Basic Concepts: The Centrify Agent

Centrify's Active Directory Client
Typically known as DirectControl (or adclient) is Centrify's Active Directory integration service.  It leverages AD LDAP, Kerberos and Group Policy;  with over 10 years of maturity, the agent has evolved to support diverse platforms and has provides super user privilege management for UNIX/Linux and Windows platforms.

 

 The architecture of the client in UNIX is as follows:

• NSS Module:  Uses the NSS facility to present AD as a source of of identity for users (passwd), and groups.
• PAM Module:  The authentication against AD is implemented as a PAM module.  Centrify implements authentication, account, session and password modules.
• Kerberos Libraries:  MIT Kerberos compiled libraries with support for Microsoft's Kerberos implementation.  The location of these tools is /usr/share/centrifydc/kerberos/bin.
• Group Policy Engine:  Processes group policies from AD in the Unix/Linux and Mac platforms
• Centrify-enhanced sudo:  A version of sudo that leverages Roles and Rights defined in AD with Centrify.
• Command-line Tools:  Centrify has implemented command for the agent (ad commands), for privilege management (dz commands) and for auditing (da commands). In addition, there are modules for PowerShell for the DirectManage components, as well as an SDK.
• LDAP and NIS Proxies:  These proxies present AD information to clients that can't have the agent installed (like filers, appliances, or legacy systems)
• Offline credential cache:  Provides high-performance (by not requiring a persistent LDAP connections to AD) and high-availability (in case AD is not available or there's a network failure)
• External Modules:  provides SSO facilities for Apache, Tomcat, Websphere, Weblogic Java2EE application servers, SAP (GUI and Netweaver) and DB2
• Watchdog Process:  provides a backup mechanism for recovery and diagnostics in the case of a daemon failure.

Communicating with Active Directory

To talk to domain controllers, the Centrify agent uses the following communication ports:

Port	Description
TCP/UDP 389	LDAP
TCP 3268	Global Catalog Search
TCP 88	Kerberos TGT
TCP 464	Kerberos password changes (passwd, adpasswd)
UDP123	Optional: Network Time Protocol (NTP)(*)
TCP 53	DNS query for A and SRV records
TCP 445	Optional:  SMB to read Group Policies
Ephemeral Ports	Required for communication

Communications between the Centrify client are mutually authenticated and encrypted, just like when Windows clients communicate with DCs.

For more information, see this Technet article.

(*) By default, the Centrify AD client will make UNIX, Linux or Mac sync time with Active Directory Domain Controllers;  you can use any NTP service, however you need to make sure that it's within 5 minutes from the DC (that acts as a Kerberos KDC).  This is a Kerberos requirement to protect against replay attacks.

Basic Concepts: UNIX and Linux Access Controls

Multiple Capabilities-Multiple Solutions

Traditionally UNIX and Linux have separate components for Directory Services, Name Resolution, Authentication, Privilege Management, Accounting and Configuration Management. 
Note:  I will be referring to the UNIX family of systems (Including Linux) as UNIX throughout this blog.

Directory Services on UNIX/Linux

UNIX Systems have been around for a long time.  They have defined and built the Internet as we know it today, so we owe a lot of the benefits that we enjoy to the legacy of UNIX.  With the birth of Linux, Open Source solutions and the penetration of virtualization technologies, the family of UNIX systems has grown exponentially.
This legacy means that UNIX systems have retained many of the challenges across the years.
Traditionally users in a UNIX system exist on:

• Locally in the /etc/passwd file
• In a Network Information System (NIS)
• In an LDAP system (like OpenLDAP)
• In commercial solutions and even in Active Directory

Name Server Switch
Because of the fragmentation of directory service providers and to eliminate having to compile programs for each provider, Sun Microsystems introduced the NSS facility.  It allows programs to access directory services, name services and remote databases in a standard fashion.   NSS is very important to understand how Centrify integrates with UNIX systems to provide name services via AD.  The configuration for NSS is in the /etc/nsswitch.conf.

Authentication Services on UNIX/Linux

Just like Directory services, authentication in Unix has been performed:

• Locally against the /etc/shadow file
• In a Network Information System (NIS) remote shadow file
• Over a Kerberos infrastructure (like MIT Kerberos or Heimdal)

Pluggable Authentication Modules
Because of the same needs around NSS, PAM is authentication framework that allow stackable modules implemented as shared objects to perform authentication functions.  For example, an account module can verify is the user account is valid, the authentication module can verify the validity of the password, the session module can display a message of the day to the user.  Along with NSS, Centrify uses a PAM module to authenticate against Active Directory's Kerberos implementation.

Name Resolution in UNIX/Linux

BIND is the defacto DNS server in UNIX.  The client component is controlled typically via the /etc/resolv.conf file.


Privilege Management in UNIX/Linux

Shared Privileged Accounts:
In UNIX, the root account is is king.  Aside from being able to impersonate any user, is able to take ownership of any file or process.  It is not uncommon (even in mature regulated organizations) to see users abuse the root account.  Sometimes even when a commercial solution or sudo is implemented, users will still issue a command to elevate to root.  This undermines accountability.
Sharing accounts is generally considered a bad security practice.

sudo
sudo is a privilege management utility that allows users to run programs in the security context of another user.  It uses the /etc/sudoers file.  It is prevalent and reliable.

Commercial Solutions:
There are a number of commercial solutions in the market to tackle the UNIX privilege management puzzle.  We will focus on leveraging Active Directory and Centrify-enhanced sudo in this blog.  Commercial solution approaches include:

• Scripting-oriented:  Like BeyondTrust's PowerBroker
• Password Vaults:  Like Cyber-Ark
• Kernel-level:  Like CA's Access Control

Accounting/Auditing in UNIX/Linux

The syslog facility is the main repository for logs, including security events.  Interestingly, when using root in a shared account scenario, there are events that are not logged!!!!

Configuration Management on UNIX/Linux

Traditionally, configuration management has been accomplished with scripts written by system administrators, but this approach may not scale depending on the core competency of the company.  Companies like AOL, Google and others are pure tech companies and writing software is their core competency; but banks, insurance companies, manufacturing companies, etc may not have the same luxury.  Wikipedia has a great article on Configuration Management utilities for UNIX and Linux like Chef, Puppet, etc.