Info Security Memo
  • Blog
  • Sitemap
    • Categories
  • Contact
  • About
  • Resources
  • Tools
  • 51sec.org

Build Confidence

Focusing on Information Security 

Info Security Notes

URL Shorten Serviec Powered By Cloudflare Workers

6/29/2022

0 Comments

 
URL Shorten Serviec Powered By Cloudflare Workers

A URL Shortener Powered by Cloudflare Worker with password protection feature





Introduction

This project is based on the work done by xyTom/Url-Shorten-Worker. I added a small javascript to prompt password to verify the user since ideally you do not want this service to be completely public because this kind of url shorten site usually will gett abused usage as the original author faced. Again, this is a simple javascript and no security consideration. Once tested with a better code, it will be replaced right away.

Cloudflare works has 100k/day requests limistation, which is enough for a small project to use.

Github project: https://github.com/51sec/Url-Shorten-By-CF-Worker

Steps

1. Go to Workers KV and create a namespace.




2. Create a new worker.



3. Bind an instance of a KV Namespace to access its data in this new created Worker.

去Worker的Settings选选项卡中绑定KV Namespace


4.Where Variable name should set as LINKS and KV namespace is the namespace you just created in the first step.

其中Variable name填写LINKS, KV namespace填写你刚刚创建的命名空间




5. Copy the index.js code from this project to Cloudflare Worker.

复制本项目中的index.js的代码到Cloudflare Worker






const html404 = `<!DOCTYPE html>
<body>
  <h1>404 Not Found.</h1>
  <p>The url you visit is not found.</p>
</body>`


async function randomString(len) {
  len = len || 6;
  let $chars = 'ABCDEFGHJKMNPQRSTWXYZabcdefhijkmnprstwxyz2345678';    
  /****Removed confusing letters an numbers, oOLl,9gq,Vv,Uu,I1****/
 
  let maxPos = $chars.length;
  let result = '';
  for (i = 0; i < len; i++) {
    result += $chars.charAt(Math.floor(Math.random() * maxPos));
  }
  return result;
}
async function checkURL(URL){
    let str=URL;
    let Expression=/http(s)?:\/\/([\w-]+\.)+[\w-]+(\/[\w- .\/?%&=]*)?/;
    let objExp=new RegExp(Expression);
    if(objExp.test(str)==true){
      if (str[0] == 'h')
        return true;
      else
        return false;
    }else{
        return false;
    }
}
async function save_url(URL){
    let random_key=await randomString()
    let is_exist=await LINKS.get(random_key)
    console.log(is_exist)
    if (is_exist == null)
        return await LINKS.put(random_key, URL),random_key
    else
        save_url(URL)
}
async function handleRequest(request) {
  console.log(request)
  if (request.method === "POST") {
    let req=await request.json()
    console.log(req["url"])
    if(!await checkURL(req["url"])){
    return new Response(`{"status":500,"key":": Error: Url illegal."}`, {
      headers: {
      "content-type": "text/html;charset=UTF-8",
      "Access-Control-Allow-Origin":"*",
      "Access-Control-Allow-Methods": "POST",
      },
    })}
    let stat,random_key=await save_url(req["url"])
    console.log(stat)
    if (typeof(stat) == "undefined"){
      return new Response(`{"status":200,"key":"/`+random_key+`"}`, {
      headers: {
      "content-type": "text/html;charset=UTF-8",
      "Access-Control-Allow-Origin":"*",
      "Access-Control-Allow-Methods": "POST",
      },
    })
    }else{
      return new Response(`{"status":200,"key":": Error:Reach the KV write limitation."}`, {
      headers: {
      "content-type": "text/html;charset=UTF-8",
      "Access-Control-Allow-Origin":"*",
      "Access-Control-Allow-Methods": "POST",
      },
    })}
  }else if(request.method === "OPTIONS"){  
      return new Response(``, {
      headers: {
      "content-type": "text/html;charset=UTF-8",
      "Access-Control-Allow-Origin":"*",
      "Access-Control-Allow-Methods": "POST",
      },
    })

  }

  const requestURL = new URL(request.url)
  const path = requestURL.pathname.split("/")[1]
  console.log(path)
  if(!path){

    const html= await fetch("https://cdn.jsdelivr.net/gh/51sec/Url-Shorten-By-CF-Worker@main/index.html")
/****customized index.html at main branch, easier to edit it****/
   
    return new Response(await html.text(), {
    headers: {
      "content-type": "text/html;charset=UTF-8",
    },
  })
  }
  const value = await LINKS.get(path)
  console.log(value)
 

  const location = value
  if (location) {
    return Response.redirect(location, 302)
   
  }
  // If request not in kv, return 404
  return new Response(html404, {
    headers: {
      "content-type": "text/html;charset=UTF-8",
    },
    status: 404
  })
}



addEventListener("fetch", async event => {
  event.respondWith(handleRequest(event.request))
})




6. Click Save and Deploy

点击Save and Deploy



Note

Note: Because someone abuse this demo website, all the generated link will automatically expired after 24 hours. For long-term use, please deploy your own. To test this demo site, please use code 'cool'. There is a space in the prompt textbox. You might want to delete that space first then enter the password.

注意:由于该示例服务被人滥用,用于转发诈骗网站,故所有由demo网站生成的链接24小时后会自动失效,如需长期使用请自行搭建。


Example Code for Authentication

This code has been put into index.html file. You might want to change it based on your needs.

<SCRIPT language="JavaScript">
var password;
var pass1="cool";
password=prompt('Please enter your password to view this page!',' ');
if (password!=pass1)
    window.location="https://51sec.org";
else
   {
    alert('Password Correct! Click OK to enter!');
    }
</SCRIPT>







Video







References

  • Github project: https://github.com/51sec/Url-Shorten-By-CF-Worker






via Blogger http://blog.51sec.org/2022/06/url-shorten-serviec-powered-by.html
June 29, 2022 at 04:39PM Cloud
0 Comments

2. Primary Vault Installation - CyberArk PAM 12.1 Lab

6/29/2022

0 Comments

 
This video shows CyberArk primary vault installation when deploying primary-DR implementation. 1. Download 2. Pre-requisites 3. Installation 4. Verification ✍, Related Post: https://blog.51sec.org/2022/06/cyberark-121-lab-2-vault-installation.html ? Related videos Playlists: CyberArk:https://www.youtube.com/playlist?list=PLg7bL1bMpwPWNr2LzAnoK995sbWUbcotS CyberArk12:https://www.youtube.com/playlist?list=PLg7bL1bMpwPWNTJdY4-NOQItypI0tfwH3 ====================================================================== If you found this video has some useful information✍, please give me a thumb up ✅ and subscribe this channel ?to get more updates?: ⚡https://www.youtube.com/c/Netsec?sub_confirmation=1 ⚡Resource Collection and Bookmarks: https://sites.51sec.org/ Learning and Sharing - ?海内存知己,天涯若比邻 ⚡https://51sec.org ?https://itprosec.com

Watch video on YouTube here: https://youtu.be/ZrO_FjVkCuE by NetSec
0 Comments

CyberArk 12.1 Lab - 4. CPM Installation

6/21/2022

0 Comments

 
CyberArk 12.1 Lab - 4. CPM Installation

This post summarizes some steps to install PVWA (Password Vault Web Access) 




Diagram


Installation Tasks Overview:




System Requirements

Refer to this doc:

1 Recommended server specifications

2 Components version compatibility

3 Software requirements
OS: 2019. 2016 (Preferred by installation guide), 2012 (Special requirements)
Application: Multi-language, Certificate, HSM, LDAP, Cipher suites for Syslog, SMTP over SSL
Protocols: RDP 

4 Ports and Protocols (Network Firewall might need to open those ports)



CPM should place to location close to the end targets, such as servers or applications. 




5 Enable a secure channel between CPM and PVWA server, if your CPM is going to be installed on a different server from PVWA.


Architecture 

Active - Passive



Active - Active














Installation Prerequisite

1 Clean installation of Windows 2016 standard. Update windows system to latest with all patches. 


2 Software requirements
  • Microsoft Visual C++ Redistributable for Visual Studio 2015-2019
  • .NET Framework 4.8 Runtime
3 Run the CPM server prerequisites script

The CPM_PreInstallation.ps1 script automates and performs the following tasks:

  • Verifies .NET version
  • Sets IIS SSL TLS configuration

To run the CPM_PreInstallation script:

  1. Copy the CPM folder from the installation package to the CPM server, and unzip the folder.

  2. In the InstallationAutomation folder, locate the CPM_PreInstallation.ps1 file.

  3. Open the PowerShell window, and run the CPM_PreInstallation.ps1 file as Administrator.


Installation CPM using scripts

 

1 Install CPM using scripts

  1. In the CPM\InstallationAutomation\Installation folder, locate and open the InstallationConfig.xml file.
  2. In the InstallationConfig.xml file, specify the following parameters:

    Parameter

    Description

    Username

    The name of the user running the installation.

    Valid values: Username

    Default value: Windows User

    Company

    The name of the company running the installation.

    Valid values: Company name

    Default value: My Company

    CPMInstallDirectory

    The path where CPM is installed.

     

    If the path is more than 260 characters, enable the LongPathsEnabled setting.

    In the Registry Key settings, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Filesystem > LongPathsEnabled, and change the value from 0 to 1. Reboot the machine to recognize the new key setting.

    Valid values: Pathname

    Default value: C:\Program Files (x86)\CyberArk\

    isUpgrade

    Whether this is a CPM upgrade or a new CPM installation.

    Valid values: True/False

    Default value: False

  3. In a PowerShell window, run the CPMInstallation.ps1 script as Administrator.



2 Registration

The registration process connects the CPM to the Vault.

  1. In the CPM\InstallationAutomation\Registration folder, locate and open the CPMRegisterComponentConfig.xml file.

  2. In the CPMRegisterComponentConfig.xml file, specify the following parameters.

    Parameter

    Description

    accepteula

    Acceptance of the end user License agreement.

    Valid values: Yes/No

    vaultIP

    The IP address or hostname of the Vault server.

    Valid values: IP address or hostname

    vaultport

    The Vault’s configured communication port.
    Recommended default Vault port: 1858

    Valid values: Port number

    vaultuser

    The name of the Vault user performing the installation.

    Valid values: Username

     

    We recommend using the Vault administrator user to install CPM as this user has the appropriate Vault authorizations, and is created in the appropriate location in the Vault hierarchy.

    For more information about the required authorizations, see Vault user authorizations.

    pocmode

    Whether or not CPM is installed in POC mode.

    Valid values: True/False

    installDirectory

    The path where CPM is installed.

    Specifiy the same value as the CPMInstallDirectory value in the InstallationConfig.xml file.

    Valid values: Pathname

    Default value: C:\Program Files (x86)\CyberArk\

    username

    Sets the CPM user name. CPM Safe names will be created according to the user name that you specify.

    If the user name is already in use, a sequence number will be added.

    Example: PasswordManager1, PasswordManager2 and so on.

    Default value: PasswordManager

    isUpgrade

    Indicates whether the registration is for a clean installation or an upgrade.

    Valid values: True\False

    Default value: False

  3. In a PowerShell window, run the CPMRegisterComponent.ps1 script as Administrator, and provide the Vault password in one of the following ways.

    Method

    Command

    As a secure string (recommended) 

    CD “<installation package Path>InstallationAutomation\Registration” .\CPMRegisterComponent.ps1 -spwdObj <vaultpassword>

    Use a Windows authentication window (recommended for manual runs)

    CD “<installation package Path>InstallationAutomation\Registration” .\CPMRegisterComponent.ps1

    As clear text (not recommended)

    CD “<installation package Path>InstallationAutomation\Registration” .\CPMRegisterComponent.ps1 -pwd <vaultpassword>



Install CPM using installation wizard

 This installation process installs the CPM and connects to the Vault (registration).

  1. On the CPM machine, create a new folder, and copy the Central Policy Manager folder from the installation package to the new folder.

  2. Start the installation procedure by doing one of the following actions:

    • Double-click Setup.exe

    • On systems that are UAC-enabled, right-click Setup.exe, and then select Run as Administrator.

      The Setup window appears.

       

      You can exit installation at any time by clicking Cancel. You can return to the previous installation window by clicking Back, when relevant.

  3. Click Next.

    A list of applications appear that must be installed on your machine prior to the CPM installation.

  4. Click Install.

  5. Read the license agreement, and then click Yes.

  6. In the Customer Information window, enter your name and Company name in the appropriate fields, and then click Next.

  7. In the Destination location window, do one of the following actions:

    • Click Next to accept the default location where the CPM will be installed (displayed in the Destination Folder area).

    • Click Browse, select another location, and then click Next.

  8. In the Setup Type window, select No Policy Manager was previously installed, and then click Next.

  9. In the Vault's Connection Details window, enter the IP address or DNS of the Vault and its port number, and then click Next.

  10. In the Vault's Username and Password Details window, enter the name and password of the Vault user who will create the CPM environment in the Vault, and then click Next.

     

    Use the Vault administrator user to add the complete installation, and create it in the appropriate location in the Vault hierarchy.

    Only the Vault administrator user has permissions to add the new platforms. If they are not added automatically during installation, you can import them manually after the installation.

    The installation process begins, and builds the CPMenvironment in the Vault and on the CPM machine.

    1. If there is an existing PasswordManager user in the Vault, the following window appears.

      Do one of the following actions:

      • Accept the default CPM user name

      • Enter a different name

    2. Click Next to continue with the installation.

    3. If the cpm.ini file already exists in the Vault, the following

      the following window appears.

      8a

      Do one of the following actions:

      • Click Yes to override the existing cpm.ini file

      • Click No to leave the existing cpm.ini file in the Vault

  11. In the Setup Complete window, click Finish to complete the installation.

  12. Restart the machine.



Post-Installation

Refer to this doc:

1 Create a Trusted Network Area

During installation, several Vault objects are created to enable the CPM to access existing passwords, generate new ones and replace them on a remote machine. However, before the CPM can begin working, it is recommended to create a Trusted Network Area for the CPM user to log on to the Vault.

Make sure that the CPM user can only log on to the Vault from the CPM machine.

To create a trusted network area:

  1. Create a Network Area that includes only the IP address of the CPM machine, and from where the CPM user will log on to the Vault.

  2. In the User Properties window, add this network area to the user’s Trusted Network Areas.

  3. Restart the following services:

    • CyberArk Password Manager service

    • CyberArk Central Policy Manager Scanner


2 Check the installation log files and CPM log files
Capture the installation log file and save it to somewhere else. Else, the installation log file will be automatically deleted after next reboot. 

pm.log
pm_error.log


3 Check the CPM related files and services




4 Add restrictions to the protected credentials file


5 Vault Changes, such as safes, users, saved files. 


Hardening

The CPM hardening process is a series of tasks that enhance security on the Windows Server machine. Hardening is performed after CPM installation.

Hardening consists of the following tasks:

  • In-Domain Automatic Hardening via GPO
  • Out of Domain Hardening via INF import



Multiple CPMs






References

  • Install AD & CS (Certification Service) on Windows Server 2016 to Deploy Enterprise PKI
  • Logo Privileged Access Manager Version 12.2 - Installation


via Blogger http://blog.51sec.org/2022/06/cyberark-121-lab-4-cpm-installation_21.html
June 21, 2022 at 02:48PM CyberArk
0 Comments

CyberArk 12.1 Lab - 2. Vault Installation

6/21/2022

0 Comments

 
CyberArk 12.1 Lab - 2. Vault Installation

 This post summarizes some steps to install vault.




Diagram




System Requirements

Refer to this doc:

1 Recommended server specifications

2 Components version compatibility

3 Software requirements
OS: 2019. 2016 (Preferred by installation guide), 2012 (Special requirements)
Application: Multi-language, Certificate, HSM, LDAP, Cipher suites for Syslog, SMTP over SSL
Protocols: RDP 

4 Ports and Protocols (Network Firewall might need to open those ports)


5 2 Operator CD and 2 Master CD, License File
For this lab, copy installation software, Operator CD and Master CD, and license file to vault server. 



Architecture 

Primary-DR Environment:

Distributed Vaults (Active - Active)



Digital Cluster Vault Server:




Installation Prerequisite

1 Clean installation of Windows 2016 standard. Update windows system to latest with all patches. 



2 Remove Unnecessary network components and only Internet Protocol Version 4 (TCP/IPv4) left in Local Area Connection Properties -Networking

Remove DNS settings to avoid some compromised DNS server attack. Also if there is no outbound traffic from other network, you can take out default gateway configuration. But if you have DR site, you need to have a default gateway filled in. For my basic lab, all machines are in same network. 

Remove / Disable LMHOSTS lookup and NetBIOS over TCP/IP

3 Installation files
  • CyberArk Vault server and Disaster Recovery software packages
  • Master folder
  • Operator folder
  • License file

4 Software requirements
  • Microsoft Visual C++ Redistributable for Visual Studio 2015-2019
  • .NET Framework 4.8 Runtime

Installation Steps

 

1 Start installation CyberArk Digital Vault server and client


Further steps can see following post:
  • CyberArk PAS (Vault PrivateArk Server and Client) Installation - Part 1
  • CyberArk PAS (PVWA) Installation - Part 2
  • CyberArk PAS (CPM) Installation - Part 3

2 Sync time with your NTP server
Make sure the vault server has same time with other CyberArk servers. You can use your DC as your NTP servers, which is also default NTP server for all your domain joined machine. 

a.  In C:\Program Files\PrivateArk\Server\DBParm.ini, set the following parameter:
 
AllowNonStandardFWAddresses=[X.X.X.X,Y.Y.Y.Y,Z.Z.Z.Z],Yes,123:outbound/udp

Where X.X.X.X, Y.Y.Y.Y, Z.Z.Z.Z and so on are the Time Server IP addresses and port 123 is the Windows Time port.

b. Restart the Vault application using the Private-Ark Central Administration Console (the PrivateArk Server icon on the desktop).


Verification

 
1 Verify six new services. 
After hardening, total running service number has been reduced 31. 

2 Verify Vault status using Server Central Administration GUI

3 Check Configuration and log files
Server\Conf
Server\Logs

4 Log into Vault to verify safes



HSM Integration

 
Contact support for further professional support. 

References

  • Install AD & CS (Certification Service) on Windows Server 2016 to Deploy Enterprise PKI
  • Logo Privileged Access Manager Version 12.2 - Installation








via Blogger http://blog.51sec.org/2022/06/cyberark-121-lab-2-vault-installation.html
June 21, 2022 at 11:27AM CyberArk
0 Comments

CyberArk 12.1 Lab - 3. PVWA Installation

6/21/2022

0 Comments

 
CyberArk 12.1 Lab - 3. PVWA Installation

This post summarizes some steps to install PVWA (Password Vault Web Access) component. 




Diagram




Installation Tasks Overview:



System Requirements

Refer to this doc:

1 Recommended server specifications

2 Components version compatibility

3 Software requirements
OS: 2019. 2016 (Preferred by installation guide), 2012 (Special requirements)
Application: Multi-language, Certificate, HSM, LDAP, Cipher suites for Syslog, SMTP over SSL
Protocols: RDP 

4 Ports and Protocols (Network Firewall might need to open those ports)

PVWA should close to end users who should sign into it. 


Architecture 





Pre-Installation Tasks

1 Clean installation of Windows 2016 standard. Update windows system to latest with all patches. 



2 Log on Windows as the administrator users

3 Run PVWA server prerequisitesscript
  1. Copy the PVWA folder from the installation package to the component server, and unzip the folder.

  2. In the InstallationAutomation folder, locate the PVWA_Prerequisites.ps1 file.

  3. Open the PowerShell window, and run the PVWA_Prerequisites.ps1 file as an administrator.


Installation Steps

The PVWA can be automatically installed and deployed using scripts, or installed by using the Installation wizard. CyberArk recommend that you use the automated scripts.

1 In the PVWA\InstallationAutomation\Installation folder, locate and open the InstallationConfig.xml file.


2 
  1. In the InstallationConfig.xml file, specify the following parameters

    Parameter

    Description

    Username

    The name of the user running the installation.

    Valid values: Username

    Company

    The name of the company running the installation.

    Valid values: Company name

    PVWAApplicationDirectory

    The location of the PVWA IIS web application.

    Valid values: Pathname

    Default value: C:\inetpub\wwwroot\PasswordVault\

    PVWAInstallDirectory

    The path where PVWA is installed.

    Valid values: Pathname

    Default value: C:\CyberArk\Password Vault Web Access\

    PVWAApplicationName

    The name of the PVWA IIS web application.

    Valid values: Application name

    Default value: PasswordVault

    PVWAAuthenticationList

    The authentication types that PVWA supports. Separate multiple values with semicolons (;).

    Valid values: CyberArk, Windows, Radius, PKI, LDAP, Oracle SSO, SAML

    Default value: CyberArk;

     
    • Some of the selected authentication types must be installed and configured on the Vault before they can be configured for the PVWA. For more information, see Authenticate to Privileged Access Manager .

    • Make sure that the administrator user for testing can authenticate to the Vault with one of the selected authentication methods so that you will be able to test the installation.

    • To customize third-party authentication servers, see Set up customized authentication modules.

    pvwaUrl

    The URL of the default PVWA to access.

    Valid values: URL

    Default value: https://127.0.0.1/PasswordVault

    isUpgrade

    Indicates whether the registration is for an upgrade or a clean installation.

    Default value: False

    Valid values: True\False

3 In a PowerShell window, run the PVWAInstallation.ps1 script as Administrator.


Option: You also can install PVWA using the installation wizard as shown fromthis doc. 


Registration

The registration process connects the PVWA to the Vault.

  1. In the PVWA\InstallationAutomation\Registration folder, locate and open the PVWARegisterComponentConfig.xml file.

  2. In the PVWARegisterComponentConfig.xml file, specify the following parameters

    Parameter

    Description

    accepteula

    Acceptance of the end user License agreement.

    Valid values: Yes/No

    vaultIP

    The IP address or hostname of the Vault server.

    When you register PVWA to a DR Vault environment, specify vaultip with <vault ip>,<DR ip>

    Valid values: IP address or hostname

    vaultport

    The Vault’s configured communication port.
    Recommended default Vault port: 1858

    Valid values: Port number

    vaultuser

    The name of the Vault user performing the installation.

    Valid values: Username

     

    We recommend using the Vault administrator user to install PVWA as this user has the appropriate Vault authorizations, and is created in the appropriate location in the Vault hierarchy.

    For more information about the required authorizations, see Vault user authorizations.

    pocmode

    Whether or not PVWA is installed in POC mode.

    Valid values: True/False

    authenticationlist

    The authentication types that PVWA supports. Separate multiple values with semicolons (;).

    Valid values: CyberArk, Windows, Radius, PKI, LDAP, Oracle SSO, SAML

    installpackagedir

    The full path to the installation package directory (the directory that includes setup.exe).

    Edit this parameter only when pocmode is set to true.

    Do not edit if pocmode is set to false.

    Valid values: Pathname

    vaultname

    The name of the Vault where the PVWA configuration files will be stored.

    Valid values: Vault name

    virtualDirectoryPath

    The root path of the web application.

    Specify the same value as the PVWAApplicationDirectory parameter value in the InstallationConfig.xml file.

    Default value: C:\inetpub\wwwroot\PasswordVault

    Valid values: Pathname

    configFilesPath

    The path where the PVWA configuration files are installed.

    Specify the same value as the PVWAInstallDirectory value in the InstallationConfig.xml file.

    Default value: C:\CyberArk\Password Vault Web Access

    Valid values: Pathname

    pvwaUrl

    The URL of the default PVWA to access.

    Valid values: URL

    isUpgrade

    Indicates whether the registration is for an upgrade or a clean installation.

    Default value: False

    Valid values: True\False

    PVWAApplicationName

    The name of the PVWA IIS web application.

    Default value: PasswordVault

    Valid values: Application name

  3. In PowerShell window run the PVWARegisterComponent.ps1 script as Administrator, and provide the Vault password in one of the following ways:

    Method

    Command

    As a secure string (recommended) 

    CD “<installation package Path>InstallationAutomation\Registration” .\PVWARegisterComponent.ps1 -spwdObj <vaultpassword>

    Using a Windows authentication window (recommended for manual runs)

    CD “<installation package Path>InstallationAutomation\Registration” .\PVWARegisterComponent.ps1

    As clear text (not recommended)

    CD “<installation package Path>InstallationAutomation\Registration” .\PVWARegisterComponent.ps1 -pwd <vaultpassword>





Post-Installation

 
1 Check the installation log files

2 Check the user permissions on the web server

3 Configure additional authentication methods to log into PVWA

4 Replace self-signed certificate

5 For high availability, specify multiple vault ip addresses 

Hardening

 
You can harden the PVWA server automatically using a script file (if PSM is going to be on the same machine, the script may affect the PSM installation). 

  • Before you run the hardening script, in the PVWA\InstallationAutomation folder, locate and open the PVWA_Hardening_Config.xml file, and set the IsPSMInstalled parameter to True.
  • In a PowerShell window, run the PVWA_Hardening.ps1 script as Administrator.


Multiple PVWA installations

Multiple PVWAs in a single Vault environment

A single Vault can work with multiple instances of PVWA that are installed on different machines and which access the same Vault. This is true for a single Vault environment and for a Disaster Recovery Vault environment, and enables you to work with high availability or load balancing scenarios. In both scenarios, the same PVWA version must be installed on all machines.

Load balancer requirements

  • The load balancer must not alter page content, or it should include a mechanism to prevent pages from being altered.

  • The load balancer must not alter the application path hierarchy (leave the default application path as it is).

  • The load balancer must support 'sticky sessions'.

Configure the PVWA to work with the load balancer

  • In the web.config file, for the LoadBalancerClientAddressHeader parameter, enter the HTTP Header field name from which the PVWA reads the client IP. For more information, see the LoadBalancerClientAddressHeader parameter in PVWA Parameter File (Web.config).





References

  • Install AD & CS (Certification Service) on Windows Server 2016 to Deploy Enterprise PKI
  • Logo Privileged Access Manager Version 12.2 - Installation








via Blogger http://blog.51sec.org/2022/06/cyberark-121-lab-4-cpm-installation.html
June 21, 2022 at 11:25AM
0 Comments

1. Home Lab Infrastructure Setup - CyberArk PAM 12.1 Lab

6/21/2022

0 Comments

 
This series is to show you how to create your own home lab using your VMWare workstation. This video shows following services installed on a windows 2022 server 1. Install Domain service 2. Promote it to domain controller 3. Install certification service 4. Install email service 5. Install syslog service All are simple click click next next steps and very easy to follow. ✍, Related Post: https://blog.51sec.org/2022/06/cyberark-121-lab-1-infrastructure-setup.html ? Related videos Playlists: CyberArk:https://www.youtube.com/playlist?list=PLg7bL1bMpwPWNr2LzAnoK995sbWUbcotS CyberArk12:https://www.youtube.com/playlist?list=PLg7bL1bMpwPWNTJdY4-NOQItypI0tfwH3 ================================= If you found this video has some useful information✍, please give me a thumb up ✅ and subscribe this channel ?to get more updates?: ⚡https://www.youtube.com/c/Netsec?sub_confirmation=1 ⚡Resource Collection and Bookmarks: https://sites.51sec.org/ Learning and Sharing - 海内存知己,天涯若比邻 ⚡https://51sec.org ?https://itprosec.com =======Music in this video============= ?Alan Walker - Tell Me How (By MØMØS) [No Copyright ? Royalty Free Music] - https://www.youtube.com/watch?v=FEydFPDqrxw ?Alan Walker - Spectre ♫ [Copyright Free Music] - https://www.youtube.com/watch?v=oClz8GysyxM ?Alan Walker - Power (By MuraD) Song: MuraD - Power (Inspired by Alan Walker) ► Alan Walker https://soundcloud.com/walkzz https://www.youtube.com/user/DjWalkzz

Watch video on YouTube here: https://youtu.be/qKiNev10GkM by NetSec
0 Comments

CyberArk 12.1 Lab - 1. Infrastructure Setup

6/20/2022

0 Comments

 
CyberArk 12.1 Lab - 1. Infrastructure Setup

This post summarizes some steps to set up my CyberArk 12.1 lab environment, including domain controller setup, email and syslog service set up. 





Diagram



DC Domain and Certification Services Installation Steps

All following steps are straightforward and default settings have been used while installing those services. 

1 Install Domain Service

2 Install DNS service

3 Install Domain Federation Service

4 Install Web Service (IIS)

5 Promote machine to domain controller

6 Install certification service

Further information can be found from one of my old posts: Install AD & CS (Certification Service) on Windows Server 2016 to Deploy Enterprise PKI


Email Server Steps

Download and install MailEnable software from https://www.mailenable.com/download.asp#standard.

Install free MailEnable software video:


To integrate with 51sectest.dev AD, you will need to enable it from Messaging Manage and Post office's domain level. 






Syslog Server Steps


Download and install tftpd64 from https://pjo2.github.io/tftpd64/





Create CyberArk Users and Groups

 
For the lab, following users and groups have been created:


References

  • Install AD & CS (Certification Service) on Windows Server 2016 to Deploy Enterprise PKI










via Blogger http://blog.51sec.org/2022/06/cyberark-121-lab-1-infrastructure-setup.html
June 19, 2022 at 10:38PM CyberArk
0 Comments

CyberArk PAS Basic and Admin/Install/Configure Lab Encironment Details

6/18/2022

0 Comments

 
CyberArk PAS Basic and Admin/Install/Configure Lab Encironment Details
The CyberArk Privileged Access Security (PAS) Administration course covers CyberArk’s core PAS Solution: Enterprise Password Vault (EPV), Privileged Session Management (PSM) solutions, and Privileged Threat Analytics (PTA). CyberArk administrators, or ‘Vault Admins’, gain extensive hands-on experience in administering the core PAS Solution using our step-by-step exercise guide and dedicated lab environment.

This post is to show what kind of subjects you will learn.
 

CyberArk PAS Administration LAB V10.10





CyberArk PAS Basic

User Accounts and Identities
  • Standard User Accounts
  • Super Users
  • Application Accounts
  • Service Accounts
Privileged Accounts
  • Elevated personal user accounts
  • Shared privileged accounts
  • Application accounts


Privileged Access



CyberArk Shared Technology Platform:

CynerArk Blueprint Stages overview





Lab Topology

For v10.10 

Total Seven Machines:
001-DC: 10.0.0.2 - 1G RAM and 25G Storage
002-PVWA/PSM/CPM : 10.0.20.1 - 4G RAM and 30G Storage
003-PSMP/PSM Gateway: 10.0.1.16 - 1G RAM and 30G Storage
004-PTA : 10.0.0.1 - 6G RAM and 50G Storage
005-Target Linux: 10.0.0.20 - 2G RAM and 20G Storage
006-Target Windows: 10.0.10.50 - 2G RAM and 60G Storage
007-Vault : 10.0.10.1 - 1G RAM and 20G Storage


For v12.12 

Total Seven Machines:
001-DC01: 10.0.0.1 GW 10.0.255.254 - 2G RAM, 2vCPU and 30GB Storage, Server 2019 Standard
002-Components - PVWA/PSM/CPM : 10.0.20.1 - 6G RAM, 6 vCPU and 30G Storage, Server 2019 Standard
003-psm-ssh-gw, PSMP/PSM Gateway: 10.0.30.1 - 6G RAM and 50G Storage
004-PTAserver : 10.0.30.2 - 8G RAM and 50G Storage
005-Target Linux: 10.0.21.1 - 2G RAM and 60G Storage
006-Target Windows: 10.0.0.20 - 1G RAM and 20G Storage
007-Vault : 10.0.10.1 - 2G RAM and 30G Storage
008-DR: 10.0.14.1 - 2GB, 30GB storage

Lab Environment



DC01 Group Policy:





Contents

PAS=Privileged Account Security

Exercise Guide Contents

CyberArk PAS Admin, v10.10


INTRODUCTION TO CORE PAS ............................................................ 14
  PVWA .................................. 14
      Log in as Administrator .. 14
     Activate the PSM ............ 17
     Deactivate “Reason for Access” ....................................................... 18
     Connect using a stored account in the New UI................................. 18
     Connect using a stored account in the Classic UI ............................. 20
  PRIVATEARK CLIENT ................. 23
  REMOTE CONTROL CLIENT ......... 27
  PRIVATEARK SERVER ................ 29

USER MANAGEMENT ....... 34

  Know the Players ............ 34
  LDAP INTEGRATION AND DIRECTORY MAPPING .............................................. 35
      LDAP Integration ............ 35
      Configure Predefined Directory Mappings ....................................... 39
      Test the LDAP Integration and Predefined Mappings ...................... 42
      Configure Custom Directory Mapping .............................................. 42
      Test Custom Directory Mapping ....................................................... 45
  UNSUSPEND A SUSPENDED USER (OPTIONAL) .................................................. 50
  LOG IN WITH MASTER ............... 53

PASSWORD MANAGEMENT – PART 1 ................................................ 54

  SECURING WINDOWS DOMAIN ACCOUNTS ..................................................... 54
      Platform Management ... 54
      Safe Management .......... 60
      Account Management .... 63
  EDITING THE MASTER POLICY ..... 67
      Password Management . 68
  SECURING UNIX SSH ACCOUNTS  72
      Vault Administrator Tasks ...................................................... 72
      Safe Manager Tasks ....... 76
      Auditor Tasks .................. 91

PASSWORD MANAGEMENT – PART 2 ................................................ 94
  LINKED ACCOUNTS ................... 94
      Securing SSH Accounts Using a Logon account ................................ 94
      Securing Windows Server Local Accounts via a Reconcile Account .. 97
  SECURING ORACLE ACCOUNTS . 103
      Vault Adminstrator Tasks ........................................................ 103
      Safe Manager Tasks ..... 105
  SECURING AN ACCOUNT WITH SSH KEYS ............................................... 107
      Generating a Key-Pair .. 107
      Verify You Are Able to Log in with the Private Key ......................... 112
  USAGES – SECURING SERVICE ACCOUNTS ...............................................116
      Manage a Scheduled Task Usage ................................................... 116
      Managing a Configuration File Usage ............................................ 121

PRIVILEGED ACCESS WORKFLOWS ................................................... 126
REQUIRE USERS TO SPECIFY REASON FOR ACCESS ....................................... 126
Activating the Policy ..... 126
Add Predefined Reasons for Access ................................................ 127
REQUIRE DUAL CONTROL ACCESS APPROVAL ............................................. 130
Activating the Policy ..... 130
Adding an approver to a Safe ..................................................... 132
Testing Dual Control ..... 134
EXCLUSIVE PASSWORDS WITH AUTOMATED RELEASE AND ONE-TIME USE .......... 138
Adding a Master Policy exception for Exclusive Passwords ........... 138
Adding a Master Policy exception for One-Time Passwords .......... 139
Reducing the Minimum Validity Period .......................................... 140
Testing Exclusive Passwords ........................................................ 141

DISCOVERY AND ONBOARDING ....................................................... 143
ACCOUNTS FEED .................... 143
Configure Automatic Onboarding Rules ......................................... 143
Configure and Run Windows Accounts Discovery .......................... 145
Verify Automatically Onboarded Accounts .................................... 150
Manually onboard discovered accounts......................................... 150
PASSWORD UPLOAD UTILITY (OPTIONAL) ......................................... 152
Add the Administrator as a member of template safe ................... 152
Configure and run PUU  153
PRIVILEGED SESSION MANAGEMENT ............................................... 161
Disable Privileged Access Workflows ............................................. 161

PRIVILEGED SESSION MANAGER  ..............................163
Enabling PSM ............... 163
Adding Exceptions ........ 163

Connect with a Linux Account ........................................................ 165
Connect with an Oracle Account .................................................... 167
Connect via HTML5 Gateway ......................................................... 169
Connect using PSM Ad-Hoc Connection ......................................... 170
PRIVILEGED SESSION MANAGER FOR WINDOWS ............................................ 173
PRIVILEGED SESSION MANAGER FOR SSH ..................................................... 176
AUDITING USER ACTIVITY IN THE PSM (MONITORING) .................................... 177
PSM Session Terminators ............................................................... 178
Monitor, Suspend and Terminate Active Sessions .......................... 181
Monitor Recordings ...... 182

PRIVILEGED THREAT ANALYTICS ...................................................... 184
DETECTIONS AND AUTOMATIC REMEDIATION FOR UNIX/LINUX ........................ 184
Unmanaged Privileged Access ....................................................... 184
Suspected Credential Theft and Automatic Password Rotation ..... 186
Suspicious Password Change and Automatic Reconciliation ......... 189
Suspicious activities in a Unix session and automatic suspension . 191
Security Rules Exceptions ........................................................ 194
DETECTIONS AND AUTOMATIC REMEDIATION FOR WINDOWS .......................... 195
Unmanaged Privileged Access ....................................................... 195
Suspicious Activities in a Windows Session and Automatic Suspension ..............200
CONNECT TO THE PTA ADMINISTRATION INTERFACE ...................................... 203

REPORTS ........................ 205
GENERATE “PRIVILEGED ACCOUNTS INVENTORY” REPORT ................................ 205
GENERATE “SAFES LIST” REPORT AND “USERS LIST” REPORT ............................ 207
GENERATE REPORTS USING EVD ................................................... 209

REPLICATIONS ................ 214
BACKUP AND RESTORE ............ 214
Enabling the Backup and DR users ................................................. 214
Installing the PrivateArk Replicator ................................................ 216
Create a Safe and an Account to test Backup ................................ 221
Running a Backup ......... 222
Delete the Linux02 Safe  223
Running a Restore ........ 223

COMMON ADMINISTRATIVE TASKS ................................................. 225
ROTATING CPM LOGS ............ 225

OPTIONAL EXERCISES ..... 227
AD HOC ACCESS .................... 227
Set up the Ad Hoc Access Platform................................................. 228
Add the Local Administrator Account ............................................ 230
CPM Scanner Configuration ........................................................... 230
Test Ad Hoc Access ....... 231
CUSTOM FILE CATEGORIES ....... 232
Creating the Custom File Category ................................................. 233
Adding the Custom File Category to the Platform .......................... 234
Making the File Categorical Searchable ......................................... 235
Testing the New File Category ....................................................... 237



CyberArk PAS Install & Configure, v10.9

 INTRODUCTION.........................................4 
USING SKYTAP...............................................4 
INTERNATIONAL USERS....................................... 6 

SCENARIO .................................................10 
EPV INSTRUCTIONS......................................11 
VAULT INSTALLATION...................................12 
BEFORE INSTALLATION.......................................... 12 
VAULT SERVER INSTALLATION.....................................15 
PRIVATEARK CLIENT INSTALLATION...............................23 
POST VAULT INSTALLATION .................................... 26 

INSTALL PASSWORD VAULT WEB ACCESS............27 
INSTALL IIS PRE-REQUISITE SOFTWARE USING AUTOMATIC PREREQUISITES SCRIPT .................................................................. 27 REQUIRE HTTP OVER SSL (PVWA)............................................................................................................................ 29 INSTALL PVWA...................................................................................................................................................... 29 HARDENING THE CYBERARK PVWA SERVERS ................................................................................................................ 32 CONFIGURE IIS REDIRECTION..................................................................................................................................... 34 TEST PVWA LOAD BALANCING.................................................................................................................................. 36 INSTALL CPM (DISTRIBUTED)................................................................................................................................. 37 INSTALL 1 ST CPM .................................................................................................................................................... 37 INSTALL THE PRIVATEARK CLIENT ON THE COMPONENT SERVER.......................................................................................... 41 POST CPM INSTALLATION......................................................................................................................................... 41 INSTALL 2 ND CPM.................................................................................................................................................... 41 POST CPM INSTALLATION......................................................................................................................................... 42 INSTALL THE PRIVATEARK CLIENT ON THE COMP01B SERVER............................................................................................. 43 RENAME 1 ST CPM................................................................................................................................................... 43 UPDATE THE NAME OF THE CPM IN THE PVWA............................................................................................................. 46 HARDEN THE CPM SERVER........................................................................................................................................ 46 INTEGRATIONS....................................................................................................................................................... 48 LDAP AUTHENTICATION (OVER SSL)........................................................................................................................... 48 SMTP INTEGRATION................................................................................................................................................ 53 SIEM INTEGRATION................................................................................................................................................. 56 NTP INTEGRATION .................................................................................................................................................. 59 AUTHENTICATION TYPES ....................................................................................................................................... 62 RADIUS AUTHENTICATION ....................................................................................................................................... 62 PKI AUTHENTICATION .............................................................................................................................................. 68 TWO FACTOR AUTHENTICATION (2FA) ........................................................................................................................ 72 EPV TESTING AND VALIDATION............................................................................................................................. 73 ADD WINDOWS DOMAIN ACCOUNT............................................................................................................................ 73 ADD WINDOWS SERVER LOCAL ACCOUNT..................................................................................................................... 73 ADD LINUX ROOT ACCOUNT ...................................................................................................................................... 74 ADD ORACLE DATABASE ACCOUNT.............................................................................................................................. 74 Privileged Account Security Install & Configure, v10.9 CyberArk University Exercise Guide Page 2 © Cyber-Ark® Software Ltd - No part of this material may be disclosed to any person or firm or reproduced by any means, electronic and mechanical, without the express prior written permission of Cyber-Ark® Software Ltd. INSTALL PSM/PSMP............................................................................................................................................... 76 INSTALL A STANDALONE PSM INSTALLATION........................................................................................................ 77 PSM INSTALLATION PREREQUISITES ............................................................................................................................ 77 PSM INSTALLATION................................................................................................................................................. 80 PSM POST INSTALLATION ......................................................................................................................................... 83 PSM HARDENING ................................................................................................................................................... 84 PSM TESTING AND VALIDATION................................................................................................................................. 86 LOAD BALANCED PSM SERVERS............................................................................................................................. 89 CONFIGURE PSM LOAD BALANCING............................................................................................................................ 89 PSM FOR SSH INSTALLATION................................................................................................................................. 92 SECURING CYBERARK............................................................................................................................................. 98 LOCK DOWN A USER’S INTERFACE............................................................................................................................... 98 USE RDP OVER SSL................................................................................................................................................. 99 MANAGE LDAP BINDACCOUNT ............................................................................................................................... 104 MANAGE PSMCONNECT/PSMADMINCONNECT USING THE CPM................................................................................... 105 MANAGE CYBERARK ADMINISTRATOR ACCOUNT USING THE CPM ................................................................................... 109 CONNECT WITH PSM-PRIVATEARK CLIENT ................................................................................................................. 110 CONNECT USING PSM-PVWA-CHROME................................................................................................................... 113 BACKUP................................................................................................................................................................ 116 ENABLE THE BACKUP AND DR USERS ......................................................................................................................... 116 INSTALL THE PRIVATEARK REPLICATOR COMPONENT ..................................................................................................... 119 TESTING THE BACKUP/RESTORE PROCESS ................................................................................................................... 123 DISASTER RECOVERY............................................................................................................................................ 126 INSTALL THE DISASTER RECOVERY MODULE................................................................................................................. 126 VALIDATE THE REPLICATION WAS SUCCESSFUL .............................................................................................................. 129 EXECUTE AUTOMATIC FAILOVER TEST ........................................................................................................................ 130 EXECUTE FAILBACK PROCEDURE USING MANUAL FAILOVER ............................................................................................ 132 (OPTIONAL) EXERCISES ........................................................................................................................................ 137 ADVANCED PSMP IMPLEMENTATIONS................................................................................................................ 138 ADDING FIREWALL RULES TO THE VAULT MANUALLY......................................................................................... 142





References

  • https://training.cyberark.com/
  • https://cyberark.influitive.com/
  • https://champions.cyberark.com/
  • https://cyberark-customers.force.com/s/









via Blogger http://blog.51sec.org/2019/12/cyberark-pas-lab.html
June 18, 2022 at 10:01AM CyberArk
0 Comments

Azure P2S VPN Users Access Remote Peering Networks

6/16/2022

0 Comments

 
Azure P2S VPN Users Access Remote Peering Networks

This post summarize the configuration for allowing Point-2-site vpn users to access your remote peering network. 





Diagram




Steps to Configure Peering

The following steps assume you have configured both resource groups in different Azure regions, both virtual networks and one Point-2-site virtual network gateway. Your remote users are able to use this p2s gateway to access the resources in one region (one resource group).

Previous related posts:
  • Azure Point-to-Site VPN Configuration (Using Certs or AD Authentication)

To have your remote users to access another region's network and resources, here are steps:

1 Go to your Azure virtual network, choose Peerings from left panel


2 Click add button



3 Enter local peering link name and remote peering link name. Azure will create two links for you in this one time setup.



4 Choose remote virtual network name 


Once you completed peering, the VMs can talk each other in those two virtual networks (10.1.0.0/16 and 10.2.0.0/16) without further configuration.

Note: You will notice virtual network gateway or route server 's default setting is none. In our next step, we will need to make change on this settings to allow remote P2S users to access peering networks. 

Configure P2S VPN Gateway 

1  Add a route for peering network into Virtual Network Gateway Configuration



2 Change P2S gateway configuration

This will allow P2S users to access your remote peering network.

Explanation for Virtual network gateway or Route server: 

Dynamic routes for virtual machines in a virtual network are programmed by virtual network gateways or Route Servers. Additionally, a virtual network gateway routes traffic between on-premises networks and Azure virtual networks. A virtual network gateway can be created for either VPN Gateway or ExpressRoute.




References

  • About Point-to-Site VPN routing - Multiple peered VNets










via Blogger http://blog.51sec.org/2022/06/azure-virtual-network-peering.html
June 16, 2022 at 01:58PM Cloud
0 Comments

Easy Ways to Get Free But Temporary Windows VPS with High Performance Without Credit Card

6/14/2022

0 Comments

 
If you think it is too much work to get a permanent free tier VPS from Oracle Cloud, Azure or GCP, here are some ways to help you get a temporary high performance Windows cloud machine for free without entering your credit card information. Related Blog Post: ✍,https://blog.51sec.org/2022/06/some-ways-to-get-free-temporary-windows.html Related Links 1. https://docs.microsoft.com/en-us/learn/modules/implement-common-integration-features-finance-ops/10-exercise-1 2. https://docs.microsoft.com/learn/modules/monitor-azure-vm-using-diagnostic-data/3-exercise-create-virtual-machine 3. https://play.instruqt.com/instruqt/tracks/windows-desktop Related Videos: ⚡Get Two Free and Permanent VPS from Oracle Cloud Platform- https://youtu.be/E9dHA3NBbN8 ⚡Create free tier Azure Windows / Linux virtual machines - https://youtu.be/rNRObnD-DkY ⚡Use Free Azure VMs After 12 Months Trial - Azure for Students Renew Each Year with Free $100 Credit- https://youtu.be/QuqekbJJN3E ⚡Get Free M365 E5 Developer Subscription with Your Own Domain Name- https://youtu.be/WtP5UCcwphw ⚡DD Install Windows System to Google Cloud Linux VM - https://youtu.be/rru1hRWp19E ⚡DD Win7 into Google Cloud Platform Free Tier Linux VM - https://youtu.be/NAYfBWeISCI ====================================================================== If you found this video has some useful information✍, please give me a thumb up ✅ and subscribe this channel ?to get more updates?: ⚡https://www.youtube.com/c/Netsec?sub_confirmation=1 ⚡Resource Collection and Bookmarks: https://sites.51sec.org/ Learning and Sharing - 海内存知己,天涯若比邻 ⚡https://51sec.org ?https://itprosec.com

Watch video on YouTube here: https://youtu.be/Su76pfNqbHU by Johnny Netsec
0 Comments
<<Previous

    Categories

    All
    Architecture
    Blog
    Checkpoint
    Cisco
    Cloud
    CyberArk
    F5
    Fortigate
    Guardium
    Juniper
    Linux
    Network
    Others
    Palo Alto
    Qualys
    Raspberry Pi
    Security
    SIEM
    Software
    Vmware
    VPN
    Wireless

    Archives

    March 2024
    February 2024
    January 2024
    December 2023
    November 2023
    October 2023
    September 2023
    August 2023
    July 2023
    June 2023
    May 2023
    April 2023
    March 2023
    February 2023
    January 2023
    December 2022
    November 2022
    October 2022
    September 2022
    August 2022
    July 2022
    June 2022
    May 2022
    April 2022
    March 2022
    February 2022
    January 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    July 2021
    June 2021
    May 2021
    April 2021
    March 2021
    February 2021
    January 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    October 2019
    September 2019
    June 2019
    July 2018
    May 2018
    December 2017
    August 2017
    April 2017
    March 2017
    January 2017
    December 2016
    November 2016
    October 2016
    September 2016
    August 2016
    July 2016
    June 2016
    May 2016
    April 2016
    March 2016
    February 2016
    January 2016
    December 2015
    November 2015
    October 2015
    September 2015
    August 2015
    July 2015
    June 2015
    May 2015
    April 2015
    March 2015

    Print Page:

    RSS Feed

    Email Subscribe
Powered by Create your own unique website with customizable templates.
  • Blog
  • Sitemap
    • Categories
  • Contact
  • About
  • Resources
  • Tools
  • 51sec.org