centrifying: What's new on Centrify Server Suite 2017

What's new on Server Suite 2017

Kerberos

Kerberos Library Upgrade: In this release, Kerberos libraries have been upgraded to MIT 5-1.14.1.
Flexible Authentication Secure Tunneling (FAST): Also known as Kerberos armoring, secures pre-authentication traffic and protects KDCs from error spoofing.
This upgrade allows support for Smart Cards using AES-256 encryption. Centrify has tested with Oberthur ID One 128 v5.5 Dual SHA256 and G&D FIPS 201 SCE 3.2 SHA256 Cards.

Flexible open-source packaging

Centrify DirectControl has leveraged OSS packages (OpenLDAP, cURL and OpenSSL); in versions prior to 2017 updating these packages required a re-spin of the whole suite (in all supported platforms)
Starting with CSS 2017 (DirectControl 5.4) the packages for cURL, OpenSSL and OpenLDAP are independent and can be separately updated, this will allow for faster response to any CVEs that apply to those components.

Security

Implemented transaction control for LRPC2, this provides security improvements over heavy load. Requires that both DirectControl and DirectAudit are upgraded.
MFA: Since Centrify Identity Service version 16.10 the IWA negotiations happen over SSL. This means that either Enterprise CA, Public CA or IWA root certificate trust must be established for Centrify Multi-factor Authentication to be successful.

Centrify Report Services

New Operation Mode (zone mode): The first release of report services works in "domain mode" this means that the "Replicating Directory Changes" delegation was required. Now in this mode, only delegations at the zones container is needed, keeping the scope of the information sent to report services only to Centrify data.
Report options: include the ability not to generate charts as well as reports for local users.

Centrify-enhanced OpenSSH

SSHv1 is no longer supported.
AIX: The LAM version of Centrify-enhanced OpenSSH is no longer shipped. This is because supported versions of AIX ship with PAM enabled.

Introducing Centrify Licensing Service

Customers are asking to provide more efficient and proactive licence capacity and usage and many are asking for elastic licensing to support public cloud workloads.
Centrify Licensing Service (v1) targets perpetual licensing and provides mechanisms for streamlined capacity, inventory and notification.
CLS requires a highly-available Windows server that runs the licensing service (this does not have to be a dedicated server)

LDAP Proxy performance enhancements

The LDAP Proxy now implements new caching mechanisms (at the server auth and client) that can result in performance increases.

Centrify Agent for Windows™

MFA: Supported at login (console, RDP, screensaver unlock) in two modes: zone mode and zoneless mode. Zoneless mode requires a Centrify Identity Service device license.
Support for both MFA at login and with privilege elevation (desktop, applications) is exclusive to zone mode (requires Standard Edition license)
Just like UNIX/Linux MFA, requires IWA over SSL, this means that Enterprise, Public or IWA root cert trust must be planned and implemented.

DirectAudit Enhancements

Compiled with libaudit support (system call monitoring at the Kernel level) on RHEL and derivatives (more platforms coming in the next releases)
DirectAudit is now able to monitor file changes on /etc/, /var/centrifydc and /var/centrifyda
DirectAudit is now able to audit commands run inside scripts
DirectAudit is now able to monitor for specific command executions.

Platform Support
Platforms Added

Platforms Removed

Component Version Upgrades

Sections