One Identity Safeguard for Privileged Sessions 6.10.0 - Administration Guide

Using SCP with agent-forwarding

When the client uses SSH to access a target server via One Identity Safeguard for Privileged Sessions (SPS) and authenticates with the public keys, the SPS Authentication Policy has Public key > Agent configured on the server-side. If the client supports agent-forwarding, this works well. However, scp does not: it always adds the -a option to the command-line to disable agent-forwarding. Explicitly allowing agent-forwarding with the -A or the -oForwardAgent yes command-line option, or writing ForwardAgent yes into the configuration has no effect, because the implicit -a at the end of the command-line takes precedence.

Solution 1: Use a wrapper script

The scp application can be started with the -S option to use an external application to create the encrypted connection. On Linux and UNIX platforms, this external application can be, for example, the following script that removes the unnecessary option from the scp command line.

#!/usr/bin/perl
exec '/usr/bin/ssh', '-A', map {$_ eq '-oForwardAgent=no' ? ( ) : $_} @ARGV

If you want your clients to use this script transparently, you can create an alias for it with the following command:

alias scp='scp -S <path-to-the-script-on-the-client>'

Solution 2: Use ssh master-channels

This solution relies on sending scp through an SSH master-control channel. In this case, scp does not need agent-forwarding, because it is already performed during the ControlMaster setup. The advantage of this solution is that the scp connection is setup quickly, because no authentication is needed, since the connection is already open. The disadvantage is that first a ControlMaster connection must be opened to the target host using the following command:

ssh -M -S /tmp/<address-of-the-target-server> <address-of-the-target-server>

When staring scp, reference the control path created with the previous command:

scp -oControlPath=/tmp/<address-of-the-target-server> [[user@]host1:]file1 ... [[user@]host2:]file2

Solution 3: Patch the scp source

You can simply patch the scp source to overcome the problem, but then you need to recompile and re-install scp on every platform you use in your environment. The following is a sample patch for openssh-5.6p1:

--- scp-org.c    2010-07-02 05:37:33.000000000 +0200
+++ scp-new.c    2010-09-08 17:56:33.000000000 +0200
@@ -339,7 +339,6 @@
     args.list = NULL;
     addargs(&args, "%s", ssh_program);
     addargs(&args, "-x");
-    addargs(&args, "-oForwardAgent no");
     addargs(&args, "-oPermitLocalCommand no");
     addargs(&args, "-oClearAllForwardings yes");

Solution 4: Use fix or mapped keys on server-side

This is not agent-forwarding anymore, but scp still can use keys. Instead of passing the user-keys to the target server, SPS can authenticate on the server using a fix key, or a separate key for every user. Setting the server-side keys on SPS (or fetching them from LDAP), has the following advantages:

• The user cannot bypass SPS and directly connect to the target server

• Key-handling in the server environment becomes much simpler, because you do not have to import the user-keys to every host (if this is done locally, without a central identity management system)

For details on configuring server-side keys on SPS, see Relayed authentication methods.

Solution 5: WinSCP and agent-forwarding

WinSCP is a common tool for Windows to transfer files using SFTP/SCP. To use agent-forwarding in WinSCP, enable it in the SSH > Authentication options and load your keys.

Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS)

The following checklist is a set of recommendations and configuration best practices to ensure that your One Identity Safeguard for Privileged Sessions (SPS) is configured securely.

Topics:

Encryption-related settings

• One Identity recommends using 2048-bit RSA keys (or stronger).

• Use strong passwords: at least 8 characters that include numbers, letters, special characters, and capital letters. For local One Identity Safeguard for Privileged Sessions (SPS) users, require the use of strong passwords (set Users & Access Control > Settings > Minimal password strength to strong). For details, see "Setting password policies for local users" in the Administration Guide.

• When exporting the configuration of SPS, or creating configuration backups, always use encryption. Handle the exported data with care, as it contains sensitive information, including credentials. For details on encrypting the configuration, see "Encrypting configuration backups with GPG" in the Administration Guide.

• Use every keypair or certificate only for one purpose. Do not reuse cryptographic keys or certificates (for example, do not use the certificate of the One Identity Safeguard for Privileged Sessions (SPS) webserver to encrypt audit trails, or the same keypair for signing and encrypting data).

• Do not use the CBC block cipher mode, or the diffie-hellman-group1-sha1 key exchange algorithm. For details, see "Supported encryption algorithms" in the Administration Guide.

• Always encrypt your audit trails to protect sensitive data. For details, see "Encrypting audit trails" in the Administration Guide.

Connection policies

• When configuring connection policies, always limit the source of the connection to the client network that requires access to the connection.

• Always use gateway authentication to authenticate clients. Do not trust the source IP address of a connection, or the result of server authentication.

• To prevent Denial of Service (DoS) attacks against One Identity Safeguard for Privileged Sessions (SPS), set the Connection rate limit option of your connection policies. For details, see "Configuring connections" in the Administration Guide.

• Configure your RDP connection policies to use strong encryption. To enable SSL-encryption for the RDP protocol, see "Enabling TLS-encryption for RDP connections" in the Administration Guide.

• In RDP connections, if the client uses the Windows login screen to authenticate on the server, the password of the client is visible in the audit trail. To avoid displaying the password when replaying the audit trail, you are recommended to encrypt the upstream traffic in the audit trail using a separate certificate from the downstream traffic. For details, see "Encrypting audit trails" in the Administration Guide.

• Ensure that host key verification is enabled in SSH connection policies. That is, the Server side host key settings > Allow plain host keys and Server side host key settings > Allow X.509 host certificates options do not have the No check required option selected. For details, see "Setting the SSH host keys of the connection" in the Administration Guide.