ActiveX Certificates Deployment Guide

Transcription

1 1 Introduction It has come to the attention of Hitachi ID Systems that some ActiveX components deployed with both generally available releases and custom builds of Hitachi ID Systems products have cryptographic signatures that will expire. This document explains the process for installing replacement ActiveX controls on Hitachi ID Password Manager and Hitachi ID Privileged Access Manager servers and - if required - on individual user PCs. 2 Background: ActiveX controls in Hitachi ID Systems products ActiveX controls are small programs that run locally on Windows workstations, launched from web pages via the Internet Explorer (IE) web browser. They may be installed in advance of a user accessing a web page that incorporates them or downloaded by the browser from the application web server on demand. Hitachi ID Password Manager uses ActiveX controls to update locally cached passwords in Windows and in Lotus Notes (on Notes ID files). Hitachi ID Privileged Access Manager uses ActiveX controls to integrate with the Windows copy buffer, to display passwords and to launch logins by authorized users to managed accounts on managed systems. To mitigate the security impact of running code locally on the user s PC, IE combines policy settings, approved URLs and checks of cryptographic signatures on each ActiveX control to determine whether it is allowed to run. ActiveX controls shipped by Hitachi ID Systems are always signed, using an official Hitachi ID Systems cryptographic certificate. When signing an ActiveX control (.ocx file), it is possible to apply a timestamp to the signature. When this is done, so long as the signing certificate was current when the signature was applied, the.ocx file is considered to be valid indefinitely that is, the signature does not expire. The software build process at Hitachi ID Systems acquires such timestamps for all.ocx files, using a service offered by Verisign. Hitachi ID Systems has learned that some.ocx files shipped to customers do not have this timestamp, due to temporary unavailability of the Verisign service at the time those.ocx files were compiled and signed. It is these signed-but-not-time-stamped.ocx files which will stop working at the end of the validity interval of whichever signing certificate was used at the time they were built Hitachi ID Systems, Inc.. All rights reserved. 1

2 3 ActiveX controls by product The ActiveX controls used in Hitachi ID Systems products, in general, are as follows: Product Filename Function Password Manager pslocalr.ocx Update Windows or AD passwords cached by the workstation, after a successful password change. Password Manager nplocalr.ocx Update locally cached passwords for third party systems (typically hard-disk encryption) by calling into the system s network provider DLL, after a successful web-based password change. Privileged Access Manager pswxcmd.ocx Runs programs and passes credentials on command-line. Privileged Access Manager pswxcopy.ocx Places managed account passwords in Windows copy buffer. Privileged Access Manager pswxtsvc.ocx Launches Remote Desktop Protocol connections with embedded credentials. Privileged Access Manager pswxview.ocx Briefly displays managed account passwords. Privileged Access Manager pswxdom.ocx Launches IE browser tab and injects credentials into HTML form. 4 Which released OCX files are missing a timestamp The following released products contain.ocx files which were signed but not timestamped: Product Version OCX files Password Manager pslocalr.ocx (32/64) Password Manager pslocalr.ocx (32/64) Password Manager nplocalr.ocx and pslocalr.ocx (32/64) Password Manager nplocalr.ocx and pslocalr.ocx (32/64) Password Manager nplocalr.ocx and pslocalr.ocx (32/64) Privileged Access Manager pswxcmd.ocx, pswxcopy.ocx, pswxtsvc.ocx and pswxview.ocx (32) Privileged Access Manager pswxcmd.ocx, pswxcopy.ocx, pswxtsvc.ocx and pswxview.ocx (32) 2014 Hitachi ID Systems, Inc.. All rights reserved. 2

3 5 Downloading replacement OCX files and checking if the installed ones are custom Hitachi ID Systems has posted replacement.ocx files, with timestamps that make them valid indefinitely, at the following URL: Please download this file from the Hitachi ID Systems web site to your Hitachi ID Password Manager or Hitachi ID Privileged Access Manager server and unzip it into a scratch directory. Next, copy the PowerShell script Hitachi-ID-Custom-OCX-check.ps1 from this zip file to the product instance directory (C:\Program Files (X86)\Hitachi ID\IDM Suite\<instance>\) you wish to test and run the script. The script will indicate whether OCX controls in that instance are stock or custom and whether ActiveX controls are properly signed. If your ActiveX controls are properly signed, the following message is displayed: All of your ActiveX controls are properly signed. action required. There is no further If any of your ActiveX controls are not properly signed, the following message is displayed: You have ActiveX controls that are not properly signed. In this case, one of the following messages will also be displayed, either: There are no custom ActiveX controls. or You have custom ActiveX controls. Please ensure you tell support that you have custom ActiveX controls when contacting them. If there are custom OCX scripts in the instance directory, please contact Hitachi ID Systems for replacement files. WARNING!: Do not replace custom.ocx files with the stock.ocx files downloaded above Hitachi ID Systems, Inc.. All rights reserved. 3

4 6 Replacing an ActiveX control on a Password Manager or Privileged Access Manager server Simply install the replacement file in the product instance directory: C:\ Program Files (X86)\ Hitachi ID\ IDM Suite\ <instance>\ wwwdocs\ Note: 64-bit versions of the.ocx files, where available, are found in the x64 sub-directory. Be sure to complete this process on every product server, including load balanced production servers, development environments, and UAT environments. 7 Replacing an ActiveX control on user devices using AD and a GPO Active Directory (AD) and the Group Policy Object (GPO) mechanism can be used to deploy software to user PCs. To deploy a replacement ActiveX control to user PCs, follow these steps: 7.1 Creating an immediate task for a group policy object to install an ActiveX control 1. Run Microsoft Management Console (mmc). 2. Select File Add/Remove Snap-in Select the Group Policy Management snap-in and click Add >. 4. Click OK. 5. Right click the group policy object that will have the new immediate task and click Edit. 6. In the console tree under Computer Configuration, expand Preferences Control Panel Settings. Note: Option may also be under User Configuration instead of Computer Configuration depending on the scope of the policy. 7. Right-click on the Scheduled Tasks New Immediate Task (At least Windows 7) (if running Windows Server 2012 or Windows 8) or Immediate Task (Windows Vista and later) (if running Windows Server 2008 R2 or Windows 7) Hitachi ID Systems, Inc.. All rights reserved. 4

5 8. In the New Task box, the Action will be set to Create. 9. Set a Name for the task. 10. Select the Actions tab, and click New. 11. You can either add a batch file here that manually installs all the ActiveX files, or you can install the ActiveX control directly by adding: Program/script: Regsvr32.exe Add arguments(optional): /s \\somenetworkshare\path\to\control\pswxview.ocx 12. Click OK. 13. Ensure that the following setting in the Common tab is selected: Apply once and do not reapply Hitachi ID Systems, Inc.. All rights reserved. 5

6 14. Ensure the following are selected under the Settings tab: Run task as soon as possible after a scheduled start is missed If the task is not scheduled to run again, delete it after: Immediately 2014 Hitachi ID Systems, Inc.. All rights reserved. 6

7 15. Click Apply, and then OK. 16. Verify the scheduled task was added to the group policy object Hitachi ID Systems, Inc.. All rights reserved. 7

8 17. (Optional) Have a user log in to the context of the group policy object and ensure that the new ActiveX controls are properly installed. For more details on this process please see: Notes In the above process, please note that: Depending on which group policy object is linked to, slightly different actions may be required. Regsvr32.exe could be added to a batch script to update all controls at once by adding one line for each control. By default the %LogonDomain%\%LogonUser% will run the task, but may require additional permissions to access and install signed ActiveX controls. Note: These permissions can be further configured/controlled by using the Microsoft ActiveX Installation Service (AXIS), or an additional group policy object. For more information, see: Hitachi ID Systems, Inc.. All rights reserved. 8

9 If the.ocx file is already installed, doing the above procedure may cause it to install a new version depending on your Windows settings. To ensure expected behavior, remove existing.ocx file first. 500, Street SE, Calgary AB Canada T2G 2J3 Tel: Fax: sales@hitachi-id.com File: SVN:fox/trunk/doc/fox/replace-ocx Date: May 22, 2014