Installation and Configuration Guide Version 4.8.5.0 U16 SP2 (1) (1) (1)
advertisement
ARCON Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Table of Contents 1 Introduction ................................................................................................................................................................................... 8 2 About this Guide........................................................................................................................................................................... 9 3 Product Overview..................................................................................................................................................................... 11 3.1 Solution Benefits ..................................................................................................................................................................... 11 3.2 Solution Architecture ............................................................................................................................................................ 11 3.3 Communication Flow............................................................................................................................................................. 12 4 ARCON PAM Deployment.................................................................................................................................................... 14 4.1 Prerequisites: Infrastructure Requirement.................................................................................................................. 14 4.2 Database Installation and Configuration ...................................................................................................................... 14 4.2.1 Prerequisites: SQL Server Setup.....................................................................................................................................14 4.2.2 SQL Server Express Installation......................................................................................................................................14 4.2.3 DB User Creation and Assign Permission ...................................................................................................................22 4.2.4 Folder Creation for database and Log files.................................................................................................................22 4.2.4.1 4.2.5 Database................................................................................................................................................................................ 22 Database Creation, Restoration and Owner Assignment ....................................................................................23 4.2.5.1 ARCOSDB ............................................................................................................................................................................. 23 4.2.5.2 ARCOSRDPDB.................................................................................................................................................................... 23 4.2.5.3 Create Database................................................................................................................................................................. 24 4.2.5.4 Database Restore............................................................................................................................................................... 25 4.2.5.5 Database Ownership and Recovery ........................................................................................................................... 29 4.2.5.6 Assign Database Role to New User (arcossqladmin) ........................................................................................... 31 4.3 Web Component Configuration........................................................................................................................................ 32 4.3.1 Install Frameworks and Controls ...................................................................................................................................33 4.3.2 Enable IIS Server on Web Server (Windows Only)..................................................................................................33 4.3.3 Configure ARCON PAM Client Manager....................................................................................................................33 4.3.3.1 Import SSL Certificate for ARCON PAM Client Manager................................................................................. 34 4.3.3.2 Assign SSL Certificate to ARCON PAM Client Manager ................................................................................... 34 4.3.3.3 Application Pool Setting for ARCON PAM Client Manager ............................................................................. 34 4.3.3.4 Database (DB) Settings Creations............................................................................................................................... 36 4.3.3.5 Test ARCON PAM Client Manager component on IE Browser ...................................................................... 37 4.3.4 Settings Deployment ...........................................................................................................................................................38 4.3.4.1 Pre-requisites ...................................................................................................................................................................... 38 4.3.4.2 Deployment Steps.............................................................................................................................................................. 39 2 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.3.4.3 4.3.5 Configuration....................................................................................................................................................................... 46 Configure ARCON PAM User Access Log Viewer Web Component...............................................................47 4.3.5.1 Application Pool Setting for ARCON PAM User Access Log Viewer Web ................................................. 49 4.3.5.2 Test ARCON PAM User Access Log Viewer Web component on Browser................................................ 50 4.3.6 4.3.6.1 4.3.7 ARCON PAM API Component Configuration...........................................................................................................51 Database(DB) Settings Creations................................................................................................................................ 52 License Registration and Login........................................................................................................................................53 4.3.7.1 ARCON PAM Server License Registration .............................................................................................................. 53 4.3.7.2 Domain Creation ................................................................................................................................................................ 54 4.4 4.4.1 ARCON PAM Windows Components............................................................................................................................. 58 ARCON Auto Healing Service..........................................................................................................................................59 4.4.1.1 Overview ............................................................................................................................................................................... 59 4.4.1.2 Installation ............................................................................................................................................................................ 60 4.4.2 ARCON WinVaulting Service...........................................................................................................................................67 4.4.2.1 Overview ............................................................................................................................................................................... 67 4.4.2.2 Prerequisites........................................................................................................................................................................ 68 4.4.2.3 Installation ............................................................................................................................................................................ 68 4.4.3 ARCOS Alert Service ...........................................................................................................................................................69 4.4.3.1 Overview ............................................................................................................................................................................... 69 4.4.3.2 Prerequisites........................................................................................................................................................................ 70 4.4.3.3 Installation ............................................................................................................................................................................ 70 4.4.4 ARCOS Failover Manager..................................................................................................................................................76 4.4.4.1 Overview ............................................................................................................................................................................... 76 4.4.4.2 Scenario.................................................................................................................................................................................. 76 4.4.5 ARCOS Log Archiver Service ...........................................................................................................................................82 4.4.5.1 Overview ............................................................................................................................................................................... 82 4.4.5.2 Installation ............................................................................................................................................................................ 83 4.4.6 ARCOS Log Archiver Service ONS.................................................................................................................................91 4.4.6.1 Overview ............................................................................................................................................................................... 91 4.4.6.2 Installation ............................................................................................................................................................................ 92 4.4.7 ARCOS Log Manager Service...........................................................................................................................................97 4.4.7.1 Overview ............................................................................................................................................................................... 97 4.4.7.2 Installation ............................................................................................................................................................................ 97 4.4.8 ARCOS Log Manager Service ONS ............................................................................................................................. 104 4.4.8.1 Overview .............................................................................................................................................................................104 4.4.8.2 Installation ..........................................................................................................................................................................104 3 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.4.9 ARCOS Scheduled Password Change Service........................................................................................................ 111 4.4.9.1 Overview .............................................................................................................................................................................111 4.4.9.2 Installation ..........................................................................................................................................................................111 4.4.10 ARCOS Viewed Password Change Service ............................................................................................................. 117 4.4.10.1 Overview .............................................................................................................................................................................117 4.4.10.2 Installation ..........................................................................................................................................................................118 4.5 4.5.1 4.5.1.1 4.5.2 4.5.2.1 5 Broker ....................................................................................................................................................................................... 123 Secure Gateway.................................................................................................................................................................. 123 Secure Gateway Server Configuration....................................................................................................................123 RDP Proxy............................................................................................................................................................................. 130 Overview .............................................................................................................................................................................130 LOB or Profile Master ...........................................................................................................................................................134 4 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 About this manual This user manual is a comprehensive documentation for those wanting to get the most out of ARCON PAM (Privileged Access Management). It combines step–by–step instructions to help you install ARCON PAM and configure database. • • • • • • • Disclaimer Copyright Notice Related Documents Target Audience Symbols & Conventions Acronyms POC (Point of Contacts) & Support Information Disclaimer This manual of ARCON PAM solution is being published to guide administrators with the step-by-step procedures involved in installing ARCON PAM and configuring database. The manual is in the nature of a guide for the users and, if any of the statements in this document are at variance or inconsistent it shall be brought to the notice of ARCON PAM through the support team. Wherever appropriate, references have been made to facilitate better understanding of the PAM solution. The ARCON PAM team has made every effort to ensure that the information contained in it was correct at the time of publishing. This Manual of ARCON PAM solution contains information, which is the intellectual property of ARCON PAM. This document is received in confidence and its contents cannot be disclosed or copied without the prior written consent of ARCON PAM. Nothing in this document constitutes a guaranty, warranty, or license, expressed or implied. ARCON PAM disclaims all liability for all such guaranties, warranties, and licenses, including but not limited to: Fitness for a particular purpose; merchantability; non-infringement of intellectual property or other rights of any third party or of ARCON PAM; indemnity; and all others. The reader is advised that third parties can have intellectual property rights that can be relevant to this document and the technologies discussed herein, and is advised to seek the advice of competent legal counsel, without obligation of ARCON PAM. Copyright Notice Copyright © 2022 ARCON PAM All rights reserved. ARCON PAM retains the right to make changes to this document at any time without notice. ARCON PAM makes no warranty for the use of this document and assumes no responsibility for any errors that can appear in the document nor does it make a commitment to update the information contained herein. Trademarks Other product and corporate names may be trademarks of other companies and are used only for explanation and to the owners' benefit, without intent to infringe. Related Documents Below are the related documents, which help to understand the ARCON PAM in detail 5 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 • ARCON PAM Overview Guide gives the overview of ARCON PAM Privilege Access Management. • ARCON PAM Client Manager Guide describes a web console which supports multi-domain authentication, dual factor authentication, multi-tenancy and target connectors. • ARCON PAM Privileged Access Management (PAM) User Guide describes the features, benefits, functionalities. • ARCON PAM Set-up Pre-requisite describes the hardware and software required for deployment of ARCON PAM in the user environment. • ARCON PAM Troubleshoot provides the basic information for ARCON PAM issues. • ARCON PAM Administrative Guide describes the process to administer, manage, and monitor Privilege Identities and servers across the organization. Target Audience This guide is intended for auditors, consultants and security experts responsible for securing, auditing and monitoring server administration processes; especially remote server management. It is also useful for IT decision makers seeking for a tool to improve the security and auditing of their servers or to facilitate compliance to the unique standard. The following skills and knowledge are necessary for a successful ARCON PAM administrator: • • • • Basic system administration knowledge. Basic understanding of networks, TCP/IP protocols, and general network terminology. Working knowledge of the Windows operating system is not mandatory, but highly useful. In-depth knowledge of various servers and server applications is required for forensics situations. Symbols and Conventions The Following are the symbols and conventions used in this manual: Symbols Description Note Indicates helpful tips, shortcuts, and suggestions. Information Indicates additional information. 0 This manual uses the following conventions to refer to sections, navigation, and other information. Convention Description Bold Keywords and menu names are displayed in bold. 0 Acronyms The acronyms used in this manual are as follows: Acronyms Description PAM Privileged Access Management LOB Line of Business SSH Secure Shell 6 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Acronyms Description RDP Remote Desktop Protocol DB Database IIS Internet Information Services EPAM Enterprise Privilege Access Management PVSL Password Vault & Session Logging SGS Secure Gateway Server 0 POC (Point of Contacts) & Support Information The product is developed and maintained by ARCON TechSolutions Private Limited web: https://arconnet.com/ Sales Contact You can directly contact us with sales related topics at the email address <sales@arconnet.com>, or leave us your contact information and we will call you back. Support Contact To access ARCON PAM Support Centre (ASC), Sign in with your account. • • • • • Remote support is available 24*7. ARCON PAM Support System is available only for registered users with a valid support package. ARCON PAM Support Centre (ASC): https://support.arconnet.com/ Central Support e-mail address: <arcos.support@arconnet.com> Support hotline: Global: +91 8080005577 (For ARCON PAM Support Press 3) UAE: 800035703628 (Press 1) 7 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 1 Introduction This guide provides the Installation and configuration instruction for system Administrators and security Administrators for ARCON Privileged Access Management (PAM) suite. For more information about its features, benefits, functionalities, and basic procedures, see the ARCON Related Document. ARCON PAM ships with a number of documents that helps you to use the various features of the product. See the following section for a list of guides. The following section include the document convention, list of documentation for the product, and where to get additional product information and technical support. 8 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 2 About this Guide This Guide describes the ARCON Privilege Access Management and its installation and configuration processes. The book has been divided into the following sections: The first part of the guide introduces you to the ARCON Privilege Access Management and its unique features. The second part of the guide takes you through pre-requisites required for infrastructure. The third part of the guide shows how to install and configure database; database creation, restoration and ownership. The forth part of the guide describes how to configure web components and license registration. The fifth part of the guide puts you through the secure gateways configuration. The sixth part of the guide explains the creation of LOB, users, services, user group and service group. Part 1: Introduction The first part of the book contains the following information: • ARCON Privilege Access Management – An introduction to the concept of application identity and the risks involved, as well as the solution requirements. Part 2: Preparing to Install Privilege Access Management The second part of the book contains the following information: • Prerequisite for Infrastructure Requirement – The infrastructure requirement for ARCON Privilege Access Management. Part 3: Installing and Configuring ARCON PAM Database The third part of the book contains the following information: • Pre-requisite for SQL Server Set-up – The system requirements for the SQL Setup. • Installing SQL Server – A step-by step guide to install SQL Server. • DB User Creation and Assign Permission – A step-by step guide to create user required for ARCON PAM database. • DB Folder Creation – A step-by step guide to create two DB folders required for ARCON PAM Privilege Account Management solution. • DB Creation, Restoration and Ownership – A step-by step guide to create two databases, configure those databases and give them the ownership. Part 4: Web Component Configuration The forth part of the book contains the following information: • Enable IIS Server – A step-by-step guide to enable IIS Server on Windows. • Install Framework and Controls – An overview of various frameworks and controls to be installed. • Configure ARCON PAM Client Manager Online – A step-by-step guide on how to configure ARCON PAM Client Manager Online on IIS Manager. 9 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 • Configure ARCON PAM User Access Log Viewer Web Component – A step-by-step guide on how to configure ARCON PAM User Access Log Viewer Web, assign Application Pool settings and test the web component configuration on browser. • ARCON PAM Database Settings Creation – A step-by-step guide on how to create DB settings for ARCON PAM Client Manager. • License Registration and Login – A guide about to license registration and login into ARCON PAM Server Manager. Part 5: Secure Gateway Configuration The fifth part of the book contains the following information: • With Windows Server – A guide to install freeSSHd. • With UNIX / Linux Server – A guide to configure and map secure gateway server. Part 6: LOB/Profile Master and Manager The sixth part of the book contains the following information: • • • • • • • • • • • • • • • • Creating LOB – A guide to create LOB. User/Service Creation and Mapping – A guide to User/Service creation and mapping. Creating User – A guide to create user. Creating Service – A guide to create service. Creating User and Service Group – A guide to create user and service group. Mapping User to User Group – A guide to map user to user group. Mapping Service to Server Group – A guide to map service to server group. Mapping Server/Service Group – A guide to map server/service group. Mapping Service to Users – A guide to map service to users. Mapping Service to Multiple Users – A guide to map service to multiple users. Mapping Users to LOB – A guide to map users to LOB. Removing Users from LOB – A guide to remove users from LOB. Sharing Users between LOB(s) – A guide to share users between LOBs. Mapping User Group/s to LOB – A guide to map user groups to LOB. Removing User Group from LOB – A guide to remove user group from LOB. Mapping Service(s) to LOB – A guide to map service to LOB. 10 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3 Product Overview The product overview gives information about the high level and full life cycle description and product offerings provided by ARCON PAM Privilege Access Management solution. ARCON Privilege Access Management (PAM) solution is a high level access security solution for managing the privilege accounts in an enterprise. The solution allows organization to secure, control, monitor and audit all the activities associated with all types of Privilege Identities such as Administrators on Windows server, Root on UNIX server, Cisco Enable in Cisco, etc. ARCON PAM Privilege Access Management uses a highly secured Digital Vault which is also known as Password Vault to store the Privilege password of privilege identities. This Password Vault is the heart of the solution. The audit and session logging activities associated with the privilege account is kept in this vault with highest security standards. The password vault uses numerous secured methodology to authenticate, encrypt, audit and protect data. The ARCON PAM Privilege Access Management solution uses following components: Single Sign On: Single Sign-On enables Administrators to enter the login id and password only once to logon into multiple systems or domains within an enterprise. The username and password is authenticated with local repository or Active Directory of the windows server through LDAP protocol. Password Vault: Password Vault is the heart of the ARCON PAM solution where passwords and sensitive data of privilege accounts are stored. It is the central repository for passwords and auditing management. It is designed with the state-of-art technology and can be installed on dedicated server as well as on the application server depending on the enterprise infrastructure. Access Control: ARCON PAM Access Control manages super-users authentication and authorization based on assigned privileges. It enables organization to secure, control and monitor privilege account by using vault technology. It empowers the organization and gives complete visibility and control of privilege account and super users in an enterprise. Also enables centralized management and auditing of the privilege account. Session Monitoring: The Session Monitoring enables enterprise to secure, control and monitor the access of privilege account. It automatically creates video log which records all activity of the Administrators for each minutes and seconds on the server. These recordings are stored in ARCON PAM database and accessible to authorized auditors. All activities are fully monitored and strictly meet the auditing and governance standards. Realtime Data Synchronization Process and Near Zero Downtime Application Failure: ARCON PAM supports High Availability by real-time data synchronization and near zero down time application failure. The Data Synchronization process for HA (High Availability) establishes consistency among data from a source to a target data storage and vice versa and the continuous harmonization of the data over time. 3.1 Solution Benefits • • • • • • • Secure, Manage and Protect Privilege Account Minimize Shared Administrative Accounts Reliably Control and Monitor Privilege Account Audit and Comply with governance requirement Streamline Password Management Easily Integrate with Enterprise Simple to Deploy 3.2 Solution Architecture The ARCON PAM solution securely manages, stores, archive and transfers all your privilege Administrative passwords within your organization internally or remotely. These secured passwords are kept in the password vault. 11 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 The password vault which acts as a ‘Bunker’ is the heart of the solution. It is secured with multiple layer of security which includes Firewall, Authentication, Authorization, Access control, Encryption, Session monitoring, etc. These layers make the solution secure for the Privilege Accounts present in an organization. The PAM architecture is very simple and seamlessly integrates with the complex infrastructure of an enterprise. It can be deployed within a short period of time and can be accessed through Web interface. The various API’s help the solution to be more secure. The following diagram shows the various components of PAM solution: The PAM architecture consists of two important components. First is ARCON PAM Secured Vault which stores data and protect it through authentication and authorization. The Vault server manages numerous services within ARCON PAM which are required for the successful operation of the PAM solution. Second is the Secured Gateway Server which uses a unique technology to channelize all the traffic. It uses a secured server that runs proprietary components to manage all traffic directly from a user machine to the target devices. Secured port are used to channelize these traffics. Major advantage of this technique is, it makes ARCON PAM highly scalable as it is not dependent on ‘RDP’ to access the application server. Further, this technology helps in managing highly complex environments including distributed datacenters, wherein all devices across data center can be managed by single instance of ARCON PAM. 3.3 Communication Flow • Enter the ARCON PAM portal URL on the browser. The request goes to the ARCON PAM Application Server and the login page of ARCON PAM is displayed on the machine. • Enter the login credentials and click OK button. The user will get authenticated in either of the two ways: If the user is a local repository user, the credentials will get authenticated with the database server [password vault (PVSL)]. OR If he’s a domain user, the credentials will get authenticated with Active Directory. • If dual factor authentication is enabled for the user, they will get authenticated twice and on successful with AD or password vault, Client Manager will open. 12 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Depending on the access granted, user can search the Hostname/IP Address/Service Type which are populated on the portal. • On clicking the Open Connection icon the request goes to the application server and the necessary executable files are downloaded on the User’s machine, under temp folder with the help of the browser plugin. On execution of this executable a secured (SSH) connection is locally established from the user’s machine to the ARCON PAM Secured Server which eventually routes it to target server/device. Thus the session is delivered on the User’s Machine. • Simultaneously, the session also establishes a dedicated connection with ARCON PAM Application Server through which the activities performed by the Administrators / users are logged and saved in the password vault (database) on real time. • Whereas for a Thick client, when a user Clicks Open Connection, Application execute the .exe of Third Party Application from the User’s local machine at the given path which is configured in User’s My Preference Tab in the ARCON PAM portal. 13 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4 ARCON PAM Deployment Before preparing to install you need to plan the various requirement required for the solution in your organization. This chapter provides various information that is required for installing and configuring the solution. During this preparation phase you may have to gather information regarding hardware and software requirements; and how to manage the passwords of the privilege accounts. Depending on your infrastructure, the decision for architecture and the Password Vault; where and how it will be installed and configured and whether or not you want to manage it through the secured gateway sever will be taken. Further this chapter provides information you should review before installing. ARCON Privilege Access Management. It discusses the following topics: Pre-requisite for Infrastructure Requirement 4.1 Prerequisites: Infrastructure Requirement Before installing the ARCON PAM application, you should read the ARCON PAM Set-up Prerequisite document to ensure that your environments meets the minimum installation requirement for the ARCON PAM product. Pre-requisite required for successful implementation is as follows: • • • • ARCON PAM Implementation Setup files Windows based Server with IIS for Application Server (EPAM). Windows based Server with SQL pre-installed for Password Vault Server (PVSL). UNIX based Server for Secure Gateway (SGS) - depending on the architecture finalized by the organization. 4.2 Database Installation and Configuration This chapter describes how to install MS SQL Server 2014 for ARCON Privilege Access Management. This chapter discusses the following topics: • • • • • SQL Server Setup Pre-requisites SQL Server Express Installation DB User Creation Folder Creation for database Database Creation, Restoration and Owner Assignment 4.2.1 Prerequisites: SQL Server Setup Before installing the SQL Server Express edition, you should have the SQL Server Express edition setup file with you. Also your environment should have the minimum installation requirement for MS SQL Server Express edition. 4.2.2 SQL Server Express Installation The SQL Server setup installs the below components which is required by the ARCON Privilege Access Management. • DOT NET Framework 3.5 SP1 • SQL Server support files 14 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 The below process shows how to install the SQL Server Express in Windows. 1. Double click the SQL Server Express setup file. 2. The SQL Server Installation Center window opens. On the right hand side, click on New SQL Server stand-alone Installation or add features to an existing installation link. 3. The Microsoft Software License Terms page opens. To install the SQL Server Express edition, click on checkbox I accept the license terms and accept the license terms. 4. Click on Next button. 15 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. On Microsoft Update page, click checkbox Use Microsoft Update to check for updates (recommended). Important updates for Windows and other Microsoft software will get automatically updated. 6. Click Next button. 16 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 7. On the Feature Selection page, select all the below checkboxes for express features to get installed: Instance Features Database Engine Services SQL Server Replication 8. Shared Features • • • • Client Tools Connectivity Client Tools Backward Compatibility Client Tools SDK Management Tools - Basic Management Tools – Complete • SQL Client Connectivity SDK • LocalDB Change the path of the Shared feature directory to E:\ drive and click Next button. 17 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 • On Feature Rules page, click on Show Details button to view the details and click Next button. • On Instance Configuration page, select the default instance if there is only one instance running for the SQL Server. If there are more than one instance Click Normal Instance radio button. Create an instance called ARCON PAM. This instance id is specifically dedicated for ARCON PAM database only. SQL Server name should not be more than 15 characters. Click Next button. • On Server Configuration page, Service Accounts tab - change the startup type of SQL Server Database Engine service to Automatic. Collation tab - keep the default settings and click Next button. 18 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 • On Database Engine Configuration page, on Account Provisioning tab, on Authentication Mode. Windows authentication mode: uses domain username and password for authentication. Mixed Mode (SQL Server Authentication and Windows authentication): uses SQL Server super username and password for authentication and to create and manage multiple users. If Mixed Mode is not selected then the administrator will not be able to login into the arcossqladmin which is the SQL user for the ARCOS database application. • Select the Mixed Mode for authentication. The Specify the password for the SQL Server system administrator (sa) account will get active. Enter the password for the ‘SA’ account which is the internal SQL Administrator account. Enter the same SA password on theConfirm Passwordfield. You should use complex password for the SA account. To specify the SQL Server Administrator, click Add Current User to login with the Default windows user. Click on Add button, to add admin and user for the SQL Server. arcossqladmin\Domain as admin arcossqladmin\SQL2008R2Serviceas User Click Data Directory tab, change the Data root directory to any specific drive e.g. E:\drive. Create ARCON PAM folder on the specified drive i.e. E drive and update the location to specified drive i.e. E:\ARCOS. 19 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 We recommend you not to store data on the C drive even you have plenty of space. When you change the Data root directory the Temp DB directory is also changed. Change the User database directory to E:\ARCON Solutions\ARCOS Database Change the Backup directory to E:\ARCON Solutions\ARCOS Backup No changes are required on the FILESTREAM tab. Click Next button. • On Feature Configuration Rules page, click the Show Details button. The status of all the rules applicable is changed to Passed status. Click Next button. • On Installation Progress page, you can see the progress of your SQL Server installation. The installation will take approximately 20 minutes depending on the performance of your machine. 20 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 • Once the SQL Server setup is complete, restart the system/computer. 21 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.2.3 DB User Creation and Assign Permission This section provides information about creating a SQL database user for ARCON PAM database application. Use the following steps to create and assign privileges to DB user i.e. arcossqladmin: 1. Login to SQL Server with the default Windows authentication instance or ‘SA’ instance which we created using Mixed Mode authentication while configuring the database engine. The Microsoft SQL Server Management Studio application opens. 2. On the left hand side, on Object Explorer pane, click on the + sign of Security. 3. Right click on Logins and click on New Login option. The New Login window opens. 4. On the General option, set the following details: Enter the Login name as arcossqladmin. Click on the SQL Server authentication radio button. Enter complex Password for the user. Click on the SQL Server authentication radio button. Uncheck the Ensure password policy checkbox. 5. Click on the Server Roles option to set the privileges for arcossqladmin use Check the public and sysadmin Server roles checkbox. 6. Click on the Status option, to set the below parameters. Permission to connect database engine: click on Grant radio button Login: Click on Enabled radio button 7. Click OK button. 4.2.4 Folder Creation for database and Log files This section provides information about what is database, types of database files i.e. Log Data File (LDF) and Meta Data File (MDF) files and to create database folder for ARCON PAM (ARCOSDB and ARCOSRDPDB). 4.2.4.1 Database When any database is created, two files are generated, namely Meta Data File (MDF) and Log Data File (LDF). The MDF and the LDF are the standard formats of SQL to store the data. The MDF is a primary master data and is important in the SQL database, the LDF is the log data. 4.2.4.1.1 Log Data File (LDF) Log data is used for the transaction purpose, as it is a temporary memory. The LDF file is used only when performing the recovery of the database. When performing the update or delete process, it holds the data in the temporary LDF file. So, even if the LDF file is deleted, it won’t have much effect on data. If a new blank LDF file is created, it will work and the data will not be lost. When any database is configured, there are three types of recovery modes in SQL – • Full • Simple. • Bulk-Logged Full Mode: In the full mode, the data can be recovered because it stores the temporary data in the LDF file. From the LDF file, the deleted data can be recovered up to a certain extent only. If you configure database in full recovery mode, then only clustering and mirroring can be configured. To configure clustering and mirroring, the full recovery mode should be enabled. 22 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 If the full recovery mode has not been configured, clustering and the mirroring cannot take place. Simple Mode: In the simple mode, there is no recovery; you cannot recover any loss of data from the LDF. Bulk Logged Mode: The bulk-logged recovery model is a special-purpose recovery model that should be used only intermittently to improve the performance of certain large-scale bulk operations, such as bulk imports of large amounts of data. Much of the description of backup under the full recovery model also applies to the bulklogged recovery model. This topic looks only at considerations that are unique to the bulk-logged recovery model. By default, ARCOSDB should be in a full recovery mode. For the ARCOSRDPDB, if the database is kept in full recovery mode, the database will grow rapidly. Hence, it is recommended to keep in simple mode. 4.2.4.1.1.1 Create DB Folder for Database (.mdf) and Log (.ldf) files Use the following steps to create folder for database (.mdf) and log (.ldf) files. 1. Click Start button on Windows. 2. Double click on My Computer. The My Computer window opens. Double click on the Drive for e.g. E drive. 3. Click on the New Folder option and create below two folders: <:\Drive> ARCON Solutions\ARCOS Database\ARCOSDB <:\Drive> ARCON Solutions\ARCOS Database\ARCOSRDPDB In a real scenario, the two database folders created for ARCON PAM may not be on the same drive of the server, but for the performance improvement it is advised to install and configure two databases on two different drives. 4.2.5 Database Creation, Restoration and Owner Assignment This section provides information about database creation, restoration and assign ownership to the ARCON PAM database. In ARCON PAM application two database ARCOSDB and ARCOSRDPDB are created. 4.2.5.1 ARCOSDB The ARCOSDB database contains the actual data of the application. If there are multiple database on the database server the ARCOSDB folder should be given the ownership and should be given the Full recovery mode. 4.2.5.2 ARCOSRDPDB When configuring the ARCOSRDPDB, make sure to configure the database in simple mode, so that the LDF file does not increases in size. When performing Insert, the MDF will grow and the LDF will not have any impact. Video logs are stored in ARCOSRDPDB database for temporary period. The video logs are captured for every action which takes place for each minute and second on the server. As the Log Manager Service archives or removes the data from ARCOSRDPDB database hence, this database is always in use. When the ARCOSRDPDB is configured for multiple drives, we recommend you to configure both the databases on multiple drives. 23 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 For example, the client provides a server of 500 GB and it is partitioned as follows: C drive is given 100GB and the remaining 400GB is divided into 200GB and 200GB or 100GB and 300GB. We recommend you to have at least 100GB space for ARCOSRDPDB database. If the Log Manager Service fails and you cannot recognize the Log Manager Service for 1 to 3 weeks it will increase the database size. When configuring the ARCOSRDPDB, configure it in such a way that such a disaster should not occur and even if it does happens, it should be manageable only in the production environment. When the application is moved to DR, it means production environment is not available. If there is an application issue or if you have moved to DR, it means that the production has failed. If it is an infrastructure issue, this needs to be checked with the infra team. If it is an application or configuration issue and the drive size is not configured properly, the application goes down. Due to which the given application cannot be accessed and this will be considered as a disaster. When configuring the application, there should be sufficient drive space for ARCOSDB and ARCOSRDPDB. It is not necessary, if there are only 10 users. However, if the organization has more than 1000 users, then consider a scenario for may be 6 months or 1 year down the line. If there is a space, it means, that the infrastructure is available for ARCON PAM and there are chances of growing it. When configuring the RDP DB check if the disk space is available, at least 100 GB should be dedicated for the ARCOSRDPDB, even if it is not used, For example, for 300 GB drive create 100 GB for D drive and 200 GB for ARCOSRDPDB. When configuring or providing the prerequisite for ARCON PAM implementation, ensure to have a separate drive for the log or the video log, images or video files. The separate drive may not be on the same server or on the physical drive. It can be a SAN storage type. There is a separate drive mapped to the system, which means the logs are separate. For a given hardware drive, hard disk or physical drive, you can utilize these drives in the database configurations or for the database files. The program files are created for the services. Do not install the services on the C drive, as according to most of the organization policies, it is recommended not to install application or EXE’s on the C drive as all the Windows operating systems files are present in this drive. For example: If the Windows or any Operating System crashes the Administrator will format the C drive. If the application or the database is present in the C drive during formatting it will be lost. Hence you should always install SQL or any other EXE or components, in other drives. 4.2.5.3 Create Database This section provides information about how to create ARCOSDB and ARCOSRDPDB database. 4.2.5.3.1 Create ARCOSDB database Use the following steps to create database (ARCOSDB) for the new user (arcossqladmin). 1. Login to SQL Management studio with the newly created User ID (arcossqladmin). 2. On the left hand side, on Object Explorer pane, right click on Databases option and select New Database, New Database window opens. 3. Enter the Database Name as ARCOSDB. 4. On the Database file area, horizontal scroll till the Path column. 5. On the Path column, click on the ellipse button and change the path of ‘ARCOSDB_DATA and ‘ARCOSDB_LOG’ file to ARCOS Database folder present in ARCON Solutions i.e.<:\Drive> ARCON Solutions\ARCOS Database\ARCOSDB Select the path of the folders which you have created in Create DB Folder for Database (.mdf) and Log (.ldf) files. 24 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 6. Click OK button. 4.2.5.3.2 Create ARCOSRDPDB database For creating ARCOSRDPDB folder repeat the steps 2- 5 of Create ARCOSDB database. You should give the folder name as ARCOSRDPDB instead of ARCOSDB. 4.2.5.4 Database Restore This section provides information about how to restore the blank database of ARCON PAM on specified drive. The backup database is the blank file. During restoring ARCON PAM application do not select the database other than ARCOSDB and ARCOSRDPDB and the physical path should be assigned properly. 4.2.5.4.1 Restore template ARCOSDB from setup files This section helps you to restore ARCOSDB template from ARCON PAM setup files. Use following steps to restore ARCOSDB template from ARCON PAM setup files: 1. On the left hand side, on Object Explorer pane, click on + sign of Databases option and right click on ARCOSDB database > Tasks > Restore > Database. The Restore Database window opens. 25 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 2. On the left hand side pane, click on the General option, set the following details: Source: Click on Device radio button. Database: Select ARCOSDB from the drop down list. Click on the ellipse button above the ARCOSDB selected and select the template database present in the ARCON PAM setup file i.e. ARCOSDB_Backup_Blank. 26 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. On the Restore plan, check the Restore checkbox to set the backup to restore. 4. On the left hand side pane, click on the Files option to map the database file i.e. ARCONDB to .mdf and .ldf files. 5. Click on the ellipse of Restore As column and map the data and log files ARCONDB_Data: Map it to the .mdf file present in the ARCON Solution>ARCOS Database > ARCOSDB >ARCOSDB.mdf. ARCONDB_Log: Map it to the .ldf file present in the ARCON Solution >ARCOS Database > ARCOSDB >ARCOSDB.ldf. 27 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 6. On the left hand side pane, click on the Options option, in the Restore Options, check the checkbox Overwrite the existing database (WITH REPLACE). 7. Click OK button. 28 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 8. Wait for few minute for the database ‘ARCOSDB’ to get restored. 9. A pop window ‘Database ARCOSDB restored successfully’ opens. 10. Click OK button. 4.2.5.4.2 Restore template ARCOSRDPDB from setup files Right click on ARCOSRDPDB folder and repeat the steps from 1-4 from above process i.e. Restore template ARCOSDB from ARCON PAM setup files. Map the ARCOSRDPDB_Data folder to ARCOSRDPDB.ldf to ARCOSRDPDB.mdf and ARCOSRDPDB_Log folder 4.2.5.5 Database Ownership and Recovery This section provides information about how to create ownership and recover the ARCON PAM database. 4.2.5.5.1 Ownership and Recovery mode for ARCOSDB Use the following steps to set the ownership and recovery mode of ARCOSDB to Full. 1. Right click the ARCOSDB folder, click Properties, Database Properties window opens. 2. On the left hand side pane Select a page, click the Files option. 3. On the right hand side, in Owner field enter arcossqladmin. 29 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4. On the left hand side pane Select a page, click the Options option. 5. On the right hand side, for Recovery model select Full from the dropdown list. 6. Click OK button. 4.2.5.5.2 Recovery mode for ARCOSRDPDB Use the following steps to set the recovery mode of ARCOSRDPDB to simple. 1. Right click the ARCOSRDPDB folder, click on Properties, Database Properties window opens. 2. On the left hand side pane Select a page, click on the Options option. 3. On the right hand side, for Recovery model select Simple from the drop down list. The bulk log is a middle type of recovery mode, which is in between the full mode and simple mode. The bulk log is not recommended from Microsoft. So, select the full mode or the simple mode. 4. Click OK button. 30 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.2.5.6 Assign Database Role to New User (arcossqladmin) This section provides information about how to assign roles and privileges to new user (arcossqladmin). Use the following steps to assign database role to new user (arcossqladmin). 1. On the left hand side, on Object Explorer pane, click on + sign of Security option, click on + sign of Logins option. You will see the various users created. 2. Right click on new user created (arcossqladmin) and click Properties. The Login Property – arcossqladmin opens. 3. On the left hand side pane, click on the User Mapping option, set the following details. Users mapped to this login table, check the checkbox for ARCOSDB database. The Database role membership for ARCOSDB area will get active. Check the checkbox and select the following roles for the ARCOSDB. db_datareader db_datawriter db_dlladmin db_owner public – default selected Users mapped to this login table, check the checkbox for ARCOSRDPDB database. The Database role membership for ARCOSRDPDB area will get active. Check the checkbox and select the following roles for the ARCOSRDPDB. 31 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 db_datareader db_datawriter db_dlladmin db_owner public – default selected 4. Click OK button. 4.3 Web Component Configuration This chapter describes how to configure various web components on Windows Server 2008. This chapter discusses the following topics: • • • • • • • • • • Enable IIS Server on Web Server (Windows Only) Install Frameworks and Controls Configure ARCON PAM Client Manager Import SSL Certificate for ARCON PAM Client Manager Assign SSL Certificate Configure Video Log Viewer Web Configuration DB Settings Creation Settings Deployment License / Domain Creation Video Log Viewer Web Configuration 32 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.3.1 Install Frameworks and Controls .Net Framework and other Windows Components are required to be installed on all the ARCON PAM Solution Servers. Follow the below mentioned steps to install Framework and Controls: • • • • • • • • • • Opens Windows Server Manager. In Dashboard, Click on Add roles and Features Click Next. Select Role-based or feature-based installation radio button and Click Next. Select Select a server from the server pool radio button and click Next. Click Next. Select .NET Framework 3.5 Features, .NET Framework 4.5, Telnet Client checkboxes. Select Desktop Experience from User Interfaces and Infrastructure checkbox and Click Next. Click Install. Click Finish. Server Reboot is required. 4.3.2 Enable IIS Server on Web Server (Windows Only) If you are installing ARCON PAM Privilege Identity Management on Windows Server 2012 and above, it’s necessary to enable the IIS Server. The below procedure shows how to enable IIS Server on Windows Server 2012 and above. To enable IIS on Web Server that is running on Windows Server 2012 or above: • • • • • • • • • • Opens Windows Server Manager. In Dashboard, Click on Add roles and Features. Click Next. Select Role-based or feature-based installation radio button and Click Next. Select Select a server from the server pool radio button and click Next. Select Web Server (IIS) checkbox and click Next. Click Next. Select all the options of IIS except FTP and click Next. Click Install. Click Finish. Server Reboot is recommended. 4.3.3 Configure ARCON PAM Client Manager This section provides information about how to configure ARCON PAM Client Manager on IIS Manager, import or create or assign SSL certificate, assign Application Pool settings and test the web component is configured properly on browser. Use the following steps to configure ARCON PAM Client Manager: 1. Create ARCONClientManager Online folder on ARCON Solutions path e.g. :\ARCON Solutions\ARCOSClientManagerOnline 2. Copy the ARCOSClientManagerOnline zip file from the ARCOS setup folder to the above drive location created i.e. <Drive>:\ARCON Solutions\ARCOSClientManagerOnline 3. Unzip the ARCOSClientManagerOnline file. 33 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4. 5. 6. 7. 8. GotoStart button and type run. In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. Click on the arrow sign of your <server name>. Right click on the Sites and click on Add Web Site. Enter the following details on the Add Web Site window: Site Name: ARCOSClientManagerOnline Physical Path: Select the path of where the ARCONClientManager folder is created. e.g. :\ARCON Solutions\ARCOSClientManagerOnline Type: https Port: 443 9. Click OK button. Install Certificate if applicable. 4.3.3.1 Import SSL Certificate for ARCON PAM Client Manager This topic provides information about how to Import SSL Certificate for ARCON PAM Client Manager provided by the client. Use the following steps to import certificate for ARCOSClientManagerOnline: 1. 2. 3. 4. 5. 6. 7. 8. Goto Start button and type run. In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. Click on the arrow sign of your <server name>. Double click on the Server Certificate icon. The Internet Information Services (IIS) Manager window opens. On right hand side Actions pane, click Import link. The Import Certificate window opens. Click on ellipse button of Certificate file (.pfx) and select the path of the certificate from the directory. Enter the Password. Click OK button. The certificate imported is displayed on the Server Certificate page. 4.3.3.2 Assign SSL Certificate to ARCON PAM Client Manager This topic provides information about how to assign self-signed certificate to ARCON PAM Client Manager. Use the following steps to assign self-signed or SSL certificate to ARCOSClientManagerOnline: 1. On Internet Information Services (IIS) Manager window, on the left hand side Connection pane, click on Sites. 2. In Run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. 3. Click on the arrow sign of Sites, click ARCOSClientManagerOnline icon. 4. Double click on SSL Settings icon. 5. On SSL Settings page, click on Require SSL checkbox. 6. On Client Certificate: click on Accept radio button. 7. On right hand side Actions pane, click Apply link. 8. The Alerts ‘The changes have been successfully saved’ pops up. 4.3.3.3 Application Pool Setting for ARCON PAM Client Manager This topic provides information about how to configure Application Pool for ARCON PAM Client Manager. Application Pool Application Pool is a logical grouping of web application that executes in a common process. It is the heart of the website. It enables to isolate the web application for better security, reliability, and availability and performance and help the web application to keep running without impacting each other. The worker process 34 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 serves as the process boundary that separates each application pool so that when one worker process or application is having an issue or recycles, other applications or worker processes are not affected. One Application Pool can have multiple worker process. For example, if you wanted every web application to execute in a separate process you have to create an application pool for each web application or in other words it is a group of one or more url’s that are served by a worker process or a set of worker processes. Use the following steps to assign application pool settings to ARCOSClientManagerOnline component. 1. 2. 3. 4. 5. 6. Go to Start button and type Run. In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. On the left hand side pane, click on Application Pool. Application Pool page opens in middle. Click on ARCOSClientManagerOnline on the Application Pool pane. On the right hand side Actions pane, click on Basic Settings in Edit Application Pool window opens. For .NET Framework version select .NET Framework v2.0 from the drop down list. In Windows 2012, default pool is set to 4.0 change it to 2.0 as the ARCON PAM application is developed on .NET Framework version 2.0 7. On the right-hand side Actions pane, click on Advanced Settings. The Advanced Settings window opens. • Enable 32 bit Applications: False If this setting is set to True, it enables the 32-bit application to run on a 64-bit machine. • Load User Profile: True Load User Profile is used to isolate the web application. For example when this option is set to False (the user profile is not loaded) the application will use the c:\windows\temp folder as its temporary directory. If you have other application pools still they will use the same c: \windows\temp folder. If you set the option to True the load user profile temporary directory will change from windows temporary folder to user profile’s temporary folder i.e. C: \Users\apppooluserid\AppData\Local\Temp. 35 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 8. Click OK button. 4.3.3.4 Database (DB) Settings Creations This section provides information about how to create DB settings for ARCON PAM Client Manager. Use the following steps to create DB settings for ARCON PAM Client Manager: 1. Goto <Drive>:\ARCON Solutions\ARCOSClientManagerOnline\DBSetting folder. 2. Double click on ‘ARCOSDBSettingCreator.exe’ file. 3. The ARCON PAM Database DBSettings.ini File Creator window opens. Enter the following details: Connection Details (Primary) Server IP– address where Database is located Server Port– port on which the ARCON PAM Database will listen (Default port is - 1433) Server Name– name of the server / IP address User Name– ARCON PAM Database name User Password– ARCON PAM database password 4. Click on Generate ini File button, to generate the ini file. The DBSetting.ini file is generated inside the DBSetting folder. 36 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.3.3.5 Test ARCON PAM Client Manager component on IE Browser This topic provides information about how to test ARCON PAM Client Manager Online component on Internet Explorer. Use the following steps to test ARCOSClientManagerOnline component on IE browser. 1. On IIS Manager window. 2. On the left hand side pane, right click on ARCOSClientManagerOnline \Manage Web Site\ Browse. 37 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. The Client Manager web page opens on Internet Explorer as seen below. 4.3.4 Settings Deployment This document will guide you through the steps involved in deployment for the ARCON Privileged Access Management (PAM) Settings. The following steps are to be followed for the successful deployment of ARCON PAM Settings in your environment. 4.3.4.1 Pre-requisites Before installing the ARCON PAM Settings, you should check the points enlisted below to ensure that your environments meets the minimum installation requirement for the ARCON PAM Settings. Pre-requisite required for successful implementation is as follows: • • • • • ARCON PAM AdminSettings package Windows based Server with IIS for Application Server (EPAM). NET Core Hosting Bundle version 2.2.6. VC++ 2015 redistributable x64 and x86 (Both) rewrite_amd64.msi 4.3.4.1.1 Install Dependencies The following dependencies are to be checked and installed if not present already. 41 IIS Features NET Core Hosting Bundle version 2.2.6. Install VC++ 2015 redistributable x64 and x86 (Both) rewrite_amd64.msi Self Signed Certificate is not supported. 38 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.3.4.2 Deployment Steps 4.3.4.2.1 Deploy AdminSettings package This section provides information about how to configure ARCON PAM Settings on IIS Manager. Use the following steps to configure ARCON Settings: 1. Create AdminSettingsfolder on ARCON Solutions path e.g. <Drive>:\ARCON Solutions\AdminSettings 2. Copy the AdminSettings.zip and unzip files to the above drive location created. <Drive>:\ARCON Solutions\AdminSettings 3. Unzip the AdminSettings 4. Kindly check for the AdminAPI folder e.g. <Drive>:\ARCON Solutions\AdminSettings, everyone has the permission at the folder level. 0 0 5. Inside AdminSettings folder, we will have AdminUI folder and AdminAPI folder 0 39 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 0 0 4.3.4.2.2 Add Application in ARCOSClientManagerOnline This section provides information about how to add application in the already hosted site on IIS Manager. If Using SSL certificate ARCOSClientManagerOnline Site host name should not be blank and if using SSL certificate, use the certificate name as the Host Name as shown below. 0 0 And the same should be updated on the Host file c:\windows\system32\drivers\etc\hosts 40 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.3.4.2.3 ARCON PAM AdminUI This section provides information about how to add ARCON PAM Settings Admin UI application in ARCOSClientManagerOnline on IIS Manager. Use the following steps to add a new Application Pool for AdminUI.0 1. 2. 3. 4. Goto Start button and type run. In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. On the left pane, click on Application Pool. Select Add Application Pool. 0 0 5. Enter the following details. 41 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 a. Name: AdminUI b. The .NET CLR version should be set to No Managed Code. 0 0 6. Enable the checkbox Start application pool immediately. 7. Click OK. 8. Add a new application for AdminUI under the ARCOSClientManagerOnline a. Right-click on the website hosted for UI. b. Select Add Application… 0 42 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 0 9. Enter the following details on the Add application window: a. b. c. d. Alias:AdminUI Physical Path:Selectthe path of where the AdminUI folder is created. Select application pool as AdminUI The Application Pool should be the same as the name of the Application Pool created for .Net Core. (In this case: AdminUI) 0 0 10. Click on OK. ARCON PAM Admin API This section provides information about how to add ARCON PAM Settings Admin API application in ARCOSClientManagerOnline on IIS Manager. Use the following steps to add a new Application Pool for AdminAPI. 1. Go to Start button and type Run. 43 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 2. In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. 3. On the left pane, click on Application Pool. 4. Select Add Application Pool. 0 0 5. Enter the following details. The .NET CLR version should be set to No Managed Code. 0 0 6. Enable the checkbox Start application pool immediately. 7. Click OK button. 8. Add a new application for Web API under the ARCOSClientManagerOnline website. Right-click on the website hosted for UI. Select Add Application… 00 44 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 0 9. Enter the following details on the Add application window: a. Alias:AdminAPI b. Physical Path:Select the path of where the AdminAPI folder is created. c. Select application pool as AdminAPI The Application Pool should be the same as the name of the Application Pool created for .Net Core. (In this case: AdminAPI) 0 45 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 0 10. Click on OK. 0 Hosting AdminAPI inside AdminUI 4.3.4.3 Configuration 4.3.4.3.1 AdminUI Configuration • In the settings assets folder (\AdminUI\assets), in file config.json, update the value parameter of “baseUrl” to the Url on which WebAPI will be hosted in IIS(in this case: https:// testarcpamapp.testad.com/AdminAPI) 4.3.4.3.2 AdminAPI Configuration • In AdminAPI’s folder (\AdminAPI), in appsettings.json, update the value parameter of “authUrl“ to the Url on which WebAPI will be hosted in IIS (in this case: https://testarcpamapp.testad.com/AdminAPI) • In AdminAPI’s folder (\AdminAPI), in appsettings.json, update the value parameter of “UiUrl“ to the Url on which the settings UI will be hosted in IIS (in this case: https://testarcpamapp.testad.com/AdminUI/) • In AdminAPI folder (\AdminAPI\DBSetting), open ARCOSDBSettingCreator.exe and generate dbsetting.ini pointing to ARCOSDB 4.3.4.3.3 ARCOSClientManagerOnline Configuration • In publish of ACMO → SAML folder → samlSPEntities.json → change the value of key: ConsumerServiceUrl and TargetUrl ofEntityCode:”PAMAS”to the Url on which Web API is hosted. (In this case: ConsumerServiceUrl: https://testarcpamapp.testad.com/AdminAPI/api/SettingViewand TargetUrl: https://testarcpamapp.testad.com/AdminUI) 46 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Access the application through ACMO → Manager Tab → Settings. Only Administrators can assign the Settings privileges to the Users in the Server Manager. Once the privilege is assigned, Users can see the settings tab in the ACMO. 4.3.5 Configure ARCON PAM User Access Log Viewer Web Component This section provides information about how to configure ARCON PAM User Access Log Viewer Web, assign Application Pool settings and test the web component configuration on browser. ARCON PAM User Access Log Viewer Web or Video Log Viewer Web component is used to view the video log captured by the ARCON PAM application. The Log Viewer Web folder is on the Vault Server (Database Server). Basically in a scenario where there is only one sever all the web components are installed on that particular server only. In the actual implementation process, the App server is different from the Vault server. Use the following steps to configure the ARCON PAM User Access Log Viewer Web component. 1. Create ARCOSUserAccessLogViewerWeb Online folder on ARCON Solutions path e.g. <Drive>:\ARCON Solutions\ ARCOSUserAccessLogViewerWeb 2. Copy the ARCOSUserAccessLogViewerWeb zip file from the ARCOS setup folder to the above drive location created i.e. <Drive>:\ARCON Solutions\ ARCOSUserAccessLogViewerWeb 3. Unzip the ARCOSUserAccessLogViewerWeb file. The video logs created will be stored in this folder therefore you should have sufficient space on this drive (Minimum: 1 TB for High Quality files). The Server Administrator should have rights to enter into this path. 47 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4. 5. 6. 7. 8. Goto Start button and type run. In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. Click on the arrow sign of your <server name>. Right click on the Sites and click on Add Web Site. Enter the following details on the Add Web Site window: Site Name: ARCOSUserAccessLogViewerWeb Physical Path: Select the path of where the ARCOSUserAccessLogViewerWeb folder is created. Site Type: http IP Address: All Unassigned Port: 8181 Click OK button. 48 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.3.5.1 Application Pool Setting for ARCON PAM User Access Log Viewer Web This topic provides information about how to configure Application Pool for ARCON PAM User Access Log Viewer Web component. Use the following steps to assign application pool settings to ARCON PAM User Access Log Viewer Web component. 1. 2. 3. 4. 5. 6. Goto Start button and type run. In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. On the left hand side pane, click on Application Pool. Application Pool page opens in middle. Click on ARCOSUserAccessLogViewerWeb on the Application Pool pane. On the right hand side Actions pane, click on Basic Settings in Edit. Application Pool window opens. For .NET Framework version select .NET Framework v2.0 from the dropdown list. In Windows 2012, default pool is set to 4.0 change it to 2.0 as the ARCON PAM application is developed on .NET Framework version 2.0 7. On the right hand side Actions pane, click on Advanced Settings. Advanced Settings window opens. Enable 32 bit Applications : True This setting enables the 32-bit application to run on 64 bit machine. 49 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Load User Profile: True Load User Profile is used to isolate the web application. For example when this option is set to False (the user profile is not loaded) the application will use the c:\windows\temp folder as its temporary directory. If you have other application pools still they will use the same c: \windows\temp folder. If you set the option to True the load user profile temporary directory will change from windows temporary folder to user profile’s temporary folder i.e. C: \Users\apppooluserid\AppData\Local\Temp. 4.3.5.2 Test ARCON PAM User Access Log Viewer Web component on Browser This topic provides information about how to test ARCON PAM User Access Log Viewer Web component on Internet Explorer. Use the following steps to Test ARCON PAM User Access Log Viewer Web on IE Browser: 1. On IIS Manager window, on the left hand side pane, right click on ARCOSUserAccessLogViewerWeb\Manage Web Site\ Browse. 2. The web page opens on Internet Explorer browser. 50 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.3.6 ARCON PAM API Component Configuration This section provides information about how to configure ARCONPAMAPI, assign Application Pool settings and test the web component configuration on browser. ARCONPAMAPI component is used for 3rd Party integrations. Use the following steps to configure the ARCONPAMAPI component. • Create ARCONPAMAPI folder on ARCON Solutions path e.g. <Drive>:\ARCON Solutions\ ARCONPAMAPI • Copy the ARCONPAMAPI zip file from the ARCOS setup folder to the above drive location created e. <Drive>:\ARCON Solutions\ ARCONPAMAPI • Unzip the ARCONPAMAPI • Goto Start button and type run. • In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. • Click on the arrow sign of your <server name>. • Right-click on the Sites and click on Add Web Site. • Enter the following details on the Add Web Site window: Site Name:ARCONPAMAPI Physical Path:Select the path of where the ARCONPAMAPI folder is created. Site Type: https IP Address:All Unassigned Port: 8444 Click OK 0 51 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 0 4.3.6.1 Database(DB) Settings Creations This section provides information about how to create DB settings for ARCONPAMAPI. Use the following steps to create DB settings for ARCONPAMAPI: • Goto <Drive>:\ARCON Solutions\ ARCONPAMAPI\DBSetting • Double click on ‘ARCOSDBSettingCreator.exe’ • The ARCON PAM Database DBSettings.ini File Creator window opens. Enter the following details: Connection Details (Primary) Server IP– Address where Database is located Server Port– Port on which the ARCON PAM Database will listen (Default port is - 1433) 52 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Server Name– Name of the server / IP address User Name– ARCON PAM Database name User Password– ARCON PAM database password Click on Generate ini File button, to generate the ini file. The DBSetting.ini file is generated inside the DBSetting folder. 0 0 4.3.7 License Registration and Login This section provides information about license registration and login into ARCON PAM Server Manager. 4.3.7.1 ARCON PAM Server License Registration If you are registering ARCON PAM for first time, then follow below steps on Application Server: 1. 2. 3. 4. 5. 6. 7. 8. Goto Start button and type run. In run window type ‘inetmgr’. The Internet Information Services (IIS) Manager window opens. Click on the arrow sign of your <server name>. Click on the arrow sign of Sites. Double click ARCOSClientManagerOnline. On right hand side Actions pane, on Browse Web Site, click Browse *:443 (https) link. ARCON PAM url https://localhost/ will open Click Continue to this website (not recommended) link. 53 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 9. ARCON PAM License Registration screen pops-up. A] Register Using License Key: Enter the 25 digit key in the License Key (Enter the 25 digit key.) text boxes. Select the validity dates in Valid From and Valid To fields. OR B] Register Using License Text: Enter the alphanumeric text key in the License Text (Enter the alphanumeric text key.) text box. When you register using License Text, the license validity is auto updated in backend. The license key or license text will be provided by ARCON Team. 10. Click OK button. A message “Registration Key updated” window pops-up for successful registration. 11. Click OK button. The ARCON PAM Domain Registration screen pops-up. To register the domain read the Domain Creation chapter. 4.3.7.2 Domain Creation In ARCON PAM the Administrator can create domain in two ways: 1. AD Integration (LDAP/ LDAP SSL) 2. ARCOSAUTH Local Repository Creation 4.3.7.2.1 AD Integration (LDAP or LDAP SSL) This topic provides information about how to enter the domain details on the Domain Registration pop-up window. 54 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 After entering the correct license key a Domain Registration window pops-up. The Administrator has to enter the details of the domain. Domain created is an Active Directory domain through LDAP/LDAP SSL) protocol. To configure Domain Registration through AD Integration (LDAP / LDAP SSL) Use the following steps to enter the domain details on the Domain Registration pop-up window. 1. Enter the following details in ARCON PAM Domain Registration screen. Enter the Domain Server name. Enter the Domain Name. Enter the Domain Extension e.g. COM, CO, etc. Enter the Application Administration name. This Application Admin name is the first user to enter in the ARCON PAM Server Manager with all the privileges. Enter the Domain Password. This password is the password which you type when you enter into your domain or standalone system. Enter the Confirm Password. Click on Finish button. 55 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 2. A message “Authentication Successful. Application will close now” window pops-up for successful domain registration. 3. Click OK button. The ARCON PAM portal is seen on the computer screen. 4.3.7.2.2 ARCOSAUTH Local Repository Creation The second way to create the domain is by running the SQL script at the backend which is provided by the support team. The SQL script contains all the default ARCOSAUTH (Local Repository) domain configuration. This topic provides information about how to create the domain by running the SQL script at the backend. The first user created would be ARCOSADMIN and it will have all the privileges. Use the following steps to create ARCOSAUTH Local Repository. 1. 2. 3. 4. 5. Open the SQL Server Management Studio. Copy the script in the Query Analyzer. Select the ARCOSDB database from the Available Database drop down list. Click Execute. The query gets executed successfully and the local domain ARCOSAUTH is created. Login into the ARCON PAM portal. The username and password for ARCOSAUTH domain will be provided by the support team. 4.3.7.2.3 ARCON PAM Portal Login On successful domain registration, login into the ARCON PAM portal with the domain details you have entered while registration of the ARCON PAM application. 56 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Follow below steps to login into the ARCON PAM portal or Server Manager. 1. Enter the User Name i.e. Application Admin or first username you have entered on the Domain Registration window. This user has all the privileges of the server manager. 2. Enter the Password i.e. Domain Password name that you have entered on the Domain Registration window. 3. The Domain name will get automatically selected for the first time. 4. Click on Login button, the ARCON PAM Server Manager application opens. 57 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.4 ARCON PAM Windows Components ARCON DeskInsight:ARCON DeskInsight is used for managing Laptop/desktop password and connection between local systems. 0 ARCON DeskInsight Master:ARCON Deskinsight Master will provide you a full and accurate scan of all your network devices. Including Windows and Desktops machines. If it's on your network and same OU in AD, this service can find it. Used to fetch data from AD server. 0 ARCON Folder Sync Service:ARCON Folder Sync Service synchronizes data from source to destination server. This service can synchronize video logs, text files, images, etc. after configured time interval. It is designed to save time setting up and running backup jobs while having nice visual feedback along the way. ARCON Folder Sync Service ARCON PAM Windows Component is used to Replicate Data in Folder from One server to another. 0 ARCOS Alert Service:ARCOS Alert Service sends alerts as per the criteria or the requirement defined in the application ie whenever a particular action is triggered or a condition is satisfied the alert is sent to the administrator. 0 ARCOS DB Sync Service:In ARCOS, there are multiple environments for redundancy. In some of the setups have SQL Express edition. SQL Express edition does not support replication, mirroring or log shipping. In such cases, ARCON provides this tool to overcome this challenge. 0 ARCOS Log Archiver Service:ARCOS Archival Service is installed on ARCOS Server* to archive video logs in playable Video Format. The logs are converted and archived into viewable video formats for transfer / share or audit logging. Logs are stored in .avi format and can be viewed using Windows Built-in Media Player. These logs can be retained for audit trail and retention of data. 0 ARCOS Log Manager Service:ARCOS Log Manager Service Windows Component is used to convert Binary Video Logs in Database to Encrypted Video Logs on Local Drive. 0 ARCOS PerfMonIT:- 58 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 This is to monitor the performance of ARCOS Servers. (ARCOS Server Performance Monitor). Windows Component is used to Check HW/SW Details of Servers 0 ARCOS SIEM Connector Service:ARCOS SIEM Connector Service is an ARCON PAM Component which is used to send unencrypted Data to Database Tables related to SIEM. 0 ARCOS SPC Service:ARCOS SPC Service is an ARCON PAM Windows Component which is used to change Password Automatically (On a Schedule). 0 ARCOS VPC Service:ARCOS VPC Service is an ARCON PAM Windows Component which is used to change Password of Service whose password has been viewed by User. 0 ARCOS Staging Log Sync Service:ARCOS Staging Log Sync Service is an ARCON PAM Windows Component which is used to send Video Logs from Staging Server to Centralized Location. 0 ARCOS TS Plugin:ARCOS TS Plugin ARCON PAM Windows Component is used to restrict / elevate process on Target Windows Device. 0 ARCON PAM Windows Vaulting Service ARCON PAM Vaulting Service is used to perform following actions: 1. Privileged IDs password discovery. 2. Change password for Windows type of devices. WinPWD version has been updated and renamed as ARCON PAM Windows Vaulting Service ARCOSADScannerService This service is used to scan details of Active Directory and fetch User/ Device details. ARCOSUserOnboardingService This service is used to auto onboard or deboard users/ devices. These users and device details are scanned from Active Directory, using ARCOSADScannerService. 4.4.1 ARCON Auto Healing Service 4.4.1.1 Overview Auto Healing is the process of automatically changing passwords for services using privileged accounts in case of password failure. Auto healing shall be attempted for all Password change Processes such as Manual, SPC, and VPC. Password Reconciliation is a process used to analyze failed scheduled passwords and auto-heal them on both ARCON PAM and the target server. The reconciliation process compares the passwords in Vault and the target system repository determines the difference between the two repositories and applies the latest changes on the servers. 4.4.1.1.1 Pre-requisites .net Framework 4.7.2 version needs to be installed. 59 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.4.1.2 Installation To install the ARCON Auto Healing Service, follow the steps below: 1. Right-click on the ARCONAutoHealingSetup.msi file and click Install. 2. Click on the Next button in the ARCON Auto Healing Service Setup Wizard screen to process the setup. 3. Click on the Browse button to select the installation folder. Select the radio button Everyone (applicable for anyone using this system) or Just me (applicable for the logged-in user) and then click on the Next button to confirm the setting. 60 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4. Click on the Next button to start the installation. 61 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 62 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Click on the Close button as the installation has been completed successfully on the system. 6. You can view the service running using the following path: Run → services.msc → ARCON Auto Healing Service Copy DB Settings from ACMO folder to all installed service folders for services to run/start. 4.4.1.2.1 Configuring the ARCON Auto Healing Service Upon successful installation, configure the ARCON Auto Healing Service following the steps below: 1. Navigate to the ARCON Auto Healing Service and open the autohealconfig.ini file in Notepad. 63 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 2. Define configurations in the autohealconfig.ini file referring to the following table. 64 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description ServiceInterval 60000 Service Interval time for the service log. The service interval is configured in milliseconds. For example: 60,000 milliseconds is equal to 1 minute. IsUserNameAfterPassword false This config is used for appending username after password (used for password change process of linux domain id’s) Configurable value : true/false 65 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description UserGatewayServerForPWDChange true Set this value as 'true' to change the password through gateway server SSHConnectionTimeout 60 In Seconds specify the time after which ARCON PAM should timeout the SSH Connection IsEnforceSUSEForPWDChange false Override password change tags through suse. Configurable value : true/false IsEnforceToRestartService false Allow self restart of service Configurable value : true/false ResatrtServiceIntervalInDays 1 Restart service after 'n' configured days ResatrtServiceByTime 2 Restart service after ’n' configured hrs NewSecureGatewaywithlatestChiphers true This config is used for checking ciphers while connection to gateway server. Configurable value : true/false StartEndTime 00:00~00:00 This config is used for setting the time for the password change process by ARCON Auto Healing service. Eg- 00:00~06:00 The above config would allow password change from 00:00 hrs to 06:00 hrs. DefaultLOBs DEFAULT LOB 1 This config is used for allowing ARCON Auto Healing Service to run for all / particular LOB Configurable value : NA for All LOB Configurable value : LOB/LOB’s name (comma separated) ShowDebugLogs true This config is used for allowing ARCON Auto Healing Service to store logs in event viewer. Configurable value : true/false 66 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description StartEndDate Eg- 1~31 This config is used for setting the date for the password change process by ARCON Auto Healing Service. Eg- 1~15 The above config would allow password change from 1st day of month to 15th day of month. ServiceName ARCON AH Service Installed Service Name should be same 3. Click File → Save to save the configurations. 4.4.2 ARCON WinVaulting Service 4.4.2.1 Overview ARCON PAM WinVaulting Service is used to perform the following actions: • Privileged IDs password discovery. • Change the password for Windows type of devices. WinPWD version has been updated and renamed as ARCON PAM WinVaulting Service. The Windows password change service is required on the Windows server to perform the password change. ARCOS does not have any other agent other than Windows password change service for the password change of Windows account. Otherwise, no agent is required on UNIX, Windows, or Oracle. The agent is required only for Windows if the given server is in the workgroup. If a server is on the domain, only one server is required with this service. One can install a domain controller or an active directory. Do not install it on the Windows server, which is in the active directory. If a server is in the workgroup, this service is required. This works on a 45045 port that is defined and already documented. Hence, the scheduled password causes this service. When using Windows, it is connected to the Windows password change service. If it is a domain controller based or the domain-based account or the local account of the server, which is in a domain, the Windows password change service is not required. In ARCOS, one can configure the settings for using the centralized password change service or the distributed service. Every server has its own password change service irrespective of the server being in the domain. One can configure it in ARCOS, whether there is a centralized service or an individual service. There could be multiple domains, as one of the clients has eight domains in their environment. Each domain is completely isolated from each individual domain. There are eight centralized password change services that are configured. Every domain has a different password change service server that can be configured in ARCOS. Whenever ARCOS tries to change the password of the domain account, it connects to the respective centralized password change service. The centralized password change service is the same service and it is called a centralized Windows password change service. This service is installed only on the target device. If it is a centralized implementation on one server in a workgroup, then every workgroup server is required. This service is also required on all the servers in ARCOS when performing the performance monitoring for the application and database vault. This service is required when the gateways server is Windows. It is, however, not required when the gateway server is UNIX. This can only be installed on Windows servers, as this is a Windows-based application. To perform the performance monitoring, the Windows password change service 67 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 should be installed on the application server and on the vault server. The performance monitoring service connects only to this service. There are two components of the Windows password change service, scheduled password change service and performance monitoring. It is not necessary that there should be only one centralized password change service. Single and multiple options are available besides the centralized password change service. Depending upon the domain, ARCOS recognizes the domain and connects to the particular IP port. These ports should be opened from the vault servers. Earlier, there was a requirement of the direct port for the password change of Windows, but now it is not required. ARCOS uses a secure server if available. Initially, the 45045 port is required to be opened from the desktop, but now it is not. One can open it from the gateway or secured server. ARCOS connects to the secured server and then to the centralized password change service. The service is installed at its location, as only port routing has changed. The UNIX password change connects to the UNIX server and then it changes the password. If this service is installed on the active directory and the particular servers are in the active directory, this service is not required on all the servers, but only on one server. In ARCOS, one can change the password from one domain controller to subsequent domain servers. If a given account is a domain-based account, it is on the active directory. If it is a local account, the individual server has a local account. By default, every Windows server has an administrator account that does not change. In any environment, one must have an administrator account. A normal administrator account remains the same or it can be renamed. The ARCON WinVaulting Service Port is static. In the future, one may need to configure some other ports for different servers or the complete environment has to change. Hence, the ARCON WinVaulting Service Port is configurable. This is a standard configuration that can be changed in case some performance tuning is required. According to the database configuration, the services are in the back end. Hence, they are monitored automatically. Here, the password change service provides all the details. 4.4.2.2 Prerequisites • .net Framework 4.7.2 needs to be installed on the server. The server should be restarted post .net installation. • Install ARCON WinVaulting Service in ARCON App server/CPC/One of the Windows servers part of the respective domain. The ARCON WinVaulting Service should run under a non-interactive Domain Account (this service account should be set to Never Expire), which holds the right to change/reset other privilege account passwords on the same domain. It should also have sufficient rights (Domain Administrator rights) to be able to change/reset the password of Windows Local Administrator accounts. 4.4.2.3 Installation Installing the ARCON WinVaulting Service To install the ARCON WinVaulting Service, follow the steps below: 1. The Product Team will share the WinVaultingServiceSetup.msi file. 2. Right-click on the WinVaultingServiceSetup.msi file and click Install. The installer wizard displays the ARCONWinVaultingService being installed. 68 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. You can view the ARCONWinVaultingService running using the following path: Run → services.msc → ARCON Pam Windows Vaulting Service running 4.4.3 ARCOS Alert Service 4.4.3.1 Overview In the ARCOS Alert Service, there is only one configuration file available. This service manages emailing, dynamic reporting, schedulers, and so on. For example, to email a specific report to a specific user on a daily, weekly, or monthly basis, the ARCOS Alert Service can be configured. The ARCOS Alert Service also manages the workflows. For example, if some users request passwords or device access, the ARCOS Alert Service monitors such requests. It generates an email and sends it to the users based on the configuration. If there are multiple application servers, one can have the server in the DMZ zone and the workflow manager to perform approval mechanisms. For this multiple links can be configured. It provides different links for different servers and IP addresses through email. Different functionalities of the ARCOS Alert Service are as follows: • • • • • • Sending alerts Sending alert notification emails Sending password requests Sending notification emails Sending service request emails Sending passwords on requested time 69 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 • Scheduling reports Consider the scenario below for sending the password at the requested time: Scenario: If a password is requested for the next day at 5 P.M., the password will be approved and sent at the requested time. Consider that an organization has multiple data centers at different locations in India – Mumbai, Delhi, Bangalore and Chennai. However, the administrators are not spread across all these centers. Now, User A requests the password for the XYZ server and the server requires approval from User B. This service detects the password requestor i.e. User A, drafts an email, and then sends it to User B. User B proceeds for the further actions. In such a case, the ARCOS Alert Service performs the password release based on the time. If a password is requested on the next day at 12 P.M., this service approves the password on the same day but releases the password only at the requested time. It always sends the password in the ARCOS mailbox and not in the email account of the requestor. In ARCOS, each user has a separate mailbox. 4.4.3.2 Prerequisites .net Framework 4.7.2 version needs to be installed. 4.4.3.3 Installation Firstly, the ARCOS Alert Service must be installed and then configure the following fields: • • • • • Service Interval Mail Subject Prefix Mail CC Mail Footer ARCOS ACMO URL 4.4.3.3.1 Installing the ARCOS Alert Service To install the ARCOS Alert Service, follow the steps below: 1. Right-click on the ARCOSAlertServiceSetup.msi file, the following options as in the below image will be displayed. Click Install. 2. If the application has never been installed before, then the following screen shall appear. Click Next. 70 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. Browse and select the installation path where you want to install the file. • Recommended folder path - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Alert Service\ • Here ‘X' denotes the drive where ARCON’s ancillary services will be installed 71 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4. Click Next. The installer is ready to install ARCOS Alert Service on your computer. 72 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Click Next to start the installation. 6. Once ARCOS Alert Service is successfully installed, click Close. 7. You can view the ARCOS Alert Service running using the following path: Run → services.msc → ARCOS Alert Service running Copy DB Settings from ACMO folder to all installed service folders for services to run/start. 4.4.3.3.2 Configuring the ARCOS Alert Service Upon successful installation, configure the ARCOS Alert Service following the steps below: 1. Navigate to the ARCOS Alert Service folder and open the alertconfig.ini file in Notepad. 2. Define configurations in the alertconfig.ini file referring to the following table. 73 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description ServiceInterval 60000 Service Interval time for the service log. The service interval is configured in milliseconds. For example: 60,000 milliseconds is equal to 1 minute. MailSubjectPrefix ARCON PAM Alert The mail subject prefix is available only when it runs alerts. Otherwise, the prefixes are not applicable. The Mail Subject Prefix service is responsible for sending emails for every activity that is performed on the email level. If an email is not received properly even after the successful configuration of this service, it means the ARCOS Alert Service is not working properly. 74 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description MailCC Leave it blank The default value for the Mail CC configuration is kept blank. One can add the recipient email ID in any email for backup purposes. It can be configured in such a way that any email that is sent should have at least one Mail CC. The Mail CC should be configured for sending the backup type of emails. MailFooter <BR><BR><BR>Please ensure that your Web/IT/ Email administrator permits emails with attachments. This is an auto-generated e-mail from ARCON PAM. Please do not reply to this e-mail. It has been sent from an e-mail account that may not be monitored. In case of any assistance or query please contact ARCON PAM Administrator. The mail footer configuration is a standard footer for all emails. One can set the standard footer for every sent email. The standard footer can be configured according to the client’s requirements. ARCOSACMOURL <PAM URL> The ARCOS ACMO URL must be changed to the PAM URL MailBodyPanelParam <PAM URL>/resources/ images/arcos-logo.png The email logo URL must be configured here ScheduleReportsFormat PDF CSV OR PDF PDFCreatedFor <Client Name> PDF created for <client name> PDFCreatedBy ARCON PDF created by <ARCON> PDFInitiated Daily Configure frequency for daily reports to be generated PDFImage X: Report cover header page image \ARCON_Solutions\ARCON_ Program_Files\ARCOS Alert Service\ReportCoverHeaderP age.png PDFHeaderText Leave it blank Text to be mentioned for the PDF Header (not in use) DeferSchedulingProcess Leave it blank If DeferSchedulingProcess then ScheduleLog is On, if blank then ScheduleLog is off ‘X' denotes the drive where ARCON’s Logs are stored. 75 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. Click File → Save to save the configurations. 4.4.4 ARCOS Failover Manager 4.4.4.1 Overview Ensuring data is available at any point in time is the topmost priority for any organization. Auto Failover is a mode if the database is not online, it would automatically be redirected to an alternative and the database would be up and available. In ARCON PAM we have a Primary Database Server and a High Availability Server to ensure that the database environment is restored with minimal impact on the business. ARCON PAM Automatic Failover Automatically initiates a fast-start failover without human intervention after the primary database has been unavailable for a set period. i.e. If the Primary Server is Down and not accessible due to network failure or any other reason, ARCON Auto Failover Manager will connect to SQL Cluster IP of DC and will perform a DB Check and if successful, it will continue to do so after 60 Seconds (Configurable) interval. 4.4.4.2 Scenario There are two ARCON PAM Database Servers (Primary and HA) in DC and one in DR Environment. MSSQL Clustering with Common Storage is used to achieve High Availability between Primary and HA Database Server in DC. MSSQL Log Shipping is used to replicate ARCON PAM Database from DC to DR Environment. ARCON Auto Failover Manager will connect to SQL Cluster IP of DC and will perform a DB Check and if successful, it will continue to do so after 60 Seconds (Configurable) interval. If DB Check is unsuccessful, ARCON Auto Failover Manager will attempt twice after 5 Seconds (Configurable) interval. After Three Unsuccessful attempts, ARCON Failover Manager will Connect to DR Database Server and will bring the ARCON PAM Database in Read-Write Mode. Once ARCON PAM Databases are Online, it will automatically start all the ARCON Windows Components. 76 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.4.4.2.1 Configuration Requirement Following are the settings required for Automatic Failover Manager: 1. 2. 3. 4. 5. 6. Primary Server database connection details. DR Server database connection details. List of ARCON Windows Component to Autostart on DR Server The service interval for connecting the Primary database and validating if the database is running. Number of failed attempts for validating if the database is running In case of failure, an interval for connecting Primary DB and validate if DB is running. 4.4.4.2.2 Configuration Steps 1. Install and Run service as Administrator account. a. Database Details : Use dbsetting.exe to generate db setting file, provide primary and DR database details. 77 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Steps to create dbsetting.ini file are as follows: i. Double click on ‘ARCOSDBSettingCreator.exe’ file. ii. The ARCON PAM Database DBSettings.ini File Creator window opens. Enter the following details: Connection Details (Primary) • Server IP – address where Database is located • Server Port – port on which the ARCON PAM Database will listen (Default port is 1433) • Server Name – the name of the server / IP address • User Name – ARCON PAM Database name • User Password – ARCON PAM database password 78 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 iii. Enter all the above details and click Test Connection. The following success message will be displayed. Test Connection Success For Primary Database. iv. Select Connection Details (DR Server) checkbox. Enter the following details: Connection Details (DR Server) • Server IP– address where Database is located • Server Port– port on which the ARCON PAM Database will listen (Default port is 1433) • Server Name– the name of the server / IP address v. Enter all the above details and click Test Connection. The following success message will be displayed. Test Connection Success For DR Database. DR Database login user should have restoring rights on DR Server. vi. Enter the following details: Database Name Details: • Primary Database – Select Use Default check box. "ARCOSDB" will be displayed in text field. • RDP Database – Select Use Default check box. "ARCOSRDPDB" will be displayed in text field. Do not change values in Primary Database and RDP Database text fields. vii. Click Generate ini File button, to generate the ini file. The DBSetting.ini file is generated inside the DBSetting folder. viii. The following screen will be displayed. b. ARCOSFailoverManagerConfig : The ARCOSFailoverManagerConfig file will be displayed on the below path after installing Service on DR Server: X:\ARCON_Solutions\ARCON_Program_Files\ARCOSAutoFailover ‘X' denotes the drive where ARCON’s ancillary services will be installed. 79 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 The ARCOS Failover Manager config file is required to manage the following: i. ServiceInterval: This is the time interval at which service will check the connection with the primary database. Set time in milliseconds, default time is 60000 milliseconds. ii. PRFailedThresholdValue: If the service failed to connect to the primary database. Set this time interval for multiple attempts in 1 min default is 1500 seconds. iii. PRConnectAttemptInterval: Set this in numbers as in how many PRFailedThresholdValue attempts, for example: If the service failed to connect primary database, then connect try will be PRFailedThresholdValue * PRConnectAttemptInterval = 1500(sec)*8(times) iv. ServicesToFailover: List down the windows service which you want to start after DR recovered. Use the Service name of Services and not the Display name of Services (Services.msc > Select a service > Right-click and select Properties). SQL Queries can be configured from ARCOSAutoFailover config file. 4.4.4.2.3 Logs Logs shall be generated for ARCOS Failover service and saved in “Applications and services logs” in Event Viewer window as shown below. 80 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 81 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.4.5 ARCOS Log Archiver Service 4.4.5.1 Overview The ARCOS Log Archiver Service is the next step of the ARCOS Log Manager Service. This service plays an important role when the images are transferred from the database to a physical disk. This service converts all the setup. ARCOS Archival Service is installed on ARCOS Server* to archive video logs in playable Video Format. The logs are converted and archived into viewable video formats for transfer/share or audit logging. Logs are stored in .avi format and can be viewed using Windows Built-in Media Player. These logs can be retained for audit trail and retention of data. 4.4.5.1.1 Pre-requisites Following are the prerequisite required for ARCOS Log Archiver Service: 82 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 1. .net Framework 4.7.2 version needs to be installed. 2. In ARCON PAM Settings enable the following configurations. To configure the PAM Settings follow the given path: ACMO → Manager → Settings → Logs → Archival Service 0 a. Enable ARCOS Log Archiver Service b. Enable ARCOS Log Archiver Service - Is Delete Service Log (If Archive Success) c. Set the value as needed for ARCOS Log Archiver Service - Archive Older Than Hours 4.4.5.2 Installation For the Installation following steps need to be followed. 1. Right-click on the .msi file ARCOSLogArchiverServiceSetup.msi, the following options as in the below image will be displayed. Click on Install. 0 2. If the application has never been installed before then the following screen shall appear. Click Next. 0 83 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. Browse and select the installation path where you want to place the file. Preferably the path as X: \ARCON_Solutions\ARCON_Program_Files\ARCOS Log Archiver Service\ Note: ‘X' denotes the drive where ARCON’s ancillary services will be installed. 4. Select the radio button Everyone (applicable for anyone using this system) or Just me (applicable for the logged-in user) and click Next to confirm the setting. 0 84 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Click next to confirm the installation. 0 85 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 6. Click Close as the installation has been completed successfully on the system 0 86 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 7. You can view the service running using the following path: Run → services.msc → ARCOS Log Archiver Service running Copy DB Settings from the ACMO folder to all the installed service folders for services to run/start. 4.4.5.2.1 Log Archiver Configuration File Once the service is installed on the system, you need to configure the resolution, interval of Video logs in the ARCOSLAConfig.ini file. To navigate, use the following path (this path is the installation path which is selected in step 3): X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Log Archiver Service\ Open the file in the notepad application. Define the configurations in the ARCOSLAConfig.ini file as listed in the table below: 87 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 0 Below listed are the Log Archiver Service names & values for the ARCOSLAConfig.ini file Config Name Config Value Description ServiceInterval 60000 This config is used for restarting the Log Archiver service after a particular time interval ( in milliseconds) EnableTraceLog false Traces the functionality. You can enable or disable Trace Logs. Trace Logs when enabled can be used for troubleshooting, if service logs does not functions properly. If the trace log is enabled, it generates a log in the Event Viewer. Every service creates logs in the Event Viewer. If there is any problem in a service and it does not function properly, then one should go to the Event Viewer and check the respective event logs. Configurable Values: true or false. VideoWidth 1024 Configures width of the video log. Should be configured same as the Log Manager configuration. 88 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description VideoHeight 768 Configures height of the video log. Should be configured same as the Log Manager configuration. VideoFrameRate 1 Configures frame rate of the video log. Video is a sequence of frames. When images are converted into a video, it gets written as one file with encoding of images. When a media player understands the encoding and plays it as a video, the video is played frame by frame. The default value for the frame rate is set to 2. The value 2 means, there are 2 frames in 1 second. This frame rate can be too fast for some clients, one can change the frame rate value from 2 to 1, which means 1 frame per second. But one cannot go below the frame rate 1 frame per 1 second. 1 frame cannot be divided in multiple seconds. One can configure 1 frame per second or 2 frames per second or more than that. VideosPerCycle 10 Configures number of image session logs to be converted to video logs for the set interval. In other words, it refers to the number of videos that the archival service should have in one cycle. For example, if VideosPerCycle value is set to 10 and Interval is set to 60,000 milliseconds, then 10 image session logs are converted to Video log after every 1 minute (service interval cycle). VideosBitRate 300000 Configures Bit rate of video log. By default, the value is 3 lac It is not recommended to change the default value. If changed, it reduces the video quality after 5 - 10 seconds. 89 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description logordertype 0 Configure the value for log order type. The valid values are 0, 1, 2. 0: All images are considered for conversion from Image log to Video Log If the value is set to 0 then only one service needs to be installed. If both services are installed, the value needs to be set to either 1 or 2 depending on the values set in ARCOS Log Archiver Service ONS. Failing to do so can lead to a malfunction. 1: Only Odd number images record will be considered for conversion from Image log to Video Log 2: Only Even number images record will be considered for conversion from Image log to Video Log If you want to generate both Odd and Even Video logs, you need to configure ARCOS Log Archiver Service ONS from ARCON PAM Windows Components Installer folder. Post installation of this service the values in config file should be configured. For example, if the logordertype value in Archival Service is configured to 1, then the logordertype value in Archival ONS should be configured to 2. This will download both the Odd and Even Video logs simultaneously. Thus, increasing the performance. VideoFormat .Mp4 Configures format of video. The valid values are: • .Mp4 • .avi 90 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description IsStagingLogServer false Staging Log Server is used to store logs before they are transferred to Database Server. Logs are compressed and stored on this Server. In a few organizations, the size of logs generated per day is higher and users accessing ARCON PAM are of greater volume. The bandwidth falls short for transferring logs to Database Server. In such a scenario, Log Staging Server is used to store logs. These logs are then transferred to Database Server in the configured time interval. The status of the logs can be monitored by hosting on URL. Configurable Values: true or false ARCOSLogFolder X: ARCOS Log source folder \ARCON_Solutions\A RCON_Web\ARCOSU serAccessLogViewer Web\ARCOSLogMana gerServiceLog ARCOSArchivedLogFolder X: ARCOS Log destination folder \ARCON_Solutions\A RCON_Web\ARCOSU serAccessLogViewer Web\ARCOSLogMana gerServiceLog_Archiv ed ARCOSWebDTURL (ARCON https://10.10.2.0/ PAM Web API URL) ARCON PAM Web API URL which is hosted locally. It is recommended to host the API on Database server as it reduces the time required for connectivity. ‘X' denotes the drive where ARCON’s Logs are stored. 4.4.6 ARCOS Log Archiver Service ONS 4.4.6.1 Overview In ARCOS, the Log Archiver Service and Log Archiver Odd Number Series (ONS) service are two different threads that run at the same level and have the same functionality 4.4.6.1.1 Pre-requisites • .net Framework 4.7.2 version needs to be installed. • Install the Log Archiver Service 91 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.4.6.2 Installation For the Installation following steps need to be followed. 1. Right-click on the .msi file ARCOSLogArchiverServiceSetup_ONS.msi, the following options as in the below image will be displayed. Click on Install. 0 2. If the application has never been installed before then the following screen shall appear. Click Next. 0 3. Browse and select the installation path where you want to place the file. Preferably the path as X:\ARCON _Solutions\ARCON_Program_Files\ARCOS Log Archiver Service ONS\ Note: ‘X' denotes the drive where ARCON’s ancillary services will be installed. 4. Select the radio button Everyone (applicable for anyone using this system) or Just me (applicable for the logged-in user) and click Next to confirm the setting. 0 92 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Click Next to confirm the installation. 0 93 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 6. Click Close as the installation has been completed successfully on the system. 0 94 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 7. You can view the service running using the following path: Run → services.msc → ARCOS Log Archiver Service ONS running Copy DB Settings from the ACMO folder to all the installed service folders for services to run/start. 4.4.6.2.1 Log Archiver Service ONS Configuration File Once the service is installed on the system, you need to copy the ARCOSLAConfig.ini (Configurations for which are already set in Log Archiver Service ) file from the following folder X: \ARCON_Solutions\ARCON_Program_Files\ARCOS Log Archiver Service\ to X:\ARCON _Solutions\ARCON_Program_Files\ARCOS Log Archiver Service ONS\ ‘X' denotes the drive where ARCON’s ancillary services will be installed. Listed below is the only configuration value that needs to be changed in the copied ARCOSLAConfig.ini file: 95 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description logordertype 1 Configure the value for log order type. The valid values are: 0, 1, 2. 0: All images are considered for conversion from Image log to Video Log If the value is set to 0 then only one service needs to be installed. If both services are installed, the value needs to be set to either 1 or 2 depending on the values set in ARCOS Log Archiver Service. Failing to do so can lead to a malfunction. 1: Only Odd number images record will be considered for conversion from Image log to Video Log 2: Only Even number images record will be considered for conversion from Image log to Video Log If you want to generate both Odd and Even Video logs, you need to configure ARCOS Log Archiver Service ONS from ARCON PAM Windows Components Installer folder. Post installation of this service the values in config file should be configured. For example, if the logordertype value in Archival Service is configured to 1, then the logordertype value in Archival ONS should be configured to 2. This will download both the Odd and Even Video logs simultaneously. Thus, increasing the performance. 96 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.4.7 ARCOS Log Manager Service 4.4.7.1 Overview ARCOS Log Manager Service configuration allows ARCON PAM to capture images during session recording for any GUI based access taken by the User. The images are transferred to Database Server on a real-time basis. It does not cache anything on the local server and memory, as it sends them to the ARCOS vault server. The ARCOS vault server consists of two databases, ARCOS DB and ARCOS RDP DB. If the images are captured in the form of command logs, they are sent to the ARCOS DB and on the other hand, the video logs are sent to the ARCOS RDP DB. The database cannot store a huge amount of binary files or images because it slows down the performance. Based on the configuration, the ARCOS log manager service copies all the logs from the database and stores them to the physical storage in JPEG format, so that the RDP DB database can always remain light in size depending upon the load. When configuring ARCOS Log Manager Service, make sure that the RDP DB has at least 100 GB of free space, so that even if it grows, one does not have any application performance issue in the backup. 4.4.7.1.1 Pre-requisites .net Framework 4.7.2 version needs to be installed. 4.4.7.2 Installation To install the ARCOS Log Manager Service, follow the steps below: 1. Right-click on the ARCOSLogManagerServiceSetup.msi file and click Install. 2. Click on the Next button in the ARCOS Log Manager Service Setup Wizard screen to process the setup. 97 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. Click on the Browse button to select the installation folder. Select the radio button Everyone (applicable for anyone using this system) or Just me (applicable for the logged-in user) and then click on the Next button to confirm the setting. • Recommended folder path - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Log Manager • Here ‘X' denotes the drive where ARCON’s ancillary services will be installed. 98 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4. Click on the Next button to start the installation. 99 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Click on the Close button as the installation has been completed successfully on the system. 100 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 6. You can view the service running using the following path: Run → services.msc → ARCOS Log Manager Service Copy DB Settings from ACMO folder to all installed service folders for services to run/start. 4.4.7.2.1 Configuring the ARCOS Log Manager Service Below listed are the ARCOS Log Manager Service Configuration names & values for the logordertype.ini and watermark.ini. logordertype.ini and watermark.ini files are located at - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Log Manager Service\ (this path is the installation path which is selected in step 3). 101 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Set the configurations in the logordertype.ini file referring to the following table: 102 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description logordertype 0 This config is used to set the session ids to be recorded. Configurable values: 0/1/2 • 0 - Normal records, will record all the session ids • 1 - Odd records, will record all the odd session ids • 2 - Even records, will record all the even session ids Only configure if Log Manager ONS is installed. Set the configurations in the watermark.ini file referring to the following table: Config Name Config Value Description _bolIsWaterMarkEnabled true This config is used to Enable or Disable Watermark in Video. To enable Watermark, configure the value to True. Configurable value : true/false _waterMarkText Client Name or ARCON Enter the Text to be displayed in Watermark _waterMarkFontName arial Font Name for Watermark _waterMarkFontColor White Font Color for Watermark _waterMarkFontSize(if 20 _bolIsTextOutlineForWaterMarkE nabled is true recommended size=20) Font Size for Watermark _debuglog If the value is set to false, it will not generate the debug logs. If the value is true it will generate the debug logs. false Configurable value : true/false _bolIsTextOutlineForWaterMarkE true nabled = true or false This config will enable/disable outline for the value of the _waterMarkText config and the timestamp Configurable value : true/false 103 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4.4.8 ARCOS Log Manager Service ONS 4.4.8.1 Overview In ARCOS, the ARCOS Log Manager Service and ARCOS Log Manager Odd Number Series (ONS) service are two different threads that run at the same level and have the same functionality. In the ARCOS Log Manager ONS service, the default value for the log order type is set to 1. If both the services are installed, one has to configure the value for the ARCOS Log Manager Service as 2 and the value for the Log Manager ONS service as 1. It means selecting even and odd services. The ARCOS Log Manager Service selects only even records and the Log Manager ONS service selects only odd number series. At the same time, a given archiving process gets doubled. 4.4.8.1.1 Pre-requisites • .net Framework 4.7.2 version needs to be installed • Install ARCOS Log Manager Service 4.4.8.2 Installation To install the ARCOS Log Manager Service ONS, follow the steps below: 1. Right-click on the ARCOSLogManagerServiceONSSetup.msi file and click Install. 2. Click on the Next button in the ARCOS Log Manager Service ONS Setup Wizard screen to process the setup. 104 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. Click on the Browse button to select the installation folder. Select the radio button Everyone (applicable for anyone using this system) or Just me (applicable for the logged-in user) and then click on the Next button to confirm the setting. • Recommended folder path - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Log Manager Service ONS\ • Here ‘X' denotes the drive where ARCON’s ancillary services will be installed. 105 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4. Click on the Next button to start the installation. 106 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 107 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Click on the Close button as the installation has been completed successfully on the system. 6. You can view the service running using the following path: Run → services.msc → ARCOS Log Manager Service Copy DB Settings from ACMO folder to all installed service folders for services to run/start. 4.4.8.2.1 Configuring the ARCOS Log Manager Service ONS Below listed are the ARCOS Log Manager Service ONS Configuration names & values for the logordertype.ini and watermark.ini. logordertype.ini and watermark.ini files are located at - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Log Manager Service ONS\ (this path is the installation path which is selected in step 3). 108 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Set the configurations in the logordertype.ini file referring to the following table: 109 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description logordertype 1 This config is used to set the session ids to be recorded. Configurable values: 0/1/2 • 0 - Normal records, will record all the session ids • 1 - Odd records, will record all the odd session ids • 2 - Even records, will record all the even session ids Only configure if Log Manager ONS is installed. Set the configurations in the watermark.ini file referring to the following table: Config Name Config Value Description _bolIsWaterMarkEnabled true This config is used to Enable or Disable Watermark in Video. To enable Watermark, configure the value to True. Configurable value : true/false _waterMarkText Client Name or ARCON Enter the Text to be displayed in Watermark _waterMarkFontName arial Font Name for Watermark _waterMarkFontColor White Font Color for Watermark _waterMarkFontSize(if 20 _bolIsTextOutlineForWaterMarkE nabled is true recommended size=20) Font Size for Watermark _debuglog If the value is set to false, it will not generate the debug logs. If the value is true it will generate the debug logs. false Configurable value : true/false 110 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config Value Description _bolIsTextOutlineForWaterMarkE true nabled = true or false This config will enable/disable outline for the config value of the _waterMarkText and the timestamp Configurable value : true/false 4.4.9 ARCOS Scheduled Password Change Service 4.4.9.1 Overview The automatic password change process is performed by a Scheduled Password Change (SPC) service. This service allows the administrator to change the passwords of the target device on the scheduled date every month automatically. Based on the LOB/Profile Default Configuration configured in ARCOS, the automatic password change refers to the password change policy. It fulfills basic requirements of compliance such as the number of upper case and lower case characters in the password, the length of the password, special characters used in the password, and so on. Based on the organization’s policy and compliance requirements, one can configure the type of passwords that ARCOS should generate and update them on the devices. Henceforth, we will call the Schedule Password Change as SPC service. 4.4.9.1.1 Pre-requisites .net Framework 4.7.2 needs to be installed on the server. The server should be restarted post .net installation. 4.4.9.2 Installation For the installation the following steps need to be followed: 1. Right-click on the .msi file ARCOSSPCServiceSetup.msi, the following options as in the below image will be displayed. 2. If the application has never been installed before then the following screen shall appear. Click Next. 111 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. Browse and select the installation path where you want to place the file. • Recommended path - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Password Change Service\ • ‘X' denotes the drive where ARCON’s ancillary services will be installed Scheduled 4. Select the radio button Everyone (applicable for anyone using this system) or Just me (applicable for the logged-in user) and click Next to confirm the setting. 112 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Click Next to confirm the installation. 113 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 6. Click Close as the installation has been completed successfully on the system. Copy DB Settings from the ACMO folder to all the installed service folders for services to start and then run. Below listed are the Scheduled Password Change Configuration names & values for the spcconfig.ini. 114 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 The spcconfig.ini file is located at - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Scheduled Password Change Service\ (this path is the installation path which is selected in step 3) Config Name Config value Description Service Interval 60000 This config is used for restarting the SPC service after a particular time interval ( in milliseconds) 115 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 MaxPwdAgeRange 23 This config is used for the password change process of those services whose max password age is less than 1 day. For services whose max password age is greater than 1 day→Config value is set to 0 It is configured based on equation(24*Max password age of the service) - config value IsUserNameAfterPassword false This config is used for appending username after password (used for password change process of linux domain id’s) Configurable value : true/false WindowsPWDChangeServicePort 45045 Mandatory windows password change port number UserGatewayServerForPWDChange true Set this value as 'true' to change the password through gateway server IsUseReplaceKeywordInPasswordCh true ange This config is used for the password change process in database services where the “replace” keyword is used in the password change command. Configurable value : true/false SSH connection timeout 60 This config is used to set timeout for ssh connection.(in seconds) IsEnforceSUSEForPWDChange false Override password change tags through suse. Configurable value : true/false IsEnforceToRestartService false Allow self restart of service Configurable value : true/false RestartServiceIntervalInDays 1 Restart service after 'n' configured days RestartServiceByTime 2 Restart service after ’n' configured hrs 116 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 IsServiceOutsideCluster false This config is used for indicating if service is present in windows cluster. Configurable value : true/false SPCDependentOn ARCOS Alert Service NewSecureGatewayWithLatestCiphe true rs Name of windows service on which SPC is dependent on. This config is used for checking ciphers while connection to gateway server. Configurable value : true/false StartEndTime 00:00~00:00 This config is used for setting the time for the password change process by SPC service. Eg- 00:00~06:00 The above config would allow password change from 00:00 hrs to 06:00 hrs. DefaultLOB →NA for All LOB →LOB/LOB names (comma separated) This config is used for allowing SPC to run for all /particular LOB Configurable value : NA for All LOB Configurable value : LOB/LOB’s name (comma separated) ShowDebugLogs true This config is used for allowing SPC to store logs in event viewer. Configurable value : true/false StartEndDate Eg- 1~31 This config is used for setting the date for the password change process by SPC. Eg- 1~15 The above config would allow password change from 1st day of month to 15th day of month. ServiceName ARCON SPC Service Installed Service Name should be same 4.4.10 ARCOS Viewed Password Change Service 4.4.10.1 Overview ARCOS Viewed Password Change (VPC) Service allow you to view the password of any services configured in ARCON PAM. Once the password is viewed by the VPC service, the Scheduled Password Change (SPC) service will rotate the password as configured in the VPC when viewing the password. Once the password has been 117 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 viewed and the set time (Password Open till) is over the password will get vaulted. Henceforth, we will call the Viewed Password Change as VPC service. 4.4.10.1.1 Pre-requisites .net Framework 4.7.2 needs to be installed on the server. The server should be restarted post .net installation. 4.4.10.2 Installation For the installation the following steps need to be followed: 1. Right-click on the ARCOSViewedPasswordServiceSetup.msi file, the following options as in the below image will be displayed. 2. If the application has never been installed before then the following screen shall appear. Click on the Next button. 3. Browse and select the installation path where you want to place the file. • Recommended path - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Viewed Password Change Service\ 118 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 • ‘X' denotes the drive where ARCON’s ancillary services will be installed 4. Select the radio button Everyone (applicable for anyone using this system) or Just me (applicable for the logged-in user) and then click on the Next button to confirm the setting. 5. Click on the Next button to confirm the installation. 119 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 6. Click on the Close button as the installation has been completed successfully on the system. Copy DB Settings from ACMO folder to all installed service folders for services to run/start. 4.4.10.2.1 Configuring the ARCOS Viewed Password Change Service Below listed are the Viewed Password Change Configuration names & values for the spcconfig.ini. 120 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 The spcconfig.ini file is located at - X:\ARCON_Solutions\ARCON_Program_Files\ARCOS Viewed Password Change Service\ (this path is the installation path which is selected in step 3) 121 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 Config Name Config value Description Service Interval 60000 This config is used for restarting the VPC service after a particular time interval (in milliseconds) MaxPwdAgeRange 23 This config is used for the password change process of those services whose max password age is less than 1 day. For services whose max password age is greater than 1 day→Config value is set to 0 It is configured based on equation(24*Max password age of the service) config value IsUserNameAfterPassword false This config is used for appending username after password (used for password change process of linux domain id’s) Configurable value : true/false UserGatewayServerForPWDChange true Set this value as 'true' to change the password through gateway server WindowsPWDChangeServicePort 45045 Mandatory windows password change port number IsUseReplaceKeywordInPasswordChange true This config is used for the password change process in database services where the “replace” keyword is used in the password change command. Configurable value : true/false SSH connection timeout 60 This config is used to set timeout for ssh connection.(in seconds) IsEnforceSUSEForPWDChange false Override password change tags through suse. Configurable value : true/false IsEnforceToRestartService false Allow self restart of service Configurable value : true/false RestartServiceIntervalInDays 1 Restart service after 'n' configured days RestartServiceByTime 2 Restart service after ’n' configured hrs IsServiceOutsideCluster false This config is used for indicating if service is present in windows cluster. Configurable value : true/false 122 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 VPCDependentOn ARCOS Alert Service Name of windows service on which VPC is dependent on. NewSecureGatewayWithLatestCiphers true This config is used for checking ciphers while connection to gateway server. Configurable value : true/false StartEndTime 00:00~00:00 This config is used for setting the time for the password change process by VPC service. Eg- 00:00~06:00 The above config would allow password change from 00:00 hrs to 06:00 hrs. DefaultLOB →NA for All LOB →LOB/LOB names (comma separated) This config is used for allowing VPC to run for all /particular LOB Configurable value : NA for All LOB Configurable value : LOB/LOB’s name (comma separated) ShowDebugLogs true This config is used for allowing VPC to store logs in event viewer. Configurable value : true/false StartEndDate Eg- 1~31 This config is used for setting the date for the password change process by VPC. Eg- 1~15 The above config would allow password change from 1st day of month to 15th day of month. ServiceName ARCON VPC Service Installed Service Name should be same 4.5 Broker 4.5.1 Secure Gateway SSH provides a secure channel over an unsecured network in a client-server architecture, connecting an SSH client application with an SSH server. Common applications include remote command-line login and remote command execution, but any network service can be secured with SSH. This document describes configuring and mapping a secured gateway with UNIX/Linux Server. 4.5.1.1 Secure Gateway Server Configuration This section helps you to configure the Secure Gateway Server. ARCON PAM uses SSH Tunneling (Port Forwarding) for routing its connection via end machines. The target server ports are not opened directly from end-user machines hence SSH Tunneling feature is used to route the connections. To configure such connections AllowTcpforwarding should be enabled and UseDNS should be disabled and the sshd_config file. 123 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 AllowTcpForwarding Port forwarding allows you to forward a port on the local (SSH client) machine to a port on the remote (SSH server) machine, which is then forwarded to a port on the destination machine. In this forwarding type, the SSH client listens on a given port and tunnels any connection to that port to the specified port on the remote SSH server, which then connects to a port on the destination machine. The destination machine can be the remote SSH server or any other machine. UseDNS This change is an extension to support the above TCP Forwarding configuration. In an ideal scenario, this value is "Yes" because it specifies whether sshd should look up the remote hostname and check that the resolved hostname for the remote IP address maps back to the very same IP address. The default value for the UseDNS option changed from "yes" to "no". With this change, sshd no longer converts a client's IP address back into a hostname. This prevents the use of hostnames during forward via the Secure Gateway Server and the host match blocks in the configuration file. Use the following steps to configure the Secure Gateway Server: 1. Login to ARCON PAM Secured Server with root or (root equivalent) access: 2. Using VI editor, open sshd_config file through path /etc/ssh/: 124 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. The default value for AllowTcpforwarding is “No”. Change the value to “Yes” (# is commented, to uncomment the same remove the #): 4. Use DNS value should be “no”: 125 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Save the file using the command ZZ or : wq: 6. Add arcossshadmin user by using the below command setting a complex password. This user account will be used as ARCON PAM Gateway Server user under ARCON PAM. 126 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 7. The user will be created and updated. 4.5.1.1.1 Secure Gateway Server Configuration in Server Manager VPN Servers are Secure Gateway Servers (SGS) for ARCON PAM. If VPN Server is configured in ARCON PAM, the connection is invoked from the user’s workstation to SGS and then from SGS to the target server/devices, or else the connection is established directly from the user's machine to the Target Device. The connection to SGS server is always on the secured port. Use the following steps to configure VPN Servers: 1. Login to ARCON PAM Server Manager. 127 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 2. From the Tools menu select Advanced Configuration. 3. Select Default Configuration and then click on VPN Servers. The following screen will be displayed: 4. Enter the required details and click on Create button to configure VPN Server. Click Modify to edit the existing configuration. Select Is Active checkbox to enable the configuration. 4.5.1.1.2 Secure Gateway Mapping with LOB/Profile You can map different LOBs to a particular VPN Server using LOB/Profile - VPN Server Details. Use the following steps to map LOBs to VPN Server: 1. 2. 3. 4. Login to ARCON PAM Server Manager. From the Tools menu select Advanced Configuration. Select LOB/Profile Default Configuration. Select LOB/Profile - VPN Server Details tab. The following screen will be displayed: 128 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5. Select LOB / Profile and VPN Server from the dropdown list and click on Assign. 6. The connection to the target server/devices under the selected LOB will be invoked through VPN Server. 4.5.1.1.3 Port Requirements Source Device Destination Device Port Protocol Description Unidirecti onal / Bidir ectional End User Gateway Server 22 SSH Port Secure Gateway Server (SGS) Unidirecti onal Gateway Server Target Application Target Application Ports HTTPs / SSH / Database / Application Port / etc. Port of access of target services Unidirecti onal 4.5.1.1.4 Security and Cipher Following ciphers are used by the ARCON PAM application for establishing the tunnel hence required to be enabled on the gateway servers and target services: KexAlgorithms: ecdh-sha2-nistp521, ecdh-sha2-nistp384, ecdh-sha2-nistp256, diffie-hellman-group-exchange-sha256 MACs: 129 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 hmac-sha2-512, hmac-sha2-256, hmac-ripemd160 Ciphers: aes256-ctr, aes192-ctr, aes128-ctr 4.5.2 RDP Proxy 4.5.2.1 Overview End-user can open a Remote Desktop Protocol (RDP) client and enter the proxy IP Address and credentials for PAM (username, password). End-user will be able to view the RDP service assigned and take a session through the proxy. The connection is routed through a proxy, session monitoring, and logs are available in the PAM vault. 4.5.2.1.1 Accessing the RDP Services To access the RDP nodes, follow the below steps: 1. Open any RDP Client, for example, Microsoft RDP Client/Microsoft Remote Desktop to login to the ARCON PAM RDP Proxy Console. 2. Enter the target server IP Address and ARCON Authentication details like username and password. If the Authentication details are not available, enter the proxy IP Address and proceed from step 4. • The RDP Proxy will use the ARCON Authentication details provided by the user • If the connection is assigned to him, RDP Proxy will connect to the target device and it will proxy back to machine. 130 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 3. Click on Connect to connect the assigned connection. If the user doesn’t enter the ARCON Authentication details like ARCON Username and ARCON Password, then ARCON RDP Proxy will flash the user to enter the details on RDP Proxy Login Screen. 131 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 4. Enter the Username and Password to ARCON RDP Proxy login. 5. Click on Login. 6. Select the required service and click on Connect. 132 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 • The user will be connected to the target server via RDP Proxy. • Entire user session will be recorded and logs will be available in ARCON PAM vault. 133 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 5 LOB or Profile Master In ARCON PAM user are of two types’ domain user and local user. The domain users are present in the active directory and are authenticated using active directory whereas the local users are present locally. The login credentials are authenticated according to the domain name specified during the login process. The LOB’s are created and fetched according to the domain name. Once the LOBs are created ARCON PAM application follows a maker-checker principle for authorization. The maker-checker principle is used for each request made by the user, for this feature there should be at least two Administrator which are necessary for its confirmation / authorization. While one Administrator may create a user, the other Administrator would be involved in confirmation/authorization of the same. Once the users are created services are added for the users. A service is an instance of a server, assume there are 4 users on a windows server such as Administrator, SYS, TEST, and UAT. Now, each user will have a unique service. This will help Administrator to have a proper control over the service which is mapped to a particular user. Due to this Administrator ID can get user wise audit trail for each action which are performed under ARCON PAM. As the Administrators are responsible for managing services they should be assigned Add Service privilege to create, delete or update a service. After creating the services the Administrator should create user group and server group; map user group to users and server group to services. After the above process the server group are mapped to user group. For mapping the Administrator should be assigned Assign Service Group To User Group privilege to perform group mapping. The services are then mapped to users. The connections to the users are established in Map Users / Services screen. The Administrator should be assigned Assign Service To User privilege to map services to user. The services are assigned to a user based on the services available in the server group, where the users are a part of the user group. To assign an existing or newly created services to single or multiple users map services to multiple users. In addition, this allows Administrator to restrict commands for the user. The next step is to map the user to LOB, map user groups to particular LOB. When LOB is assigned to User Group, the users available under User Group can be mapped to services assigned to that LOB. To assign LOB to User Group, the Administrator should have Assign LOB To User Group privilege. Next map service to LOB to assign LOB to Service, the Administrator should have Assign LOB To Service privilege. Next map a service group(s) to a particular LOB. When LOB is assigned to Service Group, the service available under Service Group can be mapped to users of that LOB. To assign LOB to Service Group, the Administrator should have Assign LOB To Service Group privilege. The Administrator can create multiple LOBs and map those LOBs. 134 Installation and Configuration Guide | Version 4.8.5.0_U16 SP2 For more detail about the process refer the ARCON PAM Administrative guide. 135 No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means such as electronic, mechanical, photocopying, recording, or otherwise without permission.
