HTTP¶
This chapter contains an example of a basic Fudo PAM configuration, to monitor access to Twitter over HTTPS. In this scenario, the user uses its individual login credentials to log in to a monitored Twitter account. The connection will timeout after 15 minutes (900 seconds) and the user will have to login again to continue browsing the server’s contents.
Warning
HTTP rendering is a CPU intensive process and may have negative impact on system’s performance. A physical appliance is recommended for monitoring rendered HTTP connections with the following limitations regarding the maximum number of concurrent rendered HTTP sessions.
Model | Maximum recommended number of concurrent HTTP sessions* |
---|---|
F100x | 2 |
F300x | 5 |
F500x | 10 |
* The actual value depends on the Fudo PAM instance configuration.
Prerequisites¶
The following description assumes that the system has been already initiated. For more information on the initiation procedure refer to the System initiation topic.
Configuration¶
Adding a server
is a definition of the IT infrastructure resource, which can be accessed over one of the specified protocols.
- Select > .
- Click and select Static server.
- Provide essential configuration parameters:
Parameter | Value |
---|---|
General | |
Name | twitter |
Description | |
Blocked | |
Protocol | HTTP |
HTTP timeout | 900 |
Bind address | 10.0.236.70 |
Use TLS | |
Legacy ciphers | |
Use root store certificates | |
CA certificate | Click i to upload a certificate. |
Permissions | |
Granted users | |
Server addresses | |
Address | twitter.com |
Port | 443 |
Server certificate | Click i to fetch server’s certificate. |
HTTP host | |
Authentication method | Twitter |
- Click .
Adding a user
User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login and domain combination, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.
- Select > .
- Click .
- Provide essential user information:
Parameter | Value |
---|---|
General | |
Login | john_smith |
Fudo domain | |
Blocked | |
Account validity | Indefinite |
Role | user |
Preferred language | English |
Safes | |
Full name | John Smith |
john@smith.com |
|
Organization | |
Phone | |
AD Domain | |
LDAP Base | |
Permissions | |
Granted users | |
Authentication | |
Authentication failures | |
Enforce static password complexity | |
Type | Password |
Password | john |
Repeat password | john |
- Click .
Adding a listener
determines server connection mode (proxy, gateway, transparent, bastion) as well as its specifics.
- Select > .
- Click .
- Provide essential configuration parameters:
Parameter | Value |
---|---|
General | |
Name | twitter_listener |
Blocked | |
Protocol | HTTP |
Render sessions | |
Permissions | |
Granted users | |
Connection | |
Mode | proxy |
Local address | 10.0.236.70 |
Port | 997 |
Use TLS | |
Legacy ciphers | |
TLS certificate | Click i to generate a certificate. |
- Click .
Adding an account
defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.
- Select > .
- Click .
- Provide essential configuration parameters:
Parameter | Value |
---|---|
General | |
Name | twitter_admin |
Blocked | |
Type | regular |
Session recording | all |
Notes | |
Data retention | |
Override global retention settings | |
Delete session data | default settings |
Permissions | |
Granted users | |
Server | |
Server | twitter |
Credentials | |
Domain | |
Login | YourTwitterAccountUsername |
Replace secret with | with password |
Password | ****** |
Repeat password | ****** |
Password change policy | Static, without restrictions |
- Click .
Defining a safe
directly regulates user access to monitored servers. It specifies available protocols’ features, policies and other details concerning users and servers relations.
- Select > .
- Click .
- Provide essential configuration parameters:
Parameter | Value |
---|---|
General | |
Name | twitter_safe |
Blocked | |
Notifications | |
Login reason | |
Require approval | |
Policies | |
Note access | No access |
Users | john_smith |
Protocol functionality | |
RDP | |
SSH | |
VNC |
- Select Users tab.
- Click .
- Find John and click ..
- Click .
- Select Accounts tab.
- Click .
- Find the
twitter_admin
object and click .. - Click .
- Click in the Listeners column.
- Find the
twitter_listener
object and click .. - Click .
- Click .
Connecting to remote resource¶
- Launch a web browser.
- Go to the
10.0.236.70:997
web address. - Enter user login and password and press the [Enter] key or click the Login button.
Note
In case you are authenticating using two factors, input your static password along with the dynamic factor (token value) in the password field as a single string of characters.
- Continue browsing the website.
Viewing user session¶
- Open a web browser and go to the Fudo PAM administration page.
- Enter user login and password to log in to Fudo PAM administration panel.
- Select > .
- Find John’s session and click i.
Related topics: