Client Settings

Applications such as su, sshd, and login authenticate users' identity by requesting user credentials (user name and password). These are signed applications that identify and authenticate before a child process is executed.

GuardPoints can have an associated policy that restricts access to the data stored in them. For a process to access the data, the user's associated identity must be authorized. This authorization can be done by adding an entry to the Settings field on the Client Settings tab. This entry specifies a program, such as mentioned above, with a keyword that indicates the type of authorization that is applied.

Client settings configured on the CipherTrust Manager are pushed to the clients periodically.

Any changes to the client settings are not automatically signed. Signatures of the newly added processes are compared against the signatures in the existing settings. If they differ, an error message is generated. Refer to Re-Sign Settings for steps to configure this setting. Refer to the CTE Agent Advanced Configuration and Integration Guide specific to your platform for details about this feature.

Client settings can also be configured at the client group level, refer to Inheritance of Client Group Settings for details.

Client Settings for Linux

Specify the authentication mechanisms in place for certain binaries on the client machine.

Default Settings for Linux

|authenticator|/usr/sbin/sshd
|authenticator|/usr/sbin/in.rlogind
|authenticator|/bin/login
|authenticator|/usr/bin/gdm-binary
|authenticator|/usr/bin/kdm
|authenticator_euid|/usr/sbin/vsftpd

Add, edit, or modify authentication settings as appropriate.

Additional Settings for HDFS (Linux Clients)

Depending on the Hadoop security authentication mode, additional settings are needed for CTE clients in an HDFS cluster. Add the following settings as appropriate.

/usr/jdk64/jdk1.8.0_40/bin/java is the Java executable used to launch the HDFS services. Change the

• Sample setup when hadoop.security.authentication mode is simple.

  |authenticator+arg=+class=org.apache.hadoop.hdfs.server.namenode.NameNode|/usr/jdk64/jdk1.8.0_40/bin/java
  |authenticator+arg=+class=org.apache.hadoop.hdfs.server.datanode.DataNode|/usr/jdk64/jdk1.8.0_40/bin/java
  

• Sample setup when hadoop.security.authentication mode is Kerberos.

  |authenticator+arg=+class=org.apache.hadoop.hdfs.server.namenode.NameNode|/usr/jdk64/jdk1.8.0_40/bin/java
  |authenticator+arg=+class=org.apache.hadoop.hdfs.server.datanode.SecureDataNodeStarter|/usr/lib/bigtop-utils/jsvc
  

Authentication Settings for Signature Sets (Linux Clients)

The CipherTrust Manager provides an option to configure authentication of CTE client binaries. If a binary, whose path matches a client setting entry, is executed on the CTE client, the operation is validated using the binary signature stored in a signature set on the CipherTrust Manager. Based on the authenticity of the binary, the operation is validated as "User Authenticated" or "User Not Authenticated" as appropriate.

The format to specify authentication settings for a signature set is:

|privilege+sig=<signature-set-name>|/path/to/binary

For example, to specify authentication settings for a signature set test-sign-set for a binary stored at /home/test/run-test, add the entry:

|authenticator+sig=test-sign-set|/home/test/run-test

The wildcard character asterisk (*) can also be used to specify paths in client settings as:

|keyword+sig=<signature-set name>|/path/to/binary/*`

For example, to specify authentication settings for all binaries under /home/test/, add the entry:

|authenticator+sig=test-sign-set|/home/test/*

Specify Authentication Settings

To specify authentication settings for the client:

1. Open the Transparent Encryption application.

2. Under Client Name, click the desired client.

3. Click the Client Settings tab. The Settings text box contains the authentication settings.

   

   Each line has the format:

   |privilege|/path/to/binary
   

   The format to specify authentication settings for a signature set is:

   |privilege+sig=<signature-set-name>|/path/to/binary
   

   Refer to Client Settings Keywords for keywords.

4. In the Settings box, specify the authentication mechanism.

   Note

   • To delete the settings, delete the content and click Apply.

   • To edit the settings, modify the content and click Apply. When editing the setting strings, follow the format |privilege|binary.

   • To cancel any changes, click Cancel.

5. Click Apply.

Client Settings for Windows

For applications running under WOW64 that require some form of user authentication, create entries on the Client Settings tab. The syswow64 paths are created by default when the CTE Agent is installed. \Windows is for Windows XP and Windows Itanium operating systems.

In WOW64, all file access to C:\Windows\System32 is redirected to C:\Windows\syswow64, and is implemented using the File System. Redirected syswow64 paths are effective only for 64-bit Windows file agents. This is the path where programs compiled for 32-bits are stored to run on a 64-bit system.

Before proceeding, verify that the volume letter and the path for the Windows system are correct. When the CTE Agent is installed, the volume letter defaults to C: It is possible that the executables on the Client Settings tab are on a different volume or in a different folder. If the volume or path information is incorrect, the CipherTrust Manager cannot sign the applications, and it cannot apply Agent Lock and System Lock.

Default Settings for Windows

||C:\WINDOWS\system32\winlogon.exe
|lock|C:\WINDOWS\system32\msiexec.exe
|lock|C:\WINDOWS\system32\wuauclt.exe
|lock|C:\WINDOWS\system32\wupdmgr.exe
|lock|C:\Program Files\Vormetric\DataSecurityExpert\Agent\Secfs\sec\bin\vminstall.exe
|exempt|C:\WINDOWS\explorer.exe
|exempt|C:\WINDOWS\regedit.exe
|exempt|C:\WINDOWS\system32\regedt32.exe
|exempt|C:\WINDOWS\system32\svchost.exe
|exempt|C:\WINDOWS\system32\services.exe
|exempt|C:\WINDOWS\system32\smss.exe

Add, edit, or modify authentication settings as appropriate.

Specify Authentication Settings

To specify authentication settings for the client:

1. Open the Transparent Encryption application.

2. Click Clients > Clients.

3. Under Client Name, click the desired client.

4. Click the Client Settings tab. The Settings text box contains the authentication settings.

   

   Each line has the format:

   |privilege|/path/to/binary
   

   Refer to Client Settings Keywords for keywords.

5. In the Settings box, specify the authentication mechanism.

   Note

   • To delete the settings, delete the content and click Apply.

   • To edit the settings, modify the content and click Apply. When editing the setting strings, follow the format |privilege|binary.

   • To cancel any changes, click Cancel.

6. Click Apply.

Oracle Database in a Guarded NFS Mount on AIX

To locate your Oracle database in a guarded NFS mount:

1. Open the Transparent Encryption application.

2. Under Client Name, click the desired client.

3. Click the Client Settings tab. The Settings text box contains the authentication settings. Each line has the format:

   |privilege|/path/to/binary
   

4. In the Settings text box, add the following entries:

   |vfsnumber|<path to>/oracle
   |vfsnumber|<path to>/dbca
   

   Example:

   |vfsnumber|/u01/app/oracle/dbhome_1/bin/oracle
   |vfsnumber|/u01/app/oracle/dbhome_1/bin/dbca
   

5. Click Apply.

Client Settings Keywords

The following table lists the keywords that you can enter on the Client Settings tab. These keywords override different authentication requirements:

The following table shows different results you get when using authenticator or authenticator_euid to verify user identities.

* indicates the real uid of the user who starts the application. This means that if the policy is configured to check the user ID, a security rule must be generated for every possible user.

Configuring Application Authentication Credentials

To configure application authentication credentials:

1. Open the Transparent Encryption application.

2. Click Clients > Clients.

3. Under Client Name, click the desired client.

4. Click the Client Settings tab. The Settings box displays the default set of system applications that may require authentication entries.

5. In the Settings box, add, modify, or delete entries to control their access permissions. When you add more processes, you must include the entire path.

   Note

   A keyword such as |authenticator| must be used in front of a process, otherwise, the entry is ignored by the CipherTrust Manager GUI.

6. Click Apply.

Client users currently logged on to the client must log off and log on again to refresh their user authentication credentials. They can verify the change by logging on to the client, accessing a GuardPoint, and checking the user information in the message logs.

Inheriting Client Settings from a Client Group

To inherit client settings from a client group:

1. Open the Transparent Encryption application.

2. Under Client Name, click the desired client.

3. Click the Client Settings tab.

4. Select the desired client group from the Inherit Client Setting From drop-down list. This drop-down shows the list of client groups the client is a member of. The drop-down is not available for standalone clients.

5. Click Apply.

The client now inherits client settings from the selected client group. Refer to Inheritance of Client Group Settings for details on inheritance.

Re-Sign Settings

If you add another process to the set of trusted applications on the Client Settings tab, enable the Re-sign Settings toggle. This ensures that the new process is signed and authenticated by the client.

Subsequently, when the client settings are pushed to the CTE Agent, the updated settings are re-signed. The Re-sign Settings toggle is turned off (or reset).

To ensure that new processes are signed and authenticated by the client:

1. Open the Transparent Encryption application.

2. Click Clients > Clients.

3. Under Client Name, click the desired client.

4. Click the Client Settings tab.

   

5. In the Settings box, update settings as appropriate.

6. Turn on the Re-sign Settings toggle.

   

7. Click Apply.

Enabling the Re-sign Settings toggle forces a signature update. On subsequent push of the client settings to the CTE Agent, the updated settings are re-signed and the Re-sign Settings toggle is turned off (or reset). If you do not turn on this toggle after adding a new process, the client ignores the newly added process.

Modifying Client Configuration

To modify the client configuration:

1. Open the Transparent Encryption application.

2. Click Clients > Clients.

3. Under Client Name, click the desired client.

   Alternatively, click the expand icon () to the left of the desired client in the clients list.

   Linux Client

   

   Windows Client

   

   Note

   Any data protection related fields such as Live Data Transformation and LDT Access Only and Multifactor Authentication are unavailable for Windows clients with the RWP protection mode.

4. Modify the following, as appropriate:

   • Live Data Transformation: Enabled or disabled based on the feature selection during registration. By default, LDT performs rekey operations on the LDT protected GuardPoints as soon as GuardPoints are enabled. To pause LDT rekey operations, click the Suspend Live Data Transformation icon (). The icon changes to Resume Live Data Transformation ().

     After LDT has been enabled, it cannot be disabled. To remove the feature, you must migrate existing data protected under LDT policies, unregister the client, and delete the client. Then, you can reregister the client without enabling the feature. This allows you reclaim the license for use on another client.

   • LDT Access Only: (Windows only) Whether the client can be added to an LDT communication group.

     • If the check box is clear, the client can be added to or removed from an LDT communication group.

     • If the check box is selected, the client cannot be added to an LDT communication group.

   • Efficient Storage: Enabled or disabled based on the feature selection during registration.

     After efficient storage has been enabled, it cannot be disabled. To remove the feature, you must migrate existing data protected with efficient storage GuardPoints, unregister the client, and delete the client. Then, you can reregister the client without enabling the feature.

   • Encryption Key Protection: Enable or disable protection of encryption keys stored in the cache memory on the CTE client. The field is available to registered clients only.

     When enabled, keys are removed from the cache after three minutes of inactivity and memory is overwritten with random data any time after a key is used.

     When keys are cached in memory, they are encrypted in the cache and only decrypted when used. This adds a small overhead but extra security. The in-memory key cache is held in the operating system kernel and is not accessible to any user-space applications. Furthermore, Thales recommends that CTE only be run on operating systems that have been patched to prevent Meltdown and Spectre attacks. Subsequent releases will prevent the CTE agent from running if patches are not in place.

     If a kernel crash dump is initiated, any clear-text key information (used to derive keys from encrypted cached key counterparts) is erased from memory before the crash dump is taken.

   • Cloud Object Storage: (Non-editable, Linux only) Enabled or disabled based on the feature selection during registration. From the GUI, you can neither disable nor enable the Cloud Object Storage feature. To enable or disable it, register the client again and opt or opt out of the Cloud Object Storage feature. Refer to the CTE Agent for Linux Quick Start Guide for details.

   • File Header Supported (FHS): (Non-editable, Windows only) Enabled or disabled based on the feature selection during Agent installation. When this feature is enabled, you can apply GuardPoints to SMB shares.

     After FHS has been enabled, it cannot be disabled from the CipherTrust Manager. To turn off the feature, you must migrate existing data protected under LDT policies, unregister the client, and delete the client. Then, you can reinstall the client with the LDT on CIFS (File Header Support, FHS) capability turned off, and register with the CipherTrust Manager.

   • Secure Start: (Non-editable, Windows only) Enabled or disabled based on the installed Agent capability. If the Agent supports the Secure Start feature, then this option is enabled, otherwise, the option is disabled.

   • Multifactor Authentication (MFA): (Windows only) Available based on the installed Agent capability.

     • If the Agent supports MFA, you can enable or disable the feature. By default, the feature is disabled. To enable MFA on the client, select the Multifactor Authentication check box. To disable, clear the check box.

       When enabled, access to the requested data is granted only after the requester satisfies configured authentication criteria. Refer to Multifactor Authentication for details.

     • If the Agent does not support MFA, the option is disabled and cannot be modified.

   • In-place Data Transformation - Device: (Non-editable, Linux only) Enabled or disabled based on the installed Agent capability. If the Agent supports the feature, then this option is enabled, otherwise, the option is disabled.

   • Domain Sharing: Allow or deny sharing the client resources across domains. Refer to Sharing Resources Across Domains for details.

   • Unlock: Unlock Agent Lock and System Lock.

   • Agent Lock: Lock the contents of the CTE Agent directories on the client.

   • System Lock: Apply an internal policy to the client to lock client system directories, like /var, /bin, /etc. Enabling System Lock automatically enables Agent Lock.

   • Communication Enabled: Whether to enable the client's communication with the CipherTrust Manager. Select to enable, clear to disable communication. By default, the communication is enabled. For manually added unregistered clients, this option is editable if Registration Allowed is selected.

   • Registration Allowed: (Manually added unregistered clients) Whether to allow client's registration with the CipherTrust Manager. Select to allow, clear to deny registration. By default, the registration is not allowed.

   • Password Creation Method: Set the password creation method—Manual or Generate. Refer to Changing Client Password for details.

   • Protection Mode: (Editable for Windows clients) Set the protection mode for the Windows client.

     To change the protection mode:

     1. Click the link next to the Protection Mode label. The Change Protection Mode dialog box is displayed.

     2. Select the desired Protection Mode.

        Note that changing the protection mode from RWP (Ransomware Protection) to CTE RWP is irreversible. Review your decision before proceeding with this change.

     3. Click Update.

   • Client Profile: Select a profile for the client. The default profile is DefaultClientProfile. If you did not specify a profile during registration, the client is linked with default profile. To change the client profile, refer to Changing the Profile for details.

   • Advanced Security Configuration: View or edit the client's security configuration parameters. Refer to Changing Security Configuration Parameters for details.

   • Details (Read-only): Shows the versions of the platform and kernel installed on the client, for example, RHEL7.8 - 3.10.0-1127.el7.x86_64. For unregistered or manually added clients, a hyphen (-) is displayed. For Windows clients, the field is empty.

   • Upgrade On Reboot (Read-only): Displays when the next upgrade of the CTE Agent is scheduled. None is displayed if the upgrade is not scheduled. For unregistered clients, the field remains blank.

   • Agent Information: Collect and download the Agent information (agentinfo) from the CTE Agent.

     • Collect: Informs the CTE client to collect the Agent information and send it back to the CipherTrust Manager. This is the default link.

       After the Agent information is successfully received, the link changes to Recollect and Download.

     • Recollect: Collects the latest Agent information from the CTE Agent.

     • Download: Downloads the Agent information from the CipherTrust Manager in a tar file. After the download, the Agent information is removed from the CipherTrust Manager. In a CipherTrust Manager cluster, the information will be downloaded from the node where the Agent information is requested.

     Refer to Collecting Agent Information for details.

5. Click Apply.

Changing the Profile

To change the client profile:

1. Open the Transparent Encryption application.

2. Under Client Name, click the desired client.

3. Next to Client Profile, click the profile link (for example, DefaultClientProfile). The Select Profile dialog box shows the current client profile and Rekey Option, Rekey Rate, and Schedule of the selected profile.

   

4. From the Profile drop-down list, select the desired profile.

5. Click OK. The selected profile is linked successfully.

Changing Security Configuration Parameters

The CipherTrust Manager provides options to modify certain security configuration parameters configured on the CTE client. The list of editable configuration parameters can vary based on the capabilities supported by the CTE Agent installed on the client. Refer to the CTE Agent documentation for compatible versions and dynamic parameters.

To view or change the security configuration parameters:

1. Open the Transparent Encryption application.

2. Under Client Name, click the desired client.

3. Next to Advanced Security Configuration, click the View/Edit Settings link. The Advanced Security Configuration dialog box lists the security configuration parameters that can be updated after the CTE client is registered with the CipherTrust Manager. Every parameter has the fixed set of values.

   Note

   The PTRACE_PROECTION feature is not applicable to CTE for Windows Agents.

4. Change the security configuration, as appropriate.

5. Click Save. The security configuration is changed successfully.