UserCheck Client

UserCheck Client Overview

The UserCheck client is installed on endpoint computers to communicate with the gateway and show UserCheck interaction notifications to users. It works with these Software Blades:

DLP - Notifications of DLP incidents can be sent by email (for SMTP traffic) or shown in a popup from the UserCheck client in the system tray (for SMTP, HTTP and FTP).

Application and URL Filtering and URL Filtering - The UserCheck client adds the option to send notifications for applications that are not in a web browser, such as Skype, iTunes, or browser add-ons (such as radio toolbars). The UserCheck client can also work together with the UserCheck portal to show notifications on the computer itself when:

• The notification cannot be displayed in a browser, or
• The UserCheck engine determines that the notification will not be shown correctly in the browser and the Fallback Action for the UserCheck object is Allow.

Users select an option in the notification message to respond in real-time.

For DLP, administrators with full permissions or the View/Release/Discard DLP messages permission can also send or discard incidents from SmartView Tracker.

Workflow for installing and configuring UserCheck clients:

1. Configure how the clients communicate with the gateway and create trust with it.
2. Enable UserCheck and the UserCheck client on the gateway.
3. Download the UserCheck client MSI file.
4. Install the UserCheck client on the endpoint computers.
5. Make sure that the UserCheck clients can connect to the gateway and receive notifications.

UserCheck Requirements

See UserCheck Client Requirements in the R76 Release Notes.

Enabling UserCheck Client

Enable UserCheck and the UserCheck client on the gateway in the Properties window of the gateway object in SmartDashboard. This is necessary to let clients communicate with the gateway.

To enable UserCheck and the UserCheck client on the gateway:

1. In SmartDashboard, open the General Properties window of the gateway object.
2. If Data Loss Prevention is enabled on the gateway, select Data Loss Prevention from the tree. In the UserCheck area:
   1. Select Enable Check Point UserCheck. This enables UserCheck notifications from the client.
   2. Optional: Select Place Check Point UserCheck download links on email notifications. When selected, DLP email notifications also contain a link to download the UserCheck client directly from the email.
3. If Application and URL Filtering is enabled on the gateway, select UserCheck from the tree:
   1. Select Enable UserCheck for Application Control and URL Filtering. This enables UserCheck notifications from the gateway.
   2. In the UserCheck Client area, select Activate UserCheck Client support. This enables UserCheck notifications from the client.
4. Click OK.
5. Install the policy on the gateway.

Client and Gateway Communication

In an environment with UserCheck clients, the gateway acts as a server for the clients. Each client must be able to discover the server and create trust with it.

To create trust, the client makes sure that the server is the correct one. It compares the server fingerprint calculated during the SSL handshake with the expected fingerprint. If the server does not have the expected fingerprint, the client asks the user to manually confirm that the server is correct.

Here is a summary of the methods that you can use for clients to discover and trust the server. More details are described later in this section.

• File name based server configuration – If no other method is configured (default, out-of-the-box situation), all UserCheck clients downloaded from the portal are renamed to have the portal machine IP address in the filename. During installation, the client uses this IP address to connect to the gateway. Note that the user has to click Trust to manually trust the server.
• AD based configuration – If client computers are members of an Active Directory domain, you can deploy the server addresses and trust data using a dedicated tool.
• DNS SRV record based server discovery – Configure the server addresses in the DNS server. Note that the user has to click Trust to manually trust the server.
• Remote registry – All of the client configuration, including the server addresses and trust data reside in the registry. You can deploy the values before installing the client (by GPO, or any other system that lets you control the registry remotely). This lets you use the configuration when the client is first installed.

Option Comparison

File Name Based Server Discovery

This option is the easiest to deploy, and works out-of-the-box. It requires that users manually click Trust to trust the server the first time they connect. You can use this option if your deployment has only one Security Gateway with the relevant Software Blades.

How does it work?

When a user downloads the UserCheck client from UserCheck notification, the address of the Security Gateway is inserted into the file name. During the installation sequence, the client checks if there is any other discovery method configured (AD based, DNS based, or local registry). If no method is configured and the gateway can be reached, it is used as the server. In the UserCheck Settings window, you can see that the server you connect to is the same as the Security Gateway in the UserCheck client filename.

Users must manually make sure that the trust data is valid because the file name can easily be changed.

Renaming the MSI

You can manually change the name of the MSI file before it is installed on a computer so that it connects to different gateway.

To rename the MSI file:

1. Make sure the gateway has a DNS name.
2. Rename the MSI using this syntax: UserCheck_~GWname.msi

   Where GWname - is the DNS name of the gateway.

   Optional: Use UserCheck_~GWname-port.msi

   Where port is the port number of notifications. For example, UserCheck_~mygw-18300.msi.

Active Directory Based Configuration

If your client computers are members of an Active Directory domain and you have administrative access to this domain, you can use the Distributed Configuration tool to configure connectivity and trust rules.

The Distributed Configuration tool has three windows:

• Welcome - Describes the tool and lets you enter different credentials that are used to access the AD.
• Server configuration – Configure which Security Gateway the client connects to, based on its location.
• Trusted gateways – View and change the list of fingerprints that the Security Gateways consider secure.

To enable Active Directory based configuration for clients:

1. Download and install the UserCheck client MSI on a computer.

   From the command line on that computer, run the client configuration tool with the AD utility.

   For example, on a Windows 7 computer:

   "C:\Users\<user name>\Local Settings\Application Data\Checkpoint\UserCheck\UserCheck.exe" -adtool

   The Check Point UserCheck - Distributed Configuration tool opens.

2. In the Welcome page, enter the credentials of an AD administrator.

   By default, your AD username is shown. If you do not have administrator permissions, click Change user and enter administrator credentials.

3. In the Server Configuration page, click Add.

   The Identity Server Configuration window opens.

4. Select Default and then click Add.
5. Enter the IP address or Fully Qualified Domain Name (FQDN) and the port for the AD Server.
6. Click OK.

   The identity of the AD Server for the UserCheck client is written in the Active Directory and given to all clients.

Server Configuration Rules

If you use the Distributed Configuration tool and you configure the client to Automatically discover the server, the client fetches the rule lists. Each time it must connect to a server, it tries to match itself against a rule, from top to bottom.

When the tool matches a rule, it uses the servers shown in the rule, according to the priority specified.

The configuration in this example means:

1. If the user is coming from ‘192.168.0.1 – 192.168.0.255’, then try to connect to US-GW1. If it is not available, try BAK-GS2 (it is only used if US-GW1 is not available, as its priority is higher).
2. If the user is connected from the Active Directory site ‘UK-SITE’, connect either to UK-GW1 or UK-GW2 (choose between them randomly, as they both have the same priority). If both of them are not available, connect to BAK-GS2.
3. If rules 1 and 2 do not apply, connect to BAK-GS2 (the default rule is always matched when it is encountered).

Use the Add, Edit and Remove buttons to change the server connectivity rules.

Trusted Gateways

The Trusted Gateways window shows the list of servers that are trusted - no messages open when users connect to them.

You can add, edit or delete a server. If you have connectivity to the server, you can get the name and fingerprint. Enter its IP address and click Fetch Fingerprint in the Server Trust Configuration window. If you do not have connectivity to the server, enter the same name and fingerprint that is shown when you connect to that server.

DNS Based Configuration

If you configure the client to Automatic Discovery (the default), it looks for a server by issuing a DNS SRV query for the address of the gateway (the DNS suffix is added automatically). You can configure the address in your DNS server.

To configure DNS based configuration on the DNS server:

1. Go to Start > All Programs > Administrative Tools > DNS.
2. Go to Forward lookup zones and select the applicable domain.
3. Go to the _tcp subdomain.
4. Right click and select Other new record.
5. Select Service Location, Create Record.
6. In the Service field, enter CHECKPOINT_DLP.
7. Set the Port number to 443.
8. In Host offering this server, enter the IP address of the Security Gateway.
9. Click OK.

Troubleshooting DNS Based Configuration

To troubleshoot issues in DNS based configuration, you can see the SRV records that are stored on the DNS server.

To see SRV records on the DNS server:

Run:

C:\> nslookup
> set type=srv
> checkpoint_dlp._tcp

The result is:

> 

Remote Registry

If you have a way to deploy registry entries to your client computers, for example, Active Directory or GPO updates, you can deploy the Security Gateway addresses and trust parameters before you install the clients. Clients can then use the deployed settings immediately after installation.

To configure the remote registry option:

1. Install the client on one of your computers. The agent installs itself in the user directory, and saves its configuration to HKEY_CURRENT_USER.
2. Connect manually to all of the servers that are configured, verify their fingerprints, and click Trust on the fingerprint verification dialog box.
3. Configure the client to manually connect to the requested servers (use the Settings window).
4. Export these registry keys (from HKEY_CURRENT_USER):
   1. SOFTWARE\CheckPoint\UserCheck\TrustedGateways (the entire tree)
   2. SOFTWARE\CheckPoint\UserCheck\
      1. DefaultGateway
      2. DefaultGatewayEnabled
5. Import the exported keys to the endpoint computers before you install the UserCheck client.

Getting the MSI File

Use the Check_Point_UserCheck.MSI file to install the client on user computers. Each UserCheck client must be configured to connect to the gateway and to use the port needed for notifications. The default ports are 443 and 80. Download the MSI file from the Security Gateway through the Properties window of the gateway object in SmartDashboard. The MSI file is available after the first time that Policy is installed on the Security Gateway.

To get the MSI file:

1. In SmartDashboard, open the General Properties window of the gateway object.
2. If Data Loss Prevention is enabled on the gateway, select Data Loss Prevention.
   • In the UserCheck area, click Download Client.
3. If Application and URL Filtering is enabled on the gateway, select UserCheck.
   • In the UserCheck Client area, click Download Client.

If DLP and Application and URL Filtering are enabled on the Security Gateway, you can get the MSI file from the Data Loss Prevention page or the UserCheck page.

Distributing and Connecting Clients

After configuring the clients to connect to the gateway, install the clients on the user machines. You can use any method of MSI or EXE mass deployment and installation that you choose. For example, you can send users an email with a link to install the client. When a user clicks the link, the MSI file automatically installs the client on the computer.

Alternatively, users can download the installation package from the regular DLP UserCheck notifications.

The installation is silent and generally, no reboot is required.

When the client is first installed, the tray icon indicates that it is not connected. When the client connects to the gateway, the tray icon shows that the client is active.

The first time that the client connects to the gateway, it asks for verification from the user and approval of the fingerprint.

We recommend that you let the users know this will happen.

We recommend that you use a server certificate that is trusted by the certificate authority installed on users' computers. Then users do not see a message that says: Issued by unknown certificate authority.

If UserCheck for DLP is enabled on the gateway, users are required to enter their username and password after the client installs.

Example of message to users about the UserCheck client installation (for DLP:

Dear Users,

Our company has implemented a Data Loss Prevention automation to protect our confidential data from unintentional leakage. Soon you will be asked to verify the connection between a small client that we will install on your computer and the computer that will send you notifications.

This client will pop up notifications if you try to send a message that contains protected data. It might let you to send the data anyway, if you are sure that it does not violate our data-security guidelines.

When the client is installed, you will see a window that asks if you trust the DLP server. Check that the server is SERVER NAME and then click Trust.

In the next window, enter your username and password, and then click OK.

UserCheck and Check Point Password Authentication

You can configure UserCheck clients to authenticate with a Check Point user name and password. This is useful for non-Active Directory environments. It is also useful when it is necessary for a user, who is not logged in to the Active Directory domain, to log in manually.

You can see and edit Check Point users in the Data Loss Prevention tab, Additional Settings > Users page.

To enable Check Point password authentication. :

SmartDashboard Configuration

1. Open SmartDashboard.
2. For each user, edit the user object. You can do this in the Data Loss Prevention tab in the Additional Settings > Users page.
3. In the General Properties page of the user, make sure that an email address is defined.

UserCheck Client Configuration

Ask your users to configure their UserCheck client:

1. On the UserCheck client computer, right click the UserCheck icon in the Notification Area (next to the system clock).
2. Select Settings.
3. Click Advanced.
4. Select Allow authentication with alternate user account.

Helping Users

If users require assistance to troubleshoot issues with the UserCheck client, you can ask them to send you the logs.

To configure the client to generate logs:

1. Right-click the UserCheck tray icon and select Settings.

   The Settings window opens.

2. Click Log to and browse to a pathname where the logs are saved.
3. Click OK.

To send UserCheck logs from the client:

1. Right-click the UserCheck tray icon and select Status.

   The Status window opens.

2. Click Advanced and then click the Collect information for technical support link.

   The default email client opens, with an archive of the collected logs attached.