UserCheck Interaction Objects

Configuring UserCheck

Configuring the Security Gateway for UserCheck

Enable or disable UserCheck directly on the Security Gateway. The DLP tab > Gateways window shows a list of Security Gateways with the DLP blade enabled.

To configure a Security Gateway for UserCheck:

1. Select a gateway and click Edit.

   The Gateway Properties window opens.

2. On the UserCheck page, select Enable UserCheck for active blades.
3. Enter the information for the UserCheck Web portal:
   • In the Main URL field, enter the primary URL for the web portal that shows the UserCheck notifications.

     If the Main URL points to an external interface, set Accessibility > Edit to Through all interfaces or According to the firewall policy.

     If users connect to the gateway remotely, set the internal interface of the gateway (on the Topology page) to be the same as the Main URL for the UserCheck portal.

     Note - The Main URL field must be manually updated if:

     • The Main URL field contains an IP address and not a DNS name.
     • You change a gateway's IPv4 address to IPv6 or vice versa.
   • In the IP address field, enter the IP address that the URL resolves to.
   • Click Aliases to add URL aliases that redirect different hostnames to the Main URL, for example: Usercheck.mycompany.com. The aliases must be resolved to the portal's IP address on the corporate DNS server
4. In the Certificate area, click Import to import a certificate that the portal uses to authenticate to the server.

   By default the portal uses a certificate from the Check Point Internal Certificate Authority (ICA). This might generate warnings if the user's browser does not recognize Check Point as a trusted Certificate Authority. To prevent these warnings, import your own certificate from a recognized external authority.

   Even though DLP interactions are displayed in a secure (https) portal, the main URL for the UserCheck portal starts with http:// and is not secured by a certificate. You might consider using a valid certificate to secure the main portal URL when using UserCheck for DLP violations.

5. In the Accessibility area, click Edit to configure interfaces on the gateway through which the portal can be accessed. These options are based on the topology configured for the gateway. Users are sent to the UserCheck portal if they connect:
   • According to the Firewall policy. Select this option if there is a rule that states who can access the portal.
   • Through all interfaces
   • Through internal interfaces (default)
     • Including undefined internal interfaces
     • Including DMZ internal interfaces
     • Including VPN encrypted interfaces (default)

     Note: If Including VPN encrypted interfaces is selected, add a Firewall rule that looks like this:

   Source	Destination	VPN	Service	Action
   Any	Gateway on which UserCheck client is enabled	Any Traffic	UserCheck	Accept

6. In the UserCheck Client area, select Activate UserCheck Client Support.
   • The UserCheck client enables user interaction notifications.
   • Click Download Client to download the installation file for the UserCheck client.

     Note: The link will not be active until the UserCheck portal is up.

7. Click OK.
8. Install policy.

The Security Gateway has an internal persistence mechanism that preserves UserCheck notification data if the gateway or gateway cluster reboots. Records of a user answering or receiving notifications are never lost.

UserCheck CLI

Usrchk

You can use the usrchk command in the gateway command line to show or clear the history of UserCheck objects.

usrchk [debug] [hits] [incidents]

debug

hits

incidents

Examples:

• To show all UserCheck interaction objects, run: usrchk hits list all
• To clear the incidents for a specified user, run: usrchk hits clear user <username>

Notes:

• You can only run a command that contains user <username> if:
  • Identity Awareness is enabled on the gateway.
  • Identity Awareness is used in the same policy rules as UserCheck objects.
• To run a command that contains a specified UserCheck interaction object, first run usrchk hits list all to see the names of the interaction objects. Use the name of the interaction object as it is shown in the list.

Kerberos Single Sign On

The UserCheck agent supports single sign on using the Kerberos network authentication protocol. Kerberos is the default authentication protocol used in Windows 2000 domains and above.

The Kerberos protocol is based on the idea of tickets, encrypted data packets issued by a trusted authority, in this case the Active Directory (AD). When a user logs in, the user authenticates to a domain controller that provides an initial ticket granting ticket (TGT). This ticket vouches for the user’s identity.

When the user needs to authenticate against the DLP gateway through the UserCheck agent, the agent presents this ticket to the domain controller and requests a service ticket (SR) for a specific resource (the DLP gateway). The UserCheck agent presents this service ticket to the gateway.

For more detailed information on Kerberos SSO, see:

• http://web.mit.edu/Kerberos/
• http://technet.microsoft.com/en-us/library/bb742433.aspx

Single Sign-On Configuration

SSO configuration has two steps:

• AD Configuration

  Creating a user account and mapping it to a Kerberos principal name.

• SmartDashboard Configuration

  Creating an LDAP Account Unit and configuring it to support SSO.

AD Configuration

The AD configuration involves:

• Creating a New User Account
• Mapping the User Account to a Kerberos Principle Name

Creating a new User Account

1. In Active Directory, open Active Directory Users and Computers (Start > Run > dsa.msc)
2. Add a new user account. You can choose any username and password. For example: a user account named ckpsso with the password 'qwe123!@#' to the domain corp.acme.com.
3. Clear User must change password at next logon and select Password Never Expires.

Mapping the User Account to a Kerberos Principle Name

This step uses the ktpass utility to create a Kerberos principal name that is used by both the gateway and the AD. A Kerberos principal name consists of a service name (for the DLP gateway that the UserCheck agent connect to) and the domain name to which the service belongs.

Ktpass is a command-line tool available in Windows 2000 and higher.

Retrieve the correct executable

You must install the correct ktpass.exe version on the AD. Ktpass.exe is not installed by default in Windows 2003.

• Windows 2003:
  1. Retrieve the correct executable for your service pack from the Microsoft Support site prior to installation. It is part of the Windows 2003 support tools. For example, AD 2003 SP2 requires support tools for 2003 sp2.
  2. Download the support.cab and suptools.msi files to a new folder on your AD server.
  3. Run the suptools.msi.
• ActiveDirectory 2008:

  The ktpass utility is already installed on your server in the Windows\System32 folder and you can run the command line. You need to open the command prompt as an administrator by right clicking it and selecting "run as an Administrator".

Use Ktpass

1. Open a command line to run the ktpass tool (Start > Run > cmd).
2. At the command prompt, run ktpass with this syntax:

   C:> ktpass -princ ckp_pdp/domain_name@DOMAIN_NAME -mapuser username@domain_name -pass password -out unix.keytab –crypto RC4-HMAC-NT

   Important - Enter the command exactly as shown. It is case-sensitive.

   This is an example of running ktpass with these parameters:

The AD is ready to support Kerberos authentication for the Security Gateway.

The example above shows the ktpass syntax on Windows 2003. When using Windows 2008/2008 R2 Server, the ktpass syntax is slightly different. Parameters are introduced using a forward slash "/" instead of a hyphen "-".

Example (Windows 2008):

ktpass /princ ckp_pdp/corp.acme.com@CORP.ACME.COM /mapuser ckpsso@corp.acme.com /pass qweQWE!@# /out unix.keytab /crypto RC4-HMAC-NT

Authentication Failure

Authentication will fail if you have used the ktpass utility before for the same principal name (ckp_pdp/domain_name@DOMAIN_NAME) but with a different account.

If you have used the ktpass utility before:

1. On the AD server, run:

   ldifde -f check_SPN.txt -t 3268 -d "dc=corp,dc=acme,dc=com" -l servicePrincipalName -r "(servicePrincipalName=ckp_pdp*)" -p subtree

2. Open the check_SPN.txt file and verify that only one record is present.

   If multiple records exist, you must delete the different account or remove its association to the principal name.

   Remove the association with the principle name by running:

   settspn –D ckp_pkp/domain_name old_account name.

   For example:

   setspn –D ckp_pdp/corp.acme.com ckpsso

SmartDashboard Configuration

In SmartDashboard you need to configure an LDAP Account Unit to support SSO

To configure the account unit:

1. Add a new host to represent the AD domain controller. Go to Network Objects tab > Nodes > Node > Host.
2. Enter a name and IP address for the AD object and click OK.
   For example, ADServer.
3. Add a new LDAP Account Unit.

   Select Servers and OPSEC Applications in the Objects Tree. Right-click Servers > New > LDAP Account Unit.

4. In the General tab of the LDAP Account Unit:
   1. Enter a name.
   2. In the Profile field, select Microsoft_AD.
   3. In the Domain field, enter the domain name. It is highly recommended to fill this field for existing account units that you want to use for Identity Awareness. Entering a value into this field will not affect existing LDAP Account Units.
   4. Select CRL retrieval and User management.
5. Click Active Directory SSO configuration and configure the values (see example):
   1. Select Use kerberos Single Sign On.
   2. Enter the domain name.
      For example, CORP.ACME.COM
   3. Enter the account username you created in Creating a New User Account.
      For example, ckpsso.
   4. Enter the account password for that user (the same password you configured for the account username in AD) and confirm it.
   5. Leave the default settings for Ticket encryption method.

   6. Click OK.
6. In the Servers tab:
   1. Click Add and enter the LDAP Server properties.
   2. In the Host field, select the AD object you configured in step 4 above.
   3. In the Login DN field, enter the login DN of a predefined user (added in the AD) used for LDAP operations.
   4. Enter the LDAP user password and confirm it.
   5. In the Check Point Gateways are allowed to section, select Read data from this server.
   6. In the Encryption tab, select Use Encryption (SSL), fetch the fingerprint and click OK.

   LDAP over SSL is not supported by default. If you did not configure your domain controller to support LDAP over SSL, do it now or make sure this option is not selected.

7. In the Objects Management tab:
   1. In the Manage objects on field, select the AD object you configured in step 4 above.
   2. Click Fetch Branches to configure the branches in use.
   3. Set the number of entries supported.
8. In the Authentication tab, select Check Point Password in the Default authentication scheme and click OK.

UserCheck Page

On the UserCheck page, you can create, edit, and preview UserCheck interaction objects and their messages. It has these options:

These are the default UserCheck messages:

Ask and Inform pages include a Cancel button that users can click to cancel the request.

You can preview each message page in these views:

• Regular view - How the message shows in a web browser on a PC or laptop
• Mobile Device - How the message shows in a web browser on a mobile device
• Email - How the message shows in email
• Agent - How the message shows in the agent

Creating UserCheck Interaction Objects

Create a UserCheck Interaction object from the Rule Base or from the UserCheck page of the DLP tab. The procedure below shows how to create the object from the Rule Base.

To create a UserCheck object that includes a message:

1. In the Data Loss Prevention > Policy rule base > Action column, select one of these interaction modes:
   • Inform user - Show an informative message users. Users can continue to the application or cancel the request.
   • Ask user - Show a message to users that asks them if they want to continue with the request or not. To continue with the request, the user is expected to supply a reason.
   • Prevent - Show a message to users and block the application request.
2. Select New UserCheck or one of the existing UserCheck Interaction objects.

   If you selected New UserCheck, the UserCheck Interaction window opens on the Message page.

3. Enter a name for the UserCheck object and, optionally, a comment.
4. Select a language (English is the default) from the Languages tabs.
5. Click Add logo to add a graphic, such as company logo.

   Note - The graphic must have a height and width of 176 x 52 pixels.

6. Click the text box adjacent to the picture and enter title text for the message.

   Note - Right-clicking inside any of the text boxes gives you the option to Switch to HTML mode and enter HTML code directly. Switching to HTML mode closes the formatting toolbar.

7. In the page title, message subject, and message body text boxes, enter the message content. You can:
   1. Use the formatting toolbar to change text color, alignment, add or remove bullets.
   2. Insert field variables for:
      • Username
      • Original URL
      • Source IP
      • Incident ID
      • Violation protocol
      • Email subject / File name
      • Matched Rules Notifications

      Variables are replaced with applicable values when the (Prevent, Ask, Inform) action occurs and the message shows. The Username can only be displayed if the Identity Awareness blade is enabled.

   3. Use the Insert User Input variable to add a:
      • Confirm checkbox - Users select a checkbox to continue
      • Textual Input - Users can enter an explanation for their activity or other text according to the instructions. Edit the default text in the Textual Input box based on your business needs.
      • Wrong report category - Users can click a link to report that an incorrect category was included in the message. Use this field with the Category variable.
8. Optional: Click Preview in browser to see the results in your default browser.

Plain Text Email Notifications

Not all emails clients can handle emails in rich text or HTML format. To accommodate such clients, you can configure the gateway to send emails without images.

To configure emails without images:

1. On the DLP gateway, open this file for editing:

   $FWDIR/conf/usrchkd.conf

2. Locate the send_emails_with_no_images entry.
3. Change the value to true.
4. Save and close the file.
5. Kill the userchkd process.

   The process is automatically restarted by the gateway. The new configuration will survive a gateway reboot.

   Email notifications are now sent in both plain text and HTML formats. The user's email clients decides which format to show.

More UserCheck Interaction Options

For each UserCheck Interaction object you can configure these options from the UserCheck Interaction window:

• Message - Modify the message text.
• Languages - Select a default language for the message.
• Fallback Action - For DLP, the fallback action is derived from the original action. If the original action is:
  • Ask - The fallback is Block
  • Inform - The fallback is Detect
• Conditions - Select actions that must occur before users can access the application. Select one or more of these options:
  • User accepted and selected the confirm checkbox - This applies if the UserCheck message contains a checkbox (Insert User Input > Confirm Checkbox). Users must accept the text shown and select the checkbox before they can access the application.
  • User filled some textual input - This applies if the UserCheck message contains a text field (Insert User Input > Textual Input). Users must enter text in the text field before they can access the application. For example, you might require that users enter an explanation for use of the application.

Localizing and Customizing the UserCheck Portal

After you set the UserCheck interaction object language, you can translate the Portal OK and Cancel buttons to the applicable language. For more information, see: sk83700.

The DLP UserCheck predefined notifications are in only English by default. If necessary, you can add more languages manually.

To support more languages:

1. Select a UserCheck interaction object and click Edit.
2. In UserCheck Interaction > Message, click Languages.
3. From the list, select the applicable language.
4. Click OK.

   A tab for the language is added.

5. Enter the necessary text and click OK.