{"id":2286,"date":"2014-06-09T13:42:01","date_gmt":"2014-06-09T19:42:01","guid":{"rendered":"http:\/\/www.jumpcloud.com\/?p=2286"},"modified":"2024-01-12T16:34:33","modified_gmt":"2024-01-12T21:34:33","slug":"know-users-accessing-servers","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/know-users-accessing-servers","title":{"rendered":"Do you know all of the users accessing your servers?"},"content":{"rendered":"\n
One of the most dangerous issues for an IT admin is having dormant admin users on machines. Compliance regulations such as PCI call this issue out (see Section 8, page 46 of the PCI standard<\/a>), but with a large number of servers, applications, and network devices it is often hard to keep track of all of your servers and accounts. Even if you happen to use a directory service like LDAP<\/a> or Active Directory<\/a>, chances are you have some user accounts not connected to those directory services. Also, you may have some servers that aren\u2019t part of the \u201cdomain\u201d. Either way, having an accurate picture of every admin account on all of your systems is an important and critical issue to track.<\/p>\n\n\n\n Today, outside of trusting your OpenLDAP server or AD implementation there isn\u2019t really a good way to solve for this issue. You may write a script to tell you, but that inherently has all of the trouble of ensuring that you know about each server, can log into it, and then can bring back all of the data. With 探花大神, we are going to tell you about two methods that you can solve for this issue.<\/p>\n\n\n\n The first option to solving this issue is to use 探花大神 as your centralized user management platform or what we call Directory-as-a-Service\u00ae. 探花大神\u2019s cloud-based, centralized user management solution can manage Linux (SSH) and Windows user accounts (and Mac user accounts as well among all kinds of other applications and network infrastructure components). You simply create the privileged user account in 探花大神 and then link it in an easy-to-use web-based UI to the servers that the person should have access to. You can manage access across internal servers, virtual servers, and cloud servers across providers and operating systems. We provide a central console for you to manage and track access. If you manage all of your accounts within 探花大神, you can easily add, delete, and modify access controls with just a few clicks. No writing code to manage your users and getting in the middle of handling SSH keys or passwords. 探花大神\u2019s end user portal handles all of those issues for you so that you aren\u2019t in the middle of it \u2013 which by the way is a security risk anyway. 探花大神 will track all access so you have a log of all logins and privileged commands executed by the user. That\u2019s a nice wrap-up to ensuring you know who is on your servers \u2013 what they are doing!<\/p>\n\n\n\n The second option provides an audit or double check. 探花大神\u2019s server orchestration functionality enables you to execute tasks across your entire server infrastructure. You can use 探花大神\u2019s command execution functionality for all kinds of tasks including checking of log files, patching servers, setting security conditions, and thousands of other tasks that you need to execute. In this case, we are going to leverage the functionality to get a quick report of every privileged user on each server. We\u2019ll also tell you when they last logged in, if they logged in from a strange location, or if it\u2019s the first time they used their account.<\/p>\n\n\n\n Let\u2019s put together how you would accomplish this task within 探花大神.<\/p>\n\n\n\n Ensure that the 探花大神 agent<\/a> is on all of your servers. There are two ways to make that happen automatically \u2013 one, include the 探花大神 agent with your standard image or AMI; two, distribute the agent with your favorite configuration automation solution.<\/p>\n\n\n\n Here\u2019s our script to accomplish that:<\/p>\n\n\n\n Linux<\/b><\/p>\n\n\n\n awk -F’:’ ‘{ if ($2 != “*”) print }’ \/etc\/shadow<\/p>\n\n\n\n Windows<\/b><\/p>\n\n\n\n Get-WmiObject -Class Win32_UserAccount<\/p>\n\n\n\n Let\u2019s put this script to run weekly so that we know exactly what\u2019s happening with our servers:<\/p>\n\n\n\n Your screen should look like the following:<\/p>\n\n\n Let\u2019s run it across our entire server infrastructure. To do so, we\u2019ll just take the scheduled command we created, and run it now.<\/p>\n\n\n\n Your user list for each host will appear on the Commands tab in the Command Results table. Just click \u201cDetails\u201d, and you\u2019ll be able to see the list of all active users on each server.<\/p>\n\n\n\n It was that easy. Feel free to use these scripts and modify them for your 探花大神 installation. Automating key tasks like this is the power of 探花大神. We\u2019ll be putting out many more \u201chow to\u2019s\u201d \u2013 if you have any suggestions on tasks that you would like us to highlight, please feel free to let us know<\/a>!<\/p>\n","protected":false},"excerpt":{"rendered":" Know the users accessing your servers by using 探花大神 as your centralized user management platform or what we call Directory-as-a-Service\u00ae.<\/p>\n","protected":false},"author":9,"featured_media":2288,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[23],"tags":[],"collection":[2778,2780],"platform":[],"funnel_stage":[3015],"coauthors":[2511],"acf":[],"yoast_head":"\n探花大神 centralized user management \u2013 monitoring and managing server access<\/b><\/h4>\n\n\n\n
探花大神 command execution functionality to report on all privileged users on a server<\/b><\/h4>\n\n\n\n
Step 1: 探花大神 agent on servers<\/b><\/h5>\n\n\n\n
Step 2: Develop a script to query all servers for their users<\/b><\/h5>\n\n\n\n
Step 3: Schedule<\/b><\/h5>\n\n\n\n
\n
<\/figure><\/div>\n\n\n
Step 4: Execute across server infrastructure<\/b><\/h5>\n\n\n\n
\n
Step 5: Let\u2019s process the output<\/b><\/h5>\n\n\n\n