Thycotic Secret Server Intermediate Knowledges

This post summarizes some Thycotic SS knowledges which considered as intermediate level.

Launchers

Launcher Setup:

• Variety of options depending on needs

Chrome Extension
Web password filler
Protocol Handler

• Protocol Handler

Pings Secret Server on interval to ensure sessions is valid
Kills Session if check fails or callback times out

• Prompted at the first Launch

Launchers Types:

• Default Launchers

RDP
PUTTY
Web Password Filler/Launcher
Powershell
SQL Server
Sybase isql (SAP SQL Anywhere)
IBM z/os
IBM i-Series

• Custom Launchers

Process
Proxied SSH
Batch File

• Launchers can be configured with Secret Templates

Proxy

Proxy Benefits

• Without a Proxy

Session is established from client to the target
Credentials sent from Secret Server to the client
Possible to dump memory and compromise the credentials

• With a Proxy

Session is established from Secret Server to the target
Credentials never transmitted to the client

Proxy Type

SSH Proxy
RDP Proxy
SSH Proxy Tunnel local RDP Session to remote server (Note recommended way since credential will be sent to client machine)

Troubleshooting Tips

Verify Remote Certificates are both Valid and Trusted
Check Firewall Ports – RDP Proxy default port is 3360, The Distributed Engine or Web Node default Port is 3389.
Credential on % Secret can be viewed by selecting More/Show Proxy Credentials and then choosing the Launcher
Verify the Latest Version of .NET framework is installed.

Discovery

Discovery finds Secrets in an IT environment and brings them into Secret Server

Secret Server is most effective when it covers all privileged accounts
Discovery helps to eliminate – Unknown Privileged Accounts, Backdoor Access and Gaps in Security
Auditors want automated processes to reduce human errors

Secret Server Discovery Out-Of-Box vs Custom

Out-of-Box

Active Directory
Unix/Linux local accounts
Hypervisor ESXi accounts
Amazon Web Services
Google Cloud Platform

Custom (Extensible)

ANYTHING -Leverages PowerShell scripts
SQL Accounts & Database links
Networking equipment
Embedded passwords

Extensible Discovery Overview

Extends Secret Server’s Discovery capabilities
Built-in and/or Custom Scanners
Discovery Process Scans:

Host Range Discovery
Machine Discovery
Local Account Discovery
Dependency Discovery

Not required to use Discovery in Secret Server but needed for most environments

Why Use Extensible Discovery?

Discover configuration files containing passwords
Scan computers not joined to the domain
Dependencies that run a SQL, SSH, or PowerShell script
Bring information back to custom fields in a Secret Template
Discover SQL Server logins as “Local Accounts”

Remote Password Changing

Remote Password Changing Summary

Enable Globally:

Remote Password Changing
Heartbeat

Password Changers:

Review built-in Changers
Create Custom
Test Actions

Secret Template:

Configure Expiration
Configure Template RPC and Heartbeat Settings

Secret or Secret Policy:

On-Demand
Auto-Change
Auto-Change Schedule

Dependency

If there are different dependency types that you want to manage that are not supported out of the box, new ones can be created based on a script. A custom dependency consists of two components:

Dependency Template: The dependency template defines how a dependency is matched to discovered accounts and how it updates the target after a password change occurs on the account. to create a new dependency template, go to Admin > Secret Templates and click the Dependency Templates button.
Dependency Changer: A dependency changer is a script and the associated parameters to be passed into the script. Dependency changers can be created and modified by going to Admin > Remote Password Changing > Configure Dependency Changers.

PowerShell, SSH, and SQL dependencies can have script arguments that derive their values from values on the dependency, the secret it belongs to, or any other secrets associated for remote password changing. Starting with Secret Server 10.0, tokens can also be used in ODBC connection string arguments. Script arguments are defined on dependency changers in Secret Server 10.0 and above and on the dependency in earlier versions of Secret Server.

Workflow

Secret Workflow Summary

Require Comment:

Justification that extends audit
Ticket Integration Optional

Request Access/Require Approval:

One-Step
Multi-Step (New IJI Only)
Enforces Tme and Approval
Ticket Integration Optional

Check-Out:

Enforces Sole Access
Enforces Tme
Enforces Rotation (Optional)
Hooks (Optional) — SSH, SQL, or PowerShell scripts that perform actions at check-out and/or check-in

Doublelock:

Additional Encryption
For your most sensitive Secrets
Cannot be exported or use RPC
Requires Doublelock Password

Event Pipelines

Overview of Event Pipelines:

Are created in Secret Server then assigned to
an Event Pipeline Policy
Can be in multiple EP Policies
Do nothing if not assigned to an EP Policy
Policies can target Folders or Secret Policies
Have no effect if it has no target (Folder or Policy)

Event Pipelines Filters:

Parameters that limit when an EP runs
Have settings and can be added to multiple times

Filter Examples:

Custom Variable
Group
Policy on a Secret
Role
Role Permission
Secret Access Role Permission
Secret Field
Secret has Field
Secret has RPC enabled
Secret Name
Secret Setting
Secret Template
Site

Event Pipelines Targets:

Folders — Secrets inside folders

Not recursive — only the secrets directly in the folder can trigger EP

Secret Policies (SP) — Secrets leveraging a specific SP

Event Pipelines Tasks:

Actions which are triggered in ap EP — over 30 built in
EP targets are NOT the receiveß of task actions — receivers are usually components of Secret Server
Event variable are used in EP tasks — Secret Field Tokens, Event Settings Tokens, Secret Setting Tokens, and some additional tokens
Example Tasks:

Change password remotely
Delete
Change Secret to require workflow
Etc.

Auditing

Introduction — Data Retention Policies

Automatically delete older audit and audit-like information
Two-data retention policies:

Personally Identifiable Information (PII)
Database Size Management

All records in each table older than the set max record age will be deleted from the database

Alerting and SIEM Integration

Per Secret Alertieg

Set on the Secret
Set for the Individual User

Per User Alerting

Set per User
Set for all Secrets they have Access to

Event Subscriptions

Customizable alerts throughout Secret Server
E-Mail Notifications

SIEM Integration

Correlation with events outside of Secret Server

Session Recording and Connector

Records Launched Sessions

Works with all Launchers Including

• Remote Desktop

• Putty SSH

• Microsoft SQL Management Studio

• Custom Launchers

Session Recording is Available

• From the Secret Audit

• Under Admin -> Session Monitoring

Can be Enabled

• Per Secret

• By Secret Policy

Secret Server Session Connector Introduction

• Clientless session recording

• Launchers session through Microsoft remote desktop services (RDS)

Requires setup and configuration of MS RDS server
Requires Thycotic components installed on MS RDS Server
Provides an additional launcher type ” Session Connector Launcher”

• No need for Connection Manager or Protocol Handler on endpoint

• Target server credentials are never sent to user’s endpoint

from Blogger http://blog.51sec.org/2021/06/thycotic-secret-server-intermediate.html

ByJon