PDFCopyright © 1996-2018 Balabit, a One Identity business
Copyright © 2018 Balabit, a One Identity business. All rights reserved. This document is protected by copyright and is distributed under licenses restricting its use, copying, distribution, and decompilation. No part of this document may be reproduced in any form by any means without prior written authorization of Balabit.
This documentation and the product it describes are considered protected by copyright according to the applicable laws.
The Balabit™ name and the Balabit™ logo are registered trademarks of Balabit SA.
The Balabit Shell Control Box™ name and the Balabit Shell Control Box™ logo are registered trademarks of Balabit.
Citrix®, ICA® and XenApp™ are trademarks or registered trademarks of Citrix Systems, Inc.
Linux™ is a registered trademark of Linus Torvalds.
Sun™, Sun Microsystems™, the Sun logo, Sun Fire 4140™, Sun Fire 2100™, Sun Fire 2200™, Sun Fire 4540™, and Sun StorageTek™ are trademarks or registered trademarks of Sun Microsystems, Inc. or its subsidiaries in the U.S. and other countries.
The syslog-ng™ name and the syslog-ng™ logo are registered trademarks of Balabit.
VMware™, VMware ESX™ and VMware View™ are trademarks or registered trademarks of VMware, Inc. and/or its affiliates.
Windows™ 95, 98, ME, 2000, XP, Server 2003, Vista, Server 2008, 7, 8, and Server 2012 are registered trademarks of Microsoft Corporation.
The Zorp™ name and the Zorp™ logo are registered trademarks of BalaSys IT Ltd.
All other product names mentioned herein are the trademarks of their respective owners.
DISCLAIMER. Balabit is not responsible for any third-party websites mentioned in this document. Balabit does not endorse and is not responsible or liable for any content, advertising, products, or other material on or available from such sites or resources. Balabit will not be responsible or liable for any damage or loss caused or alleged to be caused by or in connection with use of or reliance on any such content, goods, or services that are available on or through any such sites or resources.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (https://www.openssl.org/). This product includes cryptographic software written by Eric Young ([email protected])
This product includes open source software components. For details on the licenses and availability of these software components, see Appendix E, Open source licenses.
March 01, 2018
Administrator Guide for Balabit’s Privileged Session Management, Shell Control Box (PSM, formerly called SCB)
Table of Contents
- Preface
- 1. Introduction
- 2. The concepts of PSM
- 2.1. The philosophy of PSM
- 2.2. Policies
- 2.3. Credential Stores
- 2.4. Plugin framework
- 2.5. Indexing
- 2.6. Supported protocols and client applications
- 2.7. Modes of operation
- 2.8. Connecting to a server through PSM
- 2.9. Maximizing the scope of auditing
- 2.10. IPv6 in PSM
- 2.11. SSH hostkeys
- 2.12. Authenticating clients using public-key authentication in SSH
- 2.13. The gateway authentication process
- 2.14. Four-eyes authorization
- 2.15. Network interfaces
- 2.16. High Availability support in PSM
- 2.17. Versions and releases of SCB
- 2.18. Accessing and configuring PSM
- 2.19. Licenses
- 3. The Welcome Wizard and the first login
- 4. Basic settings
- 5. User management and access control
- 5.1. Managing PSM users locally
- 5.2. Setting password policies for local users
- 5.3. Managing local usergroups
- 5.4. Managing PSM users from an LDAP database
- 5.5. Authenticating users to a RADIUS server
- 5.6. Authenticating users with X.509 certificates
- 5.7. Managing user rights and usergroups
- 5.8. Listing and searching configuration changes
- 5.9. Displaying the privileges of users and user groups
- 6. Managing PSM
- 7. General connection settings
- 7.1. Configuring connections
- 7.2. Modifying the destination address
- 7.3. Configuring inband destination selection
- 7.4. Modifying the source address
- 7.5. Creating and editing channel policies
- 7.6. Real-time content monitoring with Content Policies
- 7.7. Configuring time policies
- 7.8. Creating and editing user lists
- 7.9. Authenticating users to an LDAP server
- 7.10. Audit policies
- 7.11. Verifying certificates with Certificate Authorities
- 7.12. Signing certificates on-the-fly
- 7.13. Creating a Local User Database
- 7.14. Configuring cleanup for the PSM connection database
- 8. HTTP-specific settings
- 9. ICA-specific settings
- 10. RDP-specific settings
- 10.1. Supported RDP channel types
- 10.2. Creating and editing protocol-level RDP settings
- 10.3. Network Level Authentication (NLA) with PSM
- 10.4. Using SSL-encrypted RDP connections
- 10.5. Verifying the certificate of the RDP server in encrypted connections
- 10.6. Using PSM as a Remote Desktop Gateway
- 10.7. Configuring Remote Desktop clients for gateway authentication
- 10.8. Inband destination selection in RDP connections
- 10.9. Usernames in RDP connections
- 10.10. Saving login credentials for RDP on Windows
- 10.11. Configuring RemoteApps
- 11. SSH-specific settings
- 12. Telnet-specific settings
- 13. VMware Horizon View connections
- 14. VNC-specific settings
- 15. Indexing audit trails
- 15.1. Configuring the internal indexer
- 15.2. Configuring external indexers
- 15.2.1. Prerequisites and limitations
- 15.2.2. Hardware requirements for the external indexer host
- 15.2.3. Configuring PSM to use external indexers
- 15.2.4. Installing the external indexer
- 15.2.5. Configuring the external indexer
- 15.2.6. Uploading decryption keys to the external indexer
- 15.2.7. Customizing the indexing of HTTP traffic
- 15.2.8. Starting the external indexer
- 15.2.9. Disabling indexing on PSM
- 15.2.10. Managing the indexers
- 15.2.11. Troubleshooting external indexers
- 15.3. Monitoring the status of the indexer services
- 15.4. HTTP indexer configuration format
- 16. Browsing and replaying audit trails on PSM
- 17. Advanced authentication and authorization techniques
- 17.1. Configuring usermapping policies
- 17.2. Configuring gateway authentication
- 17.2.1. Configuring out-of-band gateway authentication
- 17.2.2. Performing out-of-band gateway authentication on PSM
- 17.2.3. Performing inband gateway authentication in SSH and Telnet connections
- 17.2.4. Performing inband gateway authentication in RDP connections
- 17.2.5. Troubleshooting gateway authentication
- 17.3. Configuring 4-eyes authorization
- 17.4. Using credential stores for server-side authentication
- 17.4.1. Configuring local Credential Stores
- 17.4.2. Performing gateway authentication to RDP servers using local Credential Store and NLA
- 17.4.3. Configuring password-protected Credential Stores
- 17.4.4. Unlocking Credential Stores
- 17.4.5. Using Lieberman ERPM to authenticate on the target hosts
- 17.4.6. Using a custom Credential Store plugin to authenticate on the target hosts
- 17.4.7. Creating a custom Credential Store plugin
- 17.5. Integrating ticketing systems
- 17.6. Integrating external authentication and authorization systems
- 18. Reports
- 18.1. Contents of the operational reports
- 18.2. Configuring custom reports
- 18.3. Creating reports from audit trail content
- 18.4. Creating statistics from custom database queries
- 18.5. Database tables available for custom queries
- 18.5.1. The alerting table
- 18.5.2. The aps table
- 18.5.3. The archives table
- 18.5.4. The audit_trail_downloads table
- 18.5.5. The channels table
- 18.5.6. The closed_connection_audit_channels view
- 18.5.7. The closed_not_indexed_audit_channels view
- 18.5.8. The connection_events view
- 18.5.9. The connection_occurrences view
- 18.5.10. The connections view
- 18.5.11. The events table
- 18.5.12. The file_xfer table
- 18.5.13. The http_req_resp_pair table
- 18.5.14. The indexer_jobs table
- 18.5.15. The occurrences table
- 18.5.16. The progresses table
- 18.5.17. The results table
- 18.5.18. The skipped_connections table
- 18.5.19. The usermapped_channels view
- 18.5.20. Querying trail content with the lucene-search function
- 18.6. Generating partial reports
- 18.7. Creating PCI DSS reports
- 18.8. Contents of PCI DSS reports
- 19. The PSM RPC API
- 20. The PSM REST API
- 21. PSM scenarios
- 21.1. Configuring public-key authentication on PSM
- 21.2. Organizing connections in non-transparent mode
- 21.3. Using inband destination selection in SSH connections
- 21.3.1. Using inband destination selection with PuTTY
- 21.3.2. Using inband destination selection with OpenSSH
- 21.3.3. Using inband selection and nonstandard ports with PuTTY
- 21.3.4. Using inband selection and nonstandard ports with OpenSSH
- 21.3.5. Using inband destination selection and gateway authentication with PuTTY
- 21.3.6. Using inband destination selection and gateway authentication with OpenSSH
- 21.4. SSH usermapping and keymapping in AD with public key
- 22. Troubleshooting PSM
- 22.1. Network troubleshooting
- 22.2. Gathering data about system problems
- 22.3. Viewing logs on PSM
- 22.4. Changing log verbosity level of PSM
- 22.5. Collecting logs and system information for error reporting
- 22.6. Status history and statistics
- 22.7. Troubleshooting a PSM cluster
- 22.8. Understanding PSM RAID status
- 22.9. Restoring PSM configuration and data
- 22.10. VNC is not working with TLS
- A. Configuring external devices
- B. Using SCP with agent-forwarding
- C. Security checklist for configuring PSM
- D. Jumplists for in-product help
- E. Open source licenses
- F. END USER LICENSE AGREEMENT FOR BALABIT PRODUCT (EULA)
- Glossary
- Index
- List of PSM web interface labels
Published on March 01, 2018
© 2007-2017 Balabit SA
Send your comments to [email protected]
