White Paper. Deploying EUM. SurfControl Web Filter for MS Windows. rev. 1.1, January Enterprise Threat Protection

Transcription

1 White Paper Deploying EUM SurfControl Web Filter for MS Windows rev. 1.1, January 2005 Enterprise Threat Protection

2 ..... ACKNOWLEDGEMENTS SurfControl wishes to acknowledge the following people for their contributions to this white paper: Role Technical Contributor Technical Contributor Technical Contributor Editor Author Name Denise Hendsbee Sr. Technical Support Engineer Doug Braemer, Technical Support Engineer Keith Chomentowski, Sr. Systems Engineer Karen Hepner, Technical Writer Shawn Titus, Technical Training Manager NOTICE 2004 SurfControl. All rights reserved. SurfControl, SurfControl Filter, SurfControl Web Filter, Virtual Control Agent, Anti-Spam Agent, Anti-Virus Agent, Virtual Learning Agent, Virtual Image Agent, and the LexiMatch logos are registered trademarks and trademarks of SurfControl plc. All other trademarks are properties of their respective owners. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior permission of the copyright owner.

3 User name resolution..... USER NAME RESOLUTION Web Filter for MS Windows (Web Filter) can monitor users by IP address, workstation name, or user name. The only data available to Web Filter is the information included in the ethernet packet. For example, an HTTP request does not include a user name, but does include the requestor s IP address. In order to resolve the IP address to a user name, Web Filter must access additional network resources. You can always monitor internet access by IP address. However, even if you have static IP addresses for all computers in your network, you ll only be able to identify the machine, not the user. And if your network uses DHCP, you won t be able to easily identify the machine. Web Filter derives workstation names by querying a DNS/WINS server with the requesting IP address, which returns the workstation name. While this is usually 100% effective, the workstation name only identifies the machine where the request originated, not the user who originated the request. Therefore, user name resolution can be a necessity for effectively monitoring internet access. In order for Web Filter to effectively monitor internet access, the web filter must have a reliable method of resolving user names. Without user names, you will have to monitor internet access based on workstation names or IP addresses. User authentication plays a key role in performing reliable user name resolution. Your network infrastructure is the determining factor in deciding which method of user authentication and user name resolution Web Filter can use. This document provides the details necessary to effectively manage user name resolution for Web Filter. Web Filter is not an authentication service. However, the Web Filter interacts with a variety of network authentication services and can use the resolved user names for reporting and monitoring Internet access. Web Filter is a network protocol analyzer and is, therefore, a passive network resource (see Figure 1). Web Filter blocks Internet access through packet spoofing, thereby remaining passive. Since Web Filter is passive, it cannot actively allow or deny network access to a user or ask a user for their credentials. The user communicates directly with the caching device or firewall, not the Web Filter server. Figure 1 Web Filter using pass-by technology rev 1.1 SurfControl Web Filter for MS Windows EUM Deployment White Paper 1

4 ..... Architecture Web Filter includes a free user name resolution utility called EUM (Enterprise User Monitor). EUM interacts with Windows domain controllers (EUM) and Novell environments (NetwareEUM). SurfControl recommends using EUM or Netware EUM for user name resolution. ARCHITECTURE When a user logs onto the network, a domain controller authenticates the user. The EUM UA (User Agent) on the domain controller passes user data (IP address, domain\username, time, and date) to the EUM Handler on the Web Filter server. Figure 2 shows the EUM architecture. Figure 2 EUM architecture Warning: Failure to install EUM onto all domain controllers or NDS servers can compromise the accuracy of user name resolution. If a domain controller is authenticating users, but not passing that data to Web Filter, Internet activity may be stored under the wrong user name. EUM relies on logon data to determine which user is working from which IP address. In short, when a user logs onto the network, their domain name, user name, and workstation name is passed to the authenticating domain controller. Once authenticated, the UA passes the IP address and domain\username to the EUM handler on the Web Filter server. Web Filter caches the data by IP address, which allows Web Filter to track Internet activity by user name, even if the user is simultaneously logged onto multiple computers. Figure 3 shows the basic process used to obtain user data. 2 EUM Deployment White Paper SurfControl Web Filter for MS Windows rev 1.1

5 Architecture..... Figure 3 Data flow rev 1.1 SurfControl Web Filter for MS Windows EUM Deployment White Paper 3

6 ..... Architecture CACHING EUM creates multiple caches: one on each domain controller and one on each Web Filter server. Each domain controller builds a cache containing data for the users it has authenticated. The Web Filter server then builds a master cache that includes all the data from each domain controller. Figure 4 shows EUM caching Figure 4 EUM caching 4 EUM Deployment White Paper SurfControl Web Filter for MS Windows rev 1.1

7 Architecture..... If deniseh accesses the internet from two computers, Web Filter can still accurately identify the user as the requester (see Figure 5) Figure 5 EUM caching: single user, multiple computers If your network requires multiple Web Filter collectors, each collector maintains a master cache of data (see Figure 6) Figure 6 EUM caching in a multiple collector environment rev 1.1 SurfControl Web Filter for MS Windows EUM Deployment White Paper 5

8 ..... Windows EUM Caching on the domain controller The EUM UA on the domain controller or NDS server is responsible for managing a cache for each user the domain controller authenticates. Caching on the Web Filter server The EUM User Handler is responsible for managing a master data cache of all authenticated users within the network. When you stop the Web Filter service, the cache is deleted. The UA continues to write new data to its cache. When you restart the Web Filter service, the UA delivers this cache of user data to the Web Filter server and normal data delivery resumes. Depending on cache size and number of ignored users, there may be a slight delay before the UA can deliver all cached data to the Web Filter server. During this time, Web Filter records and monitors Internet traffic by workstation name or IP address. WINDOWS EUM By accessing Windows NT security auditing data and by integrating with Windows 2000 authentication to resolve user names, EUM gives Web Filter the ability to monitor users by user name in a routed environment. EUM provides Web Filter with continuous, accurate reporting of logon activity. For example, when jsmith attempts to access Web Filter sees jsmith s IP address in the HTTP request. EUM provides the missing link by mapping the IP address to data received the domain controllers regarding jsmith s identity. THE SCUA.INI FILE Web Filter requires an initialization file (scua.ini) on each domain controller. This file contains the following data: [surfcontrol_services] #this list identifies the Web Filter =61695 #collectors by IP address and the port =61695 #used to communicate with Web Filter = = = =61695 [ignored_users] domain\username=1 domain\username2=1 domain\username3=1 #This list identifies the domain #account logon events that UA should #ignore when caching data. This list #does not allow wildcards. \=1 #You must manually add this entry to #the file. This entry indicates that UA #should ignore anonymous logon events. Note: After making changes to the scua.ini file, you must: For NT domain controllers: restart the SurfControl User Agent service. For 2000 domain controllers: you must reboot the domain controller. 6 EUM Deployment White Paper SurfControl Web Filter for MS Windows rev 1.1

9 Windows EUM..... When you auto-install EUM, only one Web Filter server is entered in the scua.ini file. In a multi-collector network, you must manually edit the file and add the additional collectors. POST-INSTALLATION After installation, you must enable user name resolution and check for established connections. Enable user name resolution Once EUM is installed on the domain controller, you must enable EUM User Name Resolution. To enable, double-click the icon in the system tray and launch the SurfControl Web Filter Service Settings dialog. Click the Advanced tab to configure user name resolution. In the User Name Resolution area, select the Enterprise User Monitoring radio button. Apply the changes and click OK. Check for established connections After EUM is installed and enabled, you should check to make sure that there are established connections between Web Filter and the domain controller. From the command line, run the following command: netstat -an find When connections are established, you should see all domain controllers listed with the following format: TCP : :0 LISTENING TCP : :1046 ESTABLISHED TCP : :1059 ESTABLISHED EUM ON NT DOMAIN CONTROLLERS Web Filter installs the EUM agent onto NT domain controllers as a service (SurfControl User Agent service, which uses the ScUserAgent executable). During EUM installation, Web Filter configures NT domain controllers to record Successful Logons to the Security event log (event 528). If you make changes to this audit policy and disable event 528 logs (Successful Logon), EUM will no longer function properly. Confirm that event 528 logs are enabled by performing the following: 1 From the Web Filter server, Start Programs Administrative Tools User Manager for Domains. 2 From the menu, select Policies Audit. Confirm that Audit these Events is checked. 3 Ensure the security logs are set to overwrite as needed. Do not manually clear the security logs. Before installation The automated installation is performed from the Web Filter server. Therefore, prior to installing the EUM UA onto an NT domain controller, ensure the trust relationships are set up for multiple domain environments (in this case, Web Filter is Trusted, all other domains are Trusting). The trust relationships are only required for installation and are not required for EUM to function properly. rev 1.1 SurfControl Web Filter for MS Windows EUM Deployment White Paper 7

10 ..... Windows EUM UA activity The UA service collects information about user logons and passes this data to one or more Web Filter servers (as defined in the scua.ini file). Each UA monitors the Security event log for logon events (generated as people log into the domain). Event log entries map a user to a particular workstation, but only by the workstation name (e.g. jsmith). Therefore, the UA must perform a lookup to find the source IP address. If you stop the UA service on a Windows NT domain controller, the cache is deleted. Web Filter continues to use the locally cached user data for monitoring and reporting purposes. When you restart the UA service, the UA resumes user data delivery to Web Filter and builds a new cache. EUM ON WINDOWS 2000 DOMAIN CONTROLLERS The EUM agent installs onto Windows 2000 domain controllers as a dll (ScSubAuth.dll). When EUM is installed onto a Windows 2000 domain controller, Web Filter uses Microsoft s Sub-Authentication feature to resolve user names. After installing EUM onto a Windows 2000 domain controller, you must reboot the domain controller. Microsoft s Sub-Authentication process The Windows 2000 Operating system uses a Local System Authority (LSA) to authenticate user logons. You can customize standard Windows authentication by using an authentication package. An authentication package is a DLL that s loaded from configuration data stored in the registry. Authentication packages perform security operations and create a login sessions. There are two standard authentication packages included with Windows 2000: MSV1_0 - used for local logons (the winlogon process) and is available on both Windows NT and Kerberos - used for network account logons and is only available on Windows Both authentication packages support subauthentication packages for customizing (replacing or supplementing) standard logon authentication provided by Kerberos or MSV1_0. EUM DLL Web Filter includes an EUM subauthentication package that supplements the standard Windows 2000 authentication on a domain controller. The EUM DLL always runs on the domain controller and works in both mixed and native mode. Every time a user logs in, the authentication package calls the EUM subauthentication DLL. EUM checks the scua.ini file to determine if Web Filter monitors the user. If so, the EUM subauthentication DLL notifies Web Filter of the user name and associated IP address. Post-installation After installation, reboot the domain controller. When the domain controller receives a login request, the EUM DLL is automatically loaded. 8 EUM Deployment White Paper SurfControl Web Filter for MS Windows rev 1.1

11 Windows EUM..... INSTALLING EUM Install EUM from the Web Filter server. During installation, Web Filter installs the EUM UA onto each domain controller. Before installing EUM, confirm the following: The Web Filter server must have a static IP address. The installer must be logged into the Web Filter server as a user with domain administration rights. In order for a successful automated installation, Web Filter must be able to see the domains that require EUM. Make sure the Web Filter is located in the appropriate domain. In a two-way trusted environment, the Web Filter server can be located in any domain. If a one-way model is in use, the Web Filter server should be located in the master domain (this allows Web Filter to see all other domains). For Windows NT domain controllers, make sure the security logs of all domain controllers are set to overwrite events as needed. By default, EUM uses port to communicate with the Web Filter server. SurfControl recommends installing EUM when there are few or no users on the network or when a forced logoff can be scheduled. Note: Ignoring valid user accounts can result in mis-identification of users. During installation, you ll be prompted to identify specific user accounts that the UA should ignore; you should only use the ignore option for accounts similar to SMS. rev 1.1 SurfControl Web Filter for MS Windows EUM Deployment White Paper 9

12 ..... Windows EUM Procedure 1: Installing EUM Step Action 1 Make sure that the Web Filter server has a static IP address. 2 Make sure you have administrative privileges on all domain controllers where the User Agent will be installed. 3 Make sure the Web Filter server is located in the correct domain. 4 Make sure the firewall or router allows traffic through the provisioned port (default is 61695). 5 For Windows NT domain controllers, make sure the security logs of the domain controllers are set to overwrite events, as needed. 6 Try to perform this procedure when there are few or no users on the network, or when a forced logoff can be scheduled. This ensure the fastest, most accurate detection of users. Begin Installation 7 From the Start menu, launch EUM installation (Start Programs SurfControl Web Filter Enterprise User Monitoring Install Enterprise User Monitoring). SurfControl Enterprise User Monitoring Installation screen 8 Click the Next button to start the installation. Hostname screen 9 Enter the IP address of the Web Filter server. Note: SurfControl recommends entering the IP address instead of the hostname. 10 Enter the port the User Agent and Web Filter service should use to communicate (default is 61695). 11 Click Next to continue. Domain List screen 12 Select the domains you want to receive user data from. 13 Click Next to continue. (Sheet 1 of 2) 10 EUM Deployment White Paper SurfControl Web Filter for MS Windows rev 1.1

13 Windows EUM..... Procedure 1: Installing EUM Step Action Ignore User Accounts screen 14 Select the user accounts whose logon/logoffs do not need to be reported to Web Filter (ie, SMS accounts). 15 Click Next to continue. Ignore User Accounts screen 16 Select the domain controllers whose user s logon/logoff activity Web Filter needs to monitor (this identifies the domain controllers where the UA will be installed). Note: Failure to install EUM on all domain controllers can compromise the accuracy of user name resolution. If a domain controller is authenticating users, but not passing that data to Web Filter, user activity may be recorded under another user name. 17 Click Next to continue. 18 If you installed EUM on a Windows 2000 domain controller, you must reboot the domain controller; SurfControl recommends performing a manual reboot. Enable EUM User Name Resolution 19 Once EUM is installed on the domain controller, you must enable EUM User Name Resolution. 20 Double-click the icon in the system tray and launch the SurfControl Web Filter Service Settings dialog. 21 Click the Advanced tab to configure user name resolution. 22 In the User Name Resolution area, select the Enterprise User Monitoring radio button. Apply the changes and click OK. Check for Established Connections 23 From the command line, run the following command: > netstat -an find When connections are established, you should see ALL domain controllers listed in the following format: TCP : :0 LISTENING TCP : :1046 ESTABLISHED TCP : :1059 ESTABLISHED 25 You have successfully installed Enterprise User Monitoring. (Sheet 2 of 2) rev 1.1 SurfControl Web Filter for MS Windows EUM Deployment White Paper 11

14 ..... NetwareEUM NETWAREEUM SurfControl also provides the ability to monitor users by their Novell Netware user name. The Novell version of EUM is called NetwareEUM. NetwareEUM works in the same way as EUM. Web Filter installs a User Agent onto each Novell NDS Tree Server. Before installing NetwareEUM, confirm the following: Before installing Web Filter, install Netware s Client 32 (as Preferred TCP/IP Protocol) onto the server. Web Filter prompts for the name of the Netware Tree during installation. If you were not prompted, Web Filter will not see Netware users. The network must be using Novell 5 or 6 over IP; Web Filter does not support Novell 4.x. If you need to resolve Novell4.x users, authenticate all users on an Windows NT/2000 domain controller and use EUM to resolve the user names. The Web Filter server must have a static IP address. By default, NetwareEUM uses port to communicate with the Web Filter server. SurfControl recommends installing NetwareEUM when there are few or no users on the network or when a forced logoff can be scheduled. In order for Web Filter to receive accurate information, users must authenticate using TCP/IP and not IPx. POST-INSTALLATION After installation, you must enable user name resolution and check for established connections. Enable user name resolution Once EUM is installed on the Novell NDS Tree server, you must enable EUM User Name Resolution. To enable, double-click the icon in the system tray and launch the SurfControl Web Filter Service Settings dialog. Click the Advanced tab to configure user name resolution. In the User Name Resolution area, select the Enterprise User Monitoring radio button. Apply the changes and click OK. Check for established connections After EUM is installed and enabled, you should check to make sure that there are established connections between Web Filter and the NDS server. From the command line, run the following command: netstat -an find When connections are established, you should see all NDS servers listed with the following format: TCP : :0 LISTENING TCP : :1046 ESTABLISHED TCP : :1059 ESTABLISHED 12 EUM Deployment White Paper SurfControl Web Filter for MS Windows rev 1.1

15 NetwareEUM..... THE SCUA.INI FILE Web Filter requires an initialization file (scua.ini) on each domain controller. The NetwareEUM file differs from the EUM file. Here is an example: After making changes to the scua.ini file, you must unload and reload the NLM. [surfcontrol_services] #This list identifies the Web Filter =61696 #collectors by IP address and the port =61696 #used to communicate with Web Filter =61696 # =61696 #This is a commonly used list. [allowed_users] user1=admin.nw_5_1_surf user2=tester.acct.nw_5_1_surf [ignored_users] user1=zenworks.nw_5_1_surf [ignored_usernames_containing] string1=admin string2=host [ignored_usernames_ending_with] string1=nw_6_surf [ignored_usernames_beginning_with] string1=zenworks [nw_eum_agent] logging=1 #This list identifies explicitly allowed #users. Use the following format: #unique_user_key= #fully_qualified_username_in_the_nds_tree #This list identifies the domain #account logon events that NLM should #ignore when caching data. This list #does not allow wildcards. Ensure you include #Zenworks ids. #Use this list to ignore user names that #contain one of the specified strings. Each #string must be unique. #This is a commonly used list. #Use this list to ignore user names that #end with one of the specified strings. #Use this list to ignore user names that #begin with one of the specified strings. #Set the logging level here: #0 Disable logging #1 Important events like start, stop, connection stat #2 User logon events, ignored users #3 Combining effect of 1and 2 # #This is a commonly used list. rev 1.1 SurfControl Web Filter for MS Windows EUM Deployment White Paper 13

16 ..... NetwareEUM Procedure 2: Install NLM Step Action 1 Ensure Novell Client 32 was installed on the Web Filter server prior to Web Filter installation. 2 From Web Filter server, log on to the Novell server with administrative rights. 3 Go to the SYS volume and create a directory (for example, nweum) Note: When creating the directory, use DOS8.3 naming conventions. 4 Under this directory, copy the files nweum.nlm and scua.ini from the Web Filter server to the Novell server. 5 From the Netware Server console, load the NLM by typing: Load sys:\nweum\nweum.nlm and pressing enter Note: The system will not allow you to load the NLM if a copy is already running. Procedure 3: Automatically loading NLM Step Action 1 To automatically load the NLM every time the server is rebooted edit the sys:\system\autoexec.ncf file. 2 You can edit this file using any text editor from the workstation or from the Netware Server by typing: Load edit sys:\system\autoexec.ncf 3 Add the following line at the end of the file: load sys:\nweum\nweum.nlm 4 Save the file. Procedure 4: Unloading NLM Step Action 1 From the Netware Server console, type: unload nweum.nlm 14 EUM Deployment White Paper SurfControl Web Filter for MS Windows rev 1.1

17 NetwareEUM..... Procedure 5: Editing the Initialization file Step Action 1 If you plan to add additional Web Filter servers to your network, you ll need to edit the initialization file. NLM reads the initialization file (scua.ini) at startup; therefore, you must unload NLM before any new settings take affect. 2 Unload the NLM 3 Add the new servers to the surfcontrol_services section of the scua.ini file. The format of each entry in this section is: Note: 4 Reload the NLM. Hostname_or_IP_Address=Port number The default port number is because is used by Windows EUM. Procedure 6: Post-installation steps Step Action Enable EUM User Name Resolution 1 Once EUM is installed on the domain controller, you must enable EUM User Name Resolution. 2 Double-click the icon in the system tray and launch the SurfControl Web Filter Service Settings dialog. 3 Click the Advanced tab to configure user name resolution. 4 In the User Name Resolution area, select the Enterprise User Monitoring radio button. Apply the changes and click OK. Check for Established Connections 5 From the command line, run the following command: > netstat -an find When connections are established, you should see ALL domain controllers listed in the following format: TCP : :0 LISTENING TCP : :1046 ESTABLISHED TCP : :1059 ESTABLISHED rev 1.1 SurfControl Web Filter for MS Windows EUM Deployment White Paper 15

18 ..... Acronyms Logging The log file surflog.txt is created in the same directory as that which holds scua.ini and nweum.nlm. The logging settings are shown in Table 1. Table 1 Logging Value Detail logged 0 N logging 1 Important events - Startup, Shutdown, Errors, connections with Web Filter installations, Connection failure, Disconnects, etc. 2 Login events 3 Cumulative effect of setting the logging level to 1 as well as 2 Setting NLM to ignore certain users NetwareEUM informs Web Filter of Netware servers logging into other Netware servers, as well as informing Web Filter of user logging data. These events are written to the log file when the logging level is set to 2. This means that the size of the cache increases at both the Netware server and the Web Filter server. Therefore, SurfControl recommends that you include all Netware Server objects in the Ignored User list. Enter users you want NetwareEUM to ignore into the Ignored User list of the scua.ini file (C:\Program Files\Surfcontrol\Web Filter\Netware\scua.ini). Use the following format: user1=tester.accounting.nw_5_1_surf user2=admin.nw_5_1_surf ACRONYMS The following table defines the acronyms used in this document: Acronym EUM NDS NetwareEUM NLM SMS UA Definition Enterprise User Monitoring (for Windows) Netware Directory Service Enterprise User Monitoring (for Novell) Netware Loadable Module System Management Server User Agent 16 EUM Deployment White Paper SurfControl Web Filter for MS Windows rev 1.1