Client Settings

Applications such as su, sshd, and login authenticate users' identity by requesting user credentials (user name and password). These are signed applications that identify and authenticate before a child process is executed.

GuardPoints can have an associated policy that restricts access to the data stored in them. For a process to access the data, the user's associated identity must be authorized. This authorization can be done by adding an entry to the Settings field on the Client Settings tab. This entry specifies a program, such as mentioned above, with a keyword that indicates the type of authorization that is applied.

Client settings configured on the CipherTrust Manager are pushed to the clients periodically.

Any changes to the client settings are not automatically signed. Signatures of the newly added processes are compared against the signatures in the existing settings. If they differ, an error message is generated. Refer to Re-Sign Settings for steps to configure this setting. Refer to the CTE Agent Advanced Configuration and Integration Guide specific to your platform for details about this feature.

Client settings can also be configured at the client group level, see Inheritance of Client Group Settings for details.

Client Settings for Linux

Specify the authentication mechanisms in place for certain binaries on the client machine.

Default Settings for Linux

|authenticator|/usr/sbin/sshd
|authenticator|/usr/sbin/in.rlogind
|authenticator|/bin/login
|authenticator|/usr/bin/gdm-binary
|authenticator|/usr/bin/kdm
|authenticator_euid|/usr/sbin/vsftpd

Add, edit, or modify authentication settings as appropriate.

Specify Authentication Settings

To specify authentication settings for the client:

1. Open the CTE application.

2. Under Client Name, click the desired client.

3. Click the Client Settings tab. The Settings text box contains the authentication settings.

   

   Each line has the format:

   |privilege|/path/to/binary
   

   Refer to Client Settings Keywords for keywords.

4. In the Settings box, specify the authentication mechanism.

   Note

   • To delete the settings, delete the content and click Apply.
   • To edit the settings, modify the content and click Apply. When editing the setting strings, follow the format |privilege|binary.
   • To cancel any changes, click Cancel.

5. Click Apply.

Client Settings for Windows

For applications running under WOW64 that require some form of user authentication, create entries on the Client Settings tab. The syswow64 paths are created by default when the CTE Agent is installed. \Windows is for Windows XP and Windows Itanium operating systems.

In WOW64, all file access to C:\Windows\System32 is redirected to C:\Windows\syswow64, and is implemented using the File System. Redirected syswow64 paths are effective only for 64-bit Windows file agents. This is the path where programs compiled for 32-bits are stored to run on a 64-bit system.

Before proceeding, verify that the volume letter and the path for the Windows system are correct. When the CTE Agent is installed, the volume letter defaults to C: It is possible that the executables on the Client Settings tab are on a different volume or in a different folder. If the volume or path information is incorrect, the CipherTrust Manager cannot sign the applications, and it cannot apply Agent Lock and System Lock.

Default Settings for Windows

||C:\WINDOWS\system32\winlogon.exe
|lock|C:\WINDOWS\system32\msiexec.exe
|lock|C:\WINDOWS\system32\wuauclt.exe
|lock|C:\WINDOWS\system32\wupdmgr.exe
|lock|C:\Program Files\Vormetric\DataSecurityExpert\Agent\Secfs\sec\bin\vminstall.exe
|exempt|C:\WINDOWS\explorer.exe
|exempt|C:\WINDOWS\regedit.exe
|exempt|C:\WINDOWS\system32\regedt32.exe
|exempt|C:\WINDOWS\system32\svchost.exe
|exempt|C:\WINDOWS\system32\services.exe
|exempt|C:\WINDOWS\system32\smss.exe

Add, edit, or modify authentication settings as appropriate.

Specify Authentication Settings

To specify authentication settings for the client:

1. Open the CTE application.

2. Click Clients > Clients.

3. Under Client Name, click the desired client.

4. Click the Client Settings tab. The Settings text box contains the authentication settings.

   

   Each line has the format:

   |privilege|/path/to/binary
   

   Refer to Client Settings Keywords for keywords.

5. In the Settings box, specify the authentication mechanism.

   Note

   • To delete the settings, delete the content and click Apply.
   • To edit the settings, modify the content and click Apply. When editing the setting strings, follow the format |privilege|binary.
   • To cancel any changes, click Cancel.

6. Click Apply.

Oracle Database in a Guarded NFS Mount on AIX

To locate your Oracle database in a guarded NFS mount:

1. Open the CTE application.

2. Under Client Name, click the desired client.

3. Click the Client Settings tab. The Settings text box contains the authentication settings. Each line has the format:

   |privilege|/path/to/binary
   

4. In the Settings text box, add the following entries:

   |vfsnumber|<path to>/oracle
   |vfsnumber|<path to>/dbca
   

   Example:

   |vfsnumber|/u01/app/oracle/dbhome_1/bin/oracle
   |vfsnumber|/u01/app/oracle/dbhome_1/bin/dbca
   

5. Click Apply.

Client Settings Keywords

The following table lists the keywords that you can enter on the Client Settings tab. These keywords override different authentication requirements:

The following table shows different results you get when using authenticator or authenticator_euid to verify user identities.

* indicates the real uid of the user who starts the application. This means that if the policy is configured to check the user ID, a security rule must be generated for every possible user.

Configuring Application Authentication Credentials

To configure application authentication credentials:

1. Open the CTE application.

2. Click Clients > Clients.

3. Under Client Name, click the desired client.

4. Click the Client Settings tab. The Settings box displays the default set of system applications that may require authentication entries.

5. In the Settings box, add, modify, or delete entries to control their access permissions. When you add more processes, you must include the entire path.

   Note

   A keyword such as |authenticator| must be used in front of a process, otherwise, the entry is ignored by the CipherTrust Manager GUI.

6. Click Apply.

Client users currently logged on to the client must log off and log on again to refresh their user authentication credentials. They can verify the change by logging on to the client, accessing a GuardPoint, and checking the user information in the message logs.

Re-Sign Settings

If you add another process to the set of trusted applications on the Client Settings tab, enable the Re-sign Settings toggle. This ensures that the new process is signed and authenticated by the client.

Subsequently, when the client settings are pushed to the CTE Agent, the updated settings are re-signed. The Re-sign Settings toggle is turned off (or reset).

To ensure that new processes are signed and authenticated by the client:

1. Open the CTE application.

2. Click Clients > Clients.

3. Under Client Name, click the desired client.

4. Click the Client Settings tab.

   

5. In the Settings box, update settings as appropriate.

6. Turn on the Re-sign Settings toggle.

   

7. Click Apply.

Enabling the Re-sign Settings toggle forces a signature update. On subsequent push of the client settings to the CTE Agent, the updated settings are re-signed and the Re-sign Settings toggle is turned off (or reset). If you do not turn on this toggle after adding a new process, the client ignores the newly added process.

Modifying Client Configuration

To modify the client configuration:

1. Open the CTE application.

2. Click Clients > Clients.

3. Under Client Name, click the desired client. The mini detail view of the client is displayed.

   Linux Client

   

   Windows Client

   

   Alternatively, click the expand icon () to the left of the desired client in the clients list.

4. Modify the following, as appropriate:

   • Live Data Transformation: Enable or disable LDT. By default, any ongoing rekey operations on the LDT GuardPoints on the client are resumed. To disable the setting, click the Suspend Live Data Transformation icon (). The icon changes to Resume Live Data Transformation ().

   • Encryption Key Protection: Enable or disable protection of encryption keys stored in the cache memory on the CTE client. The field is available to registered clients only.

     When enabled, keys are removed from the cache after three minutes of inactivity and memory is overwritten with random data any time after a key is used.

     When keys are cached in memory, they are encrypted in the cache and only decrypted when used. This adds a small overhead but extra security. The in-memory key cache is held in the operating system kernel and is not accessible to any user-space applications. Furthermore, Thales recommends that CTE only be run on operating systems that have been patched to prevent Meltdown and Spectre attacks. Subsequent releases will prevent the CTE agent from running if patches are not in place.

     If a kernel crash dump is initiated, any clear-text key information (used to derive keys from encrypted cached key counterparts) is erased from memory before the crash dump is taken.

   • Cloud Object Storage: (Non-editable, Linux only) Enabled or disabled based on the feature selection during registration. From the GUI, you can neither disable nor enable the Cloud Object Storage feature. To enable or disable it, register the client again and opt or opt out of the Cloud Object Storage feature. Refer to the CTE Agent for Linux Quick Start Guide for details.

   • Secure Start: (Non-editable, Windows only) Enabled or disabled based on the installed Agent capability. If the Agent supports the Secure Start feature, then this option is enabled, otherwise, the option is disabled.

   • Unlock: Unlock Agent Lock and System Lock.

   • Agent Lock: Lock the contents of the CTE Agent directories on the client.

   • System Lock: Apply an internal policy to the client to lock client system directories, like /var, /bin, /etc. Enabling System Lock automatically enables Agent Lock.

   • Communication Enabled: Whether to enable the client's communication with the CipherTrust Manager. Select to enable, clear to disable communication. By default, the communication is enabled.

   • Password Creation Method: Set the password creation method—Manual or Generate. Refer to Changing Client Password for details.

   • Client Profile: Select a profile for the client. The default profile is DefaultClientProfile. If you did not specify a profile during registration, the client is linked with default profile. To change the client profile, refer to Changing the Profile for details.

5. Click Apply.

Changing the Profile

To change the client profile:

1. Open the CTE application.

2. Under Client Name, click the desired client.

3. Next to Client Profile, click the profile link (for example, DefaultClientProfile). The Select Profile dialog box shows the current client profile and Rekey Option, Rekey Rate, and Schedule of the selected profile.

   

4. From the Profile drop-down list, select the desired profile.

5. Click OK. The selected profile is linked successfully.