Centrify and Active Directory Functional Upgrades

This article was written originally for the Centrify Community.

What are Active Directory Functional Levels?
When Microsoft introduces new versions of Windows Server, they may add new capabilities to Active Directory. These new capabilities impact the environment and require planning, the “functional levels” can be introduced by the organization as they become ready. There are two types of functional level upgrade: domain and forest; the scope of forest functional levels affect the whole subtree, and domain-level changes only affect the target domain. A very common misconception is that all features are enabled. A functional upgrade may make a new capability or schema objects available, but it does not mean that your organization is ready or will use those capabilities.

Why should I know this, I only deal with UNIX | Linux | Mac OS X and upper-layer apps (Apache, Java, SAP, DB2)?
When your organization committed to use Active Directory on non-Windows platforms, they gained efficiencies and improved security capabilities, however, AD becomes an integral piece of infrastructure just like power, cooling, switching/routing, etc. All systems relying on AD must be aware of “functional-level” major changes.

What will be the impact to my UNIX, Linux or Mac systems when the Functional level goes up?
The answer to this question really depends on how well you manage your environment.
The rule of thumb is this. If you deployed Centrify in your UNIX, Linux or Mac environment a few years ago and time constraints have kept you from maintaining it (or because it just works), you’ll have a tougher time. If you’ve been keeping-up with the software lifecycle (upgrades) and are listening-in your AD planning calls; you may be so ready that your impact could be close to nothing.
To level-set here, this is not a “Centrify-only” consideration; this affects software and hardware that integrates to Active Directory. This article is to deep-dive into Centrify Server Suite and Identity Service Mac Edition (on-premises client).

You caught my interest. Can you tell me more about Active Directory functional levels?
The best source of information is this Microsoft TechNet article: https://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx. If you want to be better informed, see the reading list below.

What happens when I raise the Domain Functional Level as it relates to Centrify?
The answer depends on what your current functional level is and what functional you're raising it to.
Let’s focus on 3-key aspects of going from DFL 2003 and DFL 2012 (conveniently how I set up my lab :smileyhappy:).

Kerberos
Centrify DirectControl (centrifydc/adclient), just like any other Active Directory client, uses Kerberos as the authentication protocol. In Kerberos session tickets encrypted using cyphers (algorithms).
As time goes both computers have more power and mathematicians grow smarter or find issues with existing algorithm. A very good example is the Data Encryption Standard (DES), it has been around since the 70s and it was broken in the late 90s; therefore DES became phased out by AES officially in 2002.
One of the changes introduced by a DFL is better encryption algorithms.

• Raising the DFL to Windows Server 2008 implements AES 128 and AES 256 for Kerberos.

This is why Microsoft's first guidance is to perform an inventory of your AD real estate. When this change happened, many older systems could not authenticate as illustrated in this example. In some instances, even a non-DFL change like adding a “newer OS” to perform the domain controller role can introduce side effects. For example, introducing a Windows Server 2012 Domain Controller to a Windows 2003 DFL Domain will immediately will disallow older crypto algorithms.

Summary – stronger cryptography is good, however, raising the DFL to Windows 2012 OR introducing a Windows 2012 domain controller in a 2003 forest requires at a minimum Server Suite 2014.1 (5.2.x).

KRBTGT Password Change
Active Directory has a built-in account called “krbtgt” (Kerberos TGT). This account has a complex password that is only known to low-level services; However, this is a very important account because every Ticket Granting Ticket (TGT) generated by users and computers is encrypted with a key that is derived from this password. As you probably can infer from the previous topic, once you switch the cypher, the secret is updated as well.

• Raising the DFL will change the password of the KRBTGT account; this makes older secrets invalid.

Microsoft, as part of their strategy to mitigate advanced attacks like Pass-the-Hash (PtH) and others has established new best practices around the krbtgt account, but that’s the topic for another post.

Summary: When using stronger crypto, the passwords for the krbtgt will change.

SID Compression
The Windows Security Identifier (SID) is the unique and immutable identifier for an AD principal (user, group, etc.). Microsoft Kerberos implements methods that use the Privilege Attribute Certificate (PAC), in an over-simplistic way, the PAC contains information about the group membership and authorization information for the corresponding security principal.
Active Directory clients often need to make decisions about access control with information contained in the PAC; however when principals belong to large numbers of groups the information can't fit inside the data structure and that's why SID compression was implemented. Within Centrify Server Suite, this is very important especially in the context of Zones and DirectAuthorize.

• Windows 2012 Domain Controllers implement SID compression and is turned on by default.  If an AD client can't decompress the SID to view the PAC, it will have functionality issues.

This has caused many known issues, however there's flexibility given that you can disable SID compression at the object  level or at the DC level.

Summary: SID compression is enabled on Windows 2012 DCs.  This is important for group enumeration and authorization.

Now you made me worried, What should I do?
 No need to be worried, there are plenty of resources available (see the reading list below); I think that by reading this article you should be informed and dangerous enough, however my advice is this:

• Keep your agents up-to-date.
  This can be painful, but if you’re within the 3-year software life-cycle (for standard support, 5 years for premium), you should be fine. Keep in mind, you have to also be realistic. For example, Windows 2012 R2 was released in October of 2014 and Server Suite 2014.1 was released in August. In that case Centrify was ahead of the ball if organizations were looking to deploy that version of the software. In some instances we are behind and provide functionality based on the needs of our customer base.
• Maintain your consoles and utilities up-to-date
  Consoles and PowerShell commandlets are backwards compatible. Tools like Deployment Report can be great tools to inventory clients.
• Familiarize yourself with Microsoft’s methodology
  The methodology is outlined here: http://blogs.technet.com/b/askpfeplat/archive/2013/04/29/upgrading-or-migrating-active-directory-to-windows-server-2012-build-your-roadmap-now.aspx
  If you are working closely with your AD team, in the Assess phase you should be providing an inventory of all your Centrify clients and inform them if the version installed will support these key things: AES Encryption, KRBTGT password changes and SID Compression.
• Document  any exceptions
  You should also inventory if you have hardcoded certain parameters like adclient.krb5.permitted.encryption.types. Ideally you should let DCs negotiate with the client, they typically go for the maximum (AES256).

Any tools, tips or tricks to share?
You can use Centrify CLI tools, Consoles and Utilities to discover, diagnose and collect information for your Functional Upgrade project.  Here are some examples:

Determining the Centrify version (per system - see below for inventory)

$ adinfo -v
adinfo (CentrifyDC 5.2.3-429)

Determining the forest and domain functional levels (per forest/domain)

$ adinfo --diag | grep Functionality
    domainFunctionality:           5 = (DS_BEHAVIOR_WINSERVER_2012)
    forestFunctionality:           5 = (DS_BEHAVIOR_WINSERVER_2012)
    domainControllerFunctionality: 6
    domainFunctionality:           5 = (DS_BEHAVIOR_WINSERVER_2012)
    forestFunctionality:           5 = (DS_BEHAVIOR_WINSERVER_2012)
    domainControllerFunctionality: 6

Determining if the encryption types have been changed (per client exception)

$ grep encryption.types /etc/centrifydc/centrifydc.conf
# adclient.krb5.tkt.encryption.types: aes256-cts aes128-cts arcfour-hmac-md5 des-cbc-md5 des-cbc-crc
# * the default encryption types permitted for Windows 2000 server and
#   adclient.krb5.permitted.encryption.types: arcfour-hmac-md5 des-cbc-md5 des-cbc-crc
# * the default encryption types permitted for Windows Server 2008 domain
#   adclient.krb5.permitted.encryption.types: aes256-cts aes128-cts arcfour-hmac-md5 des-cbc-md5 des-cbc-crc

Determining the Kerberos system key table (keytab) encryption (per agent)

$ dzdo /usr/share/centrifydc/kerberos/bin/klist -ke /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   7 nfs/engcen6.centrify.vms@CENTRIFY.VMS (AES-256 CTS mode with 96-bit SHA-1 HMAC)
   7 nfs/engcen6.centrify.vms@CENTRIFY.VMS (AES-128 CTS mode with 96-bit SHA-1 HMAC)
   7 nfs/engcen6.centrify.vms@CENTRIFY.VMS (ArcFour with HMAC/md5)
[output truncated] 

For each ServicePrincipalName (SPN) you should see an AES256 entry for DFL 2008 and above.

Determining if the encryption type on the system's ticket cache

$ dzdo /usr/share/centrifydc/kerberos/bin/klist -fe /etc/krb5.ccache
Ticket cache: FILE:/etc/krb5.ccache
Default principal: engcen6$@CENTRIFY.VMS

Valid starting     Expires            Service principal
12/08/15 14:56:35  12/09/15 00:56:34  krbtgt/CENTRIFY.VMS@CENTRIFY.VMS
        renew until 12/09/15 14:56:35, Flags: FRIA
        Etype (skey, tkt): AES-256 CTS mode with 96-bit SHA-1 HMAC, AES-256 CTS mode with 96-bit SHA-1 HMAC

Building an Inventory of Centrify agents and versions
Open Access Manager > Right Click "Centrify DirectManage Access Manager [dc]" > Select Deployment Report (Standard Edition)


What if I want to test this?

You'll need
a) A Windows Server (2003 or 2008) acting as a DC at the low level (e.g. Windows Server 2003 DFL)
To test the raising of the DFL to
b) A Windows Server 2012 member server that you can promote to a DC
To test the introduction of a 2012 DC
c) A Centrify client in any mode (Express | Workstation | Zone) for UNIX, Linux or OS X.

Video


Reading List

• https://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx
• http://blogs.technet.com/b/askds/archive/2011/06/14/what-is-the-impact-of-upgrading-the-domain-or-forest-functional-level.aspx
• http://blogs.technet.com/b/askpfeplat/archive/2013/04/29/upgrading-or-migrating-active-directory-to-windows-server-2012-build-your-roadmap-now.aspx
• http://blogs.technet.com/b/askpfeplat/archive/2012/09/03/introducing-the-first-windows-server-2012-domain-controller.aspx
• http://windowsitpro.com/security/resetting-password-krbtgt-active-directory-account
• http://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf
• http://social.technet.microsoft.com/wiki/contents/articles/24370.sid-compression.aspx
• https://support.microsoft.com/en-us/kb/2774190

Security Corner - How to demonstrate alignment with Sarbanes-Oxley with Centrify for UNIX/Linux and Active Directory

Background on the Sarbanes-Oxley Act

You need to understand what a security analyst or auditor is asking of you, let's start with the basics:

• What is SOx?The Sarbanes-Oxley act of 2002 or “Public Company Accounting Reform and Investor Protection Act”
• Who needs to comply with it?All publicly-traded companies.
• How can you prove due-diligence with SOx?They need to provide the assurance that systems that impact financial statements have implemented the proper security controls.
• What is the point of SOX?The main intention of SOX is to establish verifiable security controls to protect against disclosure of confidential data, and tracking of personnel to detect data tampering that may be fraud related. The central purpose of the act is to reduce fraud, build public confidence and trust, and protect data that may affect companies and shareholders.
• What is the cost of non-conformance?Very steep penalties and/or prison time for executives.
• What systems are bound by SOx rules?Any system that supports applications that impact the business bottomline.  Your organization should have written guidelines to categorize the data that travels or is stored in those systems.
• What are the guidelines to determine if a system may be bound by SOx?This should be defined by a risk assessment exercise, however, a simple model is to use the CIA rating (Confidentiality-Integrity-Availability).  This triad can be used to do a simple test.  As yourself these 3 questions.
  If the data on these systems....
  a) is made public (confidentiality breach)
  b) is tampered with or not reliable
  c) is not available (system down)
  ... is there an impact to the organization's bottomline (financial, reputation, major productivity loss)?
  The answer to this question should give you a pretty good idea.  As a matter of fact, any system that falls into that category (infrastructure like Routers, Switches, DNS, PKI, etc.) has impact to operations.

What are the common misconceptions of the SOx Act?
That you should only produce reports (e.g. lists of users in the context of IAM).  The whole point of the concept of "verifiable security controls" is to prove the effectiveness of the controls;  the reason why organizations have to produce reports is due to legacy issues.
For example, if you are using /etc/passwd for 20 users, you have to potentially attest for 20 different user/attestation reports.

Now let's discuss how Centrify can help.

Centrify-Sarbanes Oxley Reference Guide
This table, should be a good starting point; however we ask that you reconcile this information with your organization's security policies, guidelines and procedures.

Section	What it means	Centrify Products/Features	Centrify Implements
Section 302.2 – Establish safeguards to prevent data tampering.	Controls are implemented to prevent, correct or detect data breaches	DirectControl, DirectAuthorize, DirectAudit / Privileged user management, logging, auditing	Centrify implements a RBAC mechanism that allows to control: a)     Who can access a system b)     How they can access the system (console, SSH, RDP, etc) c)      What can they do in that system (DirectAutorize) This approach protects systems end-to-end and it’s not password-centric.  It’s called Least Access/Least Privilege Principle Resource: What is DirectAuthorize?
Section 302.4.B – Establish verifiable controls to track data access.	Controls are implemented to attest who has access	DirectControl, DirectAuthorize, DirectAudit / Reporting, Auditing	All access and privilege elevation events are logged to UNIX/Linux syslog and the Windows Event log (if Kerberos events are being audited)
Section 302.4.C – Ensure that safeguards are operational	Self-described	DirectControl, DirectAuthorize, DirectAudit / site awareness, watchdog, caching, offline audit	Centrify implements the following high-availability mechanisms: a)     AD Site/Services awareness – this means that it will failover upon domain controller failure b)     Offline Cache:  in case of no DC availability it can provide login with cached credentials c)      Telemetry calculations:  the client proactively will probe to see if it’s talking to the most optimal DC. d)     Watchdog processes:  Implements a watchdog daemon that will spawn new processes if needed. Resource: Youtube Playlist - HA Mechanisms.
Section 302.4.D – Periodically report the effectiveness of safeguards.	Attest that controls are working as expected	DirectControl, DirectAuthorize, DirectAudit /enhanced logging, alerts.	Centrify Implements a)     Console-based reporting b)     Script-based reporting (UNIX, Windows PowerShell) c)      SQL-Server Based Reporting (CSS 2016, now in Beta)
Section 302.5.A&B – Detect Security Breaches	Self-described	DirectControl, DirectAudit / logging, capture and replay	Centrify Provides: a)     Event log and syslog logging b)     Session Transcripton (EE) c)      Session Capture and Replay (DVR-like) (EE) d)     Event consolidation (EE) e)     Event reporting (EE)
Section 404.A.1.1 – Disclose security safeguards to independent auditors. Section 404.A.2 – Disclose security breaches to independent auditors. Section 404.B – Disclose failures of security safeguards to independent auditors.	Demonstrate the existence of a security framework, for example: •       Procedures to eliminate terminated (or changed) employees •       Password Policy •       Separation of Duties •       Attestation	DirectControl, DirectAuthorize, DirectAudit / zone provisioning agent, policy enforcement, zone delegation,  role-based access, reporting, logging, auditing	Centrify allows for a)     Collapsing the termination of users directly in active directory b)     The password policy from Active Directory is reused in UNIX, Linux, Mac and Apps c)      Provides mechanisms to implement delegation and separation of duties.

The bottomline is this:
Organizations that have multiple identity silos (like /etc/passwd or /etc/group) have a very hard time (or have a lot of complexity or an army of people) just to manage simple tasks like the user/group life-cycle (add/moves/changes).  With Centrify and Active Directory these tasks become centralized, making the security controls more effective.  Organizations effectively piggy-back on existing processes, so when you get the question "how can you prove that you're performing on-time user add/moves or changes?" you can simply say:  "This is all tied to our Active Directory processes and procedures"

Here's a good sequence (for user adds/moves and policy)

1. Log on to a UNIX, Linux or Mac with an AD user.
2. Show the system log (messages log, syslog or event log)
3. Logoff and Disable the user in AD
4. Attempt login (you should fail).  Show the log again.
5. Re-enable the user and log in.
6. Try to change the password to something misaligned with policy (like 1235).
7. Show the failure in password updates.

Note: You have to be auditing logon success and failure events in Active Directory Domain Controllers to see this.  You can set this up by enabling success and failure of the Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy > Audit Account Logon Events GPO.

Samples:
In this sequence, the user Diana (dwirth) logs in to a CentOS system via SSH.

Event on UNIX/Linux:

Jul 27 17:17:55 engcen5 adclient[3313]: INFO  AUDIT_TRAIL|Centrify Suite|PAM|1.0|200|
PAM set credentials granted|5|user=dwirth(type:ad,dwirth@CENTRIFYIMAGE.VMS) 
pid=25913 utc=1438035475776 centrifyEventID=24200 status=GRANTED service=sshd tty=ssh 
client=member.centrifyimage.vms

Event on Windows:


Centrify Architecture and Credential Consolidation
You often have to explain how our solution is architected.  The bottomline is that for all intends and purposes, the system acts like a Windows system.  However, you may need to materialize diagrams like this:

Make sure you explain that Centrify uses UNIX frameworks, standard protocols and Microsoft Active Directory specifications.  Here are some of the key ones:

• Name Service Switch (NSS) –provides a facility to the OS for sources of identity information like users and groups
• Pluggable Authentication Modules (PAM) – provides a facility to the OS applications to abstract authentication providers.
• Kerberos:  Centrify communicates with AD for authentication using Kerberos.  Kerberos is an authentication protocol that relies on a Key Distribution Center and Authentication servers.  The whole principle behind Kerberos is the use of mutual authentication, tickets, encryption and mechanisms to detect replay attacks.  Centrify provides MIT-Kerberos based tools and libraries that have been optimized to work with Microsoft’s Active Directory Kerberos implementation.
• High-availability is provided by AD Site Awareness, offline credential cache, telemetry calculations and the watchdog process.

How does the authentication process work?
At a very simple level:

1. A UNIX-enabled AD user attempts to log in using a PAM-enabled(*) application (like login or SSH)
2. An application like login uses the Centrify PAM module to attempt to log in.
3. The PAM modules will perform a series of checks, e.g. (user is authorized, AD account in good standing), password is correct, etc,
4. Kerberos: The system will use a mutually authenticated encrypted connection (with the highest allowed encryption) to talk to a domain controller and get the appropriate service tickets.
5. The user will be logged in to the system via the corresponding application (e.g. login, SSH)
   (see the attachment)

Encryption Levels
You may be asked about encryption too.  Make sure you explain that in an Active Directory environment, encryption algorithms and strength are defined by the version and functional level of the environment.  For example, an AD DC that is running in 2008R2 functional level will use AES256 for encryption, previous versions would use lower encryption levels.  The Centrify agent will follow the levels defined by Active Directory. 

Passwords are stored in Active Directory domain controllers and the encryption level is defined by the msDS-SupportedEncryptionTypes attribute.  To view the encryption levels supported by your current infrastructure, consult your AD team, or look at the /etc/krb5.conf configuration of any Centrified system. 

Encryption is used for two areas:

• Kerberos transactions (encryption in traffic – self-explanatory)
• Offline cache:   Centrify just like Windows supports the use of offline logins, as a compensating high-availability mechanism in case of lack of communication with a Domain controller.  The encryption levels for the offline has are the ones available by the AD functional level.  The parameter to encrypt the hash of the offline credential is cache.encrypt (or its corresponding Group Policy Object) and you can force an encryption type by using the adclient.cache.encryption.type (or the corresponding GPO).

Due Diligence
Due to Centrify’s penetration in high-security environments, we’ve had to perform additional due diligence and have achieved the following certifications:

• Common Criteria EAL2+:  https://www.commoncriteriaportal.org/files/epfiles/centrify-v20132-cert-eng.pdf
• FIPS 140-2:  http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2011.htm#1604
• For additional certifications:  http://www.centrify.com/solutions/federal/certifications/

Resources:

• Centrify Configuration and Tuning Guide:  https://www.centrify.com/downloads/products/documentation/suite2015/centrify-unix-config-guide.pdf (page 31 – adclient.cache encrypt/encryption.type)
• About functional levels:  https://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx
• About Active Directory encryption levels:  https://msdn.microsoft.com/en-us/library/cc223853.aspx

Identity: Why aren’t AD Schema extensions or software in Domain Controllers required?
I've seen instances in which the auditor/security analysts asks this question.  
As it relates to identity data, Centrify has several ways to use Active Directory without requiring Schema Extensions:

• Pre-Windows 2003R2 AD functional levels:  Centrify zones implement mechanisms to store UNIX identity information in classic zones.
• Windows 2003R2 and above functional levels:  Centrify can use identity stored in the RFC2307 attributes implemented natively in this schema.
• Services for UNIX (SFU) Schema:  If a customer or prospect extended the AD schema to SFU, we can store information there (although it provides less flexibility than Centrify zones).

In addition, Centrify subscribes to Microsoft’s documented APIs (ADSI), therefore there’s no need to add software in domain controllers.

Resources for Identity: 

• Video – How DirectControl stores information in Active Directory:  https://www.youtube.com/watch?v=JO3_AJObkAs
  in this video, the CTO and creator of DirectControl, explains how Centrify stores data in AD.
• RFC 2307: https://www.ietf.org/rfc/rfc2307.txt
• Attached - The “Understanding the Centrify DirectControl Agent.pdf” excerpt; explains the process step by step and more detail.
  
  (*) Centrify provides functionality for IBM Loadable Authentication Modules (LAM) as well.

Application Edition
If an Application (Apache, Java, DB2, SAP) initiates an authentication request via an interface (SPNEGO, GSSAPI, SASL, SNC, etc) ultimately the agent will use Kerberos for authentication.


In addition  Centrify has a whitepaper titled "Using Microsoft Active Directory to Address Sarbanes-Oxley (SOX) Compliance in Heterogeneous Environments".

Note: the original version of this article was published in the Centrify Community.