Author: Girish Mutt

Abstract:

The main objective of this AppNote is to give a step by step procedure for customers to help them integrate the SSH relay feature of PUM with Active Directory as the authentication domain. The normal approach will be to use existing PUM framework users to enable the SSH Relay feature. This proposed approach will help customer directly integrate their existing Active Directory environment with the PUM framework thereby allowing usage of single source for all corporate users. In addition to this PUM makes use of the LDAP groups to enable access to SSH relay hosts which allow PUM to make use of corporate directory specific access controls with PUM deployments.

Table of Contents

• Introduction
• Integrating PUM Manager with Active Directory as Authentication Domain
• SSH Relay Feature enabling with PUM Manager
• Command Control Rule for LDAP Group Matching in Active Directory
• Using SSH Relay feature with Active Directory as authentication domain
• Glossary of Terms

Introduction

NetIQ Privileged User Management (PUM) helps IT administrators manage the identity and access for superuser, root accounts and application users by providing controlled superuser/privileged access to administrators, allowing them to perform jobs without needlessly exposing root account credentials. It also provides a centralized activity log across multiple platforms needed for ensuring compliance in enterprise deployments.

SSH relay is new feature added to PUM that enables delegation of privileged credentials to those hosts where PUM agents are not installed. This feature makes use of the underlying SSH functionality of Unix/Linux systems to provide privileged access and monitoring of the activities after the delegation. PUM has been designed to work with its own framework user management. With the new release of PUM 2.3, LDAP group support has been added which helps to achieve easy integration with corporate Active Directory as authentication domain. It helps to overcome the issue of managing users differently for PUM deployment and existing corporate Active Directory deployment.

This AppNote talks about the various configuration that needs to performed by a customer to enable SSH relay feature integrated with corporate Active Directory deployment.

Integrating PUM Manager with Active Directory as Authentication Domain

To integrate the PUM manager with Active Directory, the following steps needs to be performed:

2.1 Create Privileged Account Domain for Active Directory

2.2 Integrate the PUM manager to use Active Directory as authentication domain

2.1 Create Privileged Account Domain for Active Directory

Before we can integrate the PUM to use Active Directory as authentication domain, the account domain details to authenticate with should be added to PUM manager. PUM manager supports creation of the account domain under command control console installed as part of default manager installation. The various steps to be followed to add authentication account domain to PUM are as follows:

1. Goto Home/Command Control console –> Privileged Accounts.
2. Now choose the option Add Account Domain to add a new account domain to PUM manager framework.

• Provide all the details as shown in the picture below. Make sure replace xxx.xxx.xxx.xxx with the IP address of the corporate Active Directory server.

Click to view.

Figure 1: Adding corporate Active Directory account domain details.

2.2 Integrate the PUM manager to use Active Directory as authentication domain

After the addition of the Privileged Account Domain details under privileged accounts of PUM manager, the next step is to add the association between the PUM user framework to directly make use of user accounts in newly added authentication domain. The following steps should be followed to create that association:

1. Goto Home/ Framework User Manager console in PUM manager.

• Now choose the Users options and select the Account Settings from the left panel.
• In the Default Account Settings console, goto Authentication Domain and choose the newly added authentication domain from drop down box as shown in the picture below.

Click to view.

Figure 2: Associating the Account domain to be used by PUM default account settings.

After the successful association , PUM deployment is now is ready to make use of the corporate Active Directory as the default authentication domain. From this point onwards all users will be managed in the corporate Active Directory and those users, groups can be directly made use of for all PUM administration.

Note: In some cases the admin account name used by default in PUM framework will not be available in Active Directory. In such cases you can map the Active Directory Administrator to local admin user using Native Mapping feature available under Framework Users as shown below.

Click to view.

Figure 3: Native mapping of admin PUM user to Administrator user in Active Directory

SSH Relay Feature enabling with PUM Manager

To enabled SSH relay feature to a particular host or to a group of hosts, SSH credentials of the privileged users needs to be added to Privileged Account under Command Control. The following steps should be followed to create privileged accounts:

1. Goto Home/Command Control –> Privileged Accounts.

• Now choose the option Add Account Domain from left panel.
• Add all the details of the host and its privileged credentials as shown in the picture below.

Click to view.

Figure 4: Privileged Account details of the SSH Relay host

After adding the Privileged account details for SSH relay, the next step is create rules in Command Control so that authorization to access the SSH relay host is given based on the rule. This can be achieved by following the steps below:

1. Goto Home/Command Control –> Rules.

• Choose Add rule option from the left panel and add a rule R1.
• Now goto Modify Rule option for the R1 rule. Enable Session Capture to On and Authorize to Yes. Choose Run User as root and select the corresponding SSH relay privileged account added in Privileged Accounts. Choose Run Host as local as we are trying to enable SSH relay as root user to a normal user part of the corporate Active Directory as shown below.

Click to view.

Figure 5: Modifying rule to authorize and associate SSH credential for SSH relay host.

After this SSH command which will be part of the Home/Command Control/Commands needs to added to the rule. This can be easily achieved by dragging and dropping the SSH Session command under commands on to Rule R1 as shown below.

Click to view.

Figure 6: Adding SSH Session command onto rule R1.

Command Control Rule for LDAP Group Matching in Active Directory

After the integration of the PUM manager to use Active Directory, the next step will be to enable the LDAP group look up under rule matching which will make use of LDAP groups in Active Directory to decide on access permission for SSH sessions. This can be achieved by creating an Account Group which will be used to match for the LDAP group in Active Directory. The account group can be created by following the steps below:

1. Goto Home/Command Control –> Account Groups –> User Groups.

• Create a new user group using Add User group with name G1 using option from left panel.
• Now choose Modify User Group option to edit it. Under Type choose the External Group check box and select the corporate Active Directory account domain to which group look up operation will be done by rule.
• Under Users add a regular expression which matches the LDAP group of a user. This regular expression is used to check whether a particular user is part of the group.
  

  When the same is attached to the rule access to Privileged SSH sessions will be granted based on the fact that whether a user is part of the group or not. Thus LDAP group matching is used to grant access to SSH relay sessions.

Click to view.

Figure 7: Modifying User Account Group to match a LDAP group in Active Directory.

Once the User group is modified to match an external LDAP group, it will be added to rule R1 by dragging and dropping on top of the rule R1. Now this rule is able to grant access to SSH relay sessions based on the fact that whether a user is part of the external group or not. Hence PUM makes use of LDAP group look up feature to confirm membership of particular user in Active Directory and then grant access to SSH relay sessions.

The final rule after associating the group matching to rule will be as shown below:

Click to view.

Figure 8: Final rule view to match a LDAP group in Active Directory.

Using SSH Relay feature with Active Directory as authentication domain

After the successful completion of all the steps mentioned above, the deployed configuration can now be tried.

Use Case: Rule R1 basically tries to check that the user used as part of SSH relay is in deed part of LDAP group G1. It the user is part of the LDAP group in Active Directory which is the authentication domain, then list of allowed SSH Relay sessions will be displayed to user and user will be given access to SSH session as elevated root user.

The various steps to be followed to gain access to Privileged SSH Relay sessions are:

1. From any shell try making use of the SSH Relay feature using the following command:
   
   

   user311@pum-sles11x64:/root> ssh -t -p2222 user311@164.99.184.14

   Here we are trying to gain access to SSH relay session based on user311 being part of external LDAP group G1 in Active Directory.

• Now user311 is checked to verify whether the user is part of group G1 after providing password. If the user is part of the group G1, the user is shown list of allowed sessions . After choosing the session user is given access as privileged root user as defined in the rule R1 as depicted below. The user password provided will be that of user user311 under CN=Users, DC=PUM,DC=COM in PUM domain controller.
  
  

  user311@XXX.XX.XX.XX's password: 
   1) R1 - root@local
  Enter option (1-1): 1
  Password: 
  Last login: Wed Aug 17 16:08:25 2011 from pum-slesx1164.labs.blr.novell.com
  pum-sles11x64:~ # id
  uid=0(root) gid=0(root) groups=0(root),104(sfcb)

Glossary of Terms

• PUM - Privileged User Manager
• LDAP - Lightweight Directory Access Protocol
• SSH - Secure Shell