XyLoc Security Server w/ AD Integration (XSS-AD 5.x.x) Administrator's Guide Contacting Ensure Technologies Email: [email protected] Phone: (734) 547-1600 Home Office: Ensure Technologies 135 S Prospect St Suite 100 Ypsilanti, MI 48198 Web: www.ensuretech.com © Ensure Technologies, 1998-2009. All rights reserved. XyLoc and Ensure Technologies are trademarks of Ensure Technologies, Inc. Adobe® and Acrobat® are registered trademarks of Adobe Systems Incorporated. Citrix®, MetaFrame®, and ICA® are registered trademarks of Citrix Systems, Inc. in the United States and other countries. Microsoft®, Windows®, Windows NT®, and Active Directory® are registered trademarks of Microsoft Corporation. Novell®, Novell Directory Services®, NDS®, NetWare®, and eDirectory(cid:31)a re trademarks or registered trademarks of Novell, Inc. Technical information contained herein is subject to change without notice. Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 2 of 65 Table of Contents CONTACTING ENSURE TECHNOLOGIES 2  TABLE OF CONTENTS 3  INTRODUCTION: 6  OVERVIEW OF XSS 6  XSS ARCHITECTURE AND RELIABILITY 6  XSS-AD COMPONENTS 7  XYLOC AD SCHEMA EXTENSION 7  XYLOC AD MANAGEMENT UI 7  XYLOC DATABASE 8  XYLOC SECURITY SERVER SERVICE 8  WEB-BASED MANAGEMENT UI 8  XYLOC CLIENT 8  OVERVIEW OF CLIENT/XSS COMMUNICATION 9  PREPARING FOR IMPLEMENTATION: 10  BEFORE YOU BEGIN 10  OVERVIEW OF KIOSK AND UNIQUE ACCOUNTS 10  UNIQUE ACCOUNTS 10  KIOSK ACCOUNTS 11  KIOSK VS. UNIQUE 11  SERVER REQUIREMENTS 12  APPLICATION INTEGRATION FILE PERMISSIONS 12  INSTALLING XSS-AD: 13  INSTALL ACTIVE DIRECTORY SCHEMA MANAGER: 13  ENABLE ACTIVE DIRECTORY SCHEMA UPDATE: 13  INSTALL XSS-AD SCHEMA: 13  INSTALL XSS-AD USER INTERFACE: 13  VERIFY THE XSS-AD SCHEMA EXTENSION: 14  INSTALL THE XSS DATABASE: 14  INSTALLING THE XSS SERVER 18  INSTALL THE XSS SERVICE COMPONENT: 18  INSTALL THE XSS WEBUI SERVER: 21  UPGRADING FROM PREVIOUS INSTALLATION OF XSS: 27  UPGRADING FROM XSS 2.X.X (CODEBASE) VERSION 27  UPGRADING FROM XSS 3.X.X OR EARLIER 4.XX VERSION 27  USING THE XSS WEB INTERFACE: 28  Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 3 of 65 ACCESSING THE XSS 28  XSS ADMINISTRATIVE ACCOUNTS: 28  XSS HELP MENUS 29  STATUS 29  VIEW XYLOC CLIENT AUTHENTICATION EVENTS: 29  VIEW XYLOC CLIENT HOST EVENTS: 29  VIEW KEY STATUS REPORT: 29  USERS 30  DOWNLOAD 31  USING ACTIVE DIRECTORY USER INTERFACE 32  HOST-BASED KIOSK 32  MANAGING XYLOC USERS 32  XYLOC GENERAL PROPERTY PAGE 33  XYLOC PREFERENCE PROPERTY PAGE 34  MANAGING XYLOC COMPUTERS 35  USER GROUPING 37  XYLOC SETTING PRECEDENCE 37  FUNCTIONAL LIMITATION 38  COMPUTER GROUPING 39  KIOSK ACCOUNTS 39  XYLOC SETTING PRECEDENCE 42  USER VS. HOST BASED RANGE SETTINGS 42  LEGACY XSS-AD MANAGEMENT 44  MANAGING XYLOC USERS: 44  XYLOC GENERAL PROPERTY PAGE 45  XYLOC PREFERENCE PROPERTY PAGE: 47  GROUPING 48  XYLOC SETTING PRECEDENCE 49  FUNCTIONAL LIMITATION 49  KIOSK ACCOUNTS (AVAILABLE IN XSS-MD) 50  XYLOC SETTING PRECEDENCE 53  XYLOC COMPUTER PROPERTY PAGE 53  GROUPING 56  ADMINISTERING XSS SERVICES 57  XSS MONITOR SERVICE 57  XSS-SQL DATABASE UTILITIES 57  LOG MAINTENANCE 59  DEPLOYMENT OF XYLOC CLIENT SOFTWARE 60  INSTALLING THE XYLOC CLIENT LOCALLY 60  ENTERPRISE DEPLOYMENT OF THE XYLOC CLIENT: 61  Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 4 of 65 HELPFUL TIPS 62  IF THE IP ADDRESS OF THE DATABASE SERVER CHANGES: 62  IF THE IP ADDRESS OF THE XSS SERVER CHANGES, OR NEEDS TO BE CHANGED: 62  IF THE ADDRESS OF THE SQL SERVER CHANGES, OR NEEDS TO BE CHANGED: 62  XYLOC CLIENT UPDATE: 62  TROUBLESHOOTING 63  ERROR: “PAGE CANNOT BE DISPLAYED” WHEN BROWSING TO THE XSS START PAGE 63  CHANGES MADE AT THE SERVER ARE NOT PROPAGATING TO THE XYLOC CLIENTS 63  USER’S APPLICATION INTEGRATION CREDENTIALS ARE NOT PROPAGATING TO OTHER CLIENTS 64  Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 5 of 65 Introduction: Overview of XSS XSS-AD is designed to take full advantage of the enterprise-class directory services and management capabilities of Microsoft® Windows 2000/2003 Active Directory. By using the existing Active Directory infrastructure, XSS-AD integrates with the Active Directory seamlessly to store XyLoc information in the Active Directory repository and use the same Active Directory management tool to manage the XyLoc information for either users or computers. Because XSS-AD leverages Microsoft® Windows 2000/2003/2008 Active Directory management tools, additional administrative training is minimal. Administrators can use the same tools to quickly deploy the XyLoc Security System and meet the organization’s security needs. XSS Architecture and Reliability The XSS is designed with the highest level of reliability. This is achieved by the communication mechanism employed between the XyLoc client and the XSS. In the event of a loss of communication on the network or a failure of the server running the XSS software, the XyLoc clients will remain in full operation. The XyLoc client maintains a complete record of its current configuration and log files. If the communication is interrupted between the client and the XSS, the client will continue to maintain its current configuration and log files. Once communication between the XyLoc client and the XSS has been restored, the client will exchange configuration records and log files with the XSS. Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 6 of 65 The following diagram illustrates the general system design concept: Microsoft Active Directory XSS WebUI XyLoc Schema Extension SQL Database XSS Service XyLoc Client XSS-AD Components XSS-AD includes the following components: XyLoc AD Schema Extension XyLoc extends the Active Directory schema to include classes and attributes that are used for XyLoc. The details of these new classes and attributes are described in the Technical Reference: Schema Extension for XSS-AD document available from Ensure Technologies (Drawing#: 510-0100-009) XyLoc AD Management UI This is the UI extension for the new classes and attributes which adds the appropriate “tabs” in the Active Directory Users and Computers MMC. Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 7 of 65 XyLoc Database XyLoc Database stores the daily event logs generated from the XyLoc Client. XyLoc Security Server Service XyLoc Security Server (XSS) provides the link between the XyLoc Client Software and the Active Directory. It retrieves updated information stored in the Active Directory using ADSI (Active Directory Service Interface) and provides this data to the XyLoc Client as well as handling requests from the XyLoc Client software through TCP/IP. Web-based Management UI The XSS web-based management UI is used for the following: 1. Manage XSS Administrators (the XSS Administrator is separate with the actual user, and it is only used by XSS). 2. View Event logs XyLoc Client XyLoc Client software is responsible for handling the XyLoc Security Device and all the security actions. Please reference the XyLoc Client User Guide for more information about the XyLoc Client software. Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 8 of 65 Overview of Client/XSS Communication The XSS Service is used as a centralized communication point between the XyLoc Client and Active Directory. The clients themselves do not communicate directly to AD, but rather communicate to the XSS, and the XSS in turn communicates to AD and then back to the client. The XSS communicates with the XyLoc client software installed on the host by an encrypted TCP/IP protocol. When installing the XyLoc client software the client will prompt the user to enter the XSS IP address during installation. For the hosts to communicate properly with the server, the following must be true: • The XSS receives information from the XyLoc client on TCP port 5102. • The XSS transmits information to the XyLoc client on TCP port 3510. All user and computer configuration is performed within the AD Schema and the installed XyLoc UI using standard AD format. For the most part, the XSS will sit idle waiting for requests from the XyLoc clients. When the XyLoc client hears a XyLoc Key for the first time, if configured with an XSS IP Address, the client service will send a request via TCP/IP to the XSS for information about that KeyID. The XSS will then send a query to AD for that KeyID. Based on the information returned from that query, the XSS will then determine if the requested KeyID is valid for that PC and if so will generate the appropriate user record(s) and send back to the requesting PC. The client will then update the local database with information provided by the XSS and will either allow or disallow the user access with that Key, and if access is allowed, what Login Name and Password is to be used for access. Additional Notes: • The XSS does not push information to the client. Instead it waits for a request from the client before providing information. This limits the load on the network to only the necessary exchange of information. However, any changes made to a user, or the addition/deletion of users, will only occur on the client with the respective keys are presented to the client the next time. • The XyLoc clients will only lookup keys that are heard when the client is in a Locked or Logged Off state. When the client is in use by a valid Key, no database updates are performed. Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 9 of 65 Preparing for Implementation: Before You Begin Before starting the installation of the XSS, take a moment to consider how the XSS and XyLoc products will integrate within your environment. To assist you with this, consider the following: (cid:190) Define the user environment: (cid:137) The number of hosts (Computers) on which XyLoc will be installed. (cid:137) The number of users that will need XyLoc keys. (cid:137) The type of XyLoc accounts that will be deployed. o Unique user account: one XyLoc key per system login account. o Kiosk user account: multiple XyLoc keys per system login account. (cid:137) The desired XyLoc login and unlock authentication. (cid:137) Each host must have an administrator account. (cid:190) Define the client server environment: (cid:137) The static IP address, gateway and subnet mask for the XSS Server. (cid:137) The location of the SQL database server (cid:137) Will all hosts be able to access this IP address? o Verify that the client can communicate to the server via TCP/IP o Verify that the server can communicate to the client via TCP/IP (cid:137) Are there any network security devices between the hosts and the XSS? (cid:137) Will each host have a unique IP address or is some type of address translation (NAT) being used between the clients and the XSS? o NOTE: In some cases both the client and server will act as a “client”, meaning that either can, and will, initiate a connection to the other. For this reason, each client must have a unique IP address as they appear to the server. For instance, if the clients are behind a router using NAT for each client, but the server is not, then the clients will appear to the server with the same IP address…that of the router. This will cause a breakdown in communication. Overview of Kiosk and Unique Accounts There are two main types of user accounts in the XyLoc system: Unique and Kiosk. Both have their advantages and disadvantages. Each functions very differently than the other. This section will provide an overview of how each type functions and the basic differences between the two Unique Accounts Unique accounts are individual user accounts with one XyLoc Key assigned to each account. Each user will log into the PC with their own individual login accounts and have their own Windows profile and desktop and settings. Each user will login to the PC with their individual username and password, and will need to logout when they are finished for anyone else to use the computer with their account. There is a setting in XyLoc to allow another user to force a logoff of a locked workstation in the event the previous user forgets to logoff before leaving the PC, however this is a Windows “Forced Logoff” and all unsaved data from the previous user would be lost. Ensure Technologies – User’ s Guide for XSS-AD ver 4.x.x Drawing#: 510-0100-007 Drawing Rev: 2.00 Rev Date: 09-04-2009 Page 10 of 65