Identity Collector Service Account Exclusion

Overview

About Service Accounts

A is a user account that provides a security context for services that run on Windows Server operating systems. The security context determines which local and network resources a service can use.

Identity CollectorClosed Check Point dedicated client agent installed on Windows Servers in your network. Identity Collector collects information about identities and their associated IP addresses and sends it to the Check Point Security Gateways or Infinity Identity solution for identity enforcement, you can download the Identity Collector package from the Support Center. gets information for usernames and for device Service Accounts.

The Identity Collector Service Account Exclusion feature automatically detects Service Accounts to conserve resources and lessen user management overhead on an Identity AwarenessClosed Check Point Software Blade on a Security Gateway that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA. Gateway.

Example

When the Identity Collector identifies a login event, it creates a new entry in a <key>:<value> pair format.

For example: user_1:192.168.1.10

The process counts each time it identifies a login event for the same <key>:<value pair. When the number of simultaneous logins exceeds a pre-configured threshold value, the account is defined as a . The same account (username) can have more than one associated IP address.

If Service Account Exclusion is configured, the session is revoked and the account is removed from the database on the Identity Awareness Gateway. All the information for this account is deleted.

Important - This feature is enabled by default.

Terms

Term

Description

Detect Mode

The process detects Service Accounts and does not revoke sessions. The process shows the list of detected Service Accounts.

Prevent Mode (Auto-Exclude Mode)

Identity Collector detects Service Accounts, revokes the account's current sessions, and blocks any future sessions.

Detection Interval

The time interval, during which Identity Collector counts the number of logins to identify the account as a . When Prevent Mode (Auto Exclude) is enabled, the administrator can add Service Accounts to the exception list.

Exception

Identity Collector treats accounts on the exception list as regular accounts, and does not revoke future sessions from these accounts. When Prevent Mode (Auto Exclude) is enabled, the administrator can add Service Accounts to the exception list.

Threshold

The minimum number of simultaneous logins for the same account during the Detection Interval that identifies it as a .

Example:

The Detection Interval is 5 minutes and the threshold is 100 simultaneous logins.

If there are 100 or more simultaneous logins during this interval, Identity Collector treats the account as a .

Database

Identity Awareness Gateway saves the session identifier and username c associated with an identified in the $FWDIR/conf/idc_servacc.db file. The information loads from the file after a policy installation or reboot.

Configuration on Identity Awareness Gateway

The administrator can exclude the applicable information from the Identity Awareness process (Policy Decision Point / PDPClosed Check Point Identity Awareness Security Gateway that acts as Policy Decision Point: acquires identities from identity sources; shares identities with other gateways.) and its memory to conserve the gateway resources.

Parameter

Description

Mode

By default, the Prevent Mode (Auto-Exclude) is enabled. When Prevent Mode is enabled, Detect Mode is disabled. When you disable Prevent Mode, Detect Mode is enabled.

Note - When you change from Detect Mode to Prevent Mode, the PDP revokes all sessions that are marked as a .

See pdp idc > "service_accounts <options>".

Threshold

Configure the number of simultaneous logins, after which the PDP detects all usernames as Service Accounts.

The default detection interval is 100 login events from the same account.

See pdp idc > "service_accounts <options>"

Detection Interval

Configure the length of the interval.

The default is 1 hour.

Note - A change in the interval length affects the detection interval for the Multi-User Host (MUH) feature. For more information, see Identity Awareness Clients Administration Guide.

  1. Connect to the command line on the Identity Awareness Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / each Cluster MemberClosed Security Gateway that is part of a cluster..

  2. Log in to the Expert mode.

  3. Back up the current $FWDIR/conf/pdp_overriding_attrs.C file, if it exists:

    cp -v $FWDIR/conf/pdp_overriding_attrs.C{,_BKP}

  4. Edit the current $FWDIR/conf/pdp_overriding_attrs.C file:

    vi $FWDIR/conf/pdp_overriding_attrs.C

  5. Configure the applicable value for the idc_muh_interval attribute:

    (
    :idc_muh_serviceaccount_interval (NUMBER OF SECONDS)
    )

    Default Value: 3600 seconds

    Accepted Values: 1 to 86400 seconds

  6. Save the changes in the file and exit the editor.

  7. In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., install the Access Control policy.

Limitations

  • In a ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. and in Scalable Platforms, the Cluster Members and Security Group Members do not synchronize the information about Service Accounts.

    • In ClusterXL High Availability mode, detection and exclusion restarts after a cluster fail-over.

    • In ClusterXL Load Sharing mode and Scalable Platforms, each Cluster Member and Security Group Member detects its own Service Accounts.

      As a workaround, we recommend that you add a filter in the Identity Collector with the known Service Accounts. See .

  • If a entry already exists in the exception list, this is the only command that removes it from the exception list (see pdp idc > "service_accounts <options>"):

    pdp idc service_accounts delete_exception <username_1> <username_2> ... <username_N>

    After the account's session times out, the PDP removes the account from the exception list.

  • An Identity Collector that identifies login events with User Principal Name (UPN) (example: user_1@domain.com) records the account with the SAMAccountName property (example: user_1).

Troubleshooting

Step

Instructions

1

Connect to the command line on the Identity Awareness Gateway.

2

Log in to the Expert mode.

3

Run:

pdp __ed show_srv_account_tracker

Example Output:

auto_test_106->5

Output Explanation:

The account (user) auto_test_106 uses 5 different IP addresses (5 sessions).

If you configure the threshold value to 6, the next login event matches the threshold value and marks the account as a .

Step

Instructions

1

Connect to the command line on the Identity Awareness Gateway.

2

Log in to the Expert mode.

3

Configure the PDP debug options (see pdp debug):

pdp debug set IDC all CCC_SERVICE all IDC_SRV_ACC_PERSISTENCE_DB all IDP all

4

Start the PDP debug:

pdp debug on

5

Replicate the issue.

6

Set the PDP debug options:

pdp debug reset

pdp debug set TRACKER all

7

Stop the PDP debug:

pdp debug off

8

Collect and examine the debug output files:

$FWDIR/log/pdpd.elg*

This excerpt from a debug shows a new login event record for the user account "johndoe":

[9619 4058363776]@MyGW[26 Apr 13:50:26]  [CCC_SERVICE (TD::Events)] pdp::IDCEvent::shouldPreventAccount: service account mechanism is in detection mode, no prevention.

[9619 4058363776]@MyGW[26 Apr 13:50:26]  [IDC (TD::Events)] pdp::AssociationsDB::addAccountByIPToIPMap: first login of that username

[9619 4058363776]@MyGW[26 Apr 13:50:26]  [IDC (TD::Events)] pdp::AssociationsDB::aboveServiceAccountThreshold: account johndoe has 1 connected IPs and does not exceed the service account threshold (6)

[9619 4058363776]@MyGW[26 Apr 13:50:26]  [CCC_SERVICE (TD::Events)] pdp::IDCEvent::addUserToServiceAccountMechanism: account johndoe was considered in service account detection mechanism

An administrator configured the Prevent Mode (Auto-Exclude Mode).

This excerpt from a debug shows that:

  1. The user account "johndoe" exceeds the configured threshold.

  2. The PDP increments the counter.

  3. The user account "johndoe" is a .

  4. The PDP revokes the current sessions for this user account.

[15408 4057798528]@MyGW[28 Apr 13:12:02]  [IDC (TD::Events)] pdp::AssociationsDB::aboveServiceAccountThreshold: account johndoe is above service account threshold

[15408 4057798528]@MyGW[28 Apr 13:12:02]  [CCC_SERVICE (TD::Events)] pdp::IDCEvent::shouldPreventAccount: the user johndoe is a new service account and prevention is on, reporting it as service account and revoking existing sessions.

An administrator configured the Detect Mode.

This excerpt from a debug shows that the PDP records a user (account) login:

[27214 4058212224]@MyGW[28 Apr 10:32:06]  [CCC_SERVICE (TD::Events)] pdp::IDCEvent::shouldPreventAccount: service account mechanism is in detection mode, no prevention.

[27214 4058212224]@MyGW[28 Apr 10:32:06]  [IDC (TD::Events)] pdp::AssociationsDB::aboveServiceAccountThreshold: account johndoe has 2 connected IPs and does not exceed the service account threshold (3)

[27214 4058212224]@MyGW[28 Apr 10:32:06]  [CCC_SERVICE (TD::Events)] pdp::IDCEvent::addUserToServiceAccountMechanism: account johndoe was considered in service account detection mechanism