• Cluster HA / DR
• Appliance / Virtual Machine
• Cloud / On-Prem

• Multiple PVWA
• HA / Load balance

• Multiple CPM
• Load balance on different types of Safe, such as one for Windows, one for *nux/Cloud.

PSM Design

• Multiple PSM
• Load balance
• PSMP 

PTA Design

Safe Design

• Safe Name Convention
• Safe Access Mapping from Roles to Access Rights
• Safe Access Model : Share , Personal, Mix
• 
  

Platform Design

• Name Convention

• Account name length restriction
• Account name convention
• Personalized accounts, Shared accounts for different technologies (DB, Windows, *Nix, Networking, Cloud)

Traffic Flow Design

• Firewall Ports
• Traffic direction : one way or two way
• All components including integration with NTP, AD, DC, Target Servers, DBs, Cloud , SIEM, Ticket system, etc

Authentication

A phased approach for implementing PAS

CyberArk Brief: A phased approach for implementing a Privileged Access Security Program

1. Phase 0 - Identify

1.1 Crown of jewels - Most critical assets
PII
Credit Cards
etc

1.2 Accounts who can access those assets
OS accounts
DB accounts
applications accounts

1.3 Accounts
shared / role based privilege accounts - built-in administrator account and root account
personal privilege accounts : accounts with -adm, or $ at the end

Focus on shared / role based     privilege accounts  first will get you least push back from admins.

2. Phase 1

Load credentials into actual vaults
Set up automatic verification process to confirm those credentials are accurate
End user should be able to use connect to reach their targets to do their administration work
Choose selective subset accounts to change password. Start with change button to confirm the CPM process is working.
Automated changes to rotate credentials' passwords.

2.2 Isolate --> Monitor --> Analyze
Remove show/copy buttons to require end users to connect to target.
PSM will provide connectivity and  monitor/record the session without exposing credentials.
PTA component will detect / alert threat detected from multiple sources

3. Phase 2

Going wider: - expand the process to other end points we identified (Networking devices, databases, web applications, iol devices)
Going deeper: - non human id ( application accounts, iis app pool, registry keys )

Timeline for basic installation of PAS

This is basic sample implementation schedule to roll out a non-ha basic design PAS solution

Pre-implementation to collect following information;
1. network design diagram including firewall, domain controller, VM ip, dns, smtp, snmp , ntp, etc.
2. hardware / virtual machine information based on size evaluation
3. traffic flow diagram
4. firewall rule sets based on traffic flow diagram
5. Details of SMTP, DC, SNMP, NTP,
6. CA certificate
7. Download software copy and licenses.
8. Make sure hard copy of Master CD, Operator CD in safe hand.




• Onsite Implementation Day 1:  Install and perform initial configuration of the Production including advanced Vault integration such as SNMP, SMTP, SYSLOG and any others the were agreed upon.
• Onsite Implementation Day 2:  Install and perform initial configuration of the Central Policy Manager, Password Vault Web Access 1 and 2, Privileged Session Manager, Secure Replication Utility and the PrivateArk Client.
•Onsite Implementation Day 3 Perform advanced configuration for the CPM, PVWAs and PSM. Test CPM management on 3 5 types of the out of the box plug ins. Test PSM workflows on 3 5 types of the out of the box connectors.
• Onsite Implementation Day 4 Troubleshoot any issues discovered during the CPM testing and PSM workflows. Perform overview session with administrators. Go over and assist in documenting the Master Policy, Access Control Model data and permission structures. Set up and go over support access and procedures.

References

• Docs  > Administration > Components > Privileged Session Manager > Architecture

Architecture

Session Manager Architecture

Privileged Threat Analytics Architecture

PAM Solution High Availability Design

Connect through the web portal (PVWA):

PAS Configuration Steps

On the Domain Controller:
1. create a CyberArk Bind User -  ex. [email protected]. Usually it is domain admin account
2. Define follow LDAP CyberArk groups - Cyberark mapping roles:
CyberArk Vault Admins - Vault Admins
CyberArk Safe Managers - Safe Managers
CyberArk Auditors - Auditors
CyberArk Users - Users


From PVWA Web GUI:
1. Activate PSM
2. Deactivate 'Require users to specify reason for access'
3. Integrate LDAP


On the Vault
1. Manual restart the vault service, will not start Event Notification Engine service.

PSM "connect" explaination

A user clicks "connect" in PVWA, an initial RDP session is established between the user and the PSM server. Since the user shouldn't be able to connect to the PSM server directly, the PSMConnect account is used. Once the session connects, PSM checks the session variables of the connecting user, including CyberArk username. Then the PSMConnect session creates a temporary profile for the user on the PSM server, called a Shadow user (if one doesn't exist), and switches the user's RDP session to that "isolated" shadow session/profile. Now that the user is in their own shadow session, PSM tries to execute the Connection Component specified. For example if it's SSH, it needs to pull the target address, managed account and password from the Vault. It will check if the user is authorized to use that account, pull the information, and launch an ssh session using command line switches for putty. Finally it will start recording, and give control to the RDS session back to the user.

CPM "verify" explaination

For most platforms, to "verify" the password, CyberArk tries to log into the target with the stored account. If it's able to log in, it calls the password verify. In Unix machines that concept is fairly straightforward - it does an SSH connection, and if it's able to get to the regular prompt, it calls it a success. In Windows, for the regular (non-WMI platform), it tries to issue a "net use \servername\IPC$ /user:<manageduser>" command. If successful, the password is verified. For databases it might try to establish an ODBC connection, etc.

The safe is (usually) the nexus linking the various people whom have some involvement with the account - specifically via the roles assigned to these users: the ability to connect using the account : retrieve the password for use outside of CyberArk : approve other peoples requests : maintain the account details in CyberArk.....

It is typical in enterprise to create shared safes for functional teams to use as well. If you are on boarding a  shared Privileged account, you will need to create/modify your shared safe.




Notes:

• By default, Safe creator will have quota ownership which will not be deleted. For how to delete it, check post https://blog.51sec.org/2019/11/cyberark-pta-solution-issues-and.html
• Suggested permission: It should only two users in the safe member list: PSM Manager and Safe Domain User
• Hide predefined users and groups. You can change this settings through one ini file in the vault server.
• A safe name cannot be more than 28 characters. Description of the new Safe. Up to 100 characters.
• Due to performance considerations, a maximum number of objects stored in a safe is 20000. This includes versions of objects, therefore the recommended number of actual accounts or files stored in a safe is 3000-5000
• Due to security considerations, it is recommended to separate objects stored in safes in groups, following the “least privilege” concept, to avoid situations where providing access for a user to a group of accounts also gives said user access to unrelated accounts. For example: “Windows Accounts” vs “Window Local Administrators for HR App” (28 character limit was not enforced in this example)
• Safe name convention
• • Define business designations that are important for your environment. For example: Line of Business, Geographical Location, Data Center, Platform, Account Type, Application Association, Environment, etc
  • List them in order of importance
  • Discuss and agree on the resulting layered structure. This will be your Safe Naming Convention Base. Eliminate any layers that are redundant or not needed.
  • List out as many examples of each designation as possible and define 2-4 letter translations for each. For example ORA for Oracle Database or LADM for Local Administrative Account. Alternatively, define a 1-2 digit number and its place in the Safe name instead of a 2-4 letter translation. For example 06 in the 8th and 9th spot for Oracle Database or 1 in the 1st spot for Production
  • Create 7-10 examples of safe names to ensure the structure is sufficiently robust to account for any future need
  • Document the Safe Naming Convention. Examples
  • • 1. P-TOR-SRV-WIN-LADM – Local Administrative Accounts (LADM) for Production (P) Windows (WIN) Servers (SRV) in Toronto (TOR)
    • 2. P-MAR-SRV-WIN-DSVC-HR – Domain Service Accounts (DSVC) for the HR Application (HR) living on Production (P) Windows (WIN) Servers (SRV) in the Markham (MAR)
    • 3. D-AWS-DB-ORA-LSVC-HR – Local Service Accounts (LSVC) for the HR Application (HR) living on Development (D) Oracle (ORA) Database (DB) in the Amazon Cloud (AWS)

Platform Management

Notes:

• New platform can be downloaded and imported from market place.
• Platform name convention need to defined well
• You can delete platform even there is account assigned to it. (Delete need to be very careful here). But since platform has gone, you wont be able to do connect, change, reconcile, this kind of actions anymore. You will not be able to edit it without select a new platform. 
• PAS supports up to 800 platforms.
• Platform name length: ??

Create an account

Notes:

• Default account names (Application-<Safe>-<Address>-<Username>
• The CPM Login methods possess the 38 character limit on the password field, same as the Vault.
• The account name pattern can be changed (Administration > Options > Account Name Pattern) - just delete/add properties of the account that should form the account name.
• The maximum length of the full path of a filename (that includes all folders in the path) is 170 characters. I generally remove "Device Type" from the default pattern to reduce chances of auto-generated names reaching the limit.
• Domain admin accounts can set restriction to pre-defined server which will have a drop-down menu to select
• Local admin accounts will need to define target address and name well. 
• Account Name Limitation
• • Windows - 32
  • *NIX 
  • • Legacy Unix - 8 characters
    • Modern *NIX - 32

Grant User to Add New Account to their Own Safe

Grant user to account management ability.

Or more specifically, you can remove some permissions from user to have better control. Even update account content can be removed.

Change account password

To change added account's password, you will need to switch Web Gui to classic interface mode.



YouTube Video:

Reset CyberArk Built-in administrator Password

• Master user is automatically added to all new safes with full rights - even safes it did not create. It requires a special configuration in order to login into it.
• Administrator is a built-in administrative user, but unlike Master it does not get automatically assigned to all new safes created (by other users).

If for somehow, your CyberArk administrator account has been locked up or you want to update the password, you can follow following steps to work on:

First, you will have RDP into your PVWA which has PrivateArk installed.

Then, Log into PrivateArk client with another account with Vault-level permissions such as Administrator2 . Click Tools > Administrative Tools > users and groups. Click on the "Administrator" account, and then "Trusted Networks Areas..." and click Activate.

If you don't have another local account such as adminsitrator2, you'll have to log in with the "Master" user. To log in with the "Master" user you'll have to take a few extra steps. 

Reset/Log in CyberArk Built-in Master Password

As per best practices you should always have a Backup administration account for operational stuff and shouldn't use Administrator account. In case you got into such situation, here are some thing you can follow to help you out:

Steps to Log In with Master Account:

1. Place Master CD into server.
2. Double click Private Ark icon
3. Enter 'Master' as the user and enter password.

More details from CyberArk KB:
To log in as the Master user please do the following on the Vault Machine:
1. Insert the Master CD in the CD Drive
2. Verify if the dbparm.ini lists the location of the Master key in the Master CD
•  dbparm.ini is located in the following location :  Drive:\Program Files (x86)\PrivateArk\Server\dbparm.ini
•  In v10+, the dbparm.ini is located here:   Drive:\Program Files (x86)\PrivateArk\Server\conf\dbparm.ini
•  The Master key parameter and value can be found as the following in the dbparm.ini file : RecoveryPrvKey="Drive:\RecPrv.key" 
•  If the location needs to be changed, a restart of the PrivateArk Server service is required for changes to take effect
3. Start the PrivateArk Client Application on the Vault Machine
4. Right Click on the "<VaultName> Server" icon within the Private Ark Client and choose "Properties" > "Advanced" > "Authentication" tab > "Authentication methods" section > Choose "PrivateArk authentication" > Click OK in the advanced window > Click OK in the Properties window
5. Log into the Vault with the username as "Master"
•  If you need to reset the Master password, this can be accomplished by going to User > Set password after logging in

Delete Safe / Change Safe Members

There is a KB for how to delete safe member: Delete Safe member

using following URL to delete a safe member.
https://<IIS_Server_Ip>/PasswordVault/WebServices/PIMServices.svc/Safes/{SafeName}/Members/{MemberName}

Unfortunately, I got following error;


At the end of account member record, there is a delete icon. You will need drag slide bar to the end to see it. That will delete member.

Reconcile Account

Passwords in the Vault must be synchronized with corresponding passwords on remote devices to ensure that they are constantly available. Therefore, the CPM runs a verification process to check that passwords are synchronized. If the verification process discovers passwords that are not synchronized with their corresponding password in the Vault, the CPM can reset both passwords and reconcile them. This ensures that the passwords are resynchronized automatically, without any manual intervention.

During password reconciliation, the unsynchronized password is replaced in the Vault and on the remote device with a new password that is generated according to the relevant platform. As soon as reconciliation is finished successfully, all standard verifications and changes can be carried out as usual. Users can see details of the last reconciliation process in the Operational Views in the Accounts List.
Assign reconcile account at Platform level:
Find account details and copy them into Platform Password Reconciliation settings. Then all accounts (new or existing) will have this setting automatically.

References

• How to log in as the Master user (CyberArk KB)

If you found some interesting ones, let me know. I will try it out. 

Encrypt WordPress with a plugin

First of all, we recommend to you a WordPress plugin- My Private Site , which is a plugin specially used to encrypt WordPress, which can restrict access very easily.

If you use WordPress built with Pagoda Panel, then the encryption will be very simple. Pagoda Panel has a built-in website encryption function.

Visual Form Builder is a plugin that allows you to build and manage all kinds of forms for your website in a single place. Building a fully functional contact form takes only a few minutes and you don’t have to write one bit of PHP, CSS, or HTML!

WPForms definitely will be better. But once it comes into attachment feature, it will charge you $39.50/year.

Open the Powershell ISE → Run the following script, adjusting the path for the export:

Get-ADComputer -Filter * -Property * | Select-Object Name,OperatingSystem,OperatingSystemVersion,ipv4Address | Export-CSV ADcomputerslist.csv -NoTypeInformation -Encoding UTF8

Reset Domain User's Password

1. Using Powershell

Set-ADAccountPassword -Identity admin2 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)
Set-ADAccountPassword -Identity admin3 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)
Set-ADAccountPassword -Identity auditor1 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)
Set-ADAccountPassword -Identity auditor2 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)
Set-ADAccountPassword -Identity test1 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)
Set-ADAccountPassword -Identity test2 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)
Set-ADAccountPassword -Identity test3 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)
Set-ADAccountPassword -Identity vaultadmin1 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)
Set-ADAccountPassword -Identity vaultadmin2 -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Cyberark1" -Force)

2. Use Command Prompt net user /domain USERNAME NEWPASS.
Run command prompt as administrator:

C:\Windows\system32>net user /domain admin2 Cyberark1
The command completed successfully.

C:\Windows\system32>

References

• /u/jacfearsome https://github.com/JacFearsome/powershell-scripts
• /u/PowerMonkey500 https://github.com/AndrewEllis93/PowerShell-Scripts
• /u/unibody https://github.com/jwmoss/powershell_scripts
• /u/IDA_noob https://github.com/tylerapplebaum?tab=repositories
• /u/mikedopp https://github.com/mikedopp
• /u/JBear_Alpha https://github.com/Average-Bear
• /u/BornToBeRoot https://github.com/BornToBeRoot/PowerShell
• /u/ramblingcookiemonste https://github.com/RamblingCookieMonster/PowerShell
• /u/jhulbe https://github.com/jhulbe/Powershell
• jrussellfreelance/powershell-scripts

It does has some restrictions including following main ones:

• It requires activation, which I found phone number outside of Ukraine might not work. Telegram activation method is still working. 
• WHOIS information is public. 
• You can register 3 free domains in one month from the same phone number under your account

Steps to apply a new domain

As shown from the homepage of https://pp.ua, there are quite a few domain registrars. In this post, I picked the first one nic.ua to register my own subdomain as an example. You will need to register an account from nic.ua website first. 

1  Find an accredited registrar

From nic.ua's domain page (https://nic.ua/ru/domains), scroll to the bottom, you will find the free domain pp.ua registration link: https://nic.ua/ru/domains/.pp.ua

Again it is in Russian, you might need Google Translation's help to understand it well.

2  Find an available subdomain by searching

Once found an available one, you can easily add it into cart and check out from the same page. 

3  Check Domain from your account dashboard

Since it has not been activated, your new domain will not show a green dot in front of it. No more than three domain registered in one month. 

Activation

There are multiple ways to activate your domain. It will require activation code. Unfortunately, for somehow, I did not get sms message for the code. After waited a couple of days, I decided to try Telegram method. 

Follow steps below to activate the domain:

• In Telegram searching bar find the @ppuabot, press START.
• Then press "Send phone number”.
• You will see "Please select function you wish to execute”.
• Press “Activate domain” and enter your domain name without
  'www' and 'http://'
• Then you should agree with PP.UA policy and registrant contact data usage
• PP.UA Bot will generate an activation code.
• Copy the activation code.
• Go to activation page

• Fill 'Domain', 'Phone number' (in international format) and 'Key' field
• When you continue you agree again with domain rules and privacy policy
• Click 'Continue' and wait for the result.

Please note, when you will renew the domain in a year, you have to activate it again the same way. Also, all requests to the registry are eligible for 5 days. If you didn't activate domain in 5 days then you will need to do registration request again and activate your domain.

Once you got following Done! page, which confirmed your new domain activated and ready for next step, integration with CloudFlare. 

• It will take a couple of hours to get this NS-Server change take into effect. You can request CloudFlare to check this nameserver updates from Overview page in your domain's CloudFlare Dashboard.
• Eventually if all goes well, in next 2-3 hours, you CloudFlare's domain page will show you this message: "Great news! Cloudflare is now protecting your site"

• PP.UA domains restrictions
• How to activate PP.UA domain