BeyondTrust
This guide provides information and steps for integrating BeyondTrust Password Safe with Linux Control Center.
BeyondTrust Password Safe is an enterprise password manager software which ensures complete control and accountability over all privileged (and non privileged) accounts within an organization.
Through this integration it will be possible to perform a Discover using privileged credentials managed by Password Safe, Import Assets from Password Safe and retrieve a secrets such as credentials, files and texts from BeyondTrust Secrets Safe.
Version Requirements
BeyondInsight 22.X and later.
Linux Control Center 2.0 and later.
BeyondTrust Password Safe Configuration
API registration key.
API account and group with correct permissions.
Managed Account used by Linux Control Center must be API enabled and should exist to the Managed System.
The Managed Account it is preferred that it be a dedicated account for the Linux Control Center.
All assets that will be imported into Linux Control Center must be added to BeyondInsight Password Safe from a Discovery Scan to ensure the integrity of the data that must be imported correctly. The same goes for Managed System, that is it must have been created from an Asset, and their respective Managed Accounts.
API Registration
To register a new API:
In the BeyondInsight Console, go to Configuration > General > API Registrations, click on Create New API Registration and select API Key Policy.
Provide a name for the API registration and click Create API Registration.
You must add an Authentication/IP rule for the address of your Linux Control Center Worker instance. If there are multiple workers installed on the network, all worker addresses must be listed.
On the Details page, click Add Authentication Rule.
From the Type dropdown list, select Single IP Address.
Select the IP Rule option.
Provide the IP address.
Disable the Enforce Multi-Factor Authentication checkbox option.
On the Details page, click Update Registration.
API Account and Group
An API account and group must be configured for use by Linux Control Center. To create a new user:
In the BeyondInsight Console, go to Configuration > Role Based Access > User Management. Click the Users tab.
Click Create New User and select Create a New User.
Provide user details, such as identification and credentials, and click Create User.
To create a new group and enable features and Smart Groups for that group:
In the BeyondInsight Console, go to Configuration > Role Based Access > User Management. Click the Groups tab.
Click Create New Group and select Create a New Group.
Provide group name and description, and then click Create Group.
Check the box next to the newly created group, and then click the ellipsis to the right of the group. Select View Group Details.
Under Group Details, select Features.
On the Features page, locate features by selecting All Features in the Show dropdown list. Select Feature Name under the Filter By dropdown list, and then type the feature in the Feature Name field. The following features must be enabled:
Asset Management
Attribute Management
Password Safe Account Management
Password Safe System Management
The above features must be assigned a permission of read only. Click the corresponding ellipsis to the right of the feature, and then select Assign Permissions Read Only.
Under Group Details, select Smart Groups.
On the Smart Groups Permissions page, locate Smart Groups by selecting All Smart Groups in the Show dropdown list. Select Smart Group Name under the Filter By dropdown list, and then type the Smart Group in the Smart Group Name field. The target Managed Account Smart Group must be enabled.
The Smart Groups must be assigned a permission of full control. Click the corresponding ellipsis to the right of the Smart Group, then select Assign Permissions Full Control.
The target Smart Group must have Requestor, Approver and Credential Manager selected as a role. Click the corresponding ellipsis to the right of the Smart Group, and then select Edit Password Safe Roles.
Check the Requestor box, and then select a policy from the Access Policy for Requestor dropdown list. This policy is applied to the managed account that is used for the discover.
Click Save Roles.
To add the API user created above to the group:
Go to Configuration > Role Based Access > User Management > Groups.
Click the ellipsis to the right of the new group, and then select View Group Details.
Under Group Details, select Users.
Select Users Not Assigned from the Show dropdown list.
In the Filter by dropdown list, select Username. Type the user name in the Username field.
Check the box beside the user name, and then click Assign User.
Finally, assign the API that was registered for the integration to this group:
Go to Configuration > Role Based Access > User Management > Groups.
Click the ellipsis to the right of the new group, and then select View Group Details.
Under Group Details, select API Registrations. A list of API registrations is displayed.
Check the box beside the API registration created above.
Managed Account Used by Linux Control Center
To confirm the account is enabled for use with API:
In the BeyondInsight Console, go to Managed Accounts.
In the Filter by dropdown list, select Account. Enter the account name in the Account field.
Click the ellipsis to the right of each entry, and then select Edit Account. Under Account Settings, make sure the API Enabled is enabled.
Linux Control Center Configuration
BeyondTrust Configuration Page
In the Linux Control Center console, go to Config > Integrations follow and click on BeyondTrust Configuration button
Provide all necessary settings to perform authentication on the Password Safe API such as API Url Base, API Auth Key, API Auth Username, API Auth Password and the Managed Account that will be used by Linux Control Center.
Select the Privilege Escalation Type field from dropdown list based on the chosen account permission.
Click Save.
After saving, a test connection will be made to validate communication with BeyondInsight. If the connection fail, go to BeyondInsight -> Configuration -> User Audit options and analyze the connection details.
Get Assets Info
Get Assets Info option searches for All Managed Systems of the Smart Group linked to the User Group of the API Auth Username used.
To perform a Get Assets Info go to Config > Integrations > BeyondTrust and click Get Assets Info and Yes.
A new job will be created with the action "Get Smart Groups" of the User Group belonging to the Auth Username API. To follow the action go to Logs > Queue.
After the job is completed, all Managed Systems will be available to perform a Import Asset Action.
Import Assets
The Managed Account used in configuration must be exist on Managed Systems for the Linux Control Center perform a correct authentication workflow.
To list which assets are available to import to Linux Control Center, go to Config > Integrations > BeyondTrust and click Import Assets.
Select the assets that will be import by Import Assets process and click Send.
A new action called "Import Assets" will be created to validate the assets on the network.
After validating the asset, the Linux Control Center will start a new job with the "Photography" action for each imported host, fetching host information such as hostname, kernel version, ipv4 address, mac address, ssh port and os version.
After successfully Processed go to Left Menu Hosts option, and validate that assets were imported correctly by Linux Control Center with the BeyondTrust Authentication Method.
Last updated
