Rules Cnfiguratins Allwing Cnnectin frm the Web UI Only The fllwing example shws hw t enable access t users cnnecting frm the Web UI while rejecting a cnnectin frm all ther interfaces. Nte: Make sure t disable any existing rules (by unchecking each rule s Enable Rule checkbx) befre perfrming this prcedure. Nte: The prcedure belw assumes that any existing rules have been disabled. 1. Click New Rule t add a new rule that rejects access frm all lcal users. a. In the Incming User area, select the Real ptin and enter an asterisk (*) in the User field. b. In the Actin area, select the Reject Cnnectin ptin. c. Click OK. 2. If yu are using a dmain envirnment, add anther rule that rejects dmain users. a. In the Incming User area, select the Real ptin and enter an asterisk (*) fr bth the User and Dmain fields. b. In the Actin area, select the Reject Cnnectin ptin. 18

22 Attunity Prxy User Security Guide Example: Mapping All Users t One User 3. Add anther rule that enables access t the Center fr users cnnecting frm a specific Web UI machine. Fr example, machine: WebServer. a. In the Incming User area, select the Real ptin and enter an asterisk (*) as the User. b. In the Actin area, make sure that the Accept Cnnectin ptin is selected. c. Click the Advanced buttn, the Advanced Rule Filters windw appears. d. In Requester Users, remve the default asterisk (*) and any existing users, and enable Web UI users by entering: IUSR_<MACHINE NAME> where <MACHINE NAME> is the machine running the IIS that yu are cnnecting t. Nte: The IUSR_ prefix is mandatry. Fr example, IUSR_WEBSERVER: 4. Click OK. 19

23 Attunity Prxy User Security Guide Example: Mapping All Users t One User The Security Rules tab shuld lk as fllws: Allwing SSL-nly cnnectins: This rule allws cnnectins in SSL mde nly while rejecting nn-ssl cnnectins. Nte: If Backup & Restre is needed, make sure the Allw backup and restre security rules are enabled and appear first in the Center Management s Security Rules list. Fr mre infrmatin n these rules, refer t the next example. T allw an SSL-nly cnnectin: 1. Click New Rule t add a new rule. 2. In the Descriptin field, enter a prper descriptin, such as Allw ssl cnnectin nly. 3. In the Incming User area, select the Real ptin and enter an asterisk (*) fr the User field. 4. Select the SSL checkbx and make sure With SSL is selected. 5. In the Actin area, select the Accept Cnnectin ptin. 6. Click OK. Allwing Backup & Restre in SSL mde: In envirnments that require an SSL cnnectin, the fllwing tw rules need t be created t enable Backup & Restre t run. 20

24 Attunity Prxy User Security Guide Example: Mapping All Users t One User Nte: Fr these rules t wrk prperly, make sure they are enabled and appear first in the Rules list. T allw Backup & Restre fr all real dmain users: 1. Click New Rule t add a new rule. 2. In the Descriptin field, enter a prper descriptin, such as Allw backup and restre access t dmain users. 3. In the Incming User area, select the Real ptin and enter an asterisk (*) fr bth the User and Dmain fields. 4. In the Actin area, select the Accept Cnnectin ptin. 5. Click the Advanced buttn, the Advanced Rule Filters windw appears. a. In Requester Applicatins, remve the all entry and add the fllwing tw entries: Backup and Restre, as fllws: b. Click OK. 6. Select the Stp searching fr additinal rules checkbx. 7. Click OK. T allw Backup & Restre fr all real lcal users: 1. Click New Rule t add a new rule. 2. In the Descriptin field, enter a relevant descriptin, such as Allw backup and restre access t lcal users. 3. In the Incming User area, select the Real ptin and enter an asterisk (*) fr the User field. 4. In the Actin area, select the Accept Cnnectin ptin. 5. Click the Advanced buttn, the Advanced Rule Filters windw appears. 21

25 Attunity Prxy User Security Guide Example: Mapping All Users t One User a. In Requester Applicatins, remve the all entry and add the fllwing tw entries: Backup and Restre, as fllws: b. Click OK. 6. Select the Stp searching fr additinal rules checkbx. 7. Click OK. Fr any additinal infrmatin, cntact us at supprt.repliweb.cm 22