What s New in Centrify Server Suite 2014

Transcription

1 CENTRIFY SERVER SUITE 2014 WHAT S NEW What s New in Centrify Server Suite 2014 The new Centrify Server Suite 2014 introduces major new features that simplify risk management and make regulatory compliance repeatable and sustainable across heterogeneous servers and applications in the data center and the cloud. Enhancements to Centrify Server Suite include streamlined creation and management of administrative entitlements. This release makes it easier to implement least-privilege access by delivering new pre-configured rights for Windows server management consoles that can be used out of the box. New wizards automate the creation of new, complex rights for administrative users and reduce the process to the simple click of a button. Wizards can be used in conjunction with our powerful new match criteria that improves flexibility in building a least-privilege access model by enabling privileges to be determined based on properties such as a digital signature (for example, signed by Adobe, Inc.). Centrify Server Suite 2014 also uniquely provides full privileged activity audit trails and video capture that ties all activity back to an individual. With this release Centrify enhances our powerful search capabilities and compliance reporting that combines access controls and the associated activity fully integrated across Windows, Linux, and UNIX platforms. Centrify Server Suite Standard Edition New match criteria to identify applications on Windows Many organizations run different versions of applications that need elevated privileges. From the admin s perspective, it s hard to keep track of all the different combinations. For example, if you have two rights to run SQL Server Management Console because your organization uses SQL Server 2008 and SQL Server 2012, which application right belongs to which version? The new match criteria feature makes it simple to define a single application right that will launch multiple versions of the same application with privilege; or, multiple different applications that share common criteria. For example, a user can be provisioned with the right to run any application digitally signed by Microsoft Corporation with the string Microsoft SQL Server in the product name, enabling the user to run any of the SQL Server management tools with elevated privilege in a single application right. Or, a user can be granted the right to install any of a broad range of printer drivers through a single application right that elevates privilege on exe files whose file name contains the string pcl6 and is digitally signed by Hewlett-Packard Company. There are over a dozen match criteria, including: Any of 11 executable file types, including EXE, COM, MSC, MSI, VBS and PS1 files Digital signature Product name and version File version and description File digest (SHA-1 hash) File path and command-line arguments 2014 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. DS PAGE 1

2 New application rights builder Application rights enable Windows admins to do their jobs without having to use highly-privileged accounts like local administrator or domain admins. Creating and assigning rights to run applications with elevated privilege is critical to the success of a privilege management project. And, you want to make sure that the right you re creating is definitively tied to the actual application and program file you want the user to run. The new Application Rights Builder makes it easy to create application rights for your Windows admins. You simply select a program file! The Builder retrieves all match criteria including file paths and command arguments, eliminating mistakes and wasted time. Rights for complex application and argument list combinations such as MMC snap-in consoles are easy to create. Since match criteria values can be edited at any time, you can also use the Builder to make any application right a template for the creation of additional rights. You can also select from a list of running processes on the target computer instead of selecting a program file. And, since the Application Rights Builder supports pulling match criteria via remote connections to other computers on the network, you can easily assure that you are granting rights to precisely the correct program regardless of where the program file or process may reside. Figure 1 Match criteria in the Application Rights Builder Pre-defined rights for Windows Server management consoles The standard management consoles built in to Microsoft Windows Server get a lot of use from administrators. Each console is designed to manage a major Windows component such as Services or Print Management, and can connect remotely to other computers on the network when necessary CENTRIFY CORPORATION. ALL RIGHTS RESERVED. PAGE 2

3 Server Suite 2014 adds pre-defined application rights for 18 consoles, for a total of 28 pre-defined rights for managing Windows Server. These pre-defined rights make it easy to get started with privilege management for your Windows servers; for example, you can quickly grant your admins the right to manage Windows services without having to give them local administrator accounts. New pre-defined console rights include: DHCP File Server Print Management Security Configuration Share and Storage Management Windows Services Figure 2 - Out-of-the-box Application Rights PowerShell cmdlets for management and integration Microsoft s PowerShell is a powerful and ubiquitous tool for managing Windows Server. It s the go-forward command-line and script environment for Windows admins. Server Suite 2014 enables you to fully manage all aspects of its DirectManage components through PowerShell. For example, you can automate the creation of Centrify Zones and roles, add UNIX profiles for Active Directory users and groups to Centrify-managed computers and Zones, or assign UNIX and Windows users and groups to roles, computers and computer Zones, all through PowerShell commands and scripts CENTRIFY CORPORATION. ALL RIGHTS RESERVED. PAGE 3

4 A new Centrify DirectManage Module for PowerShell provides cmdlets for scripting commands and integrating with other solutions. The PowerShell module is a standard component of Centrify Server Suite 2014 Standard Edition; no additional licensing is required. The module includes cmdlets that enable PowerShell scripting of virtually all the operations available within the DirectManage management console by accessing Centrify objects in Active Directory. Computer Profile Computer Role Group Profile Right Role Role Assignment User Profile Zone Additional Windows features Offline enforcement on Windows platforms enables the use of roles and rights even when the computer is disconnected from the network or cannot reach a domain controller. The Centrify Windows Agent retains roles and rights from the last poll of the domain controller for all users who previously logged in. Support of the Centrify DirectAuthorize Agent on Windows 8 and Windows Server 2012 has been added. The Desktop rights feature is not supported on these platforms at this time. Zone Provisioning Agent Two new tools have been added to mirror group membership and hierarchy across trusted domains and forests. ADEDIT The ADEdit-based report set is enhanced to provide better reporting and customization abilities using a SQL database with user-accessible views. A new generation of report tool, adreport2.tcl, has been created for this purpose. ADEdit is enhanced to support provisioning of DirectAuthorize objects for Classic Zones. Centrify PuTTY This release of Centrify PuTTY incorporates the open source PuTTY version PuTTY 0.63 contains the following security fixes: PuTTY now wards off nefarious SSH server or network attackers from crashing PuTTY. PuTTY no longer retains the private half of users' keys in memory by mistake. Centrify OpenSSH Audit trail events for Centrify OpenSSH are now integrated with DirectAudit. Support for the SELinux environment has been improved CENTRIFY CORPORATION. ALL RIGHTS RESERVED. PAGE 4

5 Additional configuration options for UNIX A new substitution variable can be used as a placeholder for the home directory of a user Zone profile in DirectManage Access Manager. New configuration parameters have been added for UNIX agents. Please refer to the Centrify Server Suite 2014 Configuration and Tuning Reference Guide for details. Centrify Server Suite Enterprise Edition Audit Trail Integration with DirectAudit Auditing has been enhanced to include a number of different UNIX audit events. These audit events are enforced with role-based access control. The Centrify Audit Analyzer now allows querying of both Windows and UNIX audit events. The standard audit reports now query and report data for both Windows and UNIX computers. A new Group Policy has been added to allow global control of whether audit trail events from the Centrify UNIX Agent for Access should be generated and whether they should be sent to syslog and/or DirectAudit. A new command-line utility can be used in dzcheck to send audit events with extra customer-defined information such as trouble tickets. Centrify OpenSSH audit trail events have been integrated with DirectAudit, starting from Centrify DirectControl version Figure 3 - Centrify Audit Analyzer 2014 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. PAGE 5

6 Expanded support of troubleshooting privileges In previous versions of DirectAudit, only the root user was always allowed to log in or run an audited command when the system has environment setup issues. A new parameter has been added to the DirectAudit configuration file to allow specifying one or more local users who may log in or run an audited command in addition to root in such a circumstance. New Group Policy support A number of Group Policies for DirectAudit on UNIX are added. These policies include DirectAudit shell, DirectAudit Daemon, and other settings for the UNIX Agent. New custom command prompt detection You can now specify a regular expression on a computer hosting the Centrify DirectAudit Collector to detect a custom command prompt within an audited event. Skip binary data recording For file transfer commands like rsync, sftp and scp when an SSH connection is being used, you can now skip auditing and the recording of the binary data being sent to and from the server for specified SSH commands. Expanded search criteria for audited events Multiple users and/or computers can be specified as search criteria when searching for Audit Events. FindSession enhancements FindSession now supports query of multiple users and computers. New command-line options have been added to export roles and tickets in UNIX commands, input, and output data. FindSession now displays the URL link when exporting a session list. The URL can be passed directly to the DirectAudit Session Player to replay the audited session. Performance and tuning (UNIX) The default interval for monitoring and repairing the NSS/LAM configuration files is now increased from 60 seconds to one hour to reduce system load. A new configuration parameter controls whether the dad process caches name service query results about users and groups. Enhancement of DAINFO report The DAINFO command has been enhanced to include: The offline store size of the audit trail The de-spool rate of the audit trail The online status of the audit trail channel Applied Group Policy settings (option) Additional Windows features Failed privilege elevation attempts by Run As Role and desktop creation are now recorded as an audit event in the DirectAudit database CENTRIFY CORPORATION. ALL RIGHTS RESERVED. PAGE 6

7 Support of the Centrify DirectAudit Agent has been added for the following Windows platforms: Windows 8 Windows 8.1 Windows Server 2012 Windows Server 2012 R2 Management component platform support Support for the management components of Server Suite on the following Windows platforms has been added: Windows 8 Windows 8.1 Windows Server 2012 Windows Server 2012 R2 Server Suite Standard Edition Management components supported on these new platforms include: Centrify DirectManage Access Manager Centrify XML and ADM templates for extensions to Active Directory Group Policy Objects Centrify Group Policy Management Editor extension Centrify ADUC (Active Directory Users and Computers) property page extensions Centrify DirectManage Deployment Manager Server Suite Enterprise Edition Management components supported on these new platforms include (in addition to the Standard Edition management components): Centrify DirectManage Audit Manager Centrify Audit Analyzer Centrify for User Suite Mac Edition Centrify for Mac Centrify now supports the generation of UIDs, GIDs and primary GIDs in Auto Zone or in hierarchical Zones using the Apple scheme. This makes it easy for customers to change their Mac workstations from the Apple Active Directory plugin to the Centrify DirectControl Agent. A new helper script is included, and enhancements have been made in many Server Suite components to support this feature, including Access Manager, the DirectManage Module for PowerShell, the Centrify Windows SDK, ADEdit, Zone Provisioning Agent, Group Policies, and various configuration parameters. Group Policy Objects have been added to control new Agent functionality, including: Allow offline user login even if the Active Directory user account is locked. Enable the import of raw plist settings where individual settings can be applied to an existing plist file. Auto-enrolled and renewal of User Certificates specifically to support user authentication to Wi-Fi networks. Certificates can also be stored in a non-exportable keychain entry for increased security 2014 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. PAGE 7

8 Enable/disable SecurityAgent restart at ADClient startup Improvements have been made to printer management. Printer models can be specified via Group Policy to enable configuration of a particular driver. The list of printer models in Group Policy is checked locally against available printer drivers. Configuration defaults to Generic PostScript if no appropriate driver for model is found. Supported platforms Support has been added for the following operating systems: Debian Linux 7.2, 7.3 (32-bit and 64-bit) CentOS 5.10, 6.5 (32-bit and 64-bit) Fedora 20 (32-bit and 64-bit) Linux Mint 16 (32-bit and 64-bit) Mac OS/X 10.9 Oracle Linux 6.5 (32-bit and 64-bit) Red Hat Enterprise Linux Server 5.10, 6.5 (32-bit and 64-bit) Red Hat Enterprise Linux Desktop 5.10, 6.5 (32-bit and 64-bit) Red Hat Enterprise Linux Server 5.10, PPC (64-bit) Red Hat Enterprise Linux Server 5.10 Itanium (64-bit) Scientific Linux 5.10 (32-bit and 64-bit) Ubuntu Desktop (32-bit and 64-bit) Ubuntu Server (32-bit and 64-bit) The complete list of supported platforms is on the Centrify website at: CENTRIFY CORPORATION. ALL RIGHTS RESERVED. PAGE 8