All SSH sessions in any Secret Server edition can be set up to proxy through Secret Server for greater control and logging capabilities. Set up firewall rules to ensure that privileged account access only comes from the Secret Server machine.
Traffic FlowChart
2 RDP Proxy
SSH Proxy Traffic
SSH Proxy
2 Enable Proxy in Secret Policy
3 Apply Secret Policy and Test
SSH Tunneling
RDP Proxy
1. The user clicks the RDP launcher in Secret Server.
2. The launcher executes on the client's machine.
3. The launcher establishes a connection to the SSH Proxy using unique credentials generated for the session. These credentials are short lived and can only be used once.
4. Once the launcher has successfully authenticated with the SSH Proxy, the launcher will open a socket and listen for a connection on an available ephemeral port (the forwarding port) on the client's machine.
5. RDP launches on the client machine and connects locally to the forwarding port.
6. All RDP traffic for this session is now routed through the SSH tunnel to Secret Server, then forwarded to the target machine.
7. The RDP session is established.
How It Works
-
The user clicks the RDP launcher in SS.
-
The launcher executes on the client's machine.
-
The launcher establishes a connection to the RDP Proxy using credentials generated for the session. These credentials are short lived and can only be used once.
-
Once the launcher has successfully authenticated with the RDP proxy, the RDP proxy looks up the credentials and target hostname to connect to.
Note: The secret credentials do not get served to the client machine in this flow, which improves credential security.
-
The RDP proxy connects to the desired remote host with the secret credentials.
-
The RDP session is established.
-
RDP traffic is sent back and forth over the RDP proxy, session keystrokes are monitored if session recording is enabled.
References
- SSH Proxy Configuration and Bandwidth
- Secret Server: Using Connect As Command and SSH Proxy with PuTTY launcher
- SSH Terminal Administration
- SSH Proxy Configuration
- RDP Proxy Configuration
- Configuring SSH Proxies for Launchers
- RDP Proxying - IBM
- CyberArk vs Thycotic
via Blogger https://ift.tt/3ni8n8P
January 05, 2021 at 07:10PM Thycotic