Print Download PDF Send Feedback

Previous

Next

UserCheck Interaction Objects

In This Section:

Configuring UserCheck

Kerberos Single Sign On

UserCheck Page

Creating UserCheck Interaction Objects

Plain Text Email Notifications

More UserCheck Interaction Options

Localizing and Customizing the UserCheck Portal

Configuring UserCheck

Configuring the Security Gateway for UserCheck

Enable or disable UserCheck directly on the Security Gateway. The DLP tab > Gateways window shows a list of Security Gateways with the DLP blade enabled.

Note -

  • When you enable UserCheck on a Security Gateway that is on an IP Series appliance, make sure to set the Voyager management application port to a port other than 443 or 80.
  • When you enable the UserCheck portal, make sure the DLP portal is enabled as well.

To configure a Security Gateway for UserCheck:

  1. Select a gateway and click Edit.

    The Gateway Properties window opens.

  2. On the UserCheck page, select Enable UserCheck for active blades.
  3. Enter the information for the UserCheck Web portal:
    • In the Main URL field, enter the primary URL for the web portal that shows the UserCheck notifications.

      If the Main URL points to an external interface, set Accessibility > Edit to Through all interfaces or According to the firewall policy.

      If users connect to the gateway remotely, set the internal interface of the gateway (on the Topology page) to be the same as the Main URL for the UserCheck portal.

      Note - The Main URL field must be manually updated if:

      • The Main URL field contains an IP address and not a DNS name.
      • You change a gateway's IPv4 address to IPv6 or vice versa.
    • In the IP address field, enter the IP address that the URL resolves to.
    • Click Aliases to add URL aliases that redirect different hostnames to the Main URL, for example: Usercheck.mycompany.com. The aliases must be resolved to the portal's IP address on the corporate DNS server
  4. In the Certificate area, click Import to import a certificate that the portal uses to authenticate to the server.

    By default the portal uses a certificate from the Check Point Internal Certificate Authority (ICA). This might generate warnings if the user's browser does not recognize Check Point as a trusted Certificate Authority. To prevent these warnings, import your own certificate from a recognized external authority.

    Even though DLP interactions are displayed in a secure (https) portal, the main URL for the UserCheck portal starts with http:// and is not secured by a certificate. You might consider using a valid certificate to secure the main portal URL when using UserCheck for DLP violations.

  5. In the Accessibility area, click Edit to configure interfaces on the gateway through which the portal can be accessed. These options are based on the topology configured for the gateway. Users are sent to the UserCheck portal if they connect:
    • According to the Firewall policy. Select this option if there is a rule that states who can access the portal.
    • Through all interfaces
    • Through internal interfaces (default)
      • Including undefined internal interfaces
      • Including DMZ internal interfaces
      • Including VPN encrypted interfaces (default)

      Note: If Including VPN encrypted interfaces is selected, add a Firewall rule that looks like this:

    Source

    Destination

    VPN

    Service

    Action

    Any

    Gateway on which UserCheck client is enabled

    Any Traffic

    UserCheck

    Accept

  6. In the UserCheck Client area, select Activate UserCheck Client Support.
    • The UserCheck client enables user interaction notifications.
    • Click Download Client to download the installation file for the UserCheck client.

      Note: The link will not be active until the UserCheck portal is up.

  7. Click OK.
  8. Install policy.

The Security Gateway has an internal persistence mechanism that preserves UserCheck notification data if the gateway or gateway cluster reboots. Records of a user answering or receiving notifications are never lost.

UserCheck CLI

Usrchk

You can use the usrchk command in the gateway command line to show or clear the history of UserCheck objects.

Description

usrchk

Syntax

usrchk [debug] [hits] [incidents]

Parameters

Parameter

Description

debug

Controls debug messages

hits

Shows user incident options:

list - Options to list user incidents

  • all - List all existing incidents.
  • user <username> - List incidents of a specified user.
  • uci <name of interaction object> - List incidents of a specified UserCheck interaction object

clear - Options to clear user incidents

  • all - Clear all existing incidents
  • user <username> - Clear incidents for a specified user
  • uci <name of interaction object> - Clear incidents of a specified UserCheck interaction object

db - user hits database options

incidents

Operations that can be done for incidents. For example:

  • Expiring

    Sends emails to users about their expiring email violations

 

Examples:

Notes:

Kerberos Single Sign On

The UserCheck agent supports single sign on using the Kerberos network authentication protocol. Kerberos is the default authentication protocol used in Windows 2000 domains and above.

The Kerberos protocol is based on the idea of tickets, encrypted data packets issued by a trusted authority, in this case the Active Directory (AD). When a user logs in, the user authenticates to a domain controller that provides an initial ticket granting ticket (TGT). This ticket vouches for the user’s identity.

When the user needs to authenticate against the DLP gateway through the UserCheck agent, the agent presents this ticket to the domain controller and requests a service ticket (SR) for a specific resource (the DLP gateway). The UserCheck agent presents this service ticket to the gateway.

For more detailed information on Kerberos SSO, see:

Single Sign-On Configuration

SSO configuration has two steps:

AD Configuration

The AD configuration involves:

Creating a new User Account

  1. In Active Directory, open Active Directory Users and Computers (Start > Run > dsa.msc)
  2. Add a new user account. You can choose any username and password. For example: a user account named ckpsso with the password 'qwe123!@#' to the domain corp.acme.com.
  3. Clear User must change password at next logon and select Password Never Expires.

Mapping the User Account to a Kerberos Principle Name

This step uses the ktpass utility to create a Kerberos principal name that is used by both the gateway and the AD. A Kerberos principal name consists of a service name (for the DLP gateway that the UserCheck agent connect to) and the domain name to which the service belongs.

Ktpass is a command-line tool available in Windows 2000 and higher.

Retrieve the correct executable

You must install the correct ktpass.exe version on the AD. Ktpass.exe is not installed by default in Windows 2003.

Use Ktpass

  1. Open a command line to run the ktpass tool (Start > Run > cmd).
  2. At the command prompt, run ktpass with this syntax:

    C:> ktpass -princ ckp_pdp/domain_name@DOMAIN_NAME -mapuser username@domain_name -pass password -out unix.keytab –crypto RC4-HMAC-NT

    Important - Enter the command exactly as shown. It is case-sensitive.

    This is an example of running ktpass with these parameters:

Parameter

Value

domain_name@DOMAIN_NAME

corp.acme.com@CORP.ACME.COM

username@domain_name

ckpsso@corp.acme.com

password

qwe123@#

The AD is ready to support Kerberos authentication for the Security Gateway.

The example above shows the ktpass syntax on Windows 2003. When using Windows 2008/2008 R2 Server, the ktpass syntax is slightly different. Parameters are introduced using a forward slash "/" instead of a hyphen "-".

Example (Windows 2008):

ktpass /princ ckp_pdp/corp.acme.com@CORP.ACME.COM /mapuser ckpsso@corp.acme.com /pass qweQWE!@# /out unix.keytab /crypto RC4-HMAC-NT

Authentication Failure

Authentication will fail if you have used the ktpass utility before for the same principal name (ckp_pdp/domain_name@DOMAIN_NAME) but with a different account.

If you have used the ktpass utility before:

  1. On the AD server, run:

    ldifde -f check_SPN.txt -t 3268 -d "dc=corp,dc=acme,dc=com" -l servicePrincipalName -r "(servicePrincipalName=ckp_pdp*)" -p subtree

  2. Open the check_SPN.txt file and verify that only one record is present.

    If multiple records exist, you must delete the different account or remove its association to the principal name.

    Remove the association with the principle name by running:

    settspn –D ckp_pkp/domain_name old_account name.

    For example:

    setspn –D ckp_pdp/corp.acme.com ckpsso

SmartDashboard Configuration

In SmartDashboard you need to configure an LDAP Account Unit to support SSO

To configure the account unit:

  1. Add a new host to represent the AD domain controller. Go to Network Objects tab > Nodes > Node > Host.
  2. Enter a name and IP address for the AD object and click OK.
    For example, ADServer.
  3. Add a new LDAP Account Unit.

    Select Servers and OPSEC Applications in the Objects Tree. Right-click Servers > New > LDAP Account Unit.

  4. In the General tab of the LDAP Account Unit:
    1. Enter a name.
    2. In the Profile field, select Microsoft_AD.
    3. In the Domain field, enter the domain name. It is highly recommended to fill this field for existing account units that you want to use for Identity Awareness. Entering a value into this field will not affect existing LDAP Account Units.
    4. Select CRL retrieval and User management.
  5. Click Active Directory SSO configuration and configure the values (see example):
    1. Select Use kerberos Single Sign On.
    2. Enter the domain name.
      For example, CORP.ACME.COM
    3. Enter the account username you created in Creating a New User Account.
      For example, ckpsso.
    4. Enter the account password for that user (the same password you configured for the account username in AD) and confirm it.
    5. Leave the default settings for Ticket encryption method.

    6. Click OK.
  6. In the Servers tab:
    1. Click Add and enter the LDAP Server properties.
    2. In the Host field, select the AD object you configured in step 4 above.
    3. In the Login DN field, enter the login DN of a predefined user (added in the AD) used for LDAP operations.
    4. Enter the LDAP user password and confirm it.
    5. In the Check Point Gateways are allowed to section, select Read data from this server.
    6. In the Encryption tab, select Use Encryption (SSL), fetch the fingerprint and click OK.

    LDAP over SSL is not supported by default. If you did not configure your domain controller to support LDAP over SSL, do it now or make sure this option is not selected.

  7. In the Objects Management tab:
    1. In the Manage objects on field, select the AD object you configured in step 4 above.
    2. Click Fetch Branches to configure the branches in use.
    3. Set the number of entries supported.
  8. In the Authentication tab, select Check Point Password in the Default authentication scheme and click OK.

UserCheck Page

On the UserCheck page, you can create, edit, and preview UserCheck interaction objects and their messages. It has these options:

Option

Meaning

New

Creates a new UserCheck object

Edit

Modifies an existing UserCheck object

Delete

Deletes an UserCheck object

Clone

Clones the selected UserCheck object.

These are the default UserCheck messages:

Name

Action Type

Description

Inform User

Inform

Shows when the action for the rule is inform. It informs users what the company policy is for that site.

Blocked Message

Block

Shows when a request is blocked.

Ask User

Ask

Shows when the action for the rule is ask. It informs users what the company policy is for that site and they must click OK to continue to the site.

Cancel Page

Cancel

Shows after a user gets an Inform or Ask message and clicks Cancel.

Success Page

Approve

Shows information was sent according to the user's request.

Successfully Discarded

Discard

Shows when the information was successfully discarded according to the user's request.

Ask and Inform pages include a Cancel button that users can click to cancel the request.

You can preview each message page in these views:

Creating UserCheck Interaction Objects

Create a UserCheck Interaction object from the Rule Base or from the UserCheck page of the DLP tab. The procedure below shows how to create the object from the Rule Base.

To create a UserCheck object that includes a message:

  1. In the Data Loss Prevention > Policy rule base > Action column, select one of these interaction modes:
    • Inform user - Show an informative message users. Users can continue to the application or cancel the request.
    • Ask user - Show a message to users that asks them if they want to continue with the request or not. To continue with the request, the user is expected to supply a reason.
    • Prevent - Show a message to users and block the application request.
  2. Select New UserCheck or one of the existing UserCheck Interaction objects.

    If you selected New UserCheck, the UserCheck Interaction window opens on the Message page.

  3. Enter a name for the UserCheck object and, optionally, a comment.
  4. Select a language (English is the default) from the Languages tabs.
  5. Click Add logo to add a graphic, such as company logo.

    Note - The graphic must have a height and width of 176 x 52 pixels.

  6. Click the text box adjacent to the picture and enter title text for the message.

    Note - Right-clicking inside any of the text boxes gives you the option to Switch to HTML mode and enter HTML code directly. Switching to HTML mode closes the formatting toolbar.

  7. In the page title, message subject, and message body text boxes, enter the message content. You can:
    1. Use the formatting toolbar to change text color, alignment, add or remove bullets.
    2. Insert field variables for:
      • Username
      • Original URL
      • Source IP
      • Incident ID
      • Violation protocol
      • Email subject / File name
      • Matched Rules Notifications

      Variables are replaced with applicable values when the (Prevent, Ask, Inform) action occurs and the message shows. The Username can only be displayed if the Identity Awareness blade is enabled.

    3. Use the Insert User Input variable to add a:
      • Confirm checkbox - Users select a checkbox to continue
      • Textual Input - Users can enter an explanation for their activity or other text according to the instructions. Edit the default text in the Textual Input box based on your business needs.
      • Wrong report category - Users can click a link to report that an incorrect category was included in the message. Use this field with the Category variable.
  8. Optional: Click Preview in browser to see the results in your default browser.

Plain Text Email Notifications

Not all emails clients can handle emails in rich text or HTML format. To accommodate such clients, you can configure the gateway to send emails without images.

To configure emails without images:

  1. On the DLP gateway, open this file for editing:

    $FWDIR/conf/usrchkd.conf

  2. Locate the send_emails_with_no_images entry.
  3. Change the value to true.
  4. Save and close the file.
  5. Kill the userchkd process.

    The process is automatically restarted by the gateway. The new configuration will survive a gateway reboot.

    Email notifications are now sent in both plain text and HTML formats. The user's email clients decides which format to show.

More UserCheck Interaction Options

For each UserCheck Interaction object you can configure these options from the UserCheck Interaction window:

Localizing and Customizing the UserCheck Portal

After you set the UserCheck interaction object language, you can translate the Portal OK and Cancel buttons to the applicable language. For more information, see: sk83700.

The DLP UserCheck predefined notifications are in only English by default. If necessary, you can add more languages manually.

To support more languages:

  1. Select a UserCheck interaction object and click Edit.
  2. In UserCheck Interaction > Message, click Languages.
  3. From the list, select the applicable language.
  4. Click OK.

    A tab for the language is added.

  5. Enter the necessary text and click OK.