RDP in bastion mode

This chapter contains an example of a basic Fudo PAM configuration, to monitor RDP access to a remote server. In this scenario, the user connects to the remote server in bastion mode by specifying the privileged account in the username string. Bastion mode enables facilitating privileged accounts monitoring while preserving default protocols port numbers.

../../_images/quickstart_overview_rdp.png

Prerequisites

Description below assumes that the system has been already initiated. The initiation procedure is described in the System initiation topic.


Configuration

../../_images/data_modeling1.png

Adding a server

Server is a definition of the IT infrastructure resource, which can be accessed over one of the specified protocols.

  1. Select Management > Servers.
  2. Click Add and select Static server.
  1. Provide essential configuration parameters:
Parameter Value
Name rdp_server
Description fail
Blocked fail
Protocol RDP
Security Standard RDP Security
Bind address 10.0.150.151
   
Permissions  
Granted users fail
   
Server addresses  
IP address 10.0.234.6
Port 3389
  1. Click i to download the target server’s public key.
  2. Click Save.

Adding a user

User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login and domain combination, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.


  1. Select Management > Users.
  2. Click Add.
  3. Provide essential user information:
Parameter Value
General  
Login john_smith
Fudo domain fail
Blocked fail
Account validity Indefinite
Role user
Preferred language English
Safes fail
Full name John Smith
Email john@smith.com
Organization fail
Phone fail
AD Domain fail
LDAP Base fail
   
Permissions  
Granted users fail
   
Authentication  
Authentication failures fail
Enforce static password complexity fail
Type Password
Password john
Repeat password john
  1. Click Save.

Adding a listener

Listener determines server connection mode (proxy, gateway, transparent, bastion) as well as its specifics.

  1. Select Management > Listeners.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
General  
Name rdp_listener_bastion
Blocked fail
Protocol RDP
Security Standard RDP Security
Announcement fail
   
Permissions  
Granted users fail
   
Connection  
Mode bastion
Local address 10.0.150.151
Port 3389
External address fail
External port fail
  1. Click i to generate the proxy server’s private key or i to upload the .PEM file private key definition.
../../_images/quickstart_rdp_proxy.png

Note

For security reasons the form displays server’s public key derived from the generated or uploaded private key.

  1. Click Save.

Adding an account

Account defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.

  1. Select Management > Accounts.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
General  
Name admin_rdp_server
Blocked fail
Type regular
Session recording all
OCR sessions ok
OCR Language English
Notes fail
   
Data retention  
Override global retention settings fail
Delete session data after 61 days
   
Permissions  
Granted users fail
   
Server  
Server rdp_server
   
Credentials  
Domain fail
Login administrator
Replace secret with with password
Password password
Repeat password password
Password change policy Static, without restrictions
  1. Click Save.

Defining a safe

Safe directly regulates user access to monitored servers. It specifies available protocols’ features, policies and other details concerning users and servers relations.

  1. Select Management > Safes.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
General  
Name rdp_safe
Blocked fail
Notifications fail
Login reason fail
Require approval fail
Policies fail
Note access No access
   
Protocol functionality  
RDP ok
SSH fail
VNC fail
  1. Select Users tab.
  2. Click Add user.
  3. Find John and click ..
  4. Click OK.
  5. Select Accounts tab.
  6. Click Add account.
  7. Find the admin_rdp_server object and click ..
  8. Click OK.
  9. Click in the Listeners column.
  10. Find the rdp_listener_bastion object and click ..
  11. Click OK.
  12. Click Save.

Establishing an RDP connection with a remote host

  1. Launch RDP client of your choice.
  2. Enter destination host IP address and RDP service port number.
../../_images/rdp_connect1.png
  1. Enter user login along with the account name specified in the username string (john_smith#admin_rdp_server) and password.
../../_images/rdp_client_user_credentials.png

Note

  • In case you do not specify login credentials, Fudo will display the internal login screen to enter the account name along with the username and password.
../../_images/rdp_bastion_login_screen.png ../../_images/rdp_logged.png

Viewing user session

  1. Open a web browser and go to the 10.0.150.151 web address.
  2. Enter the login and password to login to the Fudo PAM administration panel.
  1. Select Management > Sessions.
  2. Find John Smith’s session and click i.
../../_images/rdp_bastion_ongoing.png

Related topics: