Prerequisites The UNIX Free Discovery Tool runs on the following operating systems and frameworks: Windows 7, 8, 8.1, and 10.NET Framework 4.5.1 or higher Scan Credentials The credentials used to scan for account need access to the following files on the UNIX machine in order to retrieve all of the needed information for the accounts on that machine. SUDO /etc/passwd /etc/shadow (Mostly Debian) /etc/master.passwd (Mostly BSD) /etc/group /etc/login.defs The UNIX Free Discovery Tool attempts to read the files on the system using the privileges that the logged in user has. If the user is unable to read a file then it will attempt to read it using sudoer privileges. However, the sudoer must be able to perform the action without a prompt for password. This is done to help ensure that passwords are not passed to a terminal where they could be recorded. Authentication with Keys The UNIX Free Discovery Tool allows for users to connect via public key authentication. This can be done by providing the private key and passphrase in the privileged credentials list of the application. The application supports loading of standard PEM and PuTTY PPK keys. Ports The Discovery scan makes use of the standard SSH TCP port to connect to the target UNIX machines and scan for local accounts. Traffic Type Ports Used SSH 22 Digest Whitelist The UNIX Free Discovery Tool provides the ability for users to provide a map of IP addresses and their associated SSH server host key digests. This allows the UNIX Free Discovery Tool to check if the machine it is connecting to is a known and trusted host helping prevent Man-in-the-Middle attacks. If the host is not in the digest whitelist the tool will stop authentication to that machine and record it is an untrusted computer on the network after the full Page 1
Discovery is complete. This feature is particularly useful for discovering possible malicious hosts or Honeypots on a network that are attempting to steal user credentials or reroute traffic while stealing data. This feature may also be used as a quick way to verify the current SSH host key digests on the network. To use this feature add a KeyDigests.txt file in the same directory as the UNIX Free Discovery Tool executable. To enable the whitelisting, add at least one entry. Each entry must be on its own line and in the format of an IP address comma separated with a SHA-1 SSH host key digest. For example: 192.168.1.5, 00:01:02:03:04:05:06:07:08:09:0A:0B:0C:0D:0E:0F Page 2
Walkthrough After downloading the Discovery Tool, unzip it and run ThycoticPrivilegedAccountsDiscoveryForUnix.exe. Privileged Credentials In the first step, you will need to enter credentials that will be used to connect to discovered UNIX machines. If there are multiple different sets of usernames/passwords that are used for UNIX machines on your network, you can enter multiple accounts. These will be used for scanning but are not saved by the privileged account scanner tool. When scanning, the tool will attempt to authenticate with each account on each computer discovered. The end report will state which account worked for each UNIX machine. Privileged Credentials Scan Settings Scan Settings For running the scan, you can choose which IP address ranges you would like to scan for UNIX machines. The IP Address range can either be a list of single IP addresses, or any combination of lines in the following format. 10.0.0.1/24 10.10.10.1-100 10.10.11.1-10.10.12.255 Page 3
Discovering Accounts Before starting the scan, review the number of computers the discovery tool retrieved from the initial machine scan based on the list of IP addresses you listed to scan. Once you have confirmed that the settings look correct, click Start Scan. While the scan runs, you will see the number of computers scanned progress. You can stop the scan at any point and generate the reports based off of the accounts discovered so far. Note The time to complete the scan will vary based on network latency, number of machines, and how many machines actually exist. Testing in a large environment resulted in a scan of approximately 1,000 UNIX machines in slightly under an hour. Results Once the scan is completed, you can generate the executive summary report and the detailed CSV reports. Just enter a company name and click Generate Reports. Page 4
The reports will be created in a folder you choose and include the following files: File (Local Accounts)ThycoticUnixAccountAnalysis.csv (Secret Server Import)ThycoticUnixAccountAnalysis.csv ThycoticUnixAccountAnalysis.html ThycoticUnixAccountAnalysis.pdf (Untrusted Computers)ThycoticUnixAccountAnalysis.csv Description Detailed inventory of local accounts discovered List of accounts in a format that can be used to import into Thycotic Secret Server Summary report of findings Summary report of findings (Optional) A list of computers found that were not on the whitelist of thumbprints or did not match. This file will only appear if the thumbprint whitelist is provided. FAQs Q: What can I do to increase the security of the scan? A: The first and foremost way to ensure the security of the authorized privileged accounts is to use Digest Whitelisting. By using the whitelist of trusted machines, the tool will not present authentication tokens to potentially malicious machines. The next step is to use privileged accounts with appropriate permissions. It is recommended to use sudoers that have no password access to just the cat command. Q: How long will it take to scan my domain? Page 5
A: The time to discover accounts will vary depending on network latency and number of machines that respond. A test environment of approximately 1,000 UNIX machines took 50 minutes. We recommend testing out your scan first on a smaller IP address range to get a sense of time and results before scanning a larger range or your full network. Q: The PDF report has inconsistent margins or page breaks. A: Depending on some display drivers, or screen resolutions, you may see a margin in the PDF report. Either run the scan from a different machine or use the HTML version. The HTML file is the exact same information as the PDF. Page 6